fix: supersede client delivery assurance chain

[agentik-os]

Scope

Supersedes the previously merged delivery-assurance line with the exact reviewed chain:

• e2fb9b99fde03f12e766ede8d3136ae418848196
• b2c822db6d3b009fee33e2e5fe3b20567c6601f6
• 0d72f726af61222d2a09a6a306e46526ddcac004

Verification

• Full source suite at exact tip: 139 passed in 7.60s
• Focused delivery/security gates: 8 passed, 37 deselected
• Local isolated CLI canary: exact four viewports, strict browser principal/probe policy, production hard block, and no run artifact after rejection
• git diff --check and Python compile checks pass
• No client credentials used

Safety

The previous remote branch tip cf2fce991dab04920c5c224205fd5a89c8864d73 is preserved at backup/feat-client-delivery-assurance-cf2fce9-20260827.

Draft remains pending final independent review and CI.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agentik-os]

Operator independent review: BLOCKED

Exact head reviewed: 0d72f726af61222d2a09a6a306e46526ddcac004.

Blocking findings

1. Viewport enforcement trusts mutable metadata (scripts/client_control.py:2649-2705). The code verifies screenshot digest, but compares required dimensions only to stored width/height; it never compares decoded image dimensions from client_evidence_artifact() to those claims. Independent runtime probe accepted four required viewport records backed by the same actual 1x1 PNG.

2. Browser principal/probe is not bound to the browser execution (scripts/client_control.py:2577-2638, 2778-2822). verify_browser_session() proves only session/time/URL browser tool activity. Principal and probe come from the report and static runtime profile, not from the recorded browser tool execution, so equality to config is not proof of the executing authenticated principal.

3. Linear attachment metadata is not revalidated on readback (scripts/client_control.py:1378+). update_evidence() validates new CLI input, but a persisted work record containing an empty title, overlong subtitle, and javascript: URL was accepted by linear_sync_plan(). Material gates must validate persisted metadata at use/readback, not only at ingestion.

4. Integration boundary: GitHub reports this PR CONFLICTING / DIRTY against main, which already contains the previously merged divergent cf2fce9 line. Rebasing or merging would violate the requested exact chain, so Operator did not alter history.

Green evidence that does not override blockers

• ./scripts/test.sh: Rust 86 + 26 PASS; Python 139 PASS; web 15 PASS; typecheck/build PASS; npm audit 0 vulnerabilities.
• Focused delivery/security suite: 8 PASS.
• Isolated CLI canary: four configured viewports present; production hard block PASS; no run artifact created.
• Exact branch SHA readback PASS; no client credentials used.

Verdict: BLOCKED. Keep draft. Do not merge or deploy this exact chain until the three logic defects are fixed in a new reviewed commit and the divergent-main integration strategy is explicitly resolved.