* fix(cso): comprehensive verify can patch read-only snapshots and accepts runtime-plan's profile
* feat(cso): helper replies carry remainingSeconds; producer receipts record a content-free tool timeline
* fix(cso): count remainingSeconds to the investigation deadline; bound and validate the tool timeline
remainingSeconds now measures to deadline - 60s, the point where scan,
verify and record-review refuse with DEADLINE, and inspect carries it.
The post-command clock lookup can only omit the field, never fail a
command whose state change is already saved. The stream timeline records
end times from tool_result, indexes only recorded calls so it stays at
the 4096 cap, and receipts reject malformed timeline entries.
* docs(changelog): unreleased entry for the /cso run clock
* v1.91.124.0 stamp
The paid CSO producer gives `/cso` the Agent tool users have, so
independent review and repair verification can run in the evaluation. The
producer's receipt now counts subagent tokens.
- every helper artifact path tripped the secret redactor: the run ID's
13-digit epoch reads as a phone number, some 32-hex IDs as wallets.
Validate paths against the helper layout; schema-shaped ID components
are accepted by shape, every other component still goes through redact
- the provider was killed at exactly --budget after cell start, before
the helper deadline (start + budget) and before finish; give it the
budget plus a 300 s reporting grace (evaluator graceSeconds)
- Claude producers stream events (stream-json --verbose
--include-partial-messages) and add usage per message, so a timed-out
receipt keeps tokens, cost, turns and the last text
- failed post-run checks name the check in the receipt reason
Garry Tan