[trissim]

ACP and selected-native IDs were decoded again after ingress. Delete only the three plain-function repeats whose source and test callers already supply validated IDs. Keep both constructor checks and the native reader with raw test callers. BOUND-1: identity spelling is checked at entry, rather than re-established at internal hops.

Six-site result

All paths below are relative to src/agent_comms unless prefixed tests/. Line numbers identify the incoming source at 83bf48f; removed lines retain their old location for review.

Ordered site	Result	Every-caller evidence
acp_extension.py:681, PromptRequest.post_init	KEPT: first decode via FieldCodec at acp_extension.py:757	CommsRequest ingress invokes its declared request constructor. Direct QueuePromptRequest/SteerPromptRequest source and test constructors omit input_id and use Id128Text.mint at :675. The correction explicitly keeps constructor validation. acp_extension.py has no final diff.
queued_input.py:136, QueuedInput.capture	DELETED: supplied input_id passes through unchanged; None still mints	The one internal capture caller is QueuedInput.reserve at :180-182. Its supplied-ID source paths are input_drain.py:714-718 (decoded PromptRequest.input_id) and InitialInput.run at queued_input.py:559-563, reached from turn_runner.py:220-226 and acp.py:384-388. ACP request decode is acp_extension.py:757; its constructor check :681 remains. Every direct test capture/reserve/run caller omits input_id and takes the mint branch.
native_pi.py:341, NativeContextProof.read_evidence	KEPT: raw caller tests/test_native_pi.py:66 passes 'd' * 32 without a decoder; :62-63 also pass INPUT_ID, defined directly at :30	The safe production paths are native_pi.py:327 and attempt_recovery.py:477/572. Direct tests also occur in test_native_input_evidence_index.py:35, test_native_input_bus_path.py:50, test_native_evidence_custody.py:183/188, and the remaining test_native_pi.py reader cases. Their existence prevents claiming every caller crossed the typed boundary.
native_pi.py:891, read_tracked_input_commitment	DELETED	Only production caller native_prompt_binding.py:219 passes a PromptBinding selected at :206. The ID was validated before storage at :123 and its physical SQL key has the exact 32-hex constraint at :59-62. The only test caller, tests/test_selected_execution_native.py:268, passes proof.input_id from historical proof acquisition (:250), corroborated by the retained NativeContextProof reader. No direct raw call in src, tests or tools.
tracked_turn.py:293, TrackedTurnSession.execute	DELETED; unused Id128Text import deleted	Only caller private_send_claim.py:164 passes self.input_id. Its reserve path at :108-120 returns the ID only after bind_expected_prompt (:110), whose check is native_prompt_binding.py:123. SelectedRequest.reserve at selected_request.py:30 uses that reservation. No test/tools execution caller or direct PrivateSendClaim construction supplying raw IDs.
acp_extension.py:305, LiveCursorScope.post_init	KEPT: first decode via FieldCodec.decode_record at acp_extension.py:157 (record_type is LiveCursorScope at :289-290); also nested update decoding at :149	Production constructor private_registry_guard.py:329 passes the established namespace. Tests bypass decoding: tests/test_acp_extension.py:71, tests/test_runtime.py:94-96, tests/test_thread_identity.py:217-218 and tests/test_acp_queue_contract.py:168-169 supply literal root IDs. acp_extension.py has no final diff.

Caller inventory

Grepped all six entry points, their request/queue subclasses and forwarding callers across src, tests and tools before editing. Used the existing refactor-audit Package.load AST reader to inspect declarations, imports/aliases and call expressions: 454 source modules, 488 test modules and 10 tools modules parsed, zero omissions. This source inventory does not resolve arbitrary external callers or runtime rebinding.

Queued-input tests reviewed: native_backend_fixture.py:134; test_current_input_origin.py:123/128/185/190/215/264; test_owned_turn_goal_replacement.py:67/86; test_retained_context_operations.py:142; test_stack_native_compaction.py:322; test_stack_persistent_compaction.py:227/232/300. Every one omits input_id. Prompt constructors reviewed in test_acp_extension.py:136/137, test_acp_queue_contract.py:52/74/113 and test_current_input_origin.py:82 likewise use the declared mint default. External acp.schema.PromptRequest calls were distinguished by their imports, not confused with this Core family.

Final change

Only native_pi.py, queued_input.py and tracked_turn.py differ. No helper, wrapper, replacement guard, assert or exception handler added. No tests or files owned by #2914/#2934/#2933/#2935/#2927 changed. Tests were not run, per order.

Assumed: declared request decoding and the retained PromptRequest constructor own incoming IDs; None means mint a new queued ID; stored PromptBinding keys retain their declared SQL constraints; only the inspected repository callers are covered. No live runtime or store was changed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.