Refactor Compass control, continuity, and skill boundaries

[ariobarin]

This imports the reviewed July Compass revision to make long-running control state resumable, clarify runtime ownership, and move specialist benchmark material out of the global portable bundle. Validated with doctor, install round-trip, portable Python and ledger suites, text checks, and MCP build plus smoke tests.

[ariobarin]

@codex review current head 9dd91e1c39f724a581fc1b412513203e14b8477b independently. Inspect the complete patch rather than relying on the PR summary. Prioritize correctness, unsafe migration or retirement behavior, ledger schema and PowerShell wrapper contracts, runtime guidance contradictions, and missing current-head tests. Return evidence-backed findings only; do not edit the branch.

[ariobarin]

@codex review final current head 2011ad664a2bbd7c30dd3d32a00cf31ef3729aa1. Earlier SHAs are superseded. Inspect the complete patch independently, including the PowerShell -Principal lifecycle fix, strict current-schema validation, and fail-closed legacy recovery migration. Prioritize correctness, installation and retirement safety, Claude derivation, ledger migration and recovery contracts, validation isolation, and missing current-head tests. Return evidence-backed findings only; do not edit the branch.

[ariobarin]

@codex review

[ariobarin]

@codex review

[ariobarin]

Current-head evidence for 2011ad664a2bbd7c30dd3d32a00cf31ef3729aa1:

• Fixed PowerShell init -Principal so it maps consistently to the principal control writer and rejects conflicting -ControlWriter values.
• Added a cross-platform PowerShell lifecycle test covering create, phase mutation, checkpoint-link replacement, evidence, recovery open/reset, and fresh-process resume.
• Kept schema-v4 records strict instead of applying legacy backfill.
• Rejected boolean schema versions and malformed legacy successor-failure counters.
• Author-side install and portability audit found no remaining blocker across the active manifest, explicit retirement map, Claude top-level guidance, derived skills and agents, doctor checks, live verification, and isolated install round trip.

Current-head GitHub evidence is green: portable checks run 973 and orchestration ledger checks run 41 both completed successfully. This comment is implementation-owner evidence, not the required independent review. The PR remains draft pending the Codex review requested below.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 2011ad664a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2011ad664a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Begin a new recovery before recording its failure

In this sequential example, the preceding record-recovery-failure with -DiscriminatingEvidence changes the circuit from active to closed. Calling record-recovery-failure again at revision 7 is therefore rejected by mutate() with “slice checkout must be active before recording failure.” Add another begin-recovery step for the next worker and adjust the subsequent expected revisions so the documented recovery workflow can actually be followed.

Useful? React with 👍 / 👎.