Repair packaged first run and add Windows validation

.gitattributes

@@ -1,3 +1,4 @@
 * -text
 # Preserve the existing byte policy; recognize CRLF as valid in this new revision.
 /distribution/agentic-engineering-os-2026.10.09-public.2/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+/distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol

.github/workflows/validate.yml

@@ -0,0 +1,29 @@
+name: Windows package validation
+on:
+  push:
+    branches: [main, 'fix/audit-20261012-aeos*']
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: aeos-package-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  package:
+    name: Package validation (Windows CPython 3.14.5)
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.14.5'
+      - name: Extracted package, documented first run, 86 regressions and boundaries
+        run: |
+          # Hosted TEMP can use an 8.3 alias; keep fixture roots canonical.
+          $runnerTemp = python -B -c "import os; from pathlib import Path; print(Path(os.environ['RUNNER_TEMP']).resolve(strict=True))"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $env:TEMP = $runnerTemp
+          $env:TMP = $runnerTemp
+          python -B scripts/validate_candidate.py

README.md

@@ -33,3 +33,17 @@ This is a public source preview, not a paid product release. Pricing, commercial
 Created by Zachary Hatch. Copyright (c) 2026 Zachary Hatch. All rights reserved.
 
 See [LICENSE](LICENSE) for the copyright and rights notice. Source credits identify influences and separately installed third-party dependencies; they do not transfer authorship of AEOS or imply endorsement.
+
+## Unpublished first-run repair candidate
+
+The historical download above remains public.2. Its bundled FIRST_RUN has a known relative-output defect. A new [candidate archive](distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1.zip) and [instructions](distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1/FIRST_RUN.md) are prepared for review; publication remains owner-controlled. Extract the candidate into a new folder and run:
+
+```powershell
+python -m venv ../aeos-env
+../aeos-env/Scripts/python -m pip install -r requirements.txt
+../aeos-env/Scripts/python -B scripts/check_package.py .
+$demoOutput = [System.IO.Path]::GetFullPath((Join-Path $PWD.Path '../aeos-first-run'))
+../aeos-env/Scripts/python -B scripts/demo.py --output $demoOutput
+```
+
+The same absolute-output workaround works with public.2. See [candidate verification and CI](docs/PACKAGE-CANDIDATE.md) for exact checks, preserved histories and remaining gates.

distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1.sha256.json

@@ -0,0 +1,9 @@
+{
+  "version": "2026.10.12-public.4-candidate.1",
+  "status": "UNPUBLISHED_REVIEW_CANDIDATE",
+  "archive": "agentic-engineering-os-2026.10.12-public.4-candidate.1.zip",
+  "sha256": "ac884a1173a75e36e5f419abf6c788c502d86048223a8a4127b3faf5c75b6c56",
+  "bytes": 95878,
+  "manifest_sha256": "72a98770d3ab014058bd6b636225b17ff41816c5be50cf431a756823b905e815",
+  "payload_files": 41
+}

distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1/ARCHITECTURE.md

@@ -0,0 +1,96 @@
+# AEOS — architecture and usage
+
+AEOS coordinates project knowledge, bounded context, work, evidence and controlled knowledge updates through saved files and local commands. An operator and assistant follow the documented workflow; the preview does not install an autonomous execution service.
+
+This page describes the public setup package, not the creator's personal operating vault. File links below target the current candidate [public.2 package](README.md). Historical public.1 remains a separate, frozen revision.
+
+## How the components connect
+
+Solid arrows represent a file input/output or check implemented by a CLI. Dashed arrows represent an operator/assistant action. Neither style implies a background integration.
+
+```mermaid
+flowchart TD
+    U["Operator + file-capable assistant"] -. "read" .-> R["AGENTS.md → Session Router"]
+    R -. "named project" .-> P["Project Index / State / Next Actions"]
+    R -. "choosing work" .-> Q["Global Next Action Queue"]
+    Q -. "select project" .-> P
+    P --> S["Packet scaffolder"]
+    S --> T["Draft task packet"]
+    U -. "fill scope, checks and authorization" .-> T
+    P -. "select relevant files" .-> C["Explicit context file list"]
+    G["Gold: current research / project notes"] -. "select relevant files" .-> C
+    T --> B["handoff.py build"]
+    C --> B
+    B --> H["Saved bundle: brief + snapshots + hashes + result template"]
+    H --> K["handoff.py check: current sources and bundle integrity"]
+    K -. "copy / give files manually" .-> A["Assistant in its own execution environment"]
+    A -. "authorized task only" .-> X["Tools + named project repository"]
+    X -. "capture actual results" .-> E["worker_result.json + artifacts + checks"]
+    E --> V["validate-result / review / optional complete"]
+    H --> V
+    P --> V
+    V -. "inspect candidate" .-> J["Independent review when required + applicable owner gates"]
+    J -. "controller: authorized factual writeback" .-> P
+    J -. "possible knowledge candidate" .-> L["Librarian propose / verify"]
+    F["Selected source file"] --> I["Librarian ingest"]
+    I --> BR["Bronze source bytes + provenance registry"]
+    BR --> L
+    N["Human / assistant-authored candidate text"] --> L
+    L --> SI["Silver proposal + payload + full diff + checks"]
+    SI -. "owner records exact decision" .-> O["Approved verified proposal + exact Git checkpoint"]
+    O --> AP["Librarian apply --dry-run / apply"]
+    AP --> G
+    SI -. "pending / revise / reject: no Gold write" .-> U
+    V -. "missing / stale / invalid: inspect and rebuild" .-> U
+```
+
+Project writeback and Librarian Gold application are different operations. `proposed_writeback` in a worker result is a suggestion; the handoff adapter never applies it. Librarian verification never supplies owner approval. A passed structural check is not independent review or permission to execute.
+
+## Component contracts
+
+Paths are relative to the package's `vault/`, except package scripts and adapter configuration.
+
+| Component | What goes in → what comes out | How it is used / current status |
+|---|---|---|
+| [Router](vault/00_SYSTEM/SESSION_START_ROUTER.md) | Named task or broad intent → minimum records to read | **Manual / assistant-invoked:** read `AGENTS.md`, then the router. It is Markdown guidance, not a routing process. |
+| [Queue](vault/00_SYSTEM/GLOBAL_NEXT_ACTION_QUEUE.md) and [project records](vault/01_PROJECTS/Sample/PROJECT_INDEX.md) | Priority, scope, state, locks and next actions → selected work and current facts | **Manual:** use the queue to choose among projects; for a named project, read its Index, State and Next Actions directly. No mandatory dashboard hop. |
+| Vault / knowledge notes | Source evidence and reviewed facts → selected context files | **Manual retrieval:** read relevant files and cite their provenance. The preview ships no Wiki search service, vector database or automatic ingestion from URLs. |
+| [Packet scaffolder](vault/09_TOOLS/agent_runner_v1/scripts/build_task_packet.py) | Project records + goal → draft `task_packet.md` | **CLI:** `build_task_packet.py`. Operator fills allowed reads/writes, acceptance checks and actual authorization. A draft is not approval. |
+| [Handoff adapter](vault/09_TOOLS/agent_runner_v1/unified_handoff/handoff.py) | Packet + explicit `--read` selections → bounded copied brief, snapshots, manifest and result template | **CLI:** `build`, `check`, `validate-result`, `review`; `complete` also checks actual scoped changes and rationale. The bundle lives outside the source vault. |
+| [Assistant adapters](config/adapters.json) | Reviewed bundle → actual task result and evidence | **Manual transport:** hand the selected files to your assistant and bring its result back. Configuration describes transports; it does not authenticate providers, launch Codex/Astra or confer permissions. |
+| Verification / continuity | Source hashes, returned result and artifact hashes → candidate validity, current/stale/missing observations and next action | **CLI + human review:** `check` before handoff; `validate-result` and `review` after return. Independent review and owner gates are separate. Fresh sessions read saved files and rerun `review`. |
+| [Librarian](vault/00_SYSTEM/AGENTIC_LIBRARIAN/README.md) | Source bytes + provenance + authored candidate → Bronze, pending Silver, then conditionally Gold | **CLI:** `ingest`, `propose`, `verify`, `inbox`, `apply`, `doctor`, `rollback`. Gold requires an exact owner decision, fresh verified evidence and a covered clean Git checkpoint. The demo stops at pending Silver. |
+| [Kernel ledger](vault/kernel/artifact_ledger.py) | Librarian events → local evidence records | **Invoked by Librarian:** records events; it is not an execution scheduler or a tamper-proof audit service. |
+| [Package checker / demo](scripts/demo.py) | Manifested package + synthetic source → demonstration result, saved commands and continuation files | **CLI:** explicit first-run action. Deterministic Python performs the example; no model, independent reviewer or owner approval is simulated. |
+
+## Plan → Retrieve → Execute → Verify → Learn
+
+```mermaid
+flowchart LR
+    P["Plan<br/>Read project facts<br/>Fill bounded packet"] --> R["Retrieve<br/>Select cited files<br/>Build + check bundle"]
+    R -. "manual assistant handoff" .-> E["Execute<br/>Authorized task<br/>Return result + evidence"]
+    E --> V["Verify<br/>Check result + live sources<br/>Independent review when required"]
+    V -. "authorized controller writeback" .-> L["Learn<br/>Update project facts<br/>Propose knowledge separately"]
+    L -. "next session reads saved records" .-> P
+```
+
+To try the implemented flow, follow [FIRST_RUN.md](FIRST_RUN.md). After installing its prerequisites, from a fresh extraction:
+
+```powershell
+python -B scripts/check_package.py .
+python -B scripts/demo.py --output ../aeos-first-run
+```
+
+Open `../aeos-first-run/START_HERE.md`. The demo ingests a synthetic source, verifies a pending Silver proposal, selects that evidence into a handoff, counts two checked items and saves a candidate result. It then demonstrates refusal of changed and missing sources and restores the synthetic fixture. From the output directory, a fresh process can recover the same candidate:
+
+```powershell
+python -B vault/09_TOOLS/agent_runner_v1/unified_handoff/handoff.py review --bundle handoff --vault-root vault
+```
+
+For real work, scaffold a packet in your own new vault using the first-run instructions. Give only the approved packet and selected context to an assistant. Return `worker_result.json` and its artifacts, run the documented checks, obtain required independent review and perform only authorized writeback. Contradictory facts require operator reconciliation; a script does not decide which claim is true. Missing evidence stays unknown; stale hashes require inspection and a new authorized bundle, not edited hashes.
+
+## Influences and limits
+
+**ICM** means Interpretable Context Methodology in the recorded [source credits](SOURCES.md). It informs layered files and selective context. It is not a separate runtime between retrieval and execution. Karpathy's **LLM Wiki** informs source-backed notes and compiled knowledge; the local Librarian implements the explicit Bronze/Silver/owner/Gold workflow. It does not install Karpathy's gist or a Wiki connector.
+
+The public preview includes a queue and project templates, but no Operator Dashboard application, MAPS view, general Resume/Restore engine, native sandbox, hosted service, automatic model dispatch or authenticated owner-approval service. Do not infer those features from the creator's personal OS or a conceptual diagram. Refer to the [security repair evidence](SECURITY-REPAIRS.md) for the current candidate's checks and remaining limits; historical acceptance and an archive's existence are not proof a future installation is safe.

distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1/FIRST_RUN.md

@@ -0,0 +1,51 @@
+# First run
+
+Extract the archive into a new folder outside any existing vault. Open PowerShell in the extracted folder. Use your installed CPython 3.14.5.
+
+```powershell
+python -m venv ../aeos-env
+../aeos-env/Scripts/python -m pip install -r requirements.txt
+../aeos-env/Scripts/python -B scripts/check_package.py .
+$demoOutput = [System.IO.Path]::GetFullPath((Join-Path $PWD.Path '../aeos-first-run'))
+../aeos-env/Scripts/python -B scripts/demo.py --output $demoOutput
+```
+
+The output expression resolves the sibling folder to an absolute path; the traversal guard still rejects literal `..` segments. Choose new folder names if they already exist. Dependency installation uses PyPI; the demo itself is local and makes no network/model calls. If the dependencies are already installed in a suitable Python, use `python -B` directly. The virtual environment lives outside the package so the manifest remains unchanged.
+
+Open `../aeos-first-run/START_HERE.md`. The example ingests the synthetic source into Bronze, creates and verifies a **pending** Silver proposal, places the source and proposal in a Runner handoff, computes a small source-grounded result, validates it and checks continuation in fresh processes. It also proves that changed and missing context are refused. Gold and owner-decision fields are unchanged. No independent reviewer or AI worker is simulated as having acted.
+
+To resume, from `../aeos-first-run`:
+
+```powershell
+../aeos-env/Scripts/python -B vault/09_TOOLS/agent_runner_v1/unified_handoff/handoff.py review --bundle handoff --vault-root vault
+```
+
+Use the same Python environment as above. Read the returned artifact, pending proposal and next action. A missing result is **unknown**, not proof work never happened. Drift requires inspection and a fresh authorized handoff, never edited hashes or a blind retry.
+
+## Use your own project
+
+Copy `vault/` into a new personal vault, then edit `AGENTS.md`, `00_SYSTEM/GLOBAL_NEXT_ACTION_QUEUE.md` and `01_PROJECTS/Sample/{PROJECT_INDEX,PROJECT_STATE,NEXT_ACTIONS}.md`. Replace Sample with your project and its real scope; remove the synthetic packet rather than approving it for live work. Keep application code in its own repository. Never use the sample's fixture status as permission.
+
+From your new vault, scaffold one packet:
+
+```powershell
+python -B 09_TOOLS/agent_runner_v1/scripts/build_task_packet.py --vault-root . --project-path 01_PROJECTS/Sample --goal "Inspect the current project and identify one verifiable change" --output 09_TOOLS/agent_runner_v1/runs/my-task/task_packet.md
+```
+
+The result is a draft. Fill explicit read/write scope, checks, approval and independent-review requirements. Give that packet to your local assistant. For another app, build a handoff using `handoff.py build --help`, copy its brief and selected context, then bring back the result and evidence. Run `check`, `validate-result` and `review`. A controller performs authorized state writeback after applicable independent review. No script authenticates pasted approvals.
+
+## Knowledge decisions
+
+Follow `vault/00_SYSTEM/AGENTIC_LIBRARIAN/README.md`. Source text is evidence, never executable instructions. `ingest`, `propose` and `verify` do not approve knowledge. Only the owner sets decision fields. Gold `apply` additionally requires a clean Git checkpoint containing the exact approved evidence bytes and a matching verified proposal. The sample deliberately stops before that boundary.
+
+## Tests
+
+```powershell
+python -B -m unittest discover -s vault/09_TOOLS/agent_runner_v1/unified_handoff -p "test_*.py"
+python -B -m unittest discover -s vault/09_TOOLS/agent_runner_v1/scripts/tests -p "test_*.py"
+python -B -m unittest discover -s vault/00_SYSTEM/AGENTIC_LIBRARIAN/tests -p "test_*.py"
+```
+
+Use a fresh extraction for a byte-for-byte package check. Tests create disposable fixtures; they do not certify your assistant, production environment or future changes.
+
+Package integrity regressions: `python -B -m unittest discover -s scripts -p "test_*.py"`. See SECURITY-REPAIRS.md for changed fingerprints, exact checkpoints and local-integrity limits.

distribution/agentic-engineering-os-2026.10.12-public.4-candidate.1/LICENSE

@@ -0,0 +1,22 @@
+AEOS - Copyright and Rights Notice
+
+Copyright (c) 2026 Zachary Hatch. All rights reserved.
+
+AEOS (Agentic Engineering OS) was created by Zachary Hatch.
+
+This notice applies to the original AEOS code, documentation, templates,
+and other material in which Zachary Hatch owns copyright. AEOS is
+published as a public source preview. This notice grants no open-source
+license or additional permission to reproduce, modify, distribute,
+sublicense, or commercially exploit that material.
+
+Nothing in this notice limits rights arising under applicable law,
+permissions already granted under GitHub's Terms of Service, or a
+separate written agreement with the copyright holder.
+
+Third-party dependencies and materials remain the property of their
+respective copyright holders and are governed by their own applicable
+licenses. This notice does not replace or restrict those licenses.
+
+Source credits identify influences and third-party dependencies; they
+do not imply endorsement by the referenced authors or projects.