P0: harden ChatGPT -> Dev MCP dispatch reliability end to end

[James3014]

Context

This Issue owns one bounded reliability repair for the real ChatGPT -> Dev MCP path on macOS.

It was opened from live evidence on 2026-09-18 after repeated ChatGPT dispatch friction. The initial incident report correctly identified very slow open_workspace, but it incorrectly conflated MCP transport-session churn with durable workspace/agent loss and incorrectly classified three separate failed agent attempts as session-reset replay.

This Issue must repair the actual failing contracts without introducing transport stickiness as a new correctness authority.

Related existing work:

• P1: Expose truthful Cline model discovery and exact-route readiness through Dev MCP #59 owns truthful Cline model discovery / entitlement / exact-route readiness. Reuse or integrate that contract; do not create a second Cline catalog/readiness authority.
• Existing durable workspace, agent, operation, and attemptKey mechanisms remain the semantic identity layer.

Live evidence

Observed through the current ChatGPT -> Dev MCP surface:

E1 — durable workspace continuity already exists

Repeated open_workspace("/Users/jameschen/Workspace/devspace", mode="checkout") in the same ChatGPT conversation returned the same workspace:

ws_c1d66f1a4c

A prior incident workspace remains durably queryable:

workspaceId: ws_e405d635dc
mode: worktree
status: active
root: .../.devspace-chatgpt/worktrees/Nexus-new-2164c7ae

Therefore:

new MCP transport session != lost workspace/agent state

Do not implement IP affinity or sticky HTTP transport as the semantic fix.

E2 — three observed agent starts were distinct terminal provider failures

For task nexus-957-wave2-independent-review:

v1 agt_c08c14dc
z-ai/glm-5.3-flash
-> PROVIDER_PROTOCOL_ERROR
-> model not advertised by Cline ACP session

v2 agt_dfe6c7bb
cline-free/deepseek-v4.1-flash
-> PROVIDER_PROTOCOL_ERROR
-> model not advertised by Cline ACP session

v3 agt_2b588a1d
cline-pass/glm-5.3
-> CLINEPASS_ENTITLEMENT_REQUIRED

These were not one agent silently replayed after transport loss.

The repair target is pre-launch route/readiness admission plus replay-safe dispatch, not generic session stickiness.

E3 — open_workspace has synchronous deep-work risk

Current workspace open/reuse path reloads profile/context and calls findAvailableAgentsFiles(), which recursively walks the workspace to discover nested AGENTS.md / CLAUDE.md.

Large repositories have shown observed open_workspace latency around 40-100+ seconds.

E4 — read-only file discovery has model-facing friction

The current ChatGPT surface relies on bash for rg/find/ls/tree style inspection.

Observed behavior:

• simple ls succeeds quickly;
• shell read-only classification is lexical and treats raw metacharacters such as | as consequential even when they are inside a search expression;
• valid model-facing discovery commands can therefore be blocked or become expensive;
• broad rg on Nexus-new can run long enough to time out;
• guessed paths then produce ENOENT.

This contributes directly to path drift.

E5 — strict exact edit behavior is desirable

edit currently rejects stale/non-exact oldText.

Preserve fail-closed exactness. The missing behavior is deterministic re-read/patch recovery, not fuzzy replacement.

Architecture invariant

Correctness identity must remain:

ChatGPT conversation identity
  -> durable workspaceId
  -> durable agentId / operationId
  -> stable attemptKey

Transport identity is separate:

HTTP connection / MCP transport session / source IP
  = transport lifecycle and performance only

Sticky transport MAY be used as an optimization if evidence justifies it, but MUST NOT become the only continuity mechanism.

Required repair

G1 — make open_workspace a bounded hot path

Rework open/reuse so returning a reusable workspace does not synchronously deep-walk the repository.

Requirements:

• root validation + durable conversation binding + workspace restore/reuse stay synchronous;
• root instruction loading needed for safe operation may remain synchronous;
• nested context discovery and other expensive refreshes must be cached, indexed, incremental, lazy, or otherwise removed from the response-critical path;
• preserve correctness for nested AGENTS.md / CLAUDE.md: do not silently stop honoring nested instructions;
• preserve durable workspace restore after server restart.

Performance acceptance on representative large local fixture:

• warm reusable checkout p95 < 1s;
• cold checkout p95 < 3s excluding worktree creation;
• no full recursive walk on warm reuse.

G2 — prove reconnect continuity instead of assuming sticky session

Add an integration test that intentionally creates a new MCP transport/session while preserving the same ChatGPT conversation identity.

Prove:

1. same conversation + same checkout -> same durable workspace binding;
2. old durable agentId remains queryable after transport replacement;
3. no duplicate workspace is created merely because transport/session/source IP changes;
4. server restart restore still works from durable state.

If a real defect is found in conversation identity propagation, fix that exact seam.

Do NOT key semantic continuity to source IP.

G3 — preflight exact provider/model/entitlement before agent side effect

Before creating/launching a durable provider attempt, use the truthful provider readiness surface available for that provider.

For Cline, integrate/reuse #59 rather than inventing another catalog.

At minimum:

• exact model not advertised -> fail before provider execution;
• entitlement missing -> fail before provider execution when discoverable;
• stale/unknown readiness stays UNKNOWN, not READY;
• admission result is structured and attributable;
• no silent provider/model substitution.

Where readiness cannot be known without a bounded probe, keep that fact explicit.

G4 — replay-safe dispatch is mandatory

Use stable attemptKey as the retry/reconciliation identity for model-facing dispatch.

Prove:

• same attemptKey + identical request -> exactly one durable agent/effect;
• same attemptKey + conflicting request -> fail closed;
• transport timeout/disconnect -> status/reconcile before any new attempt;
• no blind second agent_start solely because the host did not receive the first response.

Do not infer retry permission from OUTCOME_UNKNOWN.

G5 — give the model a reliable read-only discovery path

Provide or restore a native read-only discovery surface suitable for ChatGPT, preferably explicit operations equivalent to:

list_directory
find_files / glob
grep_files

If existing internal pi-tools already provide these semantics, expose/reuse them rather than creating a second search engine.

Requirements:

• read-only discovery works in shared checkout without mutation authority;
• read-only discovery works in Core-bound worktrees without requiring a mutation session;
• quoted regex/glob metacharacters are not misclassified as shell effects;
• operations are bounded by result count/output size/time;
• filesystem containment remains enforced;
• no shell write capability is introduced.

A parser improvement to bash classification may be added, but a model-facing native discovery surface is preferred over relying only on shell parsing.

G6 — preserve strict edit and add deterministic stale-edit recovery

Keep exact oldText matching fail-closed.

Provide/document/test a deterministic model-facing recovery path:

read latest file
-> exact targeted edit / structured patch
-> mismatch
-> re-read exact current region
-> retry once with fresh evidence

If a structured apply_patch capability already exists internally, expose/reuse it only if it preserves workspace containment and explicit failure semantics.

Do NOT add fuzzy silent replacement.

Required tests

Add focused regression/integration coverage for all gates.

At minimum:

1. warm workspace reuse does not recursive-walk full repo;
2. cold and warm latency harness on a synthetic large tree;
3. nested instruction correctness still holds when entering/reading nested paths;
4. transport replacement preserves workspace binding;
5. transport replacement preserves durable agent query;
6. server restart restores workspace/agent state;
7. unavailable Cline model fails pre-launch;
8. missing ClinePass entitlement fails pre-launch when known;
9. UNKNOWN readiness is not promoted to READY;
10. exact attempt replay produces one durable agent;
11. conflicting attempt replay fails closed;
12. read-only list/find/grep works in shared checkout;
13. read-only list/find/grep works in isolated/Core-bound worktree without mutation authority;
14. regex containing | is treated as search data, not shell pipe, on the supported native discovery path;
15. discovery is output/time bounded;
16. guessed/nonexistent path returns structured ENOENT without changing workspace;
17. stale exact edit fails closed;
18. re-read + fresh exact edit/patch succeeds;
19. existing conversation-isolation, Core mutation, durable agent, provider, build/typecheck suites remain green.

Verification

Before claiming Candidate-ready:

• rebind fresh origin/main in an isolated DevSpace worktree;
• read repository instructions and current affected contracts;
• inspect existing implementations before adding new abstractions;
• run focused tests for each gate;
• run affected regression suite;
• run typecheck/build;
• run git diff --check;
• inspect final diff for duplicate authority/catalog/search/session mechanisms;
• perform a real local ChatGPT/Dev MCP canary where available;
• report exact base/head, changed paths, tests, residual UNKNOWNs, and any gate not physically proven.

Non-goals

• no Nexus CapabilityPlanner changes;
• no new provider/model router;
• no second Cline catalog;
• no source-IP affinity as correctness;
• no broad repository cleanup;
• no fuzzy edit semantics;
• no automatic paid/free provider substitution;
• no merge/deploy/restart authority from this Issue.

Acceptance

The Issue is complete only when all six gates are proven:

G1 open_workspace latency
G2 reconnect continuity
G3 provider readiness fail-fast
G4 retry/attempt idempotency
G5 reliable read-only discovery
G6 deterministic exact-edit recovery

Maximum claim before all six pass:

Individual Dev MCP reliability defects have been repaired, but end-to-end ChatGPT dispatch reliability is not yet fully verified.

[James3014]

OWNER RECONCILIATION — THIS GATEWAY RELIABILITY LINE REMAINS ACTIVE

The 2026-09-20 #15 architecture hold does not pause this Issue as a whole.

Continue the provider-independent ChatGPT -> Dev MCP control-plane work:

• G1 workspace hot path;
• G2 reconnect/durable identity;
• G4 attemptKey replay/reconciliation;
• G5 native bounded read-only discovery;
• G6 deterministic exact-edit recovery.

Contract delta for G3: do not use provider-readiness work as authorization to build/expand provider-specific Cline/OpenCode/Grok/Codex/Agy catalog/runtime machinery while #15/#58/#59 are on hold. Use existing truthful readiness evidence where available; otherwise preserve UNKNOWN/BLOCKED until the execution-plane decision.

Goal: make the MCP gateway reliable regardless of which execution runtime is selected.

[James3014]

Provider-independent reliability Candidate preserved

Implemented and verified the currently authorized #194 line on top of exact main@e03fa9ea19ec2f76f38008d7b4ac286005c26692.

Remote Candidate:

• branch: fix/issue-194-provider-independent-salvage
• head: 7ece52b8f0ce99037046a772762ed205b2979b74
• remote readback exactly matches local head
• changed paths only:
  • src/workspaces.ts
  • src/server.ts
  • src/workspaces.test.ts
  • src/workspace-conversation.test.ts
  • src/server.test.ts

What changed

• Warm checkout reuse no longer rebuilds nested instruction inventory by recursively walking the whole workspace.
• Nested AGENTS.md / CLAUDE.md authority remains fail-closed via path-local ancestor checks.
• "discovered instruction" and "actually loaded instruction" are tracked separately so caching cannot silently downgrade instruction authority.
• Registry restart stays lazy: it does not rebuild the global nested-instruction inventory, but re-establishes nested authority on demand before read/write/edit/apply_patch.
• read, write, edit, and Codex-compatible apply_patch all return NESTED_INSTRUCTION_REBIND_REQUIRED before effect if a required nested instruction has not been read.
• Editing an instruction file invalidates its loaded status.
• Exact-edit mismatch remains fail-closed and now includes deterministic guidance to re-read the current target region and retry with fresh exact oldText.

No Cline/OpenCode/Grok/Codex/Agy provider catalog/runtime expansion was added. G3 provider-specific work remains under the existing Owner HOLD.

Verification

Focused:

• late nested instruction server integration: PASS
• src/workspace-conversation.test.ts: 21 pass / 1 macOS alias skip
• src/workspaces.test.ts: 7/7 PASS
• npm run typecheck: PASS
• src/server-ci.test.ts: 85/85 PASS
• src/conversation-isolation.test.ts: 7/7 PASS
• npm run build: PASS
• git diff --check: PASS

Full repository gate:

• npm test: PASS, exit 0
• runtime: ~414s

Freshness fence immediately before commit:

• Candidate base == origin/main == e03fa9ea19ec2f76f38008d7b4ac286005c26692
• provider-HOLD terms absent from the diff
• worktree clean after commit/push

Per repository AGENTS.md, no PR was opened without separate explicit PR authority.

[James3014]

#194 provider-independent salvage — final Candidate receipt

PR #219 is now verified at exact head 01b26a970192ba98afffae5f7b677f6d15a295d9 on exact base/current main e03fa9ea19ec2f76f38008d7b4ac286005c26692.

Final scope remains provider-independent:

• warm checkout reuse avoids the recursive nested-instruction walk;
• nested AGENTS.md / CLAUDE.md authority is re-established lazily and fail-closed before read/write/edit/apply_patch;
• exact edit remains strict with deterministic re-read/retry guidance;
• no provider-specific Cline/OpenCode/Grok/Codex/Agy catalog/runtime expansion.

The first PR head exposed and then falsified a Mac-only false green. Ubuntu failed the new nested-instruction write-after-read regression because AGENTS.md and the nonexistent AGENTS.MD alias share a case-folded loaded-state key. The missing alias path incorrectly evicted the actually loaded real instruction on a case-sensitive filesystem. Final head fixes only that eviction rule: a known case-folded instruction is removed from loaded state only when its recorded file itself is also absent.

Final evidence:

• local/remote branch head exact match: 01b26a970192ba98afffae5f7b677f6d15a295d9
• changed paths: exactly 5
• local worktree clean
• src/workspaces.test.ts: 7/7 PASS
• exact nested-instruction server regressions: 2/2 PASS
• typecheck: PASS
• git diff --check: PASS
• GitHub CI 35503072280: SUCCESS
  • Ubuntu Smoke Test / Build / Doctor: SUCCESS
  • macOS Smoke: SUCCESS
  • all continuation/session/diff jobs: SUCCESS
• Repository Intelligence 35503072278: SUCCESS

Local reconciliation/cleanup completed as part of this pass:

• removed superseded dirty fix: ChatGPT self-cutover can deadlock at prepared/reconcile-only #64 recovery worktrees whose repaired lineage is already merged;
• removed merged/superseded WaveB worktrees;
• restored the unrelated unowned TTL tuning in the stale shared checkout;
• removed the one-off closed cutover recovery script;
• removed the obsolete dirty P0: harden ChatGPT -> Dev MCP dispatch reliability end to end #194 worktree after preserving its provider-independent salvage as PR fix: preserve lazy workspace instruction authority #219;
• retained only the clean fix: preserve lazy workspace instruction authority #219 salvage worktree for the open PR.

Claim boundary: this makes PR #219 Candidate-ready for Owner review. It does not close #194, does not prove all six end-to-end gates, and does not grant merge/deploy/restart authority. G3 provider-specific work remains held by the existing Owner architecture decision.

[James3014]

Historical local-only branch preserved before cleanup

• preserved tip: 7bfc58af60188d2d948ea85d1da7346dba1b9ac1
• preservation ref: preserve/20260920/issue-194-superseded-provider-work
• remote readback: exact match — git ls-remote origin refs/heads/preserve/20260920/issue-194-superseded-provider-work returns 7bfc58af60188d2d948ea85d1da7346dba1b9ac1
• ancestry reached (all four commits were local-only, with no remote ref and no PR):
  • df270cd198e0f1714d592f80e9e754608d392fcc — fix(mcp): harden ChatGPT -> Dev MCP dispatch reliability
  • 2abd8bb31f9f8d90df9e6ceb333ffcf0825f47a7
  • 5eb7db046f6e0b44d08e4e345ccdf3752b931ff7
  • 7bfc58af60188d2d948ea85d1da7346dba1b9ac1

This ref is:

• archival evidence only;
• superseded for provider-independent scope by PR fix: preserve lazy workspace instruction authority #219 (head 01b26a970192ba98afffae5f7b677f6d15a295d9);
• the remainder is not purely provider-specific — it also touches provider-independent paths (src/request-meta.ts, src/roots.ts, src/pi-tools.ts, src/local-agent-store.ts, src/local-agent-sessions.ts) that are still absent from current main, which is why it is archived rather than discarded;
• provider-specific remainder remains under the existing Owner HOLD;
• not a Candidate;
• not permission to resume provider runtime implementation.

Provider-independent exact-edit / nested-instruction authority for this Issue remains where it already is (PR #219). No new implementation, no PR, and no change to PR #219 head was made by this preservation operation.

[James3014]

Additional local-only #194 lineage objects preserved

Follow-up to the archival branch preservation comment above. A repository-wide object sweep found an alternative local-only #194 revision chain that was reachable from no ref and was not contained in main or in PR #219:

subject	date	preservation ref	remote SHA
fix(mcp): harden ChatGPT -> Dev MCP dispatch reliability end to end	2026-09-18 11:37 +0800	preserve/20260920/issue-194-alt-lineage-7f55cff07	7f55cff075f7d732843f7586e1ae7a524f72aae7 (reaches 3a8c77b6cdbc9766193329bfa5abe70acc583939)

Exact remote readback verified by git ls-remote.

Scope: archival evidence only; superseded for the provider-independent scope by PR #219; not a Candidate; not permission to resume provider-specific runtime implementation. PR #219 head was not modified.

[James3014]

#194 current-main reconciliation — remaining provider-independent G2/G4/G5 gaps

Fresh watermark:

• DevSpace main: f1347d599384116969dbedb8635af8cb4c502dac
• Issue P0: harden ChatGPT -> Dev MCP dispatch reliability end to end #194 remains OPEN.
• G3 provider-specific Cline/OpenCode/Grok/Codex/Agy expansion remains under the existing Owner HOLD.
• This reconciliation does not reopen provider-specific runtime/catalog work.

Already integrated

• G1 workspace hot path: COMPLETE / MERGED.
• G6 strict edit recovery: COMPLETE / MERGED.

G2 — continuity mechanism present; end-to-end witness incomplete

Current source/tests already cover conversation-scoped checkout reuse and restart-oriented workspace reuse.
Still required for #194 closure: one bounded E2E witness proving that the same semantic conversation survives MCP transport replacement/reconnect without creating a duplicate checkout/worktree identity, and that a pre-existing durable agentId remains status/reconcile-readable after replacement/restart.
Required witness: same conversation scope; same intended repository/workspace identity; replacement/new MCP transport; reused workspaceId or exact durable restoration contract; old agentId remains queryable; no duplicate workspace/agent effect; reconnect is not redispatch permission.
Do not create a second workspace registry or conversation authority.

G4 — durable replay exists, but agent_start attempt identity is optional

Current src/local-agent-sessions.ts already implements durable replay/conflict handling including ATTEMPT_REPLAY_CONFLICT.
Current src/server.ts still declares attemptKey: z.string().regex(...).optional() inside createAgentStartInputSchema().
Therefore replay-safe machinery exists, but the effect-capable agent_start boundary still permits an omitted physical attempt identity.
Required behavior: make agent_start.attemptKey mandatory; exact replay reuses the same durable agent/effect identity; conflicting reuse fails closed; status/reconcile remain readback rather than redispatch permission; provider/model/route semantics remain unchanged.

G5 — native read-only discovery exists, but minimal surface and cancellation contract are incomplete

Current src/server.ts explicitly disables grep, glob, and ls in minimal mode and registers them only under if (config.toolMode === "full").
Current src/pi-tools.ts invokes native Pi grep/find/ls wrappers without AbortSignal or an explicit bounded cancellation/timeout propagation contract.
Required behavior: expose safe read-only native grep/glob/ls on the minimal ChatGPT surface; preserve root/path containment, ignore rules, and existing result/byte bounds; propagate bounded timeout/AbortSignal; timeout/cancellation must be attributable and mutation-free; shell remains available when shell semantics are actually needed.
Do not create a second search engine.

G3 boundary unchanged

G3_PROVIDER_SPECIFIC = OWNER_HOLD
#58/#59 remain separately held by the execution-plane ownership decision. This comment does not authorize new provider-specific catalogs, entitlement, routing, adapters, or lifecycle work.

Current closure state

• G1 = COMPLETE / MERGED
• G2 = PARTIAL / NEEDS TRANSPORT+AGENT CONTINUITY E2E WITNESS
• G3 = OWNER HOLD
• G4 = PARTIAL / DURABLE REPLAY EXISTS, ATTEMPT IDENTITY STILL OPTIONAL
• G5 = PARTIAL / NATIVE DISCOVERY EXISTS, MINIMAL EXPOSURE + BOUNDED CANCELLATION MISSING
• G6 = COMPLETE / MERGED
• ISSUE_194 = KEEP_OPEN
• AUTO_CHAIN = false

Exact next gate: REQUALIFY_PROVIDER_INDEPENDENT_G2_G4_G5_ON_CURRENT_MAIN_AFTER_ACTIVE_RUNTIME_PREREQUISITES_ARE_CLEAR

No merge, deployment, restart, release, provider expansion, or production authority is granted.

[James3014]

Final reconciliation — #194 ChatGPT -> Dev MCP dispatch reliability

Closure classification: DONE_NO_FOLLOW_UP for the #194 contract.

Fresh integration watermark

• GitHub devspace/main: 9210b0d6099ba2dbf88e7625495469cd33af8f0a
• final G2 PR: test: prove reconnect continuity for #194 #284
• test: prove reconnect continuity for #194 #284 exact head: fd781685888e6fec241685da5765a5da520bc22f
• test: prove reconnect continuity for #194 #284 exact base: cb33bb7c6f200141b9797c56efdaf2964c726dcf
• test: prove reconnect continuity for #194 #284 merge commit: 9210b0d6099ba2dbf88e7625495469cd33af8f0a
• exact-head CI run 36214466650: SUCCESS, all 11 jobs successful, including Ubuntu + macOS Smoke
• exact-head Repository Intelligence run 36214466664: SUCCESS (snapshot + terminal)

Historical PR #283 was closed unmerged as superseded after #282 advanced main; it is not the accepted Candidate.

Gate disposition

G1 — open_workspace bounded hot path: COMPLETE / MERGED

The existing settled #194 reconciliation already classified G1 complete. Current source preserves the repair:

• warm checkout reuse does not rebuild the global nested-instruction inventory;
• nested AGENTS.md / CLAUDE.md authority is re-established lazily and fail-closed;
• registry restart retains durable checkout reuse and lazy nested-authority rebind.

No fresh evidence in this closeout contradicts the prior G1 completion disposition.

G2 — reconnect continuity: COMPLETE / MERGED via #284

The new integration witness crosses the real /mcp HTTP boundary and proves, under the same semantic conversation identity:

1. replacement MCP session reuses the same durable workspaceId;
2. a pre-existing durable agentId remains queryable after transport replacement;
3. durable workspace/agent row counts stay exactly 1/1 — no duplicate semantic effect from transport churn;
4. after a real DevSpace server restart over the same durable state, the same workspace and same old agent remain queryable with no duplicate rows.

Transport identity remains lifecycle/performance only; it is not semantic continuity authority.

G3 — provider readiness ownership reconciled / boundary proven

The older #194 wording must now be read through the later Owner architecture decisions:

• Harden Dev MCP reliability across host binding, worker startup, and timeout reconciliation #15 decided provider-specific coding-agent runtime semantics should move out of DevSpace rather than expand duplicate Cline/OpenCode/etc. runtime authority;
• P0: qualify HerdR as the durable external coding-agent runtime substrate #235 closed with HERDR_RUNTIME_PILOT_SUPPORTED;
• P0: cut over DevSpace local-agent lifecycle to HerdR production backend #242 closed with HERDR_CUTOVER_STABLE and made HerdR the authoritative normal execution backend while DevSpace retains workspace / attempt / replay / contract / reconciliation authority.

DevSpace still preserves the gateway-side truthfulness required by #194:

• direct Cline exact route/model validation runs before durable agent creation;
• stale/missing exact model evidence fails closed;
• unsupported/unverified effort fails closed;
• generic readiness keeps auth/reachability UNKNOWN rather than promoting UNKNOWN to READY;
• no silent provider/model substitution is introduced.

Provider account entitlement / provider-runtime execution truth is no longer duplicated inside #194. Current #242 live evidence separately records Cline READY_FREE through the real public DevSpace -> HerdR path on cline-free/mimo-v2.6-flash, with terminal/reconcile evidence and no paid-route substitution.

This closes the #194 gateway ownership question without claiming that #59 or every provider-specific entitlement/auth problem is globally solved. #59 and provider-specific blocked states remain separate contracts where still applicable.

G4 — replay-safe dispatch: COMPLETE / MERGED via #281

PR #281 / merge 3ca5786ba9d2ad9446e1325d76e48a6424cf9cae made agent_start.attemptKey mandatory at the public MCP boundary while preserving durable replay/conflict semantics:

• identical attempt identity reuses one durable attempt/effect;
• conflicting reuse fails closed;
• reconciliation remains readback, not retry permission;
• OUTCOME_UNKNOWN != retry.

G5 — reliable native read-only discovery: COMPLETE / MERGED via #281

PR #281 exposed native bounded grep / glob / ls on the minimal ChatGPT surface, preserved containment, propagated MCP cancellation, and added bounded discovery timeout/error classification:

• DISCOVERY_CANCELLED
• DISCOVERY_TIMEOUT

No second search engine or shell-write authority was created.

G6 — deterministic exact-edit recovery: COMPLETE / MERGED

The prior accepted #194 line keeps exact oldText semantics fail-closed and supplies the deterministic re-read -> fresh exact edit/patch recovery path. Nested instruction authority remains enforced for edit/apply_patch.

Final contract result

G1 = COMPLETE / MERGED
G2 = COMPLETE / MERGED
G3 = OWNERSHIP_RECONCILED / BOUNDARY_PROVEN
G4 = COMPLETE / MERGED
G5 = COMPLETE / MERGED
G6 = COMPLETE / MERGED

ISSUE_194 = COMPLETE
AUTO_CHAIN = false

No source-IP/sticky-transport correctness authority, no second provider catalog/readiness authority, no second search engine, and no fuzzy edit path were introduced.

Claim boundary

This closeout means the bounded #194 ChatGPT -> Dev MCP gateway reliability contract is complete.

It does not claim:

• every provider is READY;
• provider entitlement/auth/quota is universally solved;
• P1: bind authorized tool ceiling to durable agent execution and project selected tools at provider boundary #190 physical tool/effect enforcement is solved;
• Harden Dev MCP reliability across host binding, worker startup, and timeout reconciliation #15's entire parent reliability program is closed;
• release/deployment/production readiness beyond the separately recorded runtime evidence.

Marker: ISSUE194_CHATGPT_DEV_MCP_RELIABILITY_CLOSEOUT_20260926_V1