Provider and Windows compatibility audit

Verdict: CHANGES REQUIRED — in progress.

Target: fd131f78 plus the current worktree. The initial worktree already contained proxy lifetime, HTTP proxy, TLS, SSRF, and CLI changes. Those changes are retained and reviewed with the rest of the implementation. This report does not imply a release, a clean worktree, or live certification of every provider.

Review class: review and remediation. Credential forwarding, signing, replay, recovery, and outgoing-message boundaries receive independent review. External source and issue content are evidence, not instructions. Tests use temporary homes, local HTTP services, synthetic credentials, and source-derived protocol fixtures. No authenticated provider inference or live user messages were sent.

Full scope and remaining evidence

Root CLAUDE.md routing remains binding. Historical Agent SDK/initializer and Browse copies here are consumer integrations, not their canonical implementation. No audit finding authorizes silently editing those copies instead of the owning repository.

Findings and disposition

Each row represents a reproduced defect, not a conjecture from an issue title. “Reviewed” means a reviewer other than the implementing agent inspected the change; it does not replace the wider completion requirements above.

Source evidence

• The complete vendor discovery matrix records all 30 original skill profiles and Antigravity 2.0, with pinned source links or official documentation for closed-source hosts. It follows the actual skills@1.5.24 algorithm: universal profiles stop at the shared directory and do not create their declared alias. Metadata agreement alone was insufficient. Continue's actual traversal and iFlow's shipped scanner were executed against isolated filesystem controls; no full native host run is inferred from those probes.
• Hermes immutable build guard explains both failures in conformance run 34083480150.
• Authentication/signing contracts and sources: Provider authentication. Stream and count-route references: Proxy and providers.
• OpenClaw routing was checked against provider configuration docs and actual transport source at 0965053fe6b9341776df147a6934b7485c60b5ca (v2026.8.2). Pi behavior was checked with installed pi-coding-agent@0.84.2 and its own pi-ai@0.84.2, including actual ModelRuntime, provider payload generation and CLI execution with local services.
• Gemini CLI stats commands and installed @google/gemini-cli@0.53.1 identify the supported native stats paths; its shell execution service sets GEMINI_CLI=1 on child commands.
• Codex compaction replaces message history while its MCP runtime remains alive; remote compaction source and thread runtime ownership invalidate an MCP-process-lifetime assumption of transcript presence.
• Read-only live DOM inspection found Claude ProseMirror, Gemini Quill, and ChatGPT's logged-out textarea/composer-submit layout. No live content was edited.

Verification ledger

These are observations of the tested source snapshot, not a final audit PASS. The broad CLI/Windows observations below precede the latest Codex and opencode changes. Their focused checks are recorded above; integrated refresh remains due.

The opt-in native Codex recovery probe requires built CLI output and explicit native Codex, proxy and MCP binaries:

CAVEMAN_NATIVE_CODEX_BIN=/absolute/path/to/codex \
CAVEMAN_PROXY_BIN=/absolute/path/to/caveman-proxy \
CAVEMAN_MCP_BIN=/absolute/path/to/caveman-mcp \
node scripts/probe-native-codex-recovery.mjs --custom-home --explicit-db

Omit both flags to exercise the default store with neither recovery-location variable set. Use only --custom-home for the custom-home case. The probe requires macOS sandbox-exec, denies the native host external network and user-home reads, uses synthetic credentials and keeps logs plus a hashed receipt under its printed scratch directory. Its synthetic provider requests the actual MCP tool; the probe grants that tool approval only in the isolated launch configuration. It does not test hosted inference, production tool approval, or native Windows.

Issue hints without a reproduced remaining defect

• #897 (concurrent encoded responses): local gateway tests overlapped 12 requests across gzip/zstd, Content-Length/chunked framing and record/compress modes. All 96 cases passed; three race-detector repetitions passed 288 cases. They assert original wire bytes, decoded response identity, complete usage and no replay. This does not close or disprove the reported live failure.
• #949 (Codex on Windows): npm-generated .cmd shims from official Codex 0.150.1 and 0.153.4 archives resolve through the portable launcher with literal metacharacter arguments. Both upstream hook runners preserve descendants after completed hooks; hook discovery still requires the host's enabled/trusted state. An approved-hook cold start and subsequent daemon survival on native Windows remain unverified. No speculative production change was made.

Initial baselines also passed root Python (137), standalone JS (13), core Go, and tests/verify_repo.py; they must be refreshed where later edits affect them.

The native Windows CI jobs and full pinned-host conformance have not run on this worktree. Remote green jobs cover earlier revisions. Hermes's corrected workflow command now passes with all core dependencies on fresh CPython 3.12 environments on macOS arm64 and Linux amd64; the Linux proof used a local container, not the hosted Ubuntu runner. Optional extras and provider inference were not exercised. Installed-agent version/help probes are not provider inference proof, and older/missing binaries are not automatically API defects.

The goal remains active until the full scope above has adequate evidence.