feat(prime): verify managed distributions

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes#193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−8 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−8 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.7 KiB	58.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+13 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+7 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 03defac · PR result: 29a5a34 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.