GOD-code 当前是实验性 AI Coding Agent 架构骨架，不是生产级 AI IDE。默认路径使用 deterministic fake provider，不需要 API key，也不会请求真实 provider HTTP。

当前只维护默认分支上的最新源码和 0.1.x 实验性版本，尚未建立长期维护分支。

安全修复通常优先进入默认分支。除非 release notes 另有说明，项目不承诺为旧 commit 或第三方 fork 回移修复。

当前设计中的关键安全边界：

• Python Engine 不直接触碰宿主文件系统或 shell。
• 文件、命令、MCP 和 plugin tool 执行必须经过 TS Host。
• TS Host 对工具执行应用 permission policy、path policy、command denylist、audit 和 cancel propagation。
• Tool audit默认不落盘；设置 GOD_CODE_AUDIT_FILE 后会记录工具事件。常见structured credential keys默认写为[REDACTED]，但自由文本路径、命令、错误和结果仍可能包含敏感内容，应按敏感日志保护该文件。
• Audit sink故障采用best-effort语义，不阻断或重写工具事实；调用方应检查 result.output.audit_warnings，确认期望的审计事件是否成功写入。
• JSONL audit的时间戳或事件序列化失败会以rejected Promise进入同一warning路径；单条不可序列化事件不会同步打断Host控制流，也不会阻塞后续合法审计记录。
• JSONL structured redaction按归一化key后缀识别authorization/password/secret/token/API key/private key/cookie类值，不进行自由文本secret扫描，也不替代调用方的数据最小化责任。
• GOD_CODE_AUDIT_REDACT_KEYS可追加最多64个业务敏感suffix，每项规范化后最多128字符；该配置只能扩展、不能移除内建规则，也不要把实际secret value写入配置。
• god-code audit inspect-config [--json]和doctor的audit_config检查只解析配置，不创建或读取audit文件；invalid配置错误不会回显原始capacity/redaction环境值。
• god-code audit inspect-path [--json]显式读取path metadata和最近存在目录的write access，但不创建、打开、chmod、轮转或写入target；link/non-regular检查复用运行时no-follow gate。
• Existing audit target还会独立检查W_OK，避免parent可写但文件本身无法append时错误报告ready；directory与target access结果分别输出。Access检查是即时TOCTOU诊断，不保证后续权限不变。
• Rotation前会lstat检查<audit>.1：目录占位稳定拒绝，symlink和其他non-directory entry作为opaque entry移动到private staging，commit时只unlink entry自身且不跟随target。inspect-path只报告分类，不创建staging、不删除或替换entry。
• inspect-path从同一次安全target lstat报告current generation size，并以validated capacity派生remaining bytes、over-capacity和next-record rotation提示；它不读取audit内容，也不保证检查后size不会变化。
• Runtime与inspect-path共享capacity decision helper；rotation使用current > max-next避免safe-integer addition overflow，并拒绝negative/fractional/unsafe byte-count输入。该纯计算不替代实际write时的path与descriptor检查。
• Runtime rotation与inspect-path共享current target component-lstat、regular/single-link和size inspection；真正chmod/append仍重新验证no-follow descriptor。若target在inspection后被删除，append只会在同一受检路径重新创建current generation。
• Rotation把path lstat的dev/ino与no-follow descriptor fstat绑定，并以descriptor size决定capacity；inspection-open之间的replacement会在.1删除/rename前拒绝。Descriptor关闭后的parent-entry竞态仍要求受信任目录ownership和ACL。
• Rotation需要替换existing .1时，runtime先以absolute audit path的SHA-256前32 lowercase hex派生same-parent target-bound prefix，并从pinned generation parent创建0700 .god-code-audit-rotation-<target-hash>-<id> staging directory；旧entry以no-follow BigInt snapshot rename为previous，随后才把current移动到.1。Original current与staging directory handles跨append保持；pre-commit failure按identity恢复current/archive，successful write完成file durability后才删除previous并收缩staging。Commit uncertainty保留private residue而不删除无法证明的archive；process crash residue不由runtime自动恢复或清理。
• audit inspect-rotation-stagings [--json]只读扫描configured audit target的same-parent staging scope，固定4096-entry scan和128-result预算。Scanner只匹配当前target hash prefix后的exact六字符ASCII alphanumeric ID；其他target entries不计入结果且不输出ID/path。Phase553固定prefix legacy residue只增加unscoped count和warning，不被归属到当前target，也不获得mutation authority。
• audit inspect-rotation-staging <staging-id> [--json]从当前configured audit path与exact ID重新派生selected path，不接受任意path、不扫描parent。List/direct共享single-entry no-follow projection：root通过lstat和pinned directory descriptor前后绑定，previous只lstat type/size而不读取content；layout仅为empty、previous_only或unknown。Missing为只读OK，existing/uncertain为warning；两个命令都不rename、unlink、rmdir、恢复、cleanup或生成fingerprint。
• audit inspect-rotation-recovery <staging-id> [--json]只对同一target-bound selected residue生成readiness。Runtime在staging读取前后snapshot current、.1与derived coordination lock，并把staging root、entry set及optional previous绑定到full BigInt no-follow metadata；任一object或lock projection变化都返回state_changed。只有stable private empty wrapper、current-only加staged previous、或rotated-only加staged previous可获得32-hex action-bound fingerprint。Active lock、ambiguous current+.1、invalid/unsupported graph无fingerprint。该命令不读取generation/archive bytes且固定mutation_performed: false；未来mutation仍必须先取得normal coordination lock，在锁内重验全部snapshot和exact fingerprint。
• audit recover-rotation-staging <staging-id>默认dry-run；真实mutation必须同时提供--yes、exact recommended action与32-hex recovery fingerprint。Runtime与writer共享per-target serialization并获取normal coordination lock，随后持续验证original lock directory、single owner file及owner descriptor/metadata，锁内两次重建recovery graph后再固定generation parent、selected staging和所需generation descriptor。三个action只允许exact-empty rmdir、staged previous到missing .1的restore，或.1 -> current后previous -> .1的full rollback；每个namespace syscall都有descriptor/snapshot/entry-set postcondition。Commit前failure仅在可证明时逆序恢复，无法证明则保留residue；generation commit后不反向rollback，wrapper cleanup或POSIX full sync失败通过structured warning暴露。Missing为幂等no-op，current、.1和archive content始终不读取。
• Recovery lifecycle finalization与generation outcome分开报告。Actual mutation才输出performed_action；candidate descriptor close失败输出recovery_handles_closed: false，normal lock release失败输出coordination_lock_released: false、optional logical residual path和warning。Release失败后只best-effort abandon handles并lstat logical path，不读取owner、不删除residual，也不把path missing当作original lock已安全删除。Operation已commit或确定no-op时，secondary lifecycle failure不能擦除mutation evidence；pre-commit primary error仍优先且不会被close/release error替换。Normal JsonlAuditSink successful record后的release failure继续reject，本扩展只适用于显式rotation staging recovery report。
• Recovery rejection使用JSON-safe typed details而不是要求operator从message推断filesystem结果。failure_stage限定为lock acquisition、locked revalidation、candidate open/revalidation、mutation或rollback；mutation_state限定为未开始、syscall attempted但结果未确认、已验证rollback或最终uncertain。Successful rollback仍保留primary error，rollback failure明确输出uncertain；candidate close与lock release/abandon/residual evidence只作为secondary fields合并。Report不序列化raw cause、descriptor、BigInt、owner metadata或token，acquisition timeout也不会把foreign existing lock误报为本次residual ownership。
• Candidate pinned directory在fs.open后还必须通过descriptor stat、expected identity与logical path binding。若return前失败，recovery专用failed-open handoff把该handle交给outer candidate finalizer，而不是在nested helper中close后吞掉failure。Returned与handed-off handles去重并恰好进入一次all-settled close；因此recovery_handles_closed覆盖完整candidate graph，secondary close rejection可见但不暴露fd/raw handle，也不改变primary validation error或namespace mutation state。
• All-settled candidate close在调用每个handle.close()前经过async normalization。若close在返回Promise前同步throw，该throw被转换为单项rejection，不能截断后续handles、覆盖committed result或替换primary recovery error。Runtime仍只尝试一次close并把同步/异步failure统一视为descriptor lifecycle uncertainty；它不声称descriptor必然open或closed，也不暴露fd/raw error object。
• Recovery warning/message不直接信任arbitrary thrown value的formatting hooks。Error message getter、String、toString或Symbol.toPrimitive失败时使用固定fallback；C0/C1和Unicode line/paragraph separators替换为?，summary最多512字符。Runtime不读取stack、cause或object properties，避免hostile secondary reason覆盖operation outcome、制造human diagnostic换行或产生无界CLI payload。
• Normal-lock-acquired recovery failure会在candidate handles完成settlement后、lock release前尝试只读post-failure namespace observation。Runtime在graph读取前后验证本次coordination lock仍被持有，只投影current、.1和selected staging的no-follow metadata与classifier结果；不读取generation/archive content。Lock replacement、inspection或classification failure只产生bounded warning，不能伪造observedWhileCoordinationLockHeld或覆盖primary failure。Nested eligibility/fingerprint只描述已释放锁之前的snapshot，不是后续retry authority；重试仍需fresh lock和revalidation。
• Selected rotation staging的child set不再通过无界readdir物化。Shared scanner绑定open staging descriptor，opendir最多保留2个names并额外读取1个sentinel；truncated state只输出count/limit/flag，不输出overflow names或exact total。任何truncation都令layout为unknown、withhold fingerprint，并使normal rotation/recovery exact-entry gate在namespace mutation前拒绝。该预算不把overflow entry视为可忽略内容，也不会自动删除损坏staging。
• Final append携带existing identity或missing expectation：existing路径不使用O_CREAT并在write前重验dev/ino，missing/rotated路径使用O_CREAT|O_EXCL。准备后发生replacement、disappearance或unexpected appearance时不会静默写入该entry。
• Final append在write前以descriptor最新size再次执行capacity decision；same-inode增长若使record越过maxBytes会稳定拒绝，不会依赖较早的rotation snapshot突破bounded-generation约束。
• Final descriptor完成mode收敛后、record write前会再次no-follow lstat current path，并要求regular、single-link和dev/ino仍与descriptor一致。Post-open rename、replacement、disappearance或link-state漂移会拒绝本次record，而不是继续写入已经移走的对象。
• writeFile(line)自身拒绝时，runtime会检查same descriptor的post-error size。只有增长严格位于本条record的byte上界内、logical path仍绑定same regular single-link object时才truncate回pre-write size；data/full policy同步rollback。Moved/replaced current、size倒退或beyond-bound growth不truncate，rollback failure不覆盖original write error。该机制依赖cooperative lock；非协作writer仍可能落入用户态gate窗口。
• Missing current由本次transaction通过O_EXCL从0 bytes创建、且record write尚未成功时，pre-write failure或已确认rollback回0的write rejection会触发best-effort entry cleanup。Runtime重复绑定pinned parent与empty descriptor/path/descriptor identity，从parent anchor unlink exact basename，随后要求logical path missing且original handle nlink === 0；POSIX full同步parent deletion metadata。Existing generation、unknown bytes、path/parent drift和successful write后的failure不会进入删除路径，cleanup failure也不会覆盖original error。
• Record write和配置的durability步骤完成后会再次执行同一path/descriptor identity gate。Mismatch返回Audit file changed after record write.并阻止虚假成功，但record可能已经存在于被rename移走的descriptor target中；调用方不能把该错误解释为“未写入”。
• GOD_CODE_AUDIT_DURABILITY可设为buffered、data或full；data/full分别在每条record后执行datasync/fsync。Missing current在O_EXCL create前和create成功后/write前对所有policy重验parent dev/ino；stable pre-commit failure会回收owned empty entry，check-create间parent replacement因无法证明logical binding仍最多留下空0600文件。Rotation commit只在selected file durability成功后删除staged previous archive；POSIX full随后同步pinned parent最终create/rename/delete状态，rollback也同步恢复后的namespace。Windows保持file-only full。
• JSONL redaction在读取敏感property value前执行，不调用事件对象的自定义toJSON或getter；非敏感accessor和非plain JSON container会拒绝该audit event并产生warning。Proxy traps仍不属于完整隔离边界。
• JSONL snapshot限制为64层和100000个value/slot，并在encoding前拒绝确定超过record cap的单个key/string；这些上限降低恶意深/宽事件的资源压力，但不是通用进程内存配额。
• JSONL audit默认10 MiB current generation并保留一个 .1 generation；容量限制不能替代外部备份、保留策略或安全日志集中存储。
• JsonlAuditSink自身拒绝空路径和非positive-safe-integer容量；直接嵌入或测试注入不能通过NaN、Infinity、fraction或超安全整数绕过容量边界。
• JSONL audit拒绝稳定存在的symlink/hard-link/non-regular target并使用no-follow final open。Missing parent chain从shared inspection选出的nearest existing directory descriptor逐级exact mkdir 0700、no-follow open和logical path/descriptor binding；并发EEXIST仅在child确认为same-object directory时继续。Coordination lock内随后pin current file的immediate parent；existing current preparation、missing O_EXCL create、previous .1 staging、current/previous rename、commit unlink/rmdir和POSIX full parent sync都从对应open directory descriptors执行。Parent replacement不能把descriptor-relative operation导向replacement directory，rotation source replacement由logical path/original descriptor postcondition拒绝；pre-commit safe state可rollback，但Node API仍不提供atomic mkdir-and-open或leaf compare-and-rename，unknown drift与process crash可能留下private staging residue。Audit目录仍必须置于受信任ownership/ACL下。
• JSONL sink固定构造时absolute path，并在同一Node.js进程内按path串行协调多个sink实例；独立same-user进程还通过OS temp目录中的absolute-path hash lock串行完整transaction。锁等待上限5000ms、retry 10ms，不自动清理未知持有者。该协议只约束协作writer；非协作程序、不同user namespace或同user恶意锁占位仍需ownership、ACL和运维约束。
• audit inspect-path对coordination lock先执行no-follow lstat：absent报告snapshot acquirable，directory进入same-descriptor initial/final bounded observation，regular/symlink/other blocker报告error。Directory child scan每次最多保留2个names并读取一个sentinel；initial未截断时才pin owner，valid owner handle保持到final scan之后并再次验证directory path、owner path/object/content连续性。Final scan后的两个read-only directory gates都要求descriptor/path/descriptor匹配open-time device/inode/ctimeNs/birthtimeNs；owner snapshot后的terminal gate还防止intermediate symlink traversal命中同一owner却掩盖lock leaf已变为symlink。Child entry、owner basename、chmod、directory rename/replacement或owner content drift均设置state-changed并撤销owner authority；truncation和inspection error也不发布owner metadata。Mutation transaction仍使用允许自身rename/unlink改变ctime的object matcher。Lock age仅由mtime派生，不证明holder死亡或授权cleanup；inspection不会获取、刷新、跟随或删除lock entry。
• Runtime lock directory内的owner.json以O_EXCL/no-follow和0600创建，最多读取4096 bytes，schema包含version、UUID token、PID和canonical acquired time。Acquisition先固定immediate parent，通过parent anchor exact-create lock并从actual mutation path打开reservation，再通过lock-directory anchor创建owner。Exclusive open和initial regular/single-link fstat后，creation handle在任何metadata write前进入outer ownership；write或post-write validation失败时，failed acquisition cleanup只在logical owner path仍绑定original descriptor、且descriptor-bound child scan证明not-truncated exact single-entry时unlink，因此zero-byte/partial owner不会无故阻塞后续writer，replacement、overflow或drift不会被误删。所有active-lock entry-set gates最多保留2个names并读取一个sentinel；successful holder持续持有parent、lock-directory与owner-file descriptors。Release先绑定current paths、完整metadata与bounded single-entry invariant，再从lock/parent anchors执行unlink/rmdir。每次syscall返回后还要求target missing、original descriptor dev/ino一致且nlink === 0，否则不承认released。Linux procfd capability不可用时才使用validated path fallback。显式abandon()只关闭descriptors并保留磁盘entry，不能作为force release；release/abandon按lock对象串行。该proof可检测wrong-object deletion但不能撤销replacement删除。CLI不输出token或child names。PID、timestamp和metadata valid状态都不能单独证明holder仍活跃或允许删除残留锁。
• audit cleanup-lock默认dry-run；只有active lock initial/final child scans一致、directory与pinned owner连续、两个read-only directory gates匹配open-time full generation、scan未截断且exact single valid owner时才输出本次32字符owner fingerprint。State drift、inspection error、truncation、nonexclusive set、terminal symlink/replacement或final scan后的child generation drift在fingerprint生成前拒绝。真实删除必须同时提供--yes和该fingerprint；执行阶段仍fresh打开selected lock directory与owner regular-file handles，重新验证完整metadata与single-entry invariant，并先rename到同filesystem 0700 private quarantine。Private root同时固定原root与parent descriptors，按empty、lock、lock + owner.json、owner.json、empty的exact entry set验证完整transaction；rollback与final root rmdir还要求original descriptor detachment proof。Linux feature-probe成功时，mkdtemp以及private rename/unlink/rmdir使用validated /proc/self/fd/<fd>/<child>，把parent resolution固定到open descriptors；其他平台或procfs unavailable时先重验logical parent path再降级。Fingerprint不是authentication secret，PID/age不参与授权；命令可能中断active writer。Missing/invalid metadata、非目录blocker、额外entry、wrapper或candidate path/descriptor drift、copied-owner replacement及wrong-object removal全部拒绝或通过既有residual path暴露，且不会递归删除未知对象。
• audit inspect-lock-quarantines只读扫描当前audit path派生的exact六字符suffix prefix，固定4096-entry scan与128-result预算。Selected root和nested lock均由no-follow open descriptor绑定，并分别以2-entry stream budget加1个sentinel执行initial/final scan；exact count只在未截断时存在。任一child scan truncated都固定为unknown，不选择owner、不生成empty fingerprint，也不触发restore/delete。Owner JSON继续走4096-byte bounded parser。CLI只输出scan count/limit/truncated、可证明的fingerprint、PID和time，不输出token、child names、overflow total或原始metadata。
• audit inspect-lock-quarantine <qid>只接受exact六字符ASCII alphanumeric ID，并从当前configured audit path重新派生selected quarantine。该direct command不枚举temp namespace，与bounded list共用single-entry no-follow projection和uncertainty判定；missing只报告exists: false，existing/uncertain只产生warning。它不输出owner token、不创建entry，也不把layout、fingerprint、PID或age转换为cleanup/recovery authority。
• audit cleanup-lock-quarantine <id>只允许删除valid owner_only residue。ID重新绑定当前configured audit path，真实删除要求--yes --expect-owner。Runtime保持selected quarantine directory与owner file handles open；owner先隔离到0700 disposal root并在新path重新绑定原file descriptor，原quarantine继续占位并经directory binding与empty gate后才rmdir。Private disposal root从creation后持续固定original root与parent descriptors，并按empty、owner.json、empty的exact entry set约束isolation、rollback、owner unlink和final rmdir；Linux procfd capability可用时这些mutation从相应open directory解析single child name，fallback仍执行logical path/descriptor gate。Final contraction要求descriptor证明原root已脱链，failure沿用residual_disposal_path。提交前extra entry、wrapper replacement或copied-owner replacement不会被删除，原candidate可安全识别时恢复owner。Pre-commit、empty、unknown、invalid或non-directory entry全部拒绝，active coordination lock不受影响。
• audit cleanup-empty-lock-quarantine <qid>只允许rmdir stable exact-empty quarantine。Dry-run输出empty-quarantine domain fingerprint，mutation要求--yes --expect-quarantine。Runtime同时保持candidate与immediate-parent no-follow directory descriptors open，并重新绑定current path与BigInt dev/inode/ctimeNs/birthtimeNs、fingerprint和empty invariant；rmdir只从parent anchor解析selected basename。Replacement、extra entry、owner/pre-commit/unknown或non-directory state全部拒绝且不递归删除。
• audit recover-lock-quarantine <id>只允许恢复valid lock_with_owner或lock_and_owner residue。真实恢复要求--yes --expect-owner且derived coordination lock path必须不存在；shared parent anchor上的exact mkdir reservation保证existing lock或blocker不被覆盖，并从actual mutation path立即pin原reservation。Runtime分别保持parent、quarantine root、nested lock、reservation directory和layout-selected owner file handles open；owner transfer/restore在selected/recovered directory anchors之间执行，rollback reservation与提交后的nested/root contraction从对应parent anchors执行，同时重验current paths/descriptors、完整owner metadata和entry sets。Copied-layout或copied-owner replacement会拒绝；rollback只rmdir descriptor-bound exact-empty reservation，path missing还需descriptor证明原directory已unlinked。未知entry不删除并报告residual path。恢复不证明PID存活，也不自动删除恢复后的lock；后续cleanup必须独立确认。
• audit inspect-lock-disposals只读扫描exact <lock>.cleanup-<qid>.dispose-<did> namespace，固定4096-entry scan和128-result预算。Selected directory由no-follow open descriptor绑定，root child scan最多保留2个names并读取一个sentinel；truncated root省略exact count、固定unknown且不生成owner或empty fingerprint authority。Inspection继续关联source quarantine snapshot，symlink和non-directory entry不跟随。Source absence、PID、age、valid owner metadata和fingerprint都不单独授权cleanup，command不修改任何entry，也不输出owner token、child names或overflow total。
• Quarantine/disposal owner-bearing residue只有在initial/final bounded scans、root/optional nested open-time generation gates、selected owner final reread及terminal directory gates全部连续时才发布fingerprint。Initial/final owner path、status、device/inode和canonical metadata必须一致；owner原地改写、basename替换、child generation drift或logical directory replacement统一返回state_changed/unknown，cleanup dry-run不会生成confirmation。Empty residue fingerprint也必须通过strict exact-empty generation opener。Read-only结果不是reservation，返回后仍可能过期；真实mutation继续执行独立fresh descriptor-bound revalidation。
• Source quarantine initial absence不能单独支持disposal cleanup authority。Owner-only或empty disposal完成自身稳定观测后，返回前必须再次no-follow检查derived source path；persistent late entry会更新source existence/type、标记source/disposal state changed、将disposal layout降级为unknown并清除fingerprint/confirmation。Late source directory不扫描内部内容，terminal path-chain或inspection error也fail closed。真实owner/empty disposal cleanup仍在mutation transaction前后多次独立断言source missing。
• Active lock、owner-bearing quarantine与owner-only disposal的read-only authority必须在各自terminal directory/source gate之后再次no-follow打开并有界读取owner。前后owner device、inode、ctimeNs、birthtimeNs、mtimeNs、size或canonical metadata任一不连续都撤销owner fields、fingerprint与confirmation；terminal snapshot不是reservation，真实mutation仍执行独立fresh descriptor-bound revalidation。
• Owner-bearing confirmation fingerprint必须绑定stable candidate而不只是owner token。Shared Host inspector以version/domain、absolute candidate path、layout/owner location、root/optional nested directory full generations、selected owner full generation和canonical metadata计算32 lowercase hex；owner-only disposal还绑定derived source path的confirmed-missing marker。CLI不自行派生token digest，四类mutation从fresh pinned candidate重算并在private wrapper/reservation及任何rename/unlink/rmdir前比较。Dry-run后复制相同owner JSON的directory replacement、其他path/domain/layout fingerprint或旧token-only value均不得授权mutation；fingerprint仍不是authentication secret或PID liveness proof，raw identity不进入human/JSON output。
• Phase572规定maintenance CLI不得把read-only preflight match报告为authoritative runtime confirmation。Active、owner/empty quarantine、owner/empty disposal cleanup与pre-commit recovery在调用runtime前不得发布positive match或confirmation fingerprint；runtime rejection及selection前disappearance必须省略这些字段。只有runtime existing result返回exact expected fingerprint后才能投影true和该value；preflight wrong value仍显式返回false且不泄漏current correct fingerprint。该evidence ordering不放宽任何mutation gate，也不改变post-commit residual语义。
• Phase573规定active lock和owner-only quarantine cleanup的selected-path existence必须反映runtime terminal namespace。Runtime existing result表示原active/quarantine basename已经完成删除，因此report必须为removed: true和对应*_exists: false；private quarantine/disposal wrapper残留只能通过residual path与WARN表达，不能伪装为原selected path仍存在。该修正不改变owner confirmation、commit point、rollback或unknown-entry preservation。
• Phase574规定post-commit residual locator不能单独证明owner-only disposal或recovered quarantine的logical path当前存在。无residual的runtime existing result明确投影对应*_exists: false；有residual_disposal_path或residual_quarantine_path时必须保留operator locator并省略optional existence boolean，不能通过事后path lookup把race-prone snapshot升级为transaction evidence。WARN只说明cleanup无法安全确认，不断言residue present；commit、rollback、unknown-entry preservation和token non-disclosure保持。
• Phase575规定runtime candidate missing不能继续携带preflight inspection snapshot。六条cleanup/recovery command只可报告selected path在authoritative selection时missing及no-mutation outcome，必须撤销旧entry/layout/scan/owner/state evidence；disposal还必须撤销未被missing fast path重新观察的source quarantine state，recovery还必须撤销active lock state。Concurrent source quarantine或coordination lock appearance不能被旧false遮蔽；实现不增加post-hoc lookup，不改变mutation gate、rollback或token non-disclosure。
• Phase576规定maintenance namespace outcome优先于secondary descriptor finalization。五类cleanup和pre-commit quarantine recovery必须对全部已取得handles执行normalized all-settled close；任一close失败时保留已提交removed/recovered、fingerprint、residual或verified rollback evidence，并只以Host-local *_handles_closed:false和bounded warning返回WARN。Primary operation error不得被close error替换，runtime missing不得伪造closure fields。Warning使用total bounded summary，不包含owner token、raw owner JSON或identity material；mutation、commit/rollback及跨层schema不变。
• Phase577规定maintenance rejection在candidate reader取得pinned handle后也必须保留primary error并投影descriptor finalization。Candidate-selection与post-selection failure统一抛出typed maintenance error；同步close throw必须进入all-settled，不能覆盖fingerprint/validation message或阻止其余handles关闭。CLI ERROR只映射boolean和bounded warning，不输出owner token、raw owner JSON、raw identity或unbounded reason。Preflight refusal及未handoff transient descriptor不伪造evidence，namespace mutation与跨层schema不变。
• Phase578将同一规则扩展到maintenance opener已经取得但尚未return的transient descriptor。Failed-open directory/empty/owner/parent/private/recovery handles只在当前stack内通过optional collector转移cleanup ownership，outer finalizer按object identity去重并all-settled；fd number、raw handle和secondary error object不会进入report。未取得descriptor的pre-open failure仍不输出lifecycle fields，empty terminal assertion close uncertainty只形成resolved WARN，不改变已验证namespace commit或泄漏owner token。
• Phase579将maintenance bounded child scan的Dir stream纳入descriptor finalization evidence。Stream仍在scan helper内立即close，但secondary close failure只进入stack-local aggregate，不得覆盖read primary error、成功entry result或已验证namespace outcome；outer finalizer再与pending FileHandle closure合并为既有boolean和bounded warning。Context不保存entry names、fd number、raw resource或raw error object，inspection-only与rotation staging scan保持原错误边界，CLI、wire和persistent schema不变。
• Phase580规定maintenance descriptor close Promise不得无限阻塞operation settlement。每个Dir/FileHandle仍只调用close一次并等待最多5000ms event-loop timer deadline；timeout只能形成*_handles_closed:false和bounded warning，不能推断kernel descriptor状态、覆盖primary error或撤销已验证namespace result。Late resolve/reject由私有observer消费，不重试、不取消、不输出raw resource/error。Inspection与rotation family保持原边界，CLI、wire和persistent schema不变。
• Phase581对read-only inspection descriptor实施独立5000ms settlement deadline。Parent namespace scan timeout必须明确ERROR，single-entry timeout必须设置inspection uncertainty并撤销layout、owner/empty fingerprint和recovery authority；read primary不得被secondary timeout覆盖。同一inspection finalization set并发single-attempt close，late settlement不回写结果。Timeout下禁止rename、unlink、rmdir或owner写入，maintenance、mutating recovery、CLI字段、wire和persistent schema不变。
• Phase582对mutating rotation recovery candidate descriptors实施独立5000ms settlement deadline。Generation、staging与parent handles必须按identity去重并发single-attempt close；timeout只能形成既有recovery handle false/warning，不得覆盖committed action、mutation/rollback primary、candidate-open stage或触发二次mutation。Late settlement不回写结果，candidate deadline后coordination lock继续finalize；lock lifecycle、acquisition、writer、CLI字段、wire和persistent schema不变。
• Phase583对successful cooperative lock lifecycle descriptors实施独立5000ms settlement deadline。Owner、lock directory与parent handles必须按identity去重并发single-attempt close，首次release/abandon即memoize finalization，任何timeout、重复调用或writer/recovery fallback不得二次close。Release timeout不得重建已删除lock，abandon timeout不得删除disk lock；primary/committed evidence保持，late reason不投影，public lock、CLI、wire与persistent schema不变。
• Phase584对ownership transfer前的lock acquisition descriptors实施独立5000ms settlement deadline。Failed-open parent/lock/owner、pre-transfer parent、cleanup owner/lock与child-scan stream必须single-attempt bounded close；secondary timeout不得覆盖validation/write primary或EEXIST retry，successful scan timeout必须拒绝transfer并停止基于exact entries的mutation。Late reason不泄漏，successful handles仍只由Phase583接管，public options、CLI、wire与persistent schema不变。
• Phase585对常规JSONL writer-owned descriptors实施独立5000ms settlement deadline。Bootstrap/generation parent、append/current generation、rotation transaction、backup staging directory与writer staging stream必须identity-deduplicated single-attempt bounded close；write/validation/rotation primary不得被secondary timeout覆盖，已提交append/rotation不得因close timeout回滚或重复mutation。Late reason不泄漏，serialization tail继续可用，lock/recovery/maintenance/inspection、public sink、CLI、wire与persistent schema不变。
• Phase586把successful lock transfer后的lifecycle child-scan streams纳入Phase583 5000ms deadline。assertHeld()和release scans必须read-primary-first bounded close；pre-owner timeout禁止unlink，post-owner timeout禁止重建owner或继续rmdir并保留exact empty residual。Stream timeout后必须允许abandon()关闭尚未finalize的handles，late reason不得触发额外mutation或泄漏；public lock、CLI、wire与persistent schema不变。
• Phase587把successful rotation recovery candidate的staging child-scan streams纳入Phase582 5000ms deadline。Candidate-open、mutation/rollback与final cleanup scans必须read-primary-first bounded close；pre-commit timeout只能进入existing rollback，post-commit timeout禁止回滚current/archive并保留exact empty staging residual。Late reason不得触发rename、unlink、rmdir、二次projection或泄漏；candidate handle fields、public recovery/CLI、wire与persistent schema不变。
• Phase588为MCP runtime client/transport close Promise增加5000ms settlement deadline。Connected servers必须snapshot后并发关闭，client reject/timeout后的transport fallback也必须bounded；concurrent/repeated close不得重复消费server或提前返回。Connect/list-tools primary保持，late reason不得进入diagnostic、tool result、CLI、wire或日志；timeout不证明MCP process/socket已经关闭，public MCP与persistent schema不变。
• Phase589把MCP/plugin runtime纳入prepared-host ownership transaction。Host setup失败必须并发best-effort关闭全部已创建runtime且不能用secondary close reason覆盖plugin/config/context primary；成功host的close必须terminal memoized、same-runtime single-attempt并隔离同步throw/reject。Close reason、runtime object、server/plugin配置、command、path、token、transport或process handle不得进入CLI、tool result、wire、audit或日志，public Host与persistent schema不变。
• Phase590把headless renderer、prepared host和engine teardown纳入primary-aware all-settled envelope。Renderer同步throw、host close reject或engine stop failure不得阻断其他resource，也不得覆盖run/RPC operation primary；无primary时只传播既有logical priority中的首个cleanup reason。Listener、Promise、cleanup reason、engine/host object、prompt、path、token、transport与process handle不得进入CLI、tool result、wire、audit、transcript或日志，public run与persistent schema不变。
• Phase591把REPL start/stop/cleanup、active turn与outer readline runner纳入generation-scoped primary-aware lifecycle。Stop不得等待captured cancel Promise，必须先撤销listeners与mutable ownership，并让active submit以固定local reason结束；renderer、host与engine任一cleanup failure不得阻断其他resource或覆盖start/submit/engine-exit/outer-run primary。Late cancel、Promise identity、cleanup reason、renderer/host/engine object、prompt、path、token、transport和process handle不得进入CLI、tool result、wire、audit、transcript或日志，public REPL与persistent schema不变。
• Phase592把engine child、peer、shutdown和forced termination纳入generation-scoped terminal lifecycle。Stop必须在async shutdown前撤销public RPC/turn authority；shutdown pending/reject最多阻塞5000ms，graceful与SIGKILL后exit各最多等待2000ms。Forced timeout不得伪造process已退出或允许restart；old exit callback只能关闭captured peer。Promise、timer、kill result、stderr、cleanup reason、child/peer object、command、path、token、transport和process handle不得进入CLI、tool result、wire、audit、transcript或日志，public engine与persistent schema不变。
• Phase593把doctor python/provider operation diagnostic与waiter/engine cleanup纳入primary-aware all-settled边界。Operation error不得被cleanup secondary覆盖；successful check的cleanup uncertainty只能使用固定非敏感message降级。Waiter timer/listener cleanup任一throw不得阻断Phase592 stop。Raw cleanup reason、Promise、timer、listener、stderr、signal、PID、engine/child/peer object、path、command、token或transport不得进入doctor human/JSON report或日志，check name/status/key与persistent schema不变。
• Phase594把doctor tool-catalog operation与prepared-host close纳入single diagnostic边界。Host setup或tool count primary不得被close secondary覆盖；successful count叠加close throw/reject只能使用固定tool catalog loaded but host cleanup failed降级，不能同时保留ok check或输出raw cleanup reason。Runtime object、Promise、MCP/plugin配置、path、command、token、transport和process handle不得进入doctor human/JSON report或日志，Phase589 close与public schema不变。
• Phase595把CLI tools list/inspect的catalog读取与prepared-host close拆成primary-aware outcome。Catalog read primary不得被close secondary覆盖；successful read叠加close throw/reject只能抛固定tool catalog loaded but host cleanup failed，不得向stderr或JSON泄漏raw cleanup reason、runtime object、MCP/plugin配置、path、command、token、transport或process handle。Normal catalog输出、not-found、exit routing和public schema不变。
• Phase596把plugin config/list diagnostic operation与runtime close拆成primary-aware outcome。Load/list primary不得被close secondary覆盖；successful diagnostic叠加close throw/reject只能把existing check降级为固定plugin runtime cleanup failed，不得泄漏raw cleanup reason、runtime object、manifest内容、entrypoint、path、command、token、transport或process handle。Registry fast path、sandbox、human/JSON shape和public schema不变。
• Phase597把MCP context、connection multi-check和generic operation diagnostic与runtime close拆成primary-aware graph。Existing operation error不得被close secondary覆盖；无error时cleanup uncertainty只能把existing owner check降级为固定MCP runtime cleanup failed，不得新增cleanup check或泄漏raw reason、server config value、header/token、runtime/client/transport、PID、path或command。Optional success evidence、human/JSON shape和public schema不变。
• Phase598把terminal approval readline与TUI PTY screen的同步cleanup拆成primary-aware outcome。Approval answer/abort callback不得直接close或重复finalize；question rejection、interactive deny和cancel不得被cleanup secondary覆盖，allow叠加listener detach/readline close failure必须fail closed为固定unavailable denial。TUI render primary不得被screen stop failure覆盖，successful render只能抛固定TUI PTY smoke cleanup failed。Raw cleanup reason、stack、cause、input/output/screen object、request内容、frame、terminal sequence、path、command或token不得进入decision、tool result、CLI、audit、wire或日志，public schema不变。
• Phase599把TUI controller screen、raw mode、live sessions、input listeners/readline和pending actions纳入terminal composite lifecycle。Start/input/callback primary不得被candidate/session/screen cleanup覆盖；stop必须在async cleanup前撤销runtime ownership、memoizesame-generation Promise并all-settled全部unique resources。Cleanup-only failure只能使用固定GOD-code TUI cleanup failed.，pending rejection必须有owned observer。Raw cleanup reason、Promise、session/screen/input/output object、frame、prompt、path、command、token、transport或process handle不得进入CLI、tool result、wire、audit、transcript或日志，public TUI schema不变。
• Phase600把transcript watch的active/archive FSWatcher与pending filesystem event纳入owner-root finalization。任一watcher同步close failure不得逃逸timer/event callback、阻断其他close或让outer Promise永久pending；existing root setup/validation primary不得被cleanup secondary覆盖，cleanup-only uncertainty只能使用固定transcript watcher cleanup failed。Raw cleanup reason、stack、cause、watcher/event Promise、native handle、descriptor或额外path细节不得进入human/JSON report、CLI、wire、audit、transcript或日志，public watch/discovery schema不变。
• Phase601把local provider daemon start与model pull/remove/prune日志fd纳入operation-owned finalization。Spawn、marker write、exit/timeout primary不得被closeSync secondary覆盖；successful operation cleanup uncertainty只能把existing provider check固定降级为local provider log cleanup failed并保留operation evidence。Event callback close throw不得逃逸或让Promise pending，同一fd只能attempt一次。Raw cleanup reason、stack、cause、fd、native handle、log payload、command、args、environment、marker内容或child object不得进入human/JSON report、CLI、wire、audit、transcript或日志，public provider schema不变。
• audit inspect-lock-disposal <qid> <did>只接受两个exact六字符ASCII alphanumeric ID，并从当前configured audit path重新派生selected disposal和source quarantine path。该direct command不枚举temp namespace，复用bounded scanner的single-entry no-follow projection；missing只报告exists: false，existing/uncertain只产生warning。它不输出owner token、不创建entry，也不把fingerprint或source absence转换为mutation authority。
• audit cleanup-lock-disposal <qid> <did>只允许删除valid owner_only且source quarantine absent的selected disposal。真实删除要求--yes --expect-owner，执行持续打开原disposal directory、owner file与immediate parent handles，并重验两个current paths/descriptors、完整metadata、single-entry invariant和source absence后，才从disposal anchor unlink owner、从parent anchor rmdir root。Copied-owner replacement在commit前拒绝。Owner unlink是commit；后续extra entry、replacement或rmdir failure只报告residual path，不删除未知entry。Source absence不是liveness proof，active coordination lock不受影响。
• audit cleanup-empty-lock-disposal <qid> <did>只允许rmdir source-absent exact-empty disposal。Dry-run输出绑定absolute path、BigInt dev/inode/ctimeNs/birthtimeNs的directory fingerprint，mutation要求--yes --expect-disposal并保持原directory与immediate parent descriptors open，重新验证path/descriptor identity、source absence和empty invariant，再从parent anchor删除selected basename。Owner fingerprint不适用于该命令；extra entry、replacement、source race及non-directory state全部拒绝且不递归删除。
• POSIX JSONL audit在写入和rotation前把current文件收敛为owner-only 0600，使新current和 .1 generation保持私有；Windows部署必须使用平台ACL提供等价访问控制。
• GOD_CODE_API_KEY_ENV 保存的是 API key 所在环境变量名，不应直接保存 API key 内容。
• Doctor 和测试不应打印真实 API key。
• MCP 和 plugin 默认不启用；启用后仍通过统一 host tool registry 执行。

当前未完整实现的能力包括：

• 持久 approval daemon、跨命令 approval cache 或长期规则文件。
• Provider 价格表、账户 billing、跨进程 quota limiter 或持久 spend ledger。
• MCP OAuth / token refresh、跨命令后台 daemon 或自动 prompt/resource 注入。
• 远程 plugin marketplace、下载安装脚本、远程 metadata sync 或系统级 sandbox。
• Session daemon、跨进程 handoff 或同一 session 内多 active turns。

请优先使用仓库托管平台的 private vulnerability reporting 或 security advisory。不要先创建包含漏洞细节、PoC 或 secret 的公开 Issue。

如果私密报告功能不可用，可以创建一个不含技术细节的公开 Issue，请求维护者提供私密联系渠道。Issue 中只应说明问题类型和大致影响，不要附上可利用步骤或敏感数据。

报告中建议包含：

• 受影响的 commit 或版本。
• 可复现步骤。
• 预期行为和实际行为。
• 最小 PoC 或测试用例，以及运行所需的非敏感配置。
• 影响范围、利用前提和建议缓解措施。
• 是否涉及 secret 泄漏、路径逃逸、命令执行绕过、MCP/plugin 边界绕过或 provider 配置泄漏。

不要在公开 issue 中粘贴真实 API key、token、私有路径或敏感日志。

维护者会以 best-effort 方式：

1. 确认收到报告并检查是否可复现。
2. 与报告者确认影响、受影响版本和披露范围。
3. 准备修复、回归测试和必要的安全文档更新。
4. 在修复可用后协调公开披露和版本说明。

项目当前不提供固定响应 SLA。重复报告、无法复现的问题或只影响已明确不支持场景的问题，可能会被关闭或降级处理。

优先处理以下类型的问题：

• 绕过 TS Host 的 permission、path policy、command denylist 或 tool registry。
• 未授权文件访问、命令执行或跨 session 数据访问。
• API key、token、provider header、audit 或 transcript 中的敏感信息泄漏。
• MCP/plugin 隔离边界绕过或未经配置的外部网络访问。
• JSON-RPC、session、audit 或 cleanup 生命周期导致的权限扩大和状态混淆。

纯模型输出质量、第三方服务不可用、需要用户主动关闭安全策略的行为，以及不受支持的生产部署问题，通常不作为项目安全漏洞处理，除非它们同时突破了项目声明的安全边界。