OPEN DESIGN · #9060 INTEGRATION EVIDENCE
Verification failure must not become access
Recorded on 26 October 2026 · macOS arm64 · Node 24.19.0 · pnpm 10.33.2
Same four fault-injection cases, covering ordinary and BYOK OpenCode.
BEFORE · mechanical merge
4 regressions fail
The new cases expose two integration gaps.
Strategy verification failsA resource allow rule is still injected.
Edit-base Git probe failsDynamic config build is skipped; MCP is absent.
AFTER · verified source + read-only policy
4 regressions pass
All 7 launch scenarios pass, including 3 controls.
Strategy verification failsNo injected resource grant; other config remains.
Edit-base Git probe failsProject access, MCP and BYOK are preserved.
Final local validation: 250 tests across 8 files · guard + root typecheck passed.
Real CLI controls: resource read allowed · sibling read denied · resource writes denied in Git/non-Git projects · project write succeeds.
Additional boundary: missing Git no longer implies a volume-root worktree.
Real CLI controls: resource read allowed · sibling read denied · resource writes denied in Git/non-Git projects · project write succeeds.
Additional boundary: missing Git no longer implies a volume-root worktree.
Evidence scope: this page renders recorded test results; it is not a product UI or native-terminal capture. The before side adds the new regressions to the mechanically merged code. Real CLI tests use isolated files and a loopback provider; no real credentials or paid inference.
Implementation: 4c9b4a1fe · Hosted CI, native Windows, live-provider output and manual QA remain separate.
Implementation: 4c9b4a1fe · Hosted CI, native Windows, live-provider output and manual QA remain separate.