[Shayne Boyer (spboyer)]

Summary

Add bounded standalone aggregation over explicit public completed manifest/evidence reference sets, canonical schema 1.0, original-record-context admission, per-view evidence states and complete historical usage accounting. CLI/API/Lab registrations and producer-backed production-path controls are now present. This remains a dependency-ordered partial draft: the root default-offline exemption awaits its narrowly scoped authorization, final merged-source gates/review remain pending, and this is not #766 acceptance or a release announcement.

Related issue

Related to #766 and #755; the PR base remains #958 pending the parent's upper-base decision. Normal upper-only merges preserve published core #959 934f5bdd and Lab #961 a772e37f through merge commits 95a25504 and c7bd212e. Checkpoint routes/components and both PRD sections are preserved. No lower branch was rewritten or received aggregation changes. Full issue acceptance remains pending; this partial draft has no closing directive.

Agent handoff

• Scope: new aggregation package/schema, dedicated CLI/API/client/Lab modules, actual public source fixtures, user/developer/site/release and migration notes.
• Decisions: exact pair/verified manifest/verified execution-record populations are named separately. Repeated executions are valid. Compatible views retain privacy states, count a record once, and never select a more permissive disclosure. No latest winner, pooled scores, cached subtotal or new SDK billing. Optional absent sidecars, supported metadata-only sources and privacy redaction do not themselves fail admission. One cumulative read budget covers public object and explicit namespace reads.
• Review repairs: selected custom attempt descriptors now match original reservation digest/size/media independently of filename. The client mirrors Go saved-report ordering, state priority, groups, execution populations and complete-usage prerequisites. Aggregate parsing permits at most 32 MiB of UTF-8 bytes; unrelated clients retain their prior default. Scoped numerical checks preserve unavailable/zero distinctions without modifying the global usage helper.
• Registration: the three explicitly approved additive slots now register the root command, configured server API and ManifestAggregate demo={demo} after ManifestPublication, preserving checkpoint functionality. The dedicated API wrapper consumes the actual core resolver and same opened backend's explicit public namespace reader; active non-local providers are denied before credentials. No resolver redesign or private fallback.
• Known gap: shouldRunUpdateCheck does not yet exclude aggregate. Approval for that single additional skip-list token was explicitly requested; the worker did not silently broaden its shared-file permission. Current production CLI controls explicitly disable the update checker, so default-offline CLI acceptance remains held.
• Authorized follow-up: review 5849860467's Previously missed body-only oversized-usage finding was reproduced through the actual dedicated CLI/API before repair. Native usage alone fits at 33,554,227 Go-escaped bytes, but the full report measures 33,559,582 bytes. The entire historical total is now withheld with recorded_usage_report_size_unavailable, retaining both admitted members, groups, diagnostics and the two-execution denominator in 5,247 bytes. There is no truncation, subset total, native-profile tightening, global-helper change or raised report cap.
• Nonzero oracle: two actual distinct executions and compatible views now assert exact deduplicated historical totals through saved CLI/API bytes: 3.75 credits, 33/21 input/output tokens, 9/6 cache tokens, 1.5 premium requests, model request count 6 and cost 0.75. Explicit recorded-zero controls remain separate.

Type of change

• Bug fix
• New feature
• Documentation update

Validation

Linux amd64, current committed head 2da0eb01be0ec89dee02c7610bbae30505253305, tree 1315fbb0e6b7141dbd3ec1d5d8a9698846d89ba8. Go 1.27.3 / Node 26.12.1. No Windows execution claimed.

Current merged-source registration evidence (working source committed unchanged at this head):

• NO_COLOR=1 go test -p 2 -race -count=1 -run '^TestAggregateProduction|^TestAggregateConfigured' ./internal/webserver: PASS, 1.504s. Real configured production handler verifies original execution context independently of CWD; active local and disabled remote retain canonical output; unsupported active configuration cannot fall back to a valid local neighbor. Missing store remains unavailable and is not created. Direct Azure-provider denial is tested separately without constructing the general server's unrelated storage provider.
• npm --prefix web run lint && npm --prefix web run build: PASS; tracked index and physical embedded bundles match.
• cd web && npx --no-install playwright test e2e/aggregate-production.spec.ts --project=chromium --retries=0 --workers=1: 4 PASS, 8.3s. Actual compiled root CLI saved bytes equal configured API bytes and embedded Lab downloads; source links reach the real inspection API. Actual missing-neighbor 409 retains both members/download. Real store removal 503 and injected transport loss clear prior success. Demo offers no builder and makes zero aggregate requests. Public fixtures are produced by actual explicit mock execution/capture, not hypothetical API responses.
• cd web && npx --no-install playwright test e2e/aggregate-client.spec.ts --project=chromium --retries=0 --workers=2: 11 PASS, 27.5s, including retained accounting/priority, exact 32 MiB/+1, UTF-8/default-limit separation and actual 24,433,896-byte producer download invariants after normal dependency integration.
• NO_COLOR=1 go test -p 2 -race -count=1 -run '^TestSelectedAliasedAttempt|^TestAggregateNonzeroUsage|^TestAggregateOversizedUsage' ./internal/manifestaggregate ./cmd/waza: PASS, 2.224s / 41.005s, preserving custom-alias reservation controls and both authorized usage follow-ups on the merged dependencies. Rejecting runtime marker remains absent.
• npm --prefix site run build: PASS, 32 documentation controls + 43 generated pages. cd site && npm run test:e2e -- --project=chromium --retries=0: 55 PASS, including deployed-base navigation and all local image links. An initial build started before screenshot generation finished reported its missing image; it was rerun only after the actual image existed.
• Real configured Lab screenshots were regenerated and inspected; docs/site copies match. Unrelated generated site screenshots were restored only to their verified pre-run bytes.
• Final merged-source full Go/vet/pinned lint/full dashboard/compatibility, default-offline CLI, independent approval and hosted acceptance remain pending. These are not inferred from earlier-head results; one final refresh awaits the remaining source-policy decision.

Earlier pre-integration evidence, committed head 531de0ce59aac58b1435397576e5e4e5d12be0bb, tree 83700e020438bbf04d4cf3493f39922809b714a4: canonical lint used Go 1.26.4 and checksum-verified golangci-lint 2.10.1. These results are not current merged-tree acceptance.

• NO_COLOR=1 go test -p 2 -race -count=1 -run '^TestAggregate|^TestActualRepeated|^TestNonemptyRecordedZero|^TestSelectedAliasedAttempt|^TestSavedReport|^TestLargeCanonical' ./cmd/waza ./internal/webapi ./internal/manifestaggregate: PASS (179.800s / 1.345s / 233.921s). Includes actual saved CLI/API oversized-total withholding, exact nonzero deduplication, separate zero controls, selected-alias and codec controls, plus the 24,433,896-byte actual public population.
• Before repair, NO_COLOR=1 go test -p 1 -v -count=1 -run '^TestAggregateOversizedUsagePreservesSavedCLIAndAPIReport$' ./cmd/waza failed with CLI byte-limit error and API HTTP 500. After repair, the affected new source/caller controls passed (3.954s), including identical saved CLI/API bytes. Production registrations did not yet exist at this earlier head.
• Go commands used disabled live opt-ins and the verified absolute rejecting runtime; marker absent. go vet ./... and git diff --check: PASS.
• Canonical checksum-pinned RUNNER_TEMP=... bash .github/scripts/lint.sh: PASS, 0 issues. One own staticcheck finding was corrected and the real gate re-executed, not waived.
• NO_COLOR=1 go test -p 2 -count=1 ./...: FAIL, executed once. cmd/waza reports TestGradeCommand_ProgramGraderContextCleanupFailureFailsGrade (expected denied native deletion, got nil) and reaches the package's default 10-minute deadline while TestProcessDiagnosticsRealProcess/full/blocked-stdout is active. internal/embedded TestPath/install fails native CLI installation; internal/nativesnapshot TestG2CaptureActualMissingAndSourceChangesAtFrozenBoundary fails; internal/snapshot same-size/restored-mtime and same-inode-content-change controls fail. No unrelated repair or passing full-native claim is made. The affected aggregate, models, API/server and other package results do not turn the whole suite green.
• NO_COLOR=1 make test-compat-inventory: prerequisites/inventory PASS. This does not execute or establish passing compatibility; the full Go run failed.
• Full compatibility/native Windows/current-head hosted acceptance: blocked or pending, not subsumed by focused checks.
• cd web && npm run lint && npm run build: PASS. Tracked dashboard entrypoint corresponds to the physical generated assets; ignored bundles are not force-added.
• cd web && npx --no-install playwright test --project=chromium --retries=0 --workers=2: 496 passed / 1 skipped, 497 discovered, 8.8m. All 11 aggregate fetch/component/download controls ran, including exact 32 MiB/+1 boundary, UTF-8 byte limit, unchanged unrelated 16 MiB default and byte-identical download of actual 24,433,896-byte Go output.
• The skipped existing assurance.spec.ts:284 producer-export control requires WAZA_CALIBRATION_REPORT_DIR; that family is not passing evidence. No skip was added by this change.
• npm --prefix site run build: PASS, 32 documentation controls + 43 generated pages. cd site && npx --no-install playwright test e2e/manifest-aggregation.spec.ts --project=chromium --retries=0: PASS.
• Independent final approval and required hosted checks remained pending; see the separately attributed merged-source registration/site results above.

The three requested findings were reproduced before repair, including failing actual Build and browser caller controls. Their retained independent Terra pass is source review only, not reviewer test execution. Full earlier dashboard execution regenerated unrelated screenshot files; only this task's generated changes were restored to their pre-run bytes.

The earlier full Go run left an untracked internal/snapshot/.waza-evidence-FWKAFOWRE5DOW3COLVINXNQUZF/ entry. It was not staged or deleted; ownership/residue disposition remains explicit rather than removing potentially sensitive or competing evidence. Reverse session messaging is now available and queued receipts were sent; queued is not a consuming ACK.

Documentation

• README, guide, PRD and changelog describe the unreleased source preview.
• Site worked example, command reference, sidebar, compatibility and migration notes.
• Developer/site guidance covers custom descriptor association and client byte/accounting limits.
• Registered server/Lab examples and actual-source screenshots verified; CLI default-offline policy remains separately held.

Risk and rollback

• Risk level: Medium. New opt-in modules; existing execution/capture/usage helpers are unchanged. Shared strict JSON parsing gained a caller-specific limit while preserving the previous default.
• Rollback: revert consuming registrations first, then additive aggregate modules; never rewrite original immutable sources.

Notes for reviewers

Review the full stacked dependency separately from this focused diff. Verification covers current content and original record context, not execution attestation, authentic SDK billing, assurance or full release acceptance. Per-input errors preserve structured evaluated reports; public diagnostics contain stable codes only. No private creator or worker state is read. Parent retains independent GPT-5.6 Terra review and protected merges.

[Copilot]

🟡 Changes recommended

Unchecked usage aggregation can overflow and break report emission or silently corrupt totals, while API validation can accept inconsistent admission and usage counts.

3 open issues

• Detect usage total overflow before marking reports complete · New
• Use nonzero assertions to verify deduplicated usage totals · New
• Validate admission completeness and usage execution counts · New

What changed in this PR

Adds a partial standalone aggregation core for #766, building on the evidence-capture libraries from #958. It evaluates explicit public manifest references without agents or original worker state. CLI, API, and Lab modules are included, but production registration remains deferred.

Changes:

• Adds bounded source verification, deterministic reports, separate membership populations, and historical usage accounting.
• Introduces schema 1.0, isolated CLI/API/browser modules, and fixture-based regression tests.
• Documents aggregation semantics, compatibility, migration, and intended workflows.

File	Description
web/​src/​lab/​ManifestAggregate.tsx	Adds an unregistered aggregate composition and download panel.
web/​src/​api/​aggregates.ts	Adds reference parsing, API requests, and report validation.
site/​src/​content/​docs/​reference/​schema-changes.md	Describes the independent aggregate schema version.
site/​src/​content/​docs/​reference/​cli.mdx	Documents intended aggregate command usage.
site/​src/​content/​docs/​guides/​manifest-aggregation.mdx	Adds worked examples and interpretation guidance.
site/​astro.config.mjs	Adds the aggregation guide to site navigation.
schemas/​manifest-aggregate-1.0.schema.json	Defines aggregate reports, populations, and usage states.
schemas/​manifest_aggregate.go	Embeds the aggregate schema for Go consumers.
README.md	Introduces aggregation commands and concepts.
internal/​webapi/​aggregates.go	Adds a configurable aggregate route constructor.
internal/​webapi/​aggregates_test.go	Tests request rejection and provider-error responses.
internal/​testutil/​manifestfixture/​fixture.go	Creates completed public sources through mock execution and capture.
internal/​manifestaggregate/​local.go	Opens explicit local-store read capabilities.
internal/​manifestaggregate/​codec.go	Validates inputs, report schemas, ordering, and accounting.
internal/​manifestaggregate/​budget.go	Bounds cumulative object and byte reads.
internal/​manifestaggregate/​aggregate.go	Implements source admission, grouping, and usage aggregation.
internal/​manifestaggregate/​aggregate_test.go	Covers repeated records, incomplete sources, conflicts, and compatibility.
docs/​PRD.md	Records aggregation scope and semantics.
docs/​MANIFEST_AGGREGATION.md	Defines contracts, limits, migration, and troubleshooting.
docs/​GUIDE.md	Links to the aggregation documentation.
cmd/​waza/​cmd_aggregate.go	Adds an unregistered command with exclusive output creation.
cmd/​waza/​cmd_aggregate_test.go	Tests saved CLI/API report parity and output protection.
CHANGELOG.md	Records the unreleased aggregation addition.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Reservation validation can incorrectly verify an aliased attempt with a mismatched parent, and the client rejects supported aggregate reports exceeding its 16 MiB parsing limit.

4 open issues

• Validate aliased attempt artifacts against the original reservation · New
• Allow aggregate parsing up to the native codec’s 32 MiB limit · New
• Validate admission completeness and usage execution counts
• Use nonzero assertions to verify deduplicated usage totals

1 resolved since last review

• Detect usage total overflow before marking reports complete

_{Review effort: Balanced}

[Shayne Boyer (spboyer)]

Usage-contract follow-up persisted at 1fcfe31, tree 64072eb4f3fd659dda0cca804c241d7e400da51c (Linux amd64). Before calling the unchanged global usage helper, the scoped aggregator rejects integer overflow, out-of-range JSON/UI numbers (maximum 2^53-1), non-finite arithmetic and addition that drops an entire positive floating contribution. The schema enforces the same public numeric range. Native IEEE-754 fields retain their existing arithmetic; no exact-decimal billing claim is added.

Actual public-source controls first prove each native usage category is present, then test top/model counters, AI credits and model request sums from individually valid 2^52 records, plus lost fractional addends and an alternative-valid exact fractional sum. Zero eligible records and known-zero mixed with unknown usage/identity remain unavailable/null, never an unlabeled subset or available-zero total.

Current-source go test -p 2 -race -count=1 ./internal/manifestaggregate PASS (7.113s); guarded go test -p 2 -race -count=1 -run ^TestAggregate ./cmd/waza ./internal/webapi PASS (1.755s/1.064s), rejecting-runtime marker absent; go vet ./... PASS; checksum-pinned canonical lint with Go1.26.4 PASS (0 issues); schema-consuming web build PASS; refreshed site build and targeted current-head aggregate Chromium navigation PASS. The earlier full site 54/54 belongs to unchanged site source at 602fd0e; no full dashboard/Go/compatibility/native Windows acceptance is inferred. Shared production CLI/API/Lab registrations remain explicitly pending core ownership coordination.

[Copilot]

🔵 Needs a closer look

Valid large reports are rejected by the client's 16 MiB parser limit, while oversized usage totals can prevent report generation entirely, losing evaluated membership and diagnostics.

4 open issues

• Validate aliased attempt artifacts against the original reservation
• Allow aggregate parsing up to the native codec’s 32 MiB limit
• Validate admission completeness and usage execution counts
• Use nonzero assertions to verify deduplicated usage totals

1 previously missed issue

In code that hasn't changed since last review

Preserve evaluated reports when usage exceeds the size limit

internal/​manifestaggregate/​aggregate.go:226

Valid recorded usage can exceed the 32 MiB report limit: source artifacts allow 64 MiB, and provider strings and model names have no length bound. Copying that usage into a complete report makes Encode fail, so the CLI saves nothing and the API returns 500 instead of the evaluated membership and diagnostics. Check the full serialized report size and withhold oversized usage totals with a stable diagnostic while preserving the evaluated report.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed for cross-layer validation gaps that can mark partial usage as complete or admit totals too large to serialize.

1 open issue

• Use nonzero assertions to verify deduplicated usage totals

3 resolved since last review

• Validate aliased attempt artifacts against the original reservation
• Allow aggregate parsing up to the native codec’s 32 MiB limit
• Validate admission completeness and usage execution counts

_{Review effort: Balanced}

[Shayne Boyer (spboyer)]

Bounded follow-up authorized and reproduced before repair: valid captured usage of 33,554,227 Go-escaped bytes (below 32 MiB by itself) caused the real dedicated CLI to emit no saved report and the dedicated API to return HTTP 500. The full candidate report measures 33,559,582 bytes. The repair withholds the entire historical total with recorded_usage_report_size_unavailable, retaining all two admitted members, groups, diagnostics and the two-execution denominator in a 5,247-byte report; real saved CLI/API bytes agree. Independent nonzero repeated-execution + compatible-view controls assert exact 3.75 credits, 33/21 tokens, request/cache/model counters and unique execution denominator two; recorded-zero controls remain. Focused controls pass; final-head gates are running, not yet acceptance. Shared registrations remain untouched. Coordination reverse-send discovery currently returns no available tools, so this is a durable progress receipt rather than a claimed delivered session reply.

[Shayne Boyer (spboyer)]

Disposition of review5849860467 Previously missed body-only aggregate.go finding: REPRODUCED before repair using actual captured/public-completed native sources through the dedicated CLI/API. Native usage alone fits at33,554,227 escaped UTF-8 bytes, yet the complete report is33,559,582 bytes; CLI lost the saved report and API returned500. Commit531de0ce59aac58b1435397576e5e4e5d12be0bb, tree83700e020438bbf04d4cf3493f39922809b714a4 measures the full serialized report, withholds the ENTIRE total with recorded_usage_report_size_unavailable, and retains all membership/groups/diagnostics and denominator2 in5247 bytes. Saved CLI/API bytes agree; small nonzero totals remain available; native profiles/global helper/report cap unchanged; no strings/members truncated or subset total invented. If membership without usage cannot fit, Build explicitly errors instead of dropping entries. Prior alias/accounting/32MiB repairs remain and all11 aggregate client controls ran in refreshed Chromium496PASS/1existing gatedskip (assurance.spec.ts284 requires WAZA_CALIBRATION_REPORT_DIR). Vet, pinned lint0issues, source/public-caller races and docs build/navigation pass. Complete uncached Go was executed once and FAILED in cmd native cleanup/default600s timeout, embedded installation, native snapshot frozen-boundary and snapshot same-inode/restored-mtime tests; inventory alone is not compatibility acceptance. Full details/commands and the unstaged preserved snapshot residue are in the updated PR template. No broader repairs or full native acceptance claimed. Reverse session-message tooling is currently unavailable (discovery returns zero); this PR is the persistent receipt, not a claimed delivered session reply.

[Shayne Boyer (spboyer)]

Consuming the bounded follow-up authorization: both extra items are already implemented and pushed at531de0ce59aac58b1435397576e5e4e5d12be0bb/tree83700e020438bbf04d4cf3493f39922809b714a4, after real-source RED evidence. Exact evidence/dispositions are in issuecomment-6781173438 and discussion_r4531429052; no permission request or repeated broad gates is needed. This remains the separate upper squad/766-standalone-aggregation lane on capture958, with no edits/pushes to lower959 or shared registrations. Core resolver/ref/slot consumption remains pending authorization. Reverse-send resource discovery still returns zero available tools, so this is a persisted receipt, not a claimed session delivery or independent approval.

[Shayne Boyer (spboyer)]

Consuming core file-boundary ACK: eventual upper aggregation integration owns only (1) cmd.AddCommand(newAggregateCommand()) beside artifact/runner in cmd/waza/root.go, (2) aggregate route registration beside manifest registration before SPA fallback in internal/webserver/routes.go while preserving checkpoint registration, and (3) ManifestAggregate import/render after ManifestPublication in web/src/lab/RunnerNegotiation.tsx while preserving CheckpointOperations; not DashboardLab. Component already accepts demo: boolean. No shared source edits or dependency consumption performed; manager approval remains prerequisite. Dedicated RegisterAggregateRoutesWithSources exists; configured RegisterAggregateRoutes wrapper still needs the exact consumed resolver contract, and the offline root update-check exemption needs an explicit slot rather than being silently included. Current aggregation head531de0ce59aac58b1435397576e5e4e5d12be0bb/tree83700e020438bbf04d4cf3493f39922809b714a4. Changed docs: CHANGELOG.md, README.md, docs/GUIDE.md, docs/MANIFEST_AGGREGATION.md, docs/PRD.md, site/src/content/docs/guides/manifest-aggregation.mdx, site/src/content/docs/reference/cli.mdx, site/src/content/docs/reference/schema-changes.md. Existing source-preview/partial764/765 wording must survive eventual normal integration. Live PR pointers now959=934f5bddba046cc6ba0db50f3e07c356725f7894 and961=a772e37f1d711e161a0c2bc41accae17b931d43e, newer than the ACK refs; no new-source approval or automatic refresh inferred. Reverse session-message tooling remains unavailable; this is a durable ACK receipt, not claimed direct delivery.

[Copilot]

🔵 Needs a closer look

Human assessment is needed to weigh nondeterministic report errors and validation gaps that can present partial historical usage as complete.

No open issues 🎉

1 resolved since last review

• Use nonzero assertions to verify deduplicated usage totals

_{Review effort: Balanced}

[Shayne Boyer (spboyer)]

Registration design approved by parent; consuming boundary ACK persisted on959. Exact prospective dependency refs:959934f5bddba046cc6ba0db50f3e07c356725f7894,961a772e37f1d711e161a0c2bc41accae17b931d43e (934 ancestor). Read actual manifestInspectorFor(...StorageConfig) configuredManifestInspector and its openBackend() (artifactmanifest.Backend,func()error,error). Upper integration will preserve checkpoints and source-preview docs via normal merges, not lower rewrites or retargeting. AddCommand-only root slot has one genuine offline-policy obstacle: shouldRunUpdateCheck currently exempts runner/interop etc but not aggregate; request explicit approval for that single-name exemption. Configured API/Lab work can proceed independently; no duplicate resolver or process/private-capability fallback.

[Shayne Boyer (spboyer)]

Parent consuming ACK of the complete current531de0ce/tree83700e0 public receipt, including separately authorized oversized-usage and nonzero-dedup follow-up. The actual RED CLI/API failure, 33,559,582-byte full report -> 5,247-byte whole-usage withholding, retained two-execution denominator, and exact nonzero totals are recorded as AUTHOR execution receipts; final independent source/execution acceptance is not yet asserted. No further blanket Go/browser replay is requested merely to restate unchanged recorded failures.

The missing root update-check guard permission is now explicitly approved in959 comment6781486279 after parent read of actual934 root.go: aggregate-name exclusion only in existing shouldRunUpdateCheck ancestor guard, no shared-helper refactor/unrelated update behavior change. Include the registered-root default-offline control without masking it using no-update flags/environment. Preserve actual checkpoint registrations and CheckpointOperations while integrating normal published upper ancestry once; no lower pushes or rewrites.

Registration/configured real-server -> Lab -> exact-download controls and final source/gates still pending. Retained Terra reviewer will review the actual final bounded delta, not a fictional registered harness or another whole-source cycle. Full-Go/compat/native Windows gaps and the untracked snapshot residue remain explicit; this ACK grants no authority to read sensitive residue or delete potentially competing records. The package deadline reached while blocked-stdout was active does not by itself establish the cause. No release, issue closure, frozen-wire extension or merge acceptance.