T084, 4.3: the last deferred reaches through declared seams; consumer_reach retired (plan 034)

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

Arc: neutral-product-standalone-operability

Plan 034 (specs/034-opendox-standalone-operation/tasks.md, read at openxFactory main 2140f5a7), phase 3:

• T084, the last deferred reaches (#1144's 4.3, with T007's batch G and batch L addenda).
• Realizes: 4.3.
• Falsifiers:
  • F4.1 whole;
  • tests/test_capability_honesty.py (new);
  • tests/test_rejection_report.py (new).
• After: T073 (openDox-code#72, landed as 90ac7033), for serve.py's single-writer order T055 → T073 → T084, and T070 for cli.py's, T070 → T084.
• Based on main, retargeted by the holder once T073 landed, so this diff is T084 alone: its own 28 files, the same list as 93f77dc1..7536bfe2.
  • While it was stacked on T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72's branch, T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72 was merged in at each of its moves, never rebased: 620bee27 at b333bf16, then T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72's final pre-squash head 93f77dc1 at 7536bfe2. That head carries T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's final pre-squash head c04690f8 and openDox-code main 5e7ab003 (T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's squash). Through stack A it also carries T085 (T085, the standalone doxBench defaults for T027's seams, and T058's two workbench rules move into opendox.validator (plan 034) #71), T088 (T088, the lens's two seed actions are offered only where a binding answers them (R1Q19 (a)) (plan 034) #65), T071 (T071, 13.2 and 13.3: load_settings refuses a non-PostgreSQL DSN and a collapsed DSN pair (plan 034) #60), T078 (T078, 16.1: the OpenAI-compatible dialect joins DIALECTS (plan 034) #61), T070 (T070, 13.4-13.6: OPENDOX_INSTALL_MODE and generate-and-open --local (plan 034) #67), T079 (T079, 16.2: a model field the provider receives (plan 034) #62) and T081 (T081, 16.4: "no model configured" is a state, shown before any turn (plan 034) #74).
  • After T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72 landed as the squash 90ac7033, main was merged at d556c3fb with git merge-tree --merge-base 93f77dc1, recording both parents, so the squash's copy of T073 is not merged twice. 90ac7033's tree equals 93f77dc1 merged onto 8e377823 over 5e7ab003. Through main this branch also takes T075 (T075, 10.2 and 10.2a — an installed entry point serves all 42 bundle files; intent-feed.js is not owed (plan 034) #73) and the broker-path hardening (Broker-path credential hardening (follows T080): a minted token keeps a built-in credential's rules (plan 034) #64).

Ruled:

• R1Q1 (a), R1Q22 (a), 5817152735;
• R1Q10 (a), 5850003126;
• items 1 and 3 of 5920216845;
• the model approval: Brett Heap, 2026-10-02, "Refuse by name, hide intake (Recommended)", confirmed at 5961364221, item 1;
• the chat scope: 5961651355, "Tile's own documents editable (Recommended)";
• drafted now: 5960162524.

Claimed on openxFactory#656 in 5960235138. T063 has landed (openxFactory#1218 → a883bbf6), and T073 has landed (openDox-code#72 → 90ac7033). The holder posts READY and the landers merge.

F4.1 whole

At this branch's base (T073's bb05e3d7, before T084), the scan lists eleven reaches:

AssertionError: 11 deferred reach(es) still name the consumer or the publisher:
  src/opendox/branch_session.py:1592: openxdox.register
  src/opendox/branch_session.py:2010: openxdox
  src/opendox/serve_project.py:271: openxdox.gate_console
  src/opendox/serve_project.py:272: openxdox.kickoff
  src/opendox/serve_workbench.py:1219: openxdox
  src/opendox/serve_workbench.py:1669: openxdox
  src/opendox/serve_workbench.py:2611: openxdox
  src/opendox/serve_workbench.py:351: openxdox
  src/opendox/serve_workbench.py:411: openxdox
  src/opendox/serve_workbench.py:412: openxdox
  src/opendox/serve_workbench.py:548: openxdox

src/opendox/consumer_reach.py was present. At b333bf16, and again at d556c3fb after the merge of main:

no deferred reach names the consumer or the publisher

src/opendox/consumer_reach.py is absent. tests/test_projection_seams.py::test_the_stand_ins_module_is_retired holds the absence.

What it does, commit by commit

1. Every broken rule, once (5920216845 item 3). cli._report_non_conformance prints each broken rule id once, with its count and up to five of the places it is broken, then the validator's other lines.

   • tests/test_rejection_report.py (new) covers a snapshot that breaks one rule several times and a second rule once.
   • Before: 3 failed, 1 passed. After: 6 passed.
   • Mutants killed: always prints 1 (5 failed), never groups (5 failed), drops the places (3 failed).

2. Capability honesty (5920216845 item 1). compute_capabilities(route_bindings=) sets gate true only where a contributed binding answers POST /actions/gate/<verb>, and refresh true only where one answers POST /actions/refresh. A standalone server reads both false.

   • Before, at 047bb4fa: a standalone server with an identity answered gate and refresh true, and both routes answered 404 unknown_action. The module's 20 cases then: 20 failed. After: 20 passed.
   • Mutants killed:
     • gate ignores the routes: 4 failed;
     • refresh ignores the routes: 4 failed;
     • a predicate that is always true: 5 failed;
     • every flag off: 6 failed;
     • gate drops the actor: 1 failed.

3. The consumer columns' seams. opendox.column_seams declares four seams in projection_seams' discipline: gate, scope, kickoff and register. opendox.default_columns holds openDox's own default for each (R1Q10 (a)). The four entry points register them where no host has, beside projection_seams' defaults.

   • The gate default carries the vocabulary-free primitives as real code.
   • The governed record functions refuse BY NAME (GateRecordsNotRegistered, naming opendox.column_seams.gate and its registration call). openDox writes no governed shape it does not own. This is the holder's reading (B).

4. The routing. Every reach above now reads its seam:

   • the chat turn's and the document abstract's scope authority (the abstract's reach moves below its step-1 check);
   • the thread read's live-session question;
   • the first-edit Save gate;
   • model approval;
   • the project register's prefix and kickoff readers;
   • branch_session's gate, register and kickoff;
   • cli's gate_mod.

   The scope value types are openDox's own (doxbench_scope_types).

5. A tile's own documents are editable (5961651355). This supersedes the holder's read-only reading. The neutral scope marks each section a tile projects as owned, as openXdox's authority marks its owned sections: a group's members, a selection's files, and a candidate's claiming groups' members. The set is ONE named function, default_columns.editable_paths. Nothing outside the tile is editable, an unresolved row is not, and neither is a created path.

6. opendox --help names the installed command and openDox only. This is the holder's addition, found by T099's PyPI writer. T084 is cli.py's last phase-3 writer.

   • The installed help printed usage: ideation-dashboard and cli.py's module docstring, which is openxFactory's pre-carve history ("validates it against the pinned openxFactory validator", python3 -m ideation_dashboard.cli).
   • cli.PROG = "opendox", and PARSER_DESCRIPTION and PARSER_EPILOG are neutral.
   • Two subcommand help lines in the same listing lose their internal words: create ("ideation doc" becomes "document") and runtime (drops "(split-opendox § 3.5)").
   • tests/test_installed_help.py (new) runs the INSTALLED console script, after checking that its entry point is opendox.cli:main. It asserts usage: opendox and no openxFactory, xFactory, ideation-dashboard, split-opendox or scripts/ wording.
   • Before: 3 failed. Mutants killed: the prog reverted, 3 failed; the description back to __doc__, 3 failed.

7. The static bundle's content types are pinned. This is the holder's addition: T084 is serve.py's last phase-3 writer. It comes from T075's finding on openDox-code#73 and realizes 10.2, "reachable in a browser from an openDox-only install".

   • The static route's guess_type reads extensions_map first, and the platform's mimetypes table only after it. A host whose table maps .js to text/plain serves every ES module as text, and a browser refuses to run it. Windows reads its table from the registry.
   • serve.STATIC_CONTENT_TYPES pins every extension the bundle ships, measured from a built wheel: 41 files under opendox/web/, 39 .js, one .html and one .css. It also pins .mjs, .json, .svg, .png, .ico and .woff2.
   • Each value is the standard library's built-in one. .woff2, which that table lacks, takes its registered type (RFC 8081).
   • Any other extension falls back to the platform table.

8. consumer_reach is retired. LateGateRoutes and LateProjectionRoutes leave DashboardHandler's bases. The gate and projection columns are a host's, composed in through the handler-contribution facet beside the bindings that name their methods (R1Q1 (a)). A host that contributes a binding without its column is refused at wiring, before a socket. openXdox contributes both columns that way at T086.

The three crash sites, and a fourth

tests/test_capability_honesty.py runs a standalone python -m opendox.serve child with neither sibling importable. Each site gets a structured answer, never RemoteDisconnected:

• the document abstract: model_capability_unavailable at step 1, now that gate reads false;
• model approval: approval_refused, with the sentence naming the gate seam (see below);
• GET /project-register.json: today's 404 "no project register", from openDox's own kickoff default;
• the chat rail's thread read, with the exact query the rail sends on opening a document (repository=fixture&ref=main&tile_kind=cluster&tile_id=barrel-rain&document=<member>, views/staging-workbench.js loadThread): the stated no-session absence. T095's AT-R1 harness found this site on openDox-code#75. A query-less GET stops at the 400 check first, which is why batch L's measurement missed it.

Composed in-process hosts take the chat turn and the document abstract past their early checks, to the scope step that dropped the connection. The answer is a refusal in the released envelope.

Before (a39e0201, the routing files at their pre-routing state), each of these fails with http.client.RemoteDisconnected: Remote end closed connection without response:

• the crash sites;
• the composed chat turn;
• the composed abstract;
• the host approval;
• the thread read.

Before, too, the standalone intake surface read offered: true. It now reads offered: false, with the reason (next section).

Model intake and approval (Brett Heap, 2026-10-02; 5961364221 item 1)

The enrolment ends in a recorded approval, a governed gate-action record that only a HOST's gate writes. With no host's gate registered (column_seams.gate_records_writable()):

• GET /workbench/model-intake answers offered: false with column_seams.GATE_RECORDS_REFUSAL as its reason, even beside a hand-written broker block;
• the intake act refuses with that sentence, before a broker is spawned or a declaration is written;
• so does the approval, before a record is built;
• each drains the body it was sent, so the refusal survives its transport.

The order is: no gate-record writer first, then no broker. A composed host that registers its gate is offered the flow, and its approval is recorded before the declarations document moves.

Mutants of the predicate killed: always true, 3 failed; always false, 2 failed.

Known, and out of this PR's scope:

• declared_model_port_factory serves only the FIRST approved binding (approved[0]).
• An approval's expires_at is recorded and not enforced.

The chat scope (5961651355)

tests/test_neutral_turn_scope.py (new) runs over a composed host: the plain fixture, a loopback bind, an authenticated actor, the binding opendox model-binding add declares, and the port the entry points declare over it. The host also has the released validators, as a plane with a readable contract has them.

• A turn over cluster barrel-rain's own document passes the guard and reaches the model step. It answers model_unavailable, because it names a model the catalog lacks, so nothing is spawned or contacted.
• A turn over a corpus document outside the tile is refused turn_scope_refused.
• Save is still the gate's: POST /actions/gate/first-edit answers unknown_action, and the record a Save writes is refused naming opendox.column_seams.gate.
• Standalone (case 4, a python -m opendox.serve child with a binding configured): the same turn passes the guard and reaches the model step, model_unavailable, with openDox's own validators (T085, merged in at 3387293e) and no stand-in. Until that merge the case asserted only a structured answer, as the holder accepted, and the merge commit narrowed it. tests/test_capability_honesty.py's standalone turn with a binding configured likewise now asserts the scope step's turn_scope_refused.

Before (the read-only default): 9 failed. The own-document turn answered 403 turn_scope_refused.

Mutants killed:

• widen the editable set to every corpus document: 7 failed;
• empty it: 9 failed;
• widen the tile itself to the corpus: 2 failed, including the outside-tile turn.

The content types

tests/test_static_content_types.py (new):

• under a hostile table (every guess text/plain), every bundle file keeps its pinned type;
• an extension outside the pin still reads the platform table;
• the pinned types are the standard library's built-in ones;
• every extension the bundle ships is pinned.

Mutant killed: drop the pin, 2 failed. Under the hostile table, index.html and every .js were served text/plain.

The suite

The whole suite, locally (LANG=C.UTF-8), at 213344ad: tests/ 3026 passed, 11 skipped, and tests_runtime/ 632 passed, 166 skipped. The skip count is unchanged from T073's. The database-backed cases skip locally without OPENDOX_TEST_DATABASE_URL. No new case skips, so EXPECT_SKIPPED does not move. As #67, #69 and #72 did, this PR does not edit validate.yml.

tests/test_consumer_reach.py keeps its direction census. Its CONVERTED_SITES guard is retired into tests/test_projection_seams.py's import-time rule, which now holds the column seams' proxies. opendox.consumer_reach leaves NEUTRAL_MODULES, the census "a removal from which has to be argued for". The argument: the module no longer exists.

Fix round 1 (b1db1965, Copilot's review at 897029d8)

• A seam registration with the names but not their shape is refused at registration (r4170607959, r4170608011). projection_seams._Seam gains an optional shape check, run after the name probe in register() and register_default().
  • column_seams.gate requires GateRefused to be an exception class, because openDox's verbs catch it.
  • column_seams.register requires CrossReferenceIndexAdapter to carry a callable discover, because branch_session calls it.
  • Mutant killed: skip the shape check, 2 failed.
• tests/test_column_seams.py's docstring now describes the scope default as the ruling made it (r4170608087).
• This body's crash-sites section now states the intake surface's before and after (r4170608052).

Fix round 2 (ff70ac1e, Copilot's review at 3387293e)

• A gate verb on the default gate is refused, not a traceback (r4170914922). openDox's own gate default refuses the governed GateConsole at construction, and cli._commission_cli built the console before its try. A contributed gate verb that reached the default with no host's gate registered therefore ended in an uncaught traceback. The console is now built inside the refusal boundary.
• tests/test_column_seams.py::test_a_gate_verb_on_the_default_gate_is_refused_not_a_traceback asserts exit status 1 and propose refused: ..., naming opendox.column_seams.gate.register(. Before (3387293e): an uncaught GateRecordsNotRegistered.

Fix round 3 (ebe0a35f, Copilot's review at 1d6a4f19)

• A group's edges name documents by id, and the scope projects them by path (r4171136778).
  • A group's document_edges[].document names a document by ID, and a selection's files by PATH (the snapshot schema's $defs/id and $defs/path). openDox's default scope looked every reference up as a path.
  • So a valid snapshot with id notes/soil-test and path notes/soil-test.md left every group and candidate member unresolved, with empty editable and context sets, and valid turns were refused.
  • The fix: default_columns._document_index maps each listed document's id, then its path, to the document's path, as openXdox's authority does. _section looks each reference up there, carries the document's path (confined to the root as before) and keeps the reference as the row's id.
  • A reference that no listed document answers stays unresolved under its own spelling, which must still be a safe path, so the confinement cases are unchanged.
• tests/test_column_seams.py::test_a_group_edge_names_its_document_by_id covers a snapshot whose ids differ from its paths. Before (b333bf16): failed, with editable_paths () where ('a.md', 'b.md') was expected. Mutant killed: references looked up as paths only, 1 failed.

Fix round 4 (1fb81cbd, Copilot's review at d556c3fb, the holder's ruling: ACCEPT both)

• A selection's files are paths and a group's edges are ids, looked up apart (r4173844321).
  • Fix round 3's index answered every reference id first, and it also served a selection's files, which are PATHS. The contract does not forbid one document's path from spelling another document's id.
  • _document_index now returns _DocumentIndex(ids, paths). ids (id first, then path) serves group edges and a candidate's claiming groups. paths (path only) serves a selection's files.
  • tests/test_column_seams.py::test_a_selection_file_is_a_path_where_it_spells_another_documents_id. Before (d556c3fb): failed, resolving to a.md where sel.md was expected. Mutants killed: the files looked up as ids (1 failed); the edges looked up as paths (2 failed).
  • openXdox's authority (openxdox/doxbench_scope.py) still answers a selection's files from its one id-first map. Whether it follows is outside this PR.
• The server's help names loopback as the default, not a promise (r4173844338): "on a loopback address unless --host names another", with no "locally". tests/test_installed_help.py::test_the_servers_help_states_loopback_as_the_default_bind. Before: failed. Mutant killed: the --host clause dropped, 1 failed.

Fix round 5 (213344ad, Copilot's review at 1fb81cbd, the holder's ruling: ACCEPT both)

• An in-root alias of a settings document is the settings document (r4173903232).
  • resolve_within follows a symlink to the canonical file, but a scope row keeps the spelling it was named by. So alias.md -> ideation/dashboard/model-provider-bindings.yaml, or a directory link on the way to one, stayed owned and editable, bypassing M1.
  • default_columns._settings_test(root) now compares the file a row REACHES with the files the settings documents reach. _without_settings moves such an alias, under its own name, into the settings section that nothing owns: readable, never editable.
  • tests/test_column_seams.py::test_an_in_root_alias_of_a_settings_document_is_never_editable tests a file alias and a directory alias. Before (1fb81cbd): 2 failed, e.g. ('a.md', 'b.md', 'alias.md') where ('a.md', 'b.md') was expected. Mutants killed: the target comparison dropped (2 failed); the alias compared by spelling (2 failed).
• The typeless package marker is set aside by its reason (the review's "previously missed" note on tests/test_static_content_types.py).
  • UNSHIPPED claimed the wheel leaves .gitkeep out, but since T075 it ships (web/**/.*). It is renamed TYPELESS_MARKERS: the shipped, empty, extensionless marker has no content type to pin.
  • test_the_set_aside_markers_are_empty_and_extensionless holds that reason. Mutant killed: the set widened to index.html (2 failed).

Adversarial review 2 (at b1db1965), folded in

Each item has a case that failed before its fix, and a mutant that fails it.

• M1, openDox's own settings documents are never a tile's editable material (5a3b51ee).
  • The model-provider bindings (doxbench_binding.DEFAULT_BINDINGS_RELPATH) and the model declarations (doxbench_intake.DEFAULT_DECLARATIONS_RELPATH) live in the checkout, so a tile can name them. Under 5961651355 a group listing one made it editable, and a turn's proposal could then rewrite which provider a chat talks to.
  • default_columns.SETTINGS_DOCUMENTS holds both. resolve_scope moves them out of every owned section into a trailing settings section that nothing owns, so they stay readable. editable_paths refuses them whatever section carries them.
  • The corpus scan's own exclusion (openDox-code#76) is a second layer, not the only one.
  • Before (1d6a4f19): 3 failed. Mutants killed: the function admits settings (1 failed); settings left in owned sections (2 failed).
• L1, an unknown tile_kind is a malformed request, never a dropped connection (278855d4). ScopeKey refuses one with a ValueError, which escaped three routes. Each now answers its fixed code:
  • the thread read: invalid_turn_request;
  • the document abstract: invalid_abstract_request;
  • the chat turn: invalid_turn_request, in the released envelope.
  • Before (5a3b51ee): 3 failed, each RemoteDisconnected.
• G7, generate-and-open removes the run directory it minted (5a9cb0d8).
  • With no --run-dir it minted ideation-dashboard-* and never removed it. Now it mints opendox-* (cli.RUN_DIR_PREFIX) and removes it when the run ends: a served run stopped by an interrupt (and, in a local install, by SIGTERM), a --no-serve run, a refusal, a failure.
  • A --run-dir the caller names is kept.
  • tests/test_run_dir_lifetime.py (new). Before (278855d4): 2 failed. Mutant killed: the minted directory kept, 2 failed.
  • Known Release 1 limit, accepted by the holder: a HOSTED run killed by SIGTERM leaves its opendox-* directory, because hosted mode installs no SIGTERM handler. A local run reads SIGTERM as an interrupt and cleans up.
• python -m opendox.serve --help names openDox only (6519660e). This is the same fix as opendox --help, for the server entry point's parser.
  • serve.SERVE_PROG = "python -m opendox.serve", and SERVE_DESCRIPTION is neutral.
  • Before (278855d4): 1 failed. Mutant killed: the prog reverted, 1 failed.
• Not here: M4 and L2, the DNS-rebinding Host check on every route, belong to T103, a new writer stacked on this PR. M2 is T081, 16.4: "no model configured" is a state, shown before any turn (plan 034) #74's writer's, and M3 is covered by the turn patch below.

Merges, done and ahead

• T085 (T085, the standalone doxBench defaults for T027's seams, and T058's two workbench rules move into opendox.validator (plan 034) #71), merged at 3387293e. It conflicted only where measured: cli.py and serve.py, at the four register_defaults() call sites and one import. Both sides are kept, T085's doxbench_defaults first and T084's column_seams after.
  • T084's own turn tests needed T082's patch, checked and not taken blind: the turns carry the schema-required last_assistant_turn_id, and _structured() reads the released failure envelope. Without it, both standalone turns failed with 400 invalid_turn_request.
• T088 (T088, the lens's two seed actions are offered only where a binding answers them (R1Q19 (a)) (plan 034) #65), merged at 3387293e, with the ruled one-line edit in tests/test_lens_seed_actions.py: capabilities["actions"]["gate"] is False in both runs, with the identity asserted on the resolved actor field.
• T070 (T070, 13.4-13.6: OPENDOX_INSTALL_MODE and generate-and-open --local (plan 034) #67), T079 (T079, 16.2: a model field the provider receives (plan 034) #62) and T081 (T081, 16.4: "no model configured" is a state, shown before any turn (plan 034) #74), merged at b333bf16 through stack A's merges of main and T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72's merges of T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69.
  • T081's hoisted no-model refusal and this task's scope seam sit two unchanged lines apart in the chat turn, and both are kept.
  • T082's second patch, which moves tests/test_chat_model_configuration.py's openxdox stand-in to a scope authority registered at opendox.column_seams.scope (restoring the seam's state exactly), no longer applied once the landed file had moved. It is applied by hand and checked: before, 4 failed and 45 passed; after, 49 passed.
• T073 (T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72), its final pre-squash head 93f77dc1, merged at 7536bfe2, a plain merge with no conflict. It brings T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's final rounds (17, 18a and 18b, through bc85f214), main 5e7ab003 (T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's squash, merged on T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72 with merge-tree --merge-base c04690f8), and T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72's Copilot fix round (BundledServer.report() reads the process once).
• main 90ac7033 (T073, 13.4a — /capabilities gains an install block, read from the serving process's own settings (plan 034) #72's squash), merged at d556c3fb with git merge-tree --write-tree --merge-base 93f77dc1, recording both parents (7536bfe2, 90ac7033), with no conflict. It brings T075 (T075, 10.2 and 10.2a — an installed entry point serves all 42 bundle files; intent-feed.js is not owed (plan 034) #73) and the broker-path hardening (Broker-path credential hardening (follows T080): a minted token keeps a built-in credential's rules (plan 034) #64), whose doxbench_binding.py and doxbench_provider.py changes merge clean with T084's. The F4.1 scan stays clean.

Holder readings in this PR (Brett may overrule)

• The gate default: primitives as real code, governed record functions refused by name, (B).
• kickoff and register: answer nothing, and /project-register.json keeps its 404.
• hosted_ref_refused stays serve.py's own.
• The content-type pin is the holder's addition for 10.2.
• The neutral opendox --help is the holder's addition, from T099's finding.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

A symlink alias can bypass the new protection that keeps model settings documents out of editable scope.

Review effort: Balanced
Findings: 1

Open (1)

• Symlink aliases can bypass protected settings-document checks · New

Resolved since last review (2)

• Use separate lookups for document IDs and file paths
• Clarify loopback host is the default, not an invariant

Previously missed (1)

In code that hasn't changed since last review

Rename inaccurate .gitkeep exclusion and UNSHIPPED statement

tests/​test_static_content_types.py:46

.gitkeep is now shipped by pyproject.toml via web/**/.*, so UNSHIPPED and the accompanying statement are inaccurate. Rename this exclusion to describe why the shipped, extensionless package marker is outside the content-type checks; otherwise the tests misleadingly claim to enumerate every shipped bundle file.

[sonarqubecloud]

Quality Gate passed

Issues
39 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.3% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot review overview

🔵 Needs a closer look

It changes cross-leg composition, authorization-adjacent scope behavior, routing, and server lifecycle across 28 files, requiring final human validation of host integration.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Symlink aliases can bypass protected settings-document checks

[brettheap]

READY at 213344a — phase 3 is open (T063 landed, #1218 → a883bbf6); T073 landed (#72 → 90ac703). The holder checked: validate, SonarCloud and Copilot's check succeeded; Copilot's latest review at exactly 213344a is "Needs a closer look" with Findings: None, asking for a human check of the host integration; 0 unresolved threads; no closing keywords in the body or any commit.

The holder's host-integration judgement: landing T084 on openDox-code main changes no consumer, because openXdox and openxFactory each move their openDox pin only in their own tasks. Retiring the last deferred reaches breaks what those consumers bind (openXdox-code's route handlers, a RouteBindingError, and openxFactory's host wiring) only at those pin moves. T086 (openXdox-code#37, DRAFT-CLEAN against this stack: GateRoutes and ProjectionRoutes under HANDLER_CONTRIBUTIONS, column_contributions at T084's four seams) and T094 (prep done; 65 simulation failures, all owned) carry it. Fix rounds 4–5 close the id-versus-path lookup, the loopback wording, the symlink alias of a settings document, and the TYPELESS_MARKERS reason.

#77 contains #72's final pre-squash head 93f77dc and main 90ac703 (merge-tree --merge-base 93f77dc); its diff against main is T084's own files. Dependents #80 (T103) and #81 (T102) are retargeted to main and are not READY. Brett: draft phase 3 ahead, land in plan order when green.

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

[sourcery-ai]

Sorry @brettheap, your pull request is larger than the review limit of 150,000 diff characters

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

LANDED — lane openxfactory-4, 2026-10-03T18:33:06Z, PR #77 → e49b17c (opensoft/openDox-code main; plain gate)

Brett: land phase 1 / phase 2 PRs when green