Align Entire preflight with supported checkpoint remote

[hudsonaikins]

Summary

• replace the unsupported Entire settings shape with the documented GitHub checkpoint remote
• require the project and effective Entire checkpoint remotes to match the private Tabellio control repository
• require committed project and effective automatic session pushing to remain disabled
• keep metadata-branch health verification read-only
• update focused tests and operator documentation

Root cause

Tabellio configured and enforced an unsupported checkpoints.primary shape. Entire CLI 0.7.7 rejected that field and reported the repository disabled, blocking agent and release preflight despite healthy checkpoint metadata.

Exact-head evidence

• candidate: f8c83777724a6e810aa2515810714cbfcff12d25
• Entire checkpoint: c55fc3895b17
• Tabellio validation: validation-9501dfb1-fae8-4745-bee9-88a729d58be1, 5/5 required validators passed, 115/115 tests, complete $0 cost telemetry
• Fallow new-only gate: passed; zero introduced dead code, complexity, or duplication
• focused preflight tests: 15/15 passed
• agent preflight: 11/11 required checks passed on exact candidate
• release preflight: all operational checks passed; expected clean-main blocker remains until merge
• hosted checks: Tests, Fallow changed-code, Package dry-run, and product validate passed on exact candidate
• Codex terminal re-review: no major issues on exact candidate
• evidence envelope: generated and validated; 5 changed files; external-action policy passed; no external actions attempted

Review repair

Codex exact-head review found one P2: project push_sessions: true could be masked by local false. Head f8c8377 now rejects project-level enablement independently and adds the masking regression case.

Commands

• npm run check
• node --test tests/preflight.test.mjs
• fallow audit --base origin/main --gate new-only --format json --quiet --explain
• node scripts/tabellio-validate.mjs gate --repo . --repo-id IntelIP/Tabellio --base origin/main --commit HEAD --manifest tabellio.validation.json --runner-id codex-entire-preflight-review-fix
• node scripts/tabellio-preflight.mjs --profile agent
• node scripts/tabellio-preflight.mjs --profile release
• npm pack --dry-run --json

External-action policy

No deploy, release, tag, npm publication, infrastructure, DNS, billing, live-money, production-data, or destructive workspace action performed. Merge remains separately approval-gated.

Review notes

Control-repository routing is security-sensitive. Please verify fail-closed handling for missing, malformed, locally overridden, mismatched, and auto-pushing Entire settings.

Official contract references: https://docs.entire.io/cli/configuration and https://github.com/entireio/cli.

[hudsonaikins]

@codex review using gpt-5.5. Review exact head 2248c0e. Focus on fail-closed Entire checkpoint transport, local overrides, automatic push disablement, and non-mutating metadata health verification.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2248c0e29c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2248c0e29c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[hudsonaikins]

@codex review using gpt-5.5. Re-review exact head f8c8377 after fixing the project push_sessions masking P2. Verify the committed project setting cannot be masked by local settings and check for regressions.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: f8c8377772

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".