[E11] Verify the end-to-end loop and second-change continuity

[TheAmericanMaker]

Context and scope

Part of the incremental CodeCartographer engineering evolution. Planned, not shipped. Read the agent handoff, vision/decisions, record contract, and implementation plan. Documentation baseline PR #410 is merged at bbdf6b1a8b3bc348aa9e8f20a409c66df087af13. Follow this issue's prerequisite gates before starting.

Host-executed/framework-tracked; preserve analysis state ABI, both Pi analysis guards, and current synthesis confirmation gates. Ordinary in-place changes accept zero external references. No implicit source execution, provider spend, GitHub write, release/deployment, or private-data publication. E01 owns schema/API/authority decisions; dependent workers consume its merged contract rather than inventing another.

Tracking: #398

Blocked by: #406, #408. Prerequisites must be merged, not merely started.

Objective: demonstrate the product outcome, not just the record parser.

Depends on: E08, E10. Files: create tests/engineering-e2e.test.mjs, tests/fixtures/engineering/pilot/, a sanitized public pilot report under docs/engineering/; update the roadmap only to the level actually verified.

Steps:

1. Use a disposable checkout and empty library. Choose a bounded real regression or slice-linkage feature, with the human's scope approval recorded by the supported host. Do not modify the user's active checkout without permission.
2. Produce the brief/plan, run a relevant failing baseline check, implement via the host, and record passing targeted plus applicable regression tests.
3. Run independent implementation review; resolve blockers and obtain actual human acceptance through the supported channel. Synthetic approval fixtures are test data, not evidence of this human gate.
4. Exercise interruption/resume, missing proof, wrong snapshot, stale input after proof, failed versus blocked outcomes, and a second independent change whose history preserves the first. Automated tests must cover these negative cases, not only the happy path.
5. Repeat on a feature if the first pilot was a bug, or a confirmed bug if the first was a feature. Record actual host/surface/version, observed overhead, limitations, and exact revisions. Sanitize before public publication.

Acceptance: both a real fix and a feature reach the locally reviewable/accepted boundary; the loop resumes and refuses stale or missing evidence; subsequent work preserves history. A test suite PASS or mocked host alone does not close this issue. Unavailable human interaction means the issue remains partially verified.

Out of scope: merging pilot changes upstream, production releases/deployment, cross-project library reuse, or claims of comparative productivity without measured controls.

Required verification and handoff

• Run the named RED/GREEN tests, npm run build, npm test, and git diff --check; record actual results, not historical counts.
• Inspect current source and dependency PRs first. All new paths are proposed until their owning issue lands.
• Get independent review on the exact candidate; stop on missing authority or unresolved security design.
• Attach commit/PR, changed paths, observed proof, remaining limits, compatibility notes, and the next eligible issue.
• Keep shared barrel/registration/invariant edits small and coordinate them; do not absorb unrelated work.
• This issue does not authorize implementation of the later reuse/team/release backlog.

Preregistered pilot briefs and evaluation

Planning documentation merged in PR #413 at b75a9c157fa09d7796e9221e5d7808b85b1e337d. Read pilot selection and evaluation rubric before running E11.

• B01: the known Git-configuration isolation defect from Tests: the git-config guard misses config injected through GIT_CONFIG_COUNT #412, replayed against the pinned public target.
• F01: a bounded exact-capability library-list filter spanning core and MCP. This is an evaluation target, not a new parallel feature assignment.
• The rubric includes real acceptance, proof freshness, fresh-session recovery, second-change continuity, negative controls, human effort, and workflow overhead.

These are planning artifacts only. They do not release E11 dependencies, resume E09, or supersede E01 schemas/approval authority. E09/#407 remains on maintainer hold. Do not delay an upstream #412 fix to preserve the benchmark; the pinned historical target is intentional.

[TheAmericanMaker]

E11 partially verified in #440 (squash-merged to main). tests/engineering-e2e.test.mjs drives the real record store and real pure functions through a first change to may-accept, every negative control N01–N08, and a second change (R09) that leaves the first's records byte-identical. 9 hand mutants across gates/proofs/traverse/snapshots all bite; an independent review confirmed 7/7 weakened-negative tests flip to FAIL. Report: docs/engineering/pilot-e11-2026-09-22.md.

Still open, so this issue stays open: (1) F01 has not run through a live host — nothing here executes a check or captures a real tree; B01 remains the only real-fix half (c4030a4). (2) No human acceptance has occurred; N08 proves the loop stops at needs-human-acceptance and VERIFIED_ACCEPTANCE_INTEGRATIONS is still empty. Both need a supported host with a human present, not a test.

[TheAmericanMaker]

Progress toward live acceptance: both prerequisites for this issue are now on main.

• Host-observed proof ingestion: Claude Code hook, inbox reader, MCP surface (E05, #409) #446 (05e2021) adds host-observed proof ingestion: the Claude Code hook template, the inbox reader and the ingest_observations action.
• feat: MCP acceptance adapter (request_acceptance via client elicitation) #445 (648c247) adds the MCP acceptance adapter: request_acceptance through client elicitation. Before asking, the adapter runs the gate on a fresh read of the working tree. It reads the tree again before minting an approval, allows one accepted approval per candidate, and serializes requests with an in-flight marker that expires.

VERIFIED_ACCEPTANCE_INTEGRATIONS is still empty, so no acceptance is recorded yet.

Gap before a live pilot: nothing on core or the MCP surface produces a candidate snapshot yet; only the tests seed one. The adapter's tree re-read is proven only against itself. A capture action is needed so that a real session can produce the candidate it asks acceptance for.

Remaining steps:

1. Build a candidate capture action.
2. Run a live check on a pinned Claude Code version: accept, reject, decline, stale, mismatched. Then open a registration PR.
3. Run the F01 and bug-fix pilots in a throwaway checkout.