Deferred, owed to a person: the live proof of the command-line runner (itd-2609201916056194). Phase 1 and 2 prove every criterion on fake harness binaries only; no ruling admits a live check of the runner (ruling L names the site setup, the API adapter and the decision adapter; H8 lists the three paid-service checks and itd-6's RepoPrompt run), so the intent cannot close. What a person must run: (1) the intent's first proof, criterion 7 live: a ruthless review of a real lane routed roles.ruthless-reviewer.runner=opencode, from a lane the host drives, its return recorded beside a host-run review's and differing only in the route; (2) the claude runner under --bare with --permission-mode dontAsk and --allowedTools, confirming a nested claude does not refuse under an inherited CLAUDECODE, and noting that the headless page (read 2026-09-30) says bare mode never reads OAuth or the keychain, so the claude runner needs ANTHROPIC_API_KEY, a paid API key rather than the person's subscription; (3) opencode run --format json --pure: the event shape (the CLI page does not document it; the adapter assumes step_start/text/step_finish with a sessionID and a part) and whether run mode prompts for a permission, which the timeout bounds and records as a fallback.

Deferred, owed to a person: the live proof of the command-line runner (itd-2609201916056194). Phase 1 and 2 prove every criterion on fake harness binaries only; no ruling admits a live check of the runner (ruling L names the site setup, the API adapter and the decision adapter; H8 lists the three paid-service checks and itd-6's RepoPrompt run), so the intent cannot close. What a person must run: (1) the intent's first proof, criterion 7 live: a ruthless review of a real lane routed roles.ruthless-reviewer.runner=opencode, from a lane the host drives, its return recorded beside a host-run review's and differing only in the route; (2) the claude runner under --bare with --permission-mode dontAsk and --allowedTools, confirming a nested claude does not refuse under an inherited CLAUDECODE, and noting that the headless page (read 2026-09-30) says bare mode never reads OAuth or the keychain, so the claude runner needs ANTHROPIC_API_KEY, a paid API key rather than the person's subscription; (3) opencode run --format json --pure: the event shape (the CLI page does not document it; the adapter assumes step_start/text/step_finish with a sessionID and a part) and whether run mode prompts for a permission, which the timeout bounds and records as a fallback.

2026-10-02 — Added by the sec-runnerSeal review (lane runnerSeal), a fourth live check, medium in the reviewer's grading and unverified: (4) whether opencode reads a .env from its working directory. The runner launches opencode with the repository (the lane's worktree) as its working directory (internal/core/runner/proc.go), and opencode is a Bun-built binary; if its runtime auto-loads a .env from the working directory, a repository's committed .env sets names the seal does not override, OPENCODE_CONFIG, OPENCODE_CONFIG_CONTENT or a provider base-URL variable, which reach opencode's configuration or redirect the person's key past the three seal switches (OPENCODE_DISABLE_PROJECT_CONFIG, OPENCODE_DISABLE_CLAUDE_CODE, OPENCODE_DISABLE_EXTERNAL_SKILLS) and --pure. The probe: plant a .env in a scratch repository naming OPENCODE_CONFIG at a file the repository holds, run the opencode runner there, and observe whether opencode reads that file. If it does, launch opencode from a directory the repository does not control, or clear those names in the launch environment; neither is applied without the check, because both change what the person's own environment hands opencode. Severity is raised from minor to major to match the reviewer's medium.

2026-11-01 — Check (2), run live by the product thinker's session on their own API key, in part. Claude Code 2.1.316 on macOS, the key set in the runner's environment for the one command, the runner enabled as runner.claude {} in ~/.abcd.noindex/config.json, started from inside a Claude Code session so CLAUDECODE was inherited. In run run-2611010929062241 (a build of iss-2610250107576049), validate round 1, the ruthless reviewer (--route ruthless-reviewer=runner:claude) and the security reviewer (--route security-reviewer=runner:claude) each ran on the claude runner, model claude-opus-5-5, at 0.97 USD and 0.33 USD; both returns were verified by the stage's verifier, the ruthless reviewer's verdict was SHIP, and the run record names the runner for each. Both roles are granted Bash (roleTools in internal/core/implement/loop/drive.go), so each launch took the shell route under --bare: --permission-mode default, abcd's guard approver as the one server under --mcp-config --strict-mcp-config with --permission-prompt-tool. The nested claude did not refuse under the inherited CLAUDECODE, and the approver connected without failing the launch. Later the same day the planning interviewer, a role granted no shell (Read, Edit, Grep, Glob and Write), ran on the claude runner on the same key from a plain terminal, so the launch took --permission-mode dontAsk with --allowedTools: it started, wrote its first question and returned a receipt; the interview then ended on abcd's own question check (iss-2611011402496418), not on the launch. Not yet shown: the approver judging a live shell command (the ruthless reviewer reports it ran none) and the implementer on the runner, which ran on the host this time; itd-2611011230226453's live proof covers those two. Checks (1), (3) and (4) are untouched.