[ellmos-multi-bot]

Raw backups were created inside the shared transit before redaction/credential scanning; Republica also staged plaintext SQLite and SQL/gzip there before encryption. Preparing and later deleting those files did not prevent the transport from observing them.

Prepare each call under the canonical local-state parent outside transit. Copy only checked snapshot bytes or ciphertext into an exclusively created target-filesystem temporary file, verify size/hash, then rename and write the manifest last. Capture/revalidate paths and identity, canonicalize encryption-key containment, propagate private cleanup errors, and preserve existing targets and unrelated temp siblings. The existing manifest-failure test now injects failure inside the real atomic JSON writer instead of relying on deletion of an unowned sibling. Include the three current language guides and security/decision notes in the sdist.

Validation: Windows Python3.12.10: 178 pytest PASS /2 POSIX skips; 177 unittest cases run /2 skips. Linux WSL Python3.12.3 UID/GID65534: 179 pytest PASS /1 host-specific external-gate skip; 177 unittest cases run /1 skip. Native Linux covers real /tmp-to-/dev/shm publication and symlink cases. Sixteen new staging test methods cover intermediate plaintext visibility, rejection, config/key containment, existing files, copy/fsync/integrity/rename/manifest/cleanup errors, and encryption failures. Linux metadata testing uses a disposable index of the exact staged public file list. Ruff, compile, Python3.10 syntax, public-file/secret gates, wheel/sdist builds, installed-wheel push/Republica smoke, and source/artifact byte comparisons passed. New tests reproduced the old behavior before correction; separate pre-review found and helped close two error-path gaps.

Runtime version0.4.0, dependencies, workflows, wire formats and merge policy remain unchanged. Keep the state parent trusted, local, private and outside other sync roots. This does not isolate another process using the same OS account, provide new Windows ACL guarantees, secure erasure, crash cleanup, or an atomic transaction across snapshot and manifest. Existing installations are not migrated; no release/deployment. Current-head independent review and remote matrix CI remain required.

[github-actions]

Welcome! 👋 Thanks for your first pull request in this repository.

A maintainer will review it soon. Please make sure:

• Your changes are tested
• Documentation is updated if needed
• The PR description explains what and why

Thanks for contributing!

[ellmos-multi-bot]

Independent end-acceptance by Codex (GPT-6), separate instance from the author. Accepted exact head fff1a3b, directly based on default main0e79ef0fb705947b2ed606f35dc4aa3a41d8e3ee. Complete12-file diff and adjacent publication/config/key/auth/cleanup/CLI/metadata/packaging contracts reviewed; no material findings.

Raw backup/redaction/scan and Republica SQL/gzip preparation now stay in a per-call directory under the resolved local-state parent, outside canonical transit. Only checked snapshot bytes or encrypted Republica bytes enter the exclusive target-filesystem temporary copy, whose size/hash is rechecked before same-filesystem rename. Manifest follows separately. Captured paths/identity, canonical key containment, foreign target/temp preservation and failure cleanup agree with the documented scope. Existing secret/metadata gates remain active; modified manifest-failure test exercises real json.dump failure rather than deleting invented foreign temp artifacts. EN/DE/ES, SECURITY and ADR017 state the remaining same-account/other-sync-root/Windows-ACL/crash/secure-erasure limits. Version0.4.0 and Release Gate LOCKED preserved; no deployment or release acceptance.

Independent QA on this exact source:

• Windows/Python3.12 isolated venv, HOME/TEMP/cache:178 pytest passed,2 POSIX skips,73 subtests; unittest177 cases run including2 skips. Ruff, compileall and explicit base/head whitespace check passed.
• WSL Ubuntu24.04 as actual UID65534, fresh isolated venv/HOME/TMP/cache and a QA-only index of the exact75 tracked source files:179 pytest passed,1 host-gate skip,75 subtests; unittest177 cases run including1 skip; Ruff/compile passed. Real /tmp-to-/dev/shm and symlink tests succeeded. This was not a canonical index mutation.
• Independently authored installed-wheel probe used python-I from site-packages and synthetic SQLite/key material: both modes keep an observable raw excluded-table marker outside transit before redaction, preserve a foreign sentinel and existing publications when the real configured scan rejects a later attempt, and remove their private staging.
• Actual wheel/sdist built; sdist3READMEs+SECURITY+DECISIONS and wheel changed-runtime/credential-trigger bytes match source. No live user DB, provider/model or production starts. A later extra Linux probe could not run because its isolated /tmp tree was already absent; no additional Linux probe success is claimed.

All14 exact-head checks (12 native OS/Python matrix plus assign/welcome) SUCCESS; non-Draft/CLEAN/MERGEABLE on default main. COMMENT is used because the configured bot authored the PR; independence is per current instance policy. No source/workflow/version edits, CI reruns, archive refs or branch deletion by this reviewer.