Private Dependency-Fault Harness

The #662 groundwork is a private, injected harness. Finite response fields are not registered in public eval/runtime configuration. It does not add automatic retries, a recovery verdict or resumed SDK attempt ownership. Existing repeating CLI/MCP mocks, responders, defaults and task command_mocks: [] replacement remain unchanged.

Source admission and custody

Canonical eval/task parsers retain immutable, nonserialized source bytes before prompt-file resolution or eager grader decoding. Preflight parses the same bytes it inspected, not a second read of a mutable file. Selected mock fragments preserve aliases, native merge precedence, scalar tags and duplicate fields. Returned payload properties are not reinterpreted as mock configuration.

Private finite fragments require explicit scenario schemaVersion: "2.0" and a nonempty scenario. Standalone task validation establishes shape only and still rejects otherwise-valid finite task declarations as unregistered. Mixed legacy outputs reject even when empty, zero or null. Empty/nested sequences, nested matchers, duplicate finite fields, float-tagged integer fields and invalid delays fail explicitly before resource decoding.

MCP source validation explicitly uses the offline schema loader. External file and HTTP schema references are refused without fetching; inert returned $ref payloads remain data. Legacy runtime resource loading is unchanged. External MCP source resolution reads each selected file once and preserves whole-tool replacement and lexical overwrite order.

Allocation, delivery and cancellation

Private adapters consume a matching finite step irreversibly before delay or delivery. Cancellation before allocation consumes nothing. Interruption or failed delivery after allocation cannot roll a step back. Unmatched calls and exhaustion fail loudly without trying a live dependency or a later matcher. A fresh private root resets state; changing an active configuration does not. Unique concurrent allocations do not guarantee delivery order or crash durability.

Injected CLI dispatch publishes a receipt only after complete stdout/stderr emission. Attempts and delivered receipts are separate; missing or corrupt capture returns an error rather than inventing exit zero. JSON-RPC short writes fail. Retained, repeated or concurrent delivery callbacks reject.

Private owned MCP serving requires explicit positive worker capacity. Duplicate active native IDs and capacity overflow reject before preparation. Native cancellation closes owned interruptible endpoints and joins workers/readers without a fabricated cancellation response. EOF stops admission and drains accepted calls while root-cancellation supervision remains active.

The caller must supply distinct endpoints whose concurrent close promptly interrupts I/O. Detectable aliases reject before ownership transfer; hidden aliases and arbitrary closer behavior cannot be certified. A completed native write cannot be retracted.

Platform and evidence boundaries

Boundary	Published groundwork	Not established
Darwin/Linux/Windows	Private reservation, source and injected native tests.	Public finite serving or platform process-pipe cancellation.
Owned cancellation	Bounded cooperative callbacks and caller-owned interruptible endpoints.	Guarantees for regular files, terminals or arbitrary closers.
Captured receipt	Actual array ordinal, full eval/task/run/attempt origin and verified entire artifact content.	SDK-to-MCP identity association, complete capture, authentication or external integration.

Responder metadata is not integration proof. CLI shims are not filesystem or network sandboxing. A malformed application payload is not broken JSON-RPC transport. Deterministic dependency steps do not make a stochastic agent deterministic.

Offline test coverage

These package tests exercise finite faults, allocation, cancellation, reset, concurrency, legacy preservation, source ownership and redaction without a live provider or service credentials:

ENABLE_COPILOT_TESTS=false ENABLE_LIVE_INTEGRATION_TESTS=false NO_COLOR=1 go test \
  ./internal/faultsequence ./internal/faultfixture \
  ./internal/commandmock ./internal/mcpmock ./internal/jsonrpc ./internal/models

Disable Copilot SDK tests and live integration tests separately; the live integration switch does not disable Copilot SDK tests. Use the existing offline provider-CLI rejection guard when validating. Platform test results must be recorded separately; cross-compilation is not execution. The compatibility corpus remains the broader preservation gate. There is intentionally no runnable public finite recovery example or new dashboard result metadata at this delivery stage.