fix(hosted): harden provider delivery contracts

[mkceichelbeck]

Summary

• preserve provider credentials, routing, and execution context through hosted preflight and runtime boundaries
• align Codex, Claude, and OMP hosted execution, including writable temp paths, process ownership, terminal failure semantics, and bounded completion results
• make shipped GitHub delivery authoritative and resilient to transient merge-state races
• harden private candidate/image packaging and add focused regression coverage for the deployed contracts

Deployed validation

Validated through dev.theopenengine.com with real provider calls, real work, and real --ship delivery to the-open-engine/zeroshot-matrix-demo-20260812-3ebd. Every shipped PR merged and its repository CI passed.

Provider / coordinator	RunIntent	Shipped PR
Azure OpenAI + OMP / custom	019ffd84-61e7-7d70-b900-f74eab6a6a5c	demo PR 65
Azure OpenAI + OMP / built-in	019ffd8d-6159-70a3-ac33-cc3a1eeb049d	demo PR 67
OpenRouter + Claude / custom	019ffd9c-e8f8-7f30-a6b1-d142a54238b6	demo PR 72
OpenRouter + Claude / built-in	019ffd9c-ef80-7901-b892-4b1fdaf0d244	demo PR 73
OpenAI + Codex / custom	019ffd9c-f8e8-7070-9b16-781bba765fab	demo PR 74
OpenAI + Codex / built-in	019ffd9c-ff78-7791-950c-c003ba111378	demo PR 75

The targeted Azure failure rows were proven first; only then were the four previously green rows rerun as regression guards. The accumulated demo repository suite passes 543/543 tests. No delivery fixtures or simulated provider results were used.

The full runtime tree was tested at 42c6cfd; this PR was then recomposed as one conventional commit. The only tree delta in f3ed3fe is two test-fixture files (no production/runtime files). Zero-cloud main pins f3ed3fe, and focused exact-head deployment run 31757758450 completed successfully with image scan, IaC apply, and public health checks.

Validation

• focused completion-boundary suite: 24 passing
• private hosted preflight suite: 7 passing
• npm run check: green (0 errors; existing warnings only)
• Opcore staged gate: 92/92 files covered, clean
• repository pre-commit validation: green
• branch push hooks: green
• exact-head PR CI: green (one unrelated Rust timing flake passed on the single rerun)
• zero-cloud exact-main CI: green
• zero-cloud exact-main full deployment: green

[greptile-apps]

Greptile Summary

The PR hardens hosted provider execution and GitHub delivery boundaries while aligning lifecycle and terminal-result behavior across Codex, Claude, and OMP.

• Preserves provider configuration, credentials, and execution context through hosted preflight and runtime preparation.
• Adds bounded, authoritative reconciliation for GitHub merge and auto-merge delivery.
• Tightens process ownership, terminal failure classification, output bounds, candidate packaging, and hosted image construction.
• Adds focused regression coverage across provider, lifecycle, delivery, and packaging contracts.

Confidence Score: 5/5

The PR appears safe to merge based on the available follow-up review evidence.

No blocking failure remains.

Important Files Changed

Filename	Overview
zeroshot-rust/hosted-node/workspace-delivery-github.js	Adds bounded auto-merge retries and authoritative PR-state reconciliation before reporting delivery success.
zeroshot-rust/hosted-node/workspace-delivery-retry.js	Introduces the shared bounded operation-and-reconciliation retry policy for uncertain GitHub effects.
zeroshot-rust/hosted-node/workspace-ship.js	Verifies both the merge revision and delivered provider revision against the refreshed target branch.
src/agent-cli-provider/single-agent-runtime.ts	Propagates validated provider execution context and registry-owned runtime configuration through command preparation.
src/agent-cli-provider/omp/sdk-environment-policy.ts	Restricts OMP SDK child environments to minimal process variables and registry-declared non-secret configuration.
src/agent/agent-lifecycle.js	Makes delayed starts cancellable and incorporates normalized provider terminal failures into lifecycle handling.
task-lib/runner.js	Aligns detached watcher ownership, prompt transport, execution context, and Codex writable Git metadata paths.
private/hosted-cli-candidate/credentials.js	Preserves bounded provider credentials and runtime authority in the private hosted runtime bundle.
docker/zeroshot-oecp/Dockerfile	Updates the private capsule image to include the hardened runtime dependencies and writable execution layout.

Sequence Diagram

sequenceDiagram
  participant CLI as Hosted CLI
  participant Capsule as OECP Capsule
  participant Provider as Provider Runtime
  participant Delivery as GitHub Delivery
  participant GitHub as GitHub Authority
  CLI->>Capsule: Submit RunIntent + private runtime bundle
  Capsule->>Provider: Launch with validated execution context
  Provider-->>Capsule: Bounded terminal result
  Capsule->>Delivery: Ship verified workspace mutation
  Delivery->>GitHub: Push deterministic branch and create PR
  Delivery->>GitHub: Merge or enable auto-merge
  GitHub-->>Delivery: Authoritative PR/merge state
  Delivery-->>Capsule: Verified delivery receipt
  Capsule-->>CLI: Bounded RunIntent result

Loading

_{Reviews (2): Last reviewed commit: "fix(hosted): harden provider delivery co..." | Re-trigger Greptile}

[github-actions]

🎉 This PR is included in version 6.39.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀