fix(headless): record OpenCode prompt provenance accurately

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.

[AlvaroBalbin]

This is a small, targeted change to packages/headless/harbor/opencode_agent.py, .../headless/src/tests/cell-output.test.ts, .../src/tests/fixed-prompt-controller.test.ts, .../headless/src/tests/harbor-adapter.test.ts and a few others that resolves the reported issue without touching anything unrelated.

The repo's own CI runs green on this branch; I ran it on my fork before opening this.

Fixes#1563.

[Astro-Han]

Reviewed the current head. OpenCode execution identity now comes from the verified toolchain fingerprint, while Maka-owned prompt hashes stay separate. The validation and legacy decoding paths are consistent, and the focused checks pass. I found no issues in the patch.

The branch currently conflicts with main, so the resolved head will need another review.

[Astro-Han]

Review: Approve (with comments)

The seam choice is right: producer (opencode_agent.py), validator (cell-output.ts), and controller (fixed-prompt-controller.ts) move together, and the resulting identity states the model-visible truth — the prompt is owned by the harness and identified by the pinned toolchain fingerprint. The Python-side prompt-invariance test pins the exact repro from #1563. Approving, with a few non-blocking comments below.

1. The new schema comment codifies the original falsehood for legacy artifacts.cell-output.ts says of absent systemPromptAuthority: "artifacts written before harness-owned prompts were recorded, which are Maka-injected." That claim is false for exactly the artifacts this PR is about: pre-fix OpenCode cells have no authority, do carry a systemPromptHash, and were not Maka-injected. The else branch in the validator likewise conflates "absent" with 'maka'. Suggest stating the absent semantics as unknown / pre-audit rather than asserting something we know is untrue — truthful provenance is the point of this PR.

2. The harness-native skip in classifyExecutionIdentityFailure is untested and leaves the cohort hole half-closed. Skipping the prompt-hash comparison for harness-native cells is correct, but (a) nothing pins this deliberate relaxation — a test where the round prompt mismatches and a harness-native cell is still accepted would lock it in; (b) systemPromptToolchain is never compared against an expected fingerprint, so a cell run with the wrong pinned toolchain passes identity checks. Fine as a follow-up, but worth an explicit test + a tracking note now.

3. 'maka' has no producer. Neither maka_agent.py nor the harbor-cli.ts path emits systemPromptAuthority, so the enum value exists only in the validator. Either emit it from the Maka paths (self-describing, and it is exactly what a future crossed prompt-injection ablation would need), or drop it and make "absent means Maka-owned" the single semantic. The current middle state buys a mutual-exclusion branch that nothing exercises.

4. or "unpinned" weakens the invariant the validator just established.install() already raises when MAKA_OPENCODE_TOOLCHAIN_FINGERPRINT is missing, so the fallback is unreachable in practice — and if it ever did fire, the literal string "unpinned" would satisfy systemPromptToolchain must pin the harness build. Prefer dropping the fallback and letting the Python side fail loud.

5. Cell-level promptHash semantics deserve one line of documentation. Keeping _round_prompt_hash() at the cell level is correct — attestedPromptHash → eventMatchesResumeIdentity depends on it, and it attests round membership rather than model-visible bytes. But HarborCellOutput.promptHash doesn't say that, so a downstream reader can repeat the #1563 misreading one field level up. A short comment fixes it.

None of these change behavior; 1, 3, and 4 are small deletions/edits, 2 and 5 are test/comment additions.

[AlvaroBalbin]

Closing this. packages/headless was replaced wholesale by the minimal Eval kernel in #2605, so all six files here are gone from main and #1563 is closed as completed.

The provenance point survives in the new design anyway: packages/eval/src/toolchain-verification.ts pins a per-profile toolchain fingerprint, and external-subject.ts refuses to execute a cell whose toolchain was not verified first. That is the identity this patch was trying to record instead of a Maka owned prompt hash, and it also closes the gap from review point 2, where systemPromptToolchain was never compared against an expected fingerprint.

Nothing worth rebasing onto the new kernel. Thanks @Astro-Han for the two reviews.