Make macOS owner connections and CI path checks portable

.github/CI.md

@@ -306,12 +306,17 @@ The legacy local `shard-union` stage still requires twelve receipts; explicit Li
 and macOS stages each require exactly six, with no fallback to available platforms.
 
 Qualification remains pending: seven macOS test failures remain unresolved.
-The default owner-service locator also remains broken: the native user temporary
-root plus the full socket key can exceed macOS's 103-byte socket pathname limit.
-A writable database open can succeed while the separate owner service fails to start.
-A repair and independent native owner/reader proof are still pending; prior reader
-authentication results do not prove the default locator. These are open follow-up
-items, not passing evidence. Completion requires identifying and fixing each failure in source, verifying
+The pinned ContextDB macOS default locator now canonicalizes the fixed system
+temporary root `/tmp` and uses a private per-effective-UID directory with the full
+socket key. Focused upstream engine coverage consists of five integration cases
+actually run on the pinned revision and three unchanged library cases carried
+from an older revision, not eight newly executed cases. The only reader
+authentication proof is from a separate earlier ContextDB candidate, not the
+pinned revision; prior reader authentication results do not prove the pinned
+default locator or full Context Graph qualification. Full Context Graph macOS
+consumer qualification, including the integrated default owner/reader locator,
+remains pending. These are open follow-up items, not passing evidence.
+Completion requires identifying and fixing each failure in source, verifying
 locator behavior, running all five macOS jobs with all six valid receipts on the exact
 integrated source, and reviewing the resulting evidence before changing qualification.
 No issue number or hosted green result is claimed.

Cargo.toml

@@ -44,11 +44,11 @@ candle-core = { path = "vendor/candle-core", version = "=0.10.2" }
 candle-nn = { path = "vendor/candle-nn", version = "=0.10.2" }
 candle-transformers = { path = "vendor/candle-transformers", version = "=0.10.2" }
 criterion = { version = "0.8", features = ["html_reports"] }
-contextdb-core = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-engine = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-parser = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-tx = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-vector = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
+contextdb-core = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-engine = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-parser = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-tx = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-vector = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
 safetensors = "0.7.0"
 sha2 = "0.10.9"
 tempfile = "3.23.0"

README.md

@@ -57,7 +57,7 @@ Use the [download guide](docs/download.md) for wget, receipts and provenance ver
 
 The pinned toolchain in `rust-toolchain.toml` is Rust **1.94.1**. <!-- enforced by: `readme_states_the_rust_version_rust_toolchain_toml_pins` -->
 
-ContextDB is pinned to `bc9cce955eb85fb1488f5304426eedeb6d97e905` in the manifests and lockfile. <!-- enforced by: `manifests_lockfile_and_readme_name_the_same_exact_contextdb_revision` -->
+ContextDB is pinned to `db9d067f291c0add0922713936a63f51f24e9f1c` in the manifests and lockfile. <!-- enforced by: `manifests_lockfile_and_readme_name_the_same_exact_contextdb_revision` -->
 
 Linux is required by `PR checks`; macOS runs in the separate, nonblocking `macOS advisory` workflow. See the [macOS qualification follow-up](.github/CI.md#macos-qualification-follow-up). <!-- enforced by: `cg_github_actions_workflow_runs_on_matrix_of_macos_latest_ubuntu_latest_and_documents_the_deliberate_windows_exclusion` -->
 

crates/cg-cli/Cargo.toml

@@ -43,7 +43,7 @@ cg-cli-conventions.workspace = true
 context-graph = { path = "../context-graph", features = ["fabric-sync"] }
 contextdb-core.workspace = true
 contextdb-engine.workspace = true
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh"] }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh"] }
 fs4.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
@@ -63,6 +63,6 @@ context-graph-cli = { path = ".", features = ["status-fault-injection"] }
 # compiled behind contextdb-engine's `test-seams` feature. This is a test-only activation — the
 # `cg` binary's own dependency edge on contextdb-engine does not enable it.
 contextdb-engine = { workspace = true, features = ["test-seams"] }
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh", "test-seams"] }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh", "test-seams"] }
 libc = "0.2"
 tempfile.workspace = true

crates/cg-cli/tests/cli_acceptance.rs

@@ -2690,25 +2690,19 @@ fn reply_extraction_engine_matches_recorded_envelopes() {
     let claude = extract_reply("claude", "json", CLAUDE_SUCCESS, None);
     assert_eq!(
         claude.as_deref(),
-        Ok(
-            "Host session proof received. I can answer through the logged-in Claude CLI; turn capture should stay off until ingestion ships."
-        ),
+        Ok("The logged-in Claude CLI returned this completion."),
         "claude JSON framing must extract /result"
     );
     let codex = extract_reply("codex", "file", "", Some(&codex_file));
     assert_eq!(
         codex.as_deref(),
-        Ok(
-            "Host session proof received. I can answer through this logged-in Codex CLI; no turn capture should begin until ingestion ships.\n"
-        ),
+        Ok("The logged-in Codex CLI returned this completion.\n"),
         "codex file framing must read --output-last-message"
     );
     let agy = extract_reply("agy", "text", AGY_PLAIN, None);
     assert_eq!(
         agy.as_deref(),
-        Ok(
-            "Host session proof received. I can answer through the local Agy CLI; capture remains disabled until ingestion ships.\n"
-        ),
+        Ok("The local Agy CLI returned this completion.\n"),
         "text framing returns the whole stdout"
     );
     let missing = extract_reply("claude", "json", "{\"type\":\"result\"}", None);

crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt

@@ -1 +1 @@
-Host session proof received. I can answer through the local Agy CLI; capture remains disabled until ingestion ships.
+The local Agy CLI returned this completion.

crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json

@@ -6,7 +6,7 @@
   "duration_ms": 2427,
   "duration_api_ms": 1896,
   "num_turns": 1,
-  "result": "Host session proof received. I can answer through the logged-in Claude CLI; turn capture should stay off until ingestion ships.",
+  "result": "The logged-in Claude CLI returned this completion.",
   "session_id": "6d8b4cb2-7f16-4c84-9e7f-9a43d7a51c30",
   "total_cost_usd": 0.000278,
   "usage": {

crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt

@@ -1 +1 @@
-Host session proof received. I can answer through this logged-in Codex CLI; no turn capture should begin until ingestion ships.
+The logged-in Codex CLI returned this completion.

crates/context-graph/Cargo.toml

@@ -44,7 +44,7 @@ chrono = { workspace = true, features = ["serde"] }
 contextdb-core.workspace = true
 contextdb-engine.workspace = true
 contextdb-parser.workspace = true
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh"], optional = true }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh"], optional = true }
 fs4.workspace = true
 pollster.workspace = true
 rayon.workspace = true
@@ -71,7 +71,7 @@ candle-nn.workspace = true
 candle-transformers.workspace = true
 cg-catalog = { path = "../cg-catalog", features = ["embeddinggemma-test-support"] }
 cg-connector-claude-code.workspace = true
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh", "test-seams"] }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh", "test-seams"] }
 contextdb-engine = { workspace = true, features = ["test-seams"] }
 contextdb-tx.workspace = true
 contextdb-vector = { workspace = true, features = ["test-seams"] }

crates/context-graph/tests/common/ci_stages.rs

@@ -262,7 +262,7 @@ fn model_contract_matches(
         && format!("{:x}", Sha256::digest(core.0))
             == "9feafef445a5364998c90178048e781f08b9840595a311f9f7bf620b2c0798d9"
         && format!("{:x}", Sha256::digest(core.1))
-            == "125356acd39f98d17aa3806ea4e94d3ae7ad7ba4d00e9399e6a184cf8cd70867"
+            == "175554cfa8b78e96def6645acce2ef8d6eea899ad3826d2f2355593d5df05c62"
 }
 
 fn shard_contract_is_frozen(script: &str) -> bool {
@@ -362,11 +362,11 @@ fn shard_contract_is_frozen(script: &str) -> bool {
         && format!(
             "{:x}",
             Sha256::digest(include_bytes!("../../../../Cargo.toml"))
-        ) == "ab995589c0159a218d0fd370a539c2994b6008e7e64b0d3e171062e6e0b11e85"
+        ) == "120776aefc6ae100986f4b51e837a64012df52604c3a2b59b14d3d0021a01520"
         && format!(
             "{:x}",
             Sha256::digest(include_bytes!("../../../../Cargo.lock"))
-        ) == "3d835eba6e63d7839a0eb78ca6715fb805a95509a8dcaf0df7fdc699907a9b84"
+        ) == "d08e10eb22f8394b21522c2d19b85d1a27b05bc7c3892a072acb8ef1167c02ec"
         && format!(
             "{:x}",
             Sha256::digest(include_bytes!(

scripts/tests/test_ci_model_seed.py

@@ -19,7 +19,7 @@ class SeedArtifact(unittest.TestCase):
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory()
         self.addCleanup(self.temp.cleanup)
-        self.root = Path(self.temp.name)
+        self.root = Path(self.temp.name).resolve()
         self.patch = mock.patch.object(seed, 'ROOT', self.root)
         self.patch.start()
         self.addCleanup(self.patch.stop)

scripts/tests/test_ci_shards.py

@@ -542,7 +542,7 @@ def test_isolated_audit_manifest_lock_and_source_boundary(self):
         lock_digest = 'e6a98ee802ad0f1e9e3696f87daa40c6b7a78c6bb9424f6472f1afd4a798a55f'
         def valid(body, lock_bytes, root_manifest):
             return (body == expected and hashlib.sha256(lock_bytes).hexdigest() == lock_digest
-                    and hashlib.sha256(root_manifest).hexdigest() == 'ab995589c0159a218d0fd370a539c2994b6008e7e64b0d3e171062e6e0b11e85')
+                    and hashlib.sha256(root_manifest).hexdigest() == '120776aefc6ae100986f4b51e837a64012df52604c3a2b59b14d3d0021a01520')
         self.assertTrue(valid(expected, lock.read_bytes(), (ROOT / 'Cargo.toml').read_bytes()))
         for key, value in [('edition', '2021'), ('autotests', True), ('publish', True)]:
             changed = copy.deepcopy(expected); changed['package'][key] = value