AOCI-CODE v0.1.0-rc21

AOCI-CODE v0.1.0-rc21 is built from cfa8e93ca9fe546a375f48b41b3d4766ed98b013.

Eight user reports, four contributed pull requests, and a test-system
upgrade: Volume removal keyed on the object's path, a Ledger that survives a
damaged line, activation that answers already_aligned, governed writes on
WSL DrvFs, MySQL 5.7.6 and later, localized refusals, private host-config
backups with a guarded status page, and a command tree that starts in
milliseconds instead of half a second.

• Backups written beside host configuration and formal assets are owner-only.
  The optional model client refuses redirects and credential-bearing base
  URLs, keeps a caller-owned HTTP client's own redirect policy, and reports
  the status, the category, and a sanitized cause class (dns, refused, tls,
  timeout, redirect) without the endpoint's error body or the transport
  cause. No MCP or formal-asset schema changes.
• The loopback status page protects repository data with a per-process
  capability carried in the readiness URL fragment and sent by the browser
  in Authorization headers. The static shell contains no capability or
  repository data, and a page opened without the fragment says which link
  to open instead of rendering empty. Registrations keep their existing
  shape; a tokenless page from an older binary can be stopped but is refused
  by a new start, foreground or detached, until aoci ui --stop ends it.
• An out-of-band edit to a formal Volume under Managed Scope still fails
  closed with managed_scope_formal_volume_baseline_drift, and the refusal
  now says how to recover: preserve the state, check pending Recovery through
  the Guide, restore a verified matching snapshot when there is none, and
  never edit Baseline hashes. The Legacy baseline scope refusal names the
  same route, and docs/troubleshooting.md gains the section (#123).
• A Codex config declaring [mcp_servers."aoci"] or [mcp_servers.'aoci']
  was reported as not installed and then given a duplicate bare table. The
  installer and the status predicate recognize the quoted spellings, optional
  whitespace, and a trailing comment, and leave such a config byte-for-byte
  unchanged.
• Every aoci invocation built its command tree by decoding the embedded
  localization manifest once per localized flag, several hundred times, about
  half a second before the first byte of output. The decoded manifest is now
  memoized once per process and the message reverse index is built once, so a
  config get answers in a few milliseconds; human output is byte-identical,
  pinned by the init, Guide, and help goldens.
• Fuzzing the parsers that consume external bytes found and fixed four
  defects: an index warning could carry invalid UTF-8 into Findings and JSON;
  a line whose name is only Unicode whitespace lexed as an Entry with an empty
  name; an Attestation that repeated a challenge ordinal was scored every time
  it appeared; and ./C:/x passed the drive-letter refusal of path
  normalization. The carried openGauss connector panicked on a quoted
  connection-string value ending in a backslash, from every parser entry
  point; the canonical patch now refuses it and internal/dbevidence also
  recovers at its boundary.
• Tests: internal/cli tests run through the per-invocation executor instead
  of package globals, so the package is order-independent (-shuffle) and
  runs in seconds; internal/testkit holds the shared fixture, git, locale
  and stdout helpers. Fault-injection tests cover the CAS rollback and
  recovery states, the directory lock fallback, immutable archives, zero-write
  closures, receipt storage, the Migration and Bootstrap codecs, replay
  mismatches and safety approvals; make coverage-floors enforces per-package
  statement-coverage floors for the safety core in full-confidence. Eleven
  native fuzz targets with seed corpora run under make fuzz-smoke nightly.
• Black box: conformance repeats its locale-dependent checks under zh-CN (53
  checks); scenarios gain group H for the pre-write hook and --group/--list
  (75 scenarios); lifecycle bring-up covers git submodules, the
  exclude_root_dirs roles, remove-entry, the machine documents, and a
  zh-CN twin lane. The upgrade axis gains a downgrade shape, in which every
  earlier release reads a repository the binary under test wrote (80 checks
  per release over ten shapes), --self runs the candidate as both the
  released and the under-test binary before a tag exists (make axis-self,
  also in make verify and the release rehearsal), and --recent N layers
  CI: a push runs the newest three releases, the nightly run every release.
  The real-repository harness is tracked as scripts/blackbox/realrepo.py.
• scripts/blackbox/ladder.json registers every test contract that must be
  run by name, with cadence, preconditions, and the last verification on
  record; make verify ends by listing what is overdue and make ladder
  prints it on demand.
• Nightly gates: the long-running cognition refresh harness runs again
  (make longrun-refresh; it had drifted from the Attestation schema and the
  repair finding shape since August), the seven first-party benchmarks are
  compared against an advisory baseline (scripts/bench-compare.py, a
  warning annotation above 30 percent, results uploaded as an artifact), the
  carried connector's own test suite runs against the openGauss container as
  an advisory step (300 pass, one server-behaviour difference on year-zero
  dates), and the page JavaScript tests get an explicit Node 22.
• Removing a Code Entry keys on the object's path, so an orphan whose Entry
  line is byte-identical to a line in another directory section (a staged
  copy of the same file) goes while its live twin stays; the line-keyed
  remover refused both as duplicates, and three such orphans held a
  1,400-target authoring debt behind write_conflict (#117). A plain
  repository-relative path under Volumes v1 names code:<path> and reaches
  the Volume pipeline instead of the Legacy loader's volume_read_only
  (#112); while a Managed Scope edit is pending, the orphan refusal says
  scope_change_required and names aoci scope activate --json, since
  orphan proof follows the active Baseline. The remove-entry help states that
  Volumes removal is orphan-only on both surfaces.
• A Volumes removal that had written the Volume and the Baseline but could
  not complete its Ledger event left a receipt nothing could close and
  remove_ledger_completion_failed carried no reason (#121). A Ledger line
  that does not decode is now skipped by the terminal-event check, a line
  over 1 MiB counts as one corrupt line instead of ending the read, the
  failure names its cause, and a disabled Ledger is refused before anything
  is written.
• aoci scope activate reports already_aligned with exit status 0 and
  records no transaction when the desired policy, budget, and authorization
  posture already equal the active receipt and nothing would move; it used
  to file a zero-change transaction and report it as "applied" (#113).
  scope status and scope show carry repository_root.
• When a Volumes v1 policy edit blocks aoci_maintain, next_commands and
  the Volumes Guide name scope activate --json beside scope status --json
  instead of looping between status and Maintain (#118; contributed by
  dayebishouji in PR #119).
• Twenty-six CLI commands rendered their English short description under
  every locale because the hand-kept localization map had no entry for them
  (scope budget and its subcommands, observe-policy, approval-mode,
  authorize, source, capabilities, cognition onboard, baseline scope); all are mapped, and a test walks the visible tree under zh-CN.
  The PreToolUse hook injected hardcoded Chinese text into every host; its
  six texts now come from the UI catalog in both locales, byte-identical
  under zh-CN.
• repair_required findings about an object that does not exist, or already
  exists, rendered "Repair only the reported of this candidate"; each now
  has its own action naming the identity and the create/update alternative,
  and no field-less finding renders a blank.
• Governed CAS writes work on filesystems that refuse RENAME_EXCHANGE,
  such as WSL DrvFs (/mnt/*, 9p), where every Entry batch and Managed Scope
  write failed with "原子交换目标失败: invalid argument" while init and
  scan worked (#116). The primitive is probed and, when refused, emulated
  with a hard link and two renames that end in the primitive's exact
  post-state; crash states converge through the existing recovery. On such
  a filesystem the replacement window is link-to-rename rather than zero: a
  writer outside aoci that replaces the target by rename in that instant is
  overwritten rather than detected, while in-place modification is still
  caught; every aoci writer is serialized by the CAS lock. Verified on a real
  DrvFs mount.
• Strict decoders of governance and protocol artifacts (receipts, run
  manifests, previews, checkpoints, onboarding sessions, Curation documents,
  Host-Agent stage requests) reject two keys that differ only by letter case:
  encoding/json matches struct fields case-insensitively, so
  {"path":"a","Path":"b"} passed the exact duplicate-key check and decoded
  last-wins without an error. Callers that decode user-owned maps, such as
  the OpenCode configuration, keep the exact check, where differently cased
  keys are distinct by design. The new scanner has its own fuzz target under
  make fuzz-smoke.
• Database Evidence collects MySQL 5.7.6 and later (#111). The collector
  reads the server version and runs only the catalog queries that release can
  answer: CHECK constraints from 8.0.16, index expressions from 8.0.13, index
  visibility from 8.0.0; a 5.7 server records an empty check list, since 5.7
  parses CHECK syntax and stores nothing, and canonical Evidence keeps one
  shape on every supported release. A server below 5.7.6, an unreadable
  version, or MariaDB fails closed with unsupported_catalog_feature before
  any table query. The full-confidence MySQL job runs both mysql:5.7 and
  mysql:8.4, each followed by the black-box database lifecycle, and
  mcp_lifecycle.py --mysql-image mysql:5.7 maps the two 8.0-only statements
  of the frozen fixture to their 5.7 shape in memory.
• A refused repository path (empty, absolute, drive, UNC, no target, or a
  .. escape) is reported in the active locale on the hook, the remove,
  update, report, and read faces instead of as a Chinese sentence that the
  en-US filter reduced to "non-localized diagnostic"; the refusals are
  sentinel errors with machine-token text, and a UNC path is named as such
  rather than as an absolute path. On a 9p mount (WSL DrvFs) an owner file
  that vanished between open and fstat failed lock acquisition under
  contention with "读取锁owner身份失败"; it now reads as a release and the
  acquisition retries, verified on a real DrvFs mount. The MySQL index
  projections for 8.0.0–8.0.12 and 8.0.13–8.0.15 were exercised against
  mysql:8.0.12 and mysql:8.0.15 through the database lifecycle suite.

See docs/install.md and docs/supply-chain.md for asset verification.