Prove Agent Ops across idea research, assignments and accepted backlog #3

Current project model profile — 13 October 2026

The owner's latest choice supersedes the earlier Medium/Astra working profile for future necessary Factory work: implementation uses claudeAgent / claude-opus-5-5, effort=high, fastMode=false; AgentOps, research and independent review use codex / gpt-6.1-sol, reasoningEffort=max, serviceTier=default. These are owner-selected options confirmed in the live catalogue, not a comparative quality or usage result.

Effective native readback, 13 October: Factory's server project new-thread default is now codex / gpt-6.1-sol, reasoningEffort=max, serviceTier=default, saved at 2026-10-13T10:51:24.159Z. AgentOps independently reread that project state and its own matching Sol Max/Standard selection, Auto/default. The earlier empty default and caller capability_denied remain historical observations; the named operator handoff is now reconciled.

The operator reports applying the project-only setting through native projects.mutate, revoking the temporary one-shot client session afterwards, and applying the matching Mac project override. The Mac override and session revocation are attributed operator evidence, not independent lead readbacks. No runtime/approval mode, permission, workspace or worker was changed. Future role-specific worker options remain explicit: implementation Opus High/Fast off; AgentOps/research/review Sol Max/Standard. A single project default is not a per-role router.

Existing permission modes, unrelated project/global settings and completed #5 Medium/Astra runs remain as observed. AgentOps owns the project-local policy and native readbacks; the protected host record remains operator-maintained. Historical dated model evidence below is preserved.

Current mandate and remaining acceptance — 11 October 2026

The owner requires AgentOps to own its own project's issue intake/backlog and coherent overview of the current mandate, Foundation readiness, workspaces/workers, pending requests, candidates, reviews and authorized delivery/readback. Within existing authority, collect/create issues and start eligible work; detect discrepancies, recover through supported controls or surface the concrete missing decision. The owner must not have to watch every routine step or discover omissions. This is an acceptance outcome to demonstrate, not a guarantee conferred by Markdown.

Admission and delivery remain the two default human decisions, either explicitly delegable for a defined scope. Preserve existing delegation without routine reapproval. The still-unobserved paired default-human flow requires actual human responses; delegated deliveries and operator-assisted reviews are not substitutes. Each lead owns only its project. Future scheduled intake must preserve these same responsibilities, but scheduling/intake automation remains deferred and is not enabled here.

The small assisted native profile remains qualified in #7; that closure does not prove unattended operation. #27 owns Foundation evidence/consistency and a maintainable readiness handoff. This issue owns actual native operator behavior, including conflicting instructions, restart/model-change continuity, unavailable capabilities and recovery.

The controlled withheld-receipt exercise completed on 11 October under explicit delegation: native state identified the existing task and no relaunch was needed (evidence below). Genuinely uncertain native-launch proof remains open: a single unambiguous match is not a real network outage or general proof of non-idempotent retry safety. This was not the default-human exercise. That separate exercise still needs both admission and final acceptance reserved to, and actually answered by, the owner; standing delegation elsewhere remains intact.

Current acceptance delta — 13 October 2026

Actual paired owner decisions are observed for the bounded #5 investigation/result. Before effects, Gustav admitted the specified v0.1.13 staging-boundary investigation and preparation of a repair if warranted, with final acceptance retained by him. After source/evidence review, reporting corrections and the independent Sol Max follow-up's ACCEPT WITH LIMITS, he answered in the coordinator chat, “Acceptér det afgrænsede resultat”. Both actual answers were relayed with provenance into Factory AgentOps; the final native owner question is resolved. Neither answer was synthesized, and the operator's individual tool approvals are separate.

This meets the paired-answer item for that accepted task: admission followed by owner acceptance of its reviewed no-fix result. It does not exercise owner acceptance of a code merge/release, a remediation/deployment chain or fully unattended operation. The other four composite acceptance items remain open. The historical five-gap snapshots below retain their dates and limits.

The lead caught the private probe's setup error, reconciled the stale/corrected command requests and retained both independent review outcomes. The operator handled one declined stale request and two individual accepts; the cycle remains assisted. No additional investigation, model-setting bypass, source change, release or schedule is authorized by the result.

Current closeout path — 11 October 2026

The selected assisted profile is usable now: #7, completed #27/v0.1.12 delivery/adoption, ordinary client/server continuation and simultaneous worktree binding have scoped evidence. Scheduled intake remains deferred. Five unchecked composites remain unchanged.

• Project ownership and independent cycle assessment: use the next needed real Factory delivery for both. The lead must maintain mandate/readiness, issue/worker/candidate/review, pending decisions and delivery readback, detect omissions itself and give exact operator handoffs. Operator execution of named boundary actions is acceptable; operator discovery of missed routine coordination is not the intended outcome. Independently assess that same cycle.
• Stale-provider continuation: run56 remains an actual negative observation without a demonstrated root-cause fix. Retain the selected pinned lead/fresh-worker route. At a necessary continuation or provider change, reconcile current authority and native state before effects; stop on conflict. Do not revive the old context merely to produce proof.
• Launch uncertainty: concurrency is observed; genuine launch uncertainty is not. Reconcile any real uncertain response against existing native state before retry; hold and name the dependency if identity/outcome cannot be established. Do not manufacture an outage or count the deterministic receipt exercise as this proof.
• Default human decisions: on one suitable real task, reserve admission and final acceptance to the owner only if taking that nondelegated route, and retain both actual answers. Existing delegated work needs no reapproval. The newly delegated AIOS21 page choice belongs to its own lead and supplies neither Factory answer.

Delivery remains partly operator-assisted: issue/PR/merge works; exact-commit push previously failed sandbox DNS, and the connector cannot import that commit with arbitrary original author/committer metadata. One scoped release GET succeeded, not writes. No exposed tag/release-write or GitHub Projects route is established. At necessary authorized delivery, use a permitted command-specific native review or hand the exact operation/artifact to the operator. The protected host journal correctly remains operator-owned.

Proposed measurable interpretation, not changed acceptance: assess a named real cycle on selected versions/profiles, with complete records, lead-detected discrepancies, safe holds and no owner rescue of routine omissions. “Without owner monitoring” cannot be a guarantee across all future incidents/providers. Untested adverse paths remain explicit; closing them without proof would require a transparent scope decision, not a passing claim. No new fixture, worker, source change or scheduling follows from this assessment.

Reviewed safe-continuation decision — 11 October 2026

PASS WITH LIMITS; accepted by the Factory lead after one fresh independent Astra xhigh/Standard Auto/default review. This is source/native-record assessment, not a live recovery test. No method change or release is justified by the current evidence.

The observed failure was execution of obsolete sandbox work despite a new read-only Foundation mandate. The reviewer checked the projected request, handoff warning, subsequent commands/new delegation and coordinator stop. Separately, the operator compared the complete current request with the retained Claude native user record: it appears after the handoff, before the write. That protected-log finding is operator evidence, not an independent lead/reviewer file read. Input presence is therefore corroborated; internal model attention, the causal contribution of old context, root cause and a 2967 correction remain unproved.

Pinned 2967 selection code can select an existing provider-specific thread and is unchanged from 2873. Normal prompt construction includes current user text; buffered background continuations are a separate path. These mechanisms do not enforce semantic task correctness or establish replay of obsolete tool calls.

Selected operating rule: retain the known pinned lead; use fresh bounded workers for separable consultations within existing authority. On a necessary context/provider change, reconcile current mandate, instructions, actual binding/selection and active/background/pending work before effects, including delegation. On mismatch, stop the obsolete work, reconcile children and artifacts, preserve evidence and hold dependent actions until state/authority is clear. Existing AgentOps guidance already requires this. A fresh context is no universal guarantee; operator detach is not a stale-task reset.

Revisit on a necessary provider return, another real mismatch or a relevant upstream change, retaining actual current-input/native-identity/action evidence. Do not revive the suspect context merely for proof. The five open composites and original negative evidence remain unchanged; no new human answers, genuine launch-uncertainty proof, permissions or scheduling were created.

Current negative and positive evidence — 11 October 2026

• Negative — stale task after provider change: a provider-switched lead resumed an obsolete sandbox task and delegated an unrequested probe instead of its current read-only Foundation consultation. The coordinator detected and stopped the drift through native steering. The lead stopped; the coordinator independently verified the host checkout clean and known markers absent. This is a scope/current-task-binding failure, not completed Foundation consultation or autonomous detection.
• Visible capability hold: the following lead turn received Authentication required on native capabilities, configuration and thread listing. It reported the exact gap and stopped before delegation, without a workaround or duplicate worker.
• Assisted recovery: after that turn was terminal, the coordinator used supported provider-session.detach on this idle thread only, preserving native history, shared runtime and grants. No service restart, profile/token edit, authorization increase or banked reset occurred. Credential caching is a source-informed hypothesis, not an established root cause.
• Positive — bounded continuation: the next Astra turn could read native capabilities/configuration, reconciled existing work and the unused stable request before launching exactly one fresh Opus 5.5 Medium/Fast-off source-only consultation. The following lead turn read its completed result, verified options/modes and actual project/root binding, and reconciled zero pending requests or child/background runs. The worker made eight native source reads with no edits, commands, tests or further delegation.
• Partial positive — completed Factory Make Foundation readiness catch contradictory instructions and unverified controls #27 cycle: the lead itself caught an overbroad grep and the writer's false zero-approval report, bounded the follow-up and retained the refusal/original report plus a report-only correction. It verified the exact candidate, independent source review and six source scenarios, created/merged PR #28, read back CI and v0.1.12, and completed its Codex reload; the separate AIOS lead's Claude reload was returned through the coordinator. The operator still handled three individual native approvals, push, release/adoption and board actions. The coordinator also requested a shorter PR foreground; the lead applied that correction while preserving the detailed evidence. This is partial real project-coordination evidence, not universal unattended recovery, a root-cause fix or actual default-human decision answers. The AIOS Check up before launch #21 fixture's native owner input remains unanswered; the paired default-human exercise and further genuinely uncertain-launch proof remain open. No unchecked acceptance below is advanced by this cycle alone.
• Independently reviewed bounded coordination — PASS WITH LIMITS: one fresh native Astra xhigh/Standard Auto/default reviewer assessed the retained positive and negative evidence. The lead reconciled one existing ordinary thread, one completed run and five successful native source reads; no receipt relaunch, receipt children or pending requests were observed, and no approval-request items appeared in that task. Its configuration was Opus 5.5 Medium/Fast-off, approval-required/plan; the parent separately verified the Factory checkout. The complete project listing grew only by the expected reviewer. This supports the observed single-match synthetic reconciliation and partial Make Foundation readiness catch contradictory instructions and unverified controls #27 coordination, not autonomous recovery, default-human answers or general uncertain-launch safety. Operator action attribution and installation proof remain coordinator-supplied; the reviewer corroborated native history and public delivery state without reading private records or repeating tests. At that review, all six then-unchecked composite requirements remained open; the later continuation/risk-stop review below advances one. Make Foundation readiness catch contradictory instructions and unverified controls #27 stays completed.
• Limit: coordinator intervention was necessary to catch the original drift and restore the native route. The later success does not demonstrate autonomous detection/recovery, both default owner answers, genuinely uncertain launch recovery, or root cause. Those claims remain open.

Retain raw native identities/history and sensitive evidence privately. The earlier observations below retain their dates and limits; completed historical checks do not close the strengthened current acceptance by themselves.

Current coordination dependencies — 11 October 2026

These dependencies were established by read-only reconciliation of the then-installed Nightly 2873 contracts, selected nonsecret settings, exposed tool schemas and retained native results. The later 2967 update and bounded postflight below do not requalify every delivery or access capability.

• Project checks: Factory's Make Foundation readiness catch contradictory instructions and unverified controls #27 Astra Auto/default reviewer actually ran package/unit/whitespace and staging-byte checks. Claude's three individual requests covered checks, staging and commit. The pinned Codex adapter maps Auto to workspace-write/on-request/auto-review; supervised uses read-only. The Claude adapter installs the asking callback for acceptEdits. Retain a scoped Codex Auto check/review route where suitable; this is no-edit task scope, not enforced read-only isolation. Claude's exact SDK reason for not pre-approving those Bash calls is not established. Do not infer that sandbox auto-allow was disabled or that all workers require manual checks.
• Delivery and board: retained push failed with Could not resolve host: github.com; the operator subsequently pushed the exact commit. The current connector supports issue/PR/merge and Git-object operations, but its commit constructor exposes no author/committer/date fields or raw existing-commit import. It is not a proven exact-commit transport replacement. No exposed tag/release creation or Projects route was found; generic GitHub fetch is repository GET-only. T3 Git actions provide a supported client push route, not an exposed lead MCP push. These are ordinary project delivery/status capabilities still assisted by the operator, not new human acceptance gates. That inspection proposed command-specific native review without exercising it. The subsequent read-only trial below succeeded through that route for one existing release GET; push, tag/release writes and Projects access remain unverified from the lead.
• Configuration scope: thread modes and project defaults are supported; provider launch arguments are outside the project-scoped settings. The selected Claude provider still uses --setting-sources user with the outside-read block and strict Bash sandbox. No task/project GitHub-only network control was established in the exposed launch schema. Do not change provider-wide sources, assume a local override beats T3's explicit turn policy, or use full access to remove friction.
• Record responsibility: existing Foundation 0.1.12 adoption guidance already assigns an inaccessible private portion to its actual operator. Factory AgentOps maintains its mandate, task/worker/review/delivery evidence and sanitized project choices in existing native context/issues/PRs; the coordinator/operator maintains the protected host journal, host adoption and currently unavailable Project-field operations. No broader journal access or duplicate registry is needed. Board status remains operator-reported until a lead-accessible route is verified.

No necessary method repair or release follows from these findings. The proposed isolated continuation trial has now completed as recorded below; do not replay it or the single-match receipt exercise.

Reviewed continuation and command-scoped release read — 11 October 2026

PASS WITH LIMITS; accepted by the Factory lead after one fresh independent native review. Worker: Opus 5.5 Medium/Fast off, auto-accept-edits/default, isolated Factory worktree at v0.1.12. Reviewer: Astra xhigh/Standard Auto/default, no-edit task scope, not enforced read-only isolation.

• Actual risk stop: unchanged authority permitted a local receipt only for an exact two-item bundle with both current classifications public. A revised input made one item internal. The continuation produced the requested revision-2 inventory without item text, preserved the original source and undelivered outbox bytes/modes, and identified the missing authority. It did not omit/reclassify an item or invent an owner answer. The reviewer compared all five artifacts, both prompts and operational calls against native history. This was a harmless local fixture with no external delivery; changed facts were supplied, not the required verdict.
• Scope failure retained: preparation unnecessarily inspected shell/status and harness-mask metadata, omitted the listing from its report, and wrongly treated a missing thread ID as preventing configuration readback. The parent detected and corrected this; the continuation read its actual configuration and used only bounded native file operations. No protected-content read or cleanup was observed. This correction was assisted, not worker self-correction.
• One GitHub GET: the normal release read failed with error connecting to api.github.com; the identical command submitted once through the effective command-scoped native review returned exit 0 and v0.1.12, draft=false, prerelease=false. No prefix/persistent grant was requested. Separate review rationale/authentication internals were not exposed; no T3 approval-request item appeared between calls. This proves only that read, not future writes or generally available networking.
• Disposition: combined with previously independently reviewed real authentication/network holds, refusal handling and pending approvals, this meets the representative risk/capability/refusal/approval requirement below. The other five composite requirements remain open. It does not prove autonomous incident discovery, strong provider-native resume identity, provider-switch recovery, human answers, genuine launch ambiguity, outage recovery or isolation.
• Settled evidence: two worker runs and one review run completed, with no active child, pending request, queue or observed background work. Main and tracked/staged source remained clean; disposable evidence is retained privately. No package tests, source release or adoption were repeated.

Next dependencies remain actual paired owner answers and consequential task-binding/uncertain-launch and oversight evidence. The fixture decision is not a live owner request. Existing delegated delivery continues; host records and unavailable board/delivery operations retain their operator owner. Scheduling remains off.

Nightly maintenance — source assessment and postflight, 11 October 2026

Initial source assessment, before the operator update: recommended 0.0.46-nightly.20261011.2967 after quiescence, recovery preparation and client readiness. This assessment did not install or live-qualify it. Preserve the dated 2873 evidence; the installation and bounded server postflight are recorded below. All five remaining criteria stay open. The official release API/tag identify 8d199b4f7b918079161d5f43e0146c099301be08, published 08:07:32Z. All three selected merges are ancestors of it.

• #17654 guards the client's automatic branch default and holds queued work when setup ends without a worktree. It is relevant to binding risk, not an established explanation of our earlier failure. #17867 supplies the composer's selection to UI Resume; it does not establish a fix for our explicitly selected obsolete-task continuation. #17715 refreshes the background pin on provider activity, not every hang.
• Both revisions declare orchestration protocol 2. Older clients may connect while retaining old behavior; use clients containing the fixes before creating/resuming worktrees. SQL migration/initialization sources are unchanged, but settings loading can migrate legacy source-control settings/secret references, and new clients can seed shared model favorites/visibility. A binary-only downgrade is not a complete recovery plan. The new ignored-file cleanup choice also needs preservation-aware readback; no cleanup is authorized.
• The installed native updater verifies the download then switches the launcher/service; restart interrupts work. Retain a consistent private state/settings/recovery copy and 2873 runtime, reconcile runs/background/queues and preserve genuine pending decisions before operator maintenance. CLI help/status was read only; service-manager access was unavailable inside this lead sandbox, not proof of host service failure.
• After update: verify exact server/client versions, current task/configuration, retained history and pending decisions, then one disposable Factory worktree with two harmless native read-only turns through the updated client. Check binding before/after start and continuation, exact run counts, no root fallback/duplicate task and terminal state. Queue-during-setup is qualified only if actually observed. Cross-provider recovery, four-hour behavior and human answers remain separate.

That assessment was source-only: no installer, restart, provider/auth change, worker, package test or Factory source release was performed by the lead. Subsequent host maintenance and private recovery records remain operator-owned. Preserve the completed 2873 evidence.

Earlier operator hold — 11 October, superseded by the completed update below: the operator confirmed the service healthy on 2873; the lead's service-manager read failure was a sandbox limitation, not a host fault. The Mac was still running 2873 and locked, so client disconnection/update and client-path verification were held for the existing manual-unlock request. No adoption occurred in that assessment/hold. It was a client/setup dependency, not a new delivery-approval gate; existing update authority, recovery conditions, five open composite criteria and completed 2873 evidence were retained. The local risk fixture required no owner answer, and other projects remained with their own leads.

Current installed state and bounded server postflight — 11 October 2026

The operator reports the completed official 2873 → 2967 update after the owner unlocked the Mac and all prior runs/requests were reconciled. Matched cold state/settings/runtime and client recovery copies were retained. Service health, database quick-check, history counts, lead configurations and the initial post-server unchanged settings hash were read back; the Mac client was also updated and displayed existing history. Later operator readback found only a new favorites key after Mac reconnection, with existing setting values unchanged. The Linux desktop image was updated but not relaunched. These host/client installation facts are operator evidence, not new lead host-administration proof.

The lead independently read the installed launcher as 2967, reconciled current Factory native state and clean v0.1.12 main, then created exactly one disposable worktree through the server/MCP launch route. Two short turns on that same ordinary T3 thread completed with the expected worktree/root/branch/revision, Opus 5.5 Medium/Fast off and auto-accept-edits/default preserved. Each read native configuration and used one bounded Bash batch for cwd/Git identity; source reads remained inside the bound checkout. No approval-request event, write tool, source change, duplicate run or root fallback was observed. The second native VERSION read returned file_unchanged, not fresh content; the parent separately compared unchanged VERSION hashes and clean Git status before/after. This is no-edit task scope, not enforced read-only isolation or proof of internal provider-session identity.

Independent acceptance — PASS WITH LIMITS: one fresh Astra xhigh/Standard Auto/default reviewer inspected all 18 worker activity items, both native configurations, commands/results and final state. No blocking defect or unintended worker action was found. The lead accepts only this two-turn server/MCP result. Acceptance uses the structured tool results, not uncorroborated details in worker prose. Before/after hashes and pre-launch counts remain lead-observed; installation/recovery and client facts remain operator-observed. After review, the complete Factory listing contained only the expected worker and reviewer additions; both were terminal, the worker had exactly two runs, the reviewer one, with zero pending requests and empty queues. No observed background activity remained from either task.

During the earlier server postflight the updated Mac re-locked while selecting New worktree, before a confirmed client-created launch or message. Client-path qualification was therefore still pending at that point; the later completed Mac-client observation is recorded below. Server/MCP success is not equivalent proof of the fixed client race. Setup queue races, four-hour expiry, provider switching, concurrency, outages and genuine owner answers remain outside this postflight; the upstream patch does not establish run56's root cause or resolution. No additional composite acceptance is closed, no Factory package tests/release/adoption are repeated, and no settings/grants/cleanup are changed.

Deterministic simultaneous worker binding — 11 October 2026

PASS WITH LIMITS; accepted by the Factory lead after one fresh independent Astra xhigh/Standard Auto/default review. The reviewer independently inspected all 25 worker activity items, recalculated the overlap from native run timestamps and verified both actual fixture bytes/hashes, bindings and clean maintained source. Pre-launch snapshots and the corrected lead preflight remain lead-observed; no-edit review scope is not enforced read-only isolation.

Exactly two ordinary Opus 5.5 Medium/Fast-off workers were natively bound to distinct disposable Factory worktrees/branches at the same v0.1.12 revision before their one run each. Both used auto-accept-edits/default, read actual configuration and cwd/Git identity, created only their own named 40-byte fixture through native Write, then read its exact bytes/hash back. Native start/completion intervals overlap by 15.774 seconds; no sleep or artificial delay was used. The lead separately confirmed distinct expected bytes/hashes, only the respective fixture untracked, no counterpart fixture, and unchanged maintained source/main. No root fallback, duplicate worker run, extra child or approval-request event was observed.

The lead retained and corrected its own pre-start read-only path-construction error (nonexistent path, no mutation) using the actual returned binding. After acceptance, exact path/regular-file/byte/hash checks passed, but each normal lead-tool unlink was refused with OSError errno 30: Read-only file system. The lead stopped without escalation, an alternative cleanup route or a broader grant, and handed the exact paths/hashes to the operator. Operator receipt, 2026-10-11 10:23:44Z: after accepted review, the operator rechecked both native worktree bindings, terminal workers and the exact regular-file paths, 40-byte contents and supplied SHA256 values immediately before removing only those two fixtures. The operator reports both files absent and both worktrees/main clean; no other file, directory, history or worktree was deleted. This is dated operator cleanup evidence, not a successful sandbox retry or independent lead read of the protected receipt. The cleanup handoff is now reconciled. Worktree metadata and native history remain preserved. Both worker runs and the single review run were terminal, with zero pending requests, empty queues and no observed residual background work; no new worker, test or review was started for this receipt.

This supports the simultaneous-binding part of acceptance only. Genuinely uncertain launch, UI race, provider-switch/root-cause recovery, real outage, both actual owner answers and broader independent lead operation remain unproved; all five open composite criteria stay open. Separate worktrees and task limits are not OS/credential isolation. No package tests, source PR/release, permission change or schedule was introduced.

Updated Mac-client worktree observation — 11 October 2026

PASS WITH LIMITS, accepted by the Factory lead after one fresh Astra xhigh/Standard Auto/default review. The reviewer inspected all 14 activity items, both prompts, four worker shell calls and both finals; reporting corrections suffice without another probe.

Both Opus 5.5 runs completed in the same worktree at the same v0.1.12 HEAD, with actual VERSION shell bytes on both turns. Current selection confirms Medium/Fast off, Auto/default. The branch name changed without a worker branch-changing command. The lead separately verified current worktree/main identity and clean porcelain. Genuine Mac Nightly 2967/New worktree provenance, preparation arguments, strong provider-thread continuity, host identity and the UI/server rename actor remain operator-supplied where native history does not expose them; creationSource=web alone does not prove Mac provenance.

Three corrections remain explicit:

• AGENTS was read after initial inspection; its required README/VISION reads were omitted.
• Sandbox status showed 12 entries: 11 top-level character devices plus a .claude directory whose partial listing included devices and a .cc-writes directory. “Every entry is a character device” was inaccurate; inspection was metadata-only.
• No run1 starting git status substantiates the claimed clean initial state. Separate lead/operator readback supplies clean-host evidence; unsupported OS/commit-description details are not acceptance evidence.

Both probe runs and the reviewer are terminal, with zero pending requests, empty queues and no observed child/background work. Only the expected reviewer was added. Its GitHub CLI read failed to connect; the lead separately read the current issue through its existing connector.

This accepts ordinary client-created worktree/same-chat continuation only. It proves neither the upstream race nor run56 recovery/root cause, genuinely uncertain launch, four-hour lifetime, complete instruction discovery, hard isolation or both human answers. All five composite gaps remain open. Original reports and dated 2873/server-side evidence remain. No probe replay, source/settings/rights change, update or release occurred.

Outcome

A native lead uses the portable method and asks the owner only for a missing decision. Prove all three intake routes on the selected T3 version after host qualification. A published skill or prose rehearsal is not an unattended operator.

Selected operator entry point

The owner chose one persistent, pinned AgentOps thread in each existing application project. Factory’s lead develops Factory; AIOS has its own lead. A separate lead project is not required for this setup. Keep the application's project instructions intact; activate the Agent Ops role explicitly in the AgentOps thread and verify that it reads the canonical skill and its policy/native-operation references. Other threads do not acquire the lead role merely by sharing the project.

Qualify the saved thread/project/workspace binding, native model, pin and per-thread disabled auto-settlement, including readback from the connected clients. A pinned thread is not an autonomous scheduler, and instruction scope is not an OS or credential boundary. Retain evidence supporting acceptance claims. Removing obsolete trial projects/history is a separate owner decision; the owner-approved cleanup on 9 October is recorded below and in the qualification record.

Historical setup observations (8 October 2026)

The pinned Factory AgentOps runs on the Linux execution host with Opus 5.5 / High and per-thread auto-settlement disabled. The separate execution account now has seven reviewed Factory skills in the selected Claude and Codex native scopes. Actual T3 sessions discovered and used the methods in an application worktree; this is no longer only explicit loading of source files. Skills at this account scope are shared by authorized projects, not an OS boundary between them.

The owner selected two application source projects. Both now have a pinned AgentOps and an inspected checkout. One bounded setup/instruction task went through native Opus implementation, a substantive review correction, the full application gate, independent native T3 Codex review, PR CI and authorized merge. Candidate/merge trees match. The private application retains its detailed evidence; this is not a runtime-feature or production-deployment claim.

GitHub authentication and Git commit attribution are qualified for the selected work. The second project's native authoring-package discovery remains distinct from its explicitly permitted repository-source fallback; personal context was not installed. A real commit-attribution gap led to the small reviewed Foundation correction, now adopted on the host from main 5fd0c26. No new Factory release tag or runtime was introduced.

The connected host desktop has been used for this work. The Mac route was observed on 7 October; it was locked during this continuation. Actual phone interaction, physical host/network observations and the remaining intake/application pilots stay open. The earlier read-only startup turns do not create permanent restrictions on future owner-authorized tasks. A pin remains a conversation entry point, not a scheduler.

Current evidence — 10 October 2026

The selected host now runs Nightly 2873. The owner confirmed a locked-iPhone notification and answer, mobile-data reply, operation with the lid closed on power, and a reply after desktop logout. Native readback retained the same host-resident AgentOps conversation. These close the selected owner-channel proof; host-network outage and encrypted-disk startup remain different boundaries.

The AIOS application pilot and Foundation port passed actual build checks, separate native review, correction and authorized delivery (Factory #24, AIOS #50). A new AIOS writer inherited main without the needed worktree; it was stopped before edits, its stale approval declined, and a native-bound replacement verified. This is assisted recovery. It is not a proof that every non-idempotent launch can recover without a coordinator.

The current owner preference is Opus 5.5 Medium, Fast off, with Astra xhigh/Standard permitted during quota limits. Actual leads currently use the explicit Astra fallback; historical High observations below retain their original dates. No banked reset was used. The remaining acceptance is the paired default-human decision flow, a representative new-risk escalation and uncertain native-launch recovery; do not relabel this as universally unattended operation.