[codex] prove grounding-only managed plugin convergence

[TheGreenCedar]

Outcome

The protected Apple Silicon release proof now reaches its first full Agent generation through the packaged managed plugin's normal ground activation. It no longer uses an explicit repair command to establish initial readiness.

On a local Apple Silicon macOS 15 run, one managed shared-agent repair advanced a stale complete publication from generation 1 to 4, launched the checksum-pinned native Metal backend, verified meaningful accelerator work and an embedding smoke, then served packet and search through the same MCP session. A fresh MCP process reused the exact native PID and launch fingerprint.

What changed

• Add a packaged proof mode whose only MCP tool calls are ground, packet, and search; canonical status polling proves packet/search remain closed until local freshness, full retrieval, live native identity, and GPU proof converge.
• Make the managed repair worker wait for a grounding-owned local refresh lock before it begins sidecar repair. This closes the observed cache_busy race on repositories whose bounded grounding refresh outlives the MCP request.
• Preserve the remaining Metal lifecycle gates: warm reuse, endpoint death and fail-closed readiness, explicit recovery, occupied ports, stale leases, interrupted repair, corrupt installs, Unicode/spaces, and proof-owned cleanup.
• Keep the proof scripts compatible with the system Python on macOS 15 and Docker 29 RFC3339 nanosecond timestamps.
• Require grounding-only convergence in the protected workflow and document the stronger proof boundary.

Hardware proof

• Packaged archive: codestory-cli-v0.14.3-macos-arm64.tar.gz
• MCP tool sequence: ground -> packet -> search
• Managed repair attempts: exactly 1
• Publication generation: 1 -> 4
• Retrieval: full; packet/search allowed
• GPU proof: verified; meaningful accelerator work true; embed smoke true; observation source native_log
• Launch: native_spawned; exact PID/fingerprint reused after MCP restart
• Endpoint death blocked readiness; explicit repair recovered the runtime
• Proof caches, native processes, ports, containers, network, and marker-owned temp root were removed

Verification

• cargo check --workspace --locked
• cargo test --workspace --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo build --release -p codestory-cli --locked
• mandatory repo-scale full-sidecar stats: 2 passed; 148,476 nodes, 123,857 edges, 307 files, 0 index errors, 1,007 dense anchors
• packaged Apple Silicon Metal lifecycle and grounding-only convergence proof
• packaged-proof and package-release Python self-tests
• retrieval setup self-test
• plugin static suite: 71 passed, 1 expected Windows-only skip
• workflow policy, actionlint, documentation links, and git diff --check

The stats run emitted one telemetry warning: retrieval indexing took 56.30 seconds versus the latest local warning baseline. Correctness remained full_sidecar; repeat refresh took 15.44 seconds and search took 2.22 seconds.

Closes #1053
Refs #897
Refs #899

[TheGreenCedar]

PR #1058 review remediation is pushed at exact head 04a15422c62e8c40d29212d033ce9162af43b577.

What changed:

• The managed repair worker now retains the grounding-owned local-refresh guard through ensure_open and releases it immediately after index readiness, closing the second-contender cache_busy race.
• Managed convergence proof now requires one namespace-stable repair attempt with a durable terminal result, plus explicitly requested and detected Metal before packet/search readiness can pass.
• Runtime-log accelerator proof records the proven requested backend as the detected provider when host inventory has no provider result.
• Timeout cleanup now discovers workers started by ground_activation from the latest convergence status and avoids terminating a completed attempt.
• Shared status extraction and convergence validation are consolidated; the constructor-literal self-test was removed. The review-remediation commit is net +45 lines (157 insertions, 112 deletions).

Verification:

• Rebased onto exact origin/dev/codestory-next 174b77ea20093150cd1de3640d885327e3704b3f; both conflicting stats rows were preserved.
• Packaged-proof and package self-tests, workflow policy, release-version synchronization, documentation links, and focused remediation probes passed.
• Locked focused lock test, workspace check/test, full fidelity and language-coverage binaries, all-target/all-feature clippy, and release CLI build passed.
• The repo-scale ignored stats lane passed with full-sidecar evidence; the emitted Apple Silicon row is appended. It records the expected retrieval-index timing warning against the prior baseline, with zero index errors.

The PR remains draft and has not been merged or marked ready.

[TheGreenCedar]

Pause checkpoint: exact head 04a1542 is published and its full local gate passed, but the final independent review found two remaining P2s. The PR stays draft.

1. Ground-triggered repair cleanup still depends on a successful convergence-status response exposing the worker PID. If ground or the first poll fails after activation, the detached worker can escape proof cleanup and race cache/resource removal.
2. detected_provider=metal is currently backfilled from the requested provider. Because the existing log prerequisite can match metal in the managed executable path plus a generic offload line, the protected proof is not yet independent runtime Metal evidence.

The local-refresh ownership handoff, terminal worker-result requirement, and namespace stability fixes reviewed cleanly. No further changes or tests are being started before the Codex update.