test: prove composite host discovery isolation

[ScriptedAlchemy]

Summary

• prove every non-colliding built-in host pair preserves host-native bindings in either target order
• reject the Claude/Cursor frontmatter-bearing command collision with an AB4103 diagnostic that names the component and precedence risk
• repeat forbidden-discovery assertions through relocated and packed host installs

Host evidence

No adapter capability contract data changed. Existing pinned sources remain authoritative in packages/agent-bundle/src/adapters/capabilities/{claude,codex,cursor,portable}.json.

Local merge gate

Branch head 2a9e921a90 contains current origin/main 46e8e7d25a.

• pnpm build — pass
• pnpm typecheck — pass
• pnpm lint — pass (1,420 files, 88 rules)
• pnpm test:unit — pass (283 files; 4,223 passed, 6 skipped)
• pnpm build — pass (refreshed dist before integration pools)
• pnpm exec rstest --config rstest.config.ts packages/agent-bundle/tests/build-compose.test.ts packages/agent-bundle/tests/host-contract.test.ts packages/agent-bundle/tests/host-install-proof.test.ts packages/agent-bundle/tests/manifest-relocatable.test.ts packages/agent-bundle/tests/packed-host-install-proof.test.ts — pass (5 files; 47 passed, 1 opt-in host-contract check skipped)

Deslop

Deslop: GPT-5.6 Sol, 3 edits (kept discovery assertions in existing helpers; reused canonical projection/executable records instead of adding a catalog; flattened the final inspect assertion path).

Self-review

Reviewer: Claude Fable 5.1 Thinking High. First pass findings and disposition:

• Synthetic fixture not on the production path: dismissed. It is deliberately a labelled contract oracle for the Ponytail semantics; the adjacent real-host matrix, build/inspect, and both install-proof suites exercise production composition. Registering two synthetic adapters is itself rejected by the existing AB4106 contract.
• Invalid inspect result could skip assertions: fixed by failing unless the inspected manifest is valid.
• Root-level AB4103 paths were labelled root manifest: fixed to root and aligned the diagnostic docs.
• Changeset overstated behavior: fixed to describe only the AB4103 wording change.
• No byte-for-byte single-host baseline: dismissed. Composite wrappers intentionally gain host suffixes, so byte equality is not the invariant; fixed expected pointers plus required-own/forbidden-foreign bindings prove effective behavior.
• Pair list implied unconditional host support: fixed by renaming it to nonCollidingFixturePairs and qualifying Claude/Cursor rejection to this fixture's frontmatter-bearing command.

Second and post-main-refresh passes: no remaining merge risks. The sole cosmetic indentation note was fixed in 26f8e2f0b3; the complete local gate above passed on the branch containing current main.

Closes #651

[changeset-bot]

🦋 Changeset detected

Latest commit: 2a9e921

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@653

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@653

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@653

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@653

commit: 26f8e2f

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.