---
name: f027-trust-seam-groundtruth
description: "F-027 (ENDPOINT_SPAWN_FAIL) design ground truth — trust-config resolution is PER-ROOT (3 config roots via CLAUDE_CONFIG_DIR), backslash-key-ignored was a rig artifact, + spawn-fail taxonomy"
metadata: 
  node_type: memory
  type: reference
  originSessionId: 6381498d-5efd-4af4-835f-b4ef61197264
---

**Ground truth for F-027 pre-trust seam (verified on box HFENDULEAM 2026-07-03, sent to doyle as design input).**

**CORRECTION to the fwd-slash pin:** ALL of CC's own project keys in a `.claude.json` are FORWARD-SLASH (verified: 17/17, zero backslash). CC's writer emits forward-slash; CC matches trust by exact forward-slash key. The "backslash-keyed hasTrustDialogAccepted silently ignored" earlier was **my rig artifact** — my first seed script wrote a Windows backslash path as the key, which CC never matched. NOT a natural CC/harness writer. The surviving real pin: trust matches an EXACT string key (slash direction/casing/canonicalization mismatch → silent miss → wedge), and `endpoint run` prints ENDPOINT_RUN_STARTED while the harness sits wedged at the trust prompt, ready=false FOREVER, silent = the F-027 core.

**Account-root mechanism (CONCRETE):** the box has THREE separate CC config roots, each with its OWN `.claude.json` + per-project trust:
- `~/.claude.json` (default root)
- `~/.ccs/instances/bigscreen/.claude.json` (this session; `CLAUDE_CONFIG_DIR=C:\Users\decid\.ccs\instances\bigscreen`)
- `~/.ccs/instances/brandon/.claude.json` (second ccs account)
This is the ccs CLAUDE_CONFIG_DIR relocation (multi-account). Trust is PER-ROOT. The spt-hosted spawn resolves its trust file from `CLAUDE_CONFIG_DIR` (adapter `[env]` reads it) or default `~/.claude` when unset. FIELD EVIDENCE: si1-probe's spawned CC welcomed "Reavo", b6b-probe's welcomed "Brandon" — different roots resolved for two spawns same box. Seeding `~/.claude.json` took for si1 (default root resolved) but MISSED for b6b (different root) → wedge despite a valid-looking seed. INFERRED tie to doyle's CreateEnvironmentBlock mechanism: a DETACHED daemon spawn may DROP CLAUDE_CONFIG_DIR (session-local) → falls to default `~/.claude` (seed worked); a spawn that keeps/resolves a different CLAUDE_CONFIG_DIR reads another root (seed missed). **Design implication: a pre-trust seam MUST target the root the SPAWN resolves ($CLAUDE_CONFIG_DIR at spawn time, else default ~/.claude), not the operator shell's root — using the SAME resolution the spawn uses.**

**Spawn-fail taxonomy (observed this session unless noted):**
1. TRUST-WEDGE — CC at workspace-trust dialog, null stdin → ready=false forever, STARTED already printed, silent. (extensive)
2. TRUST-WEDGE / ACCOUNT-ROOT-MISMATCH — seeded in the wrong config root (above) → still wedges. (Reavo/Brandon)
3. PSYCHE-CRASHLOOP — nested psyche CC dies instantly at its trust dialog → wrapper respawns ~3/sec silent forever (F-h; ordinal 5358/30min; now guarded by v0.13.0 give-up + core C3(b)).
4. ADAPTER-UNRESOLVED — by-pid host resolve finds no adapter: "no registered adapter hosts 'bash.exe'". (loud, pre-spawn)
5. STALE-CLI-CONTRACT — bringup passes a removed flag (`api listen --manifest` gone in 0.22.0) → unexpected-argument, no spawn. (loud, pre-spawn)
6. rc-OFFLINE-AFTER-RELAUNCH — 2nd `endpoint run` same-id after tree-kill → STARTED prints but never binds, rc "offline". (si1 + b6, on 0.22.0). **VERIFIED FIXED on 0.23.0 (F-028 B1/B4): 2nd same-id run re-binds cleanly with a fresh session; tree-kill flips status→offline + perch record survives → re-run rebinds. Provenance fixed-note, NOT in the F-027 silent class.**
NOT observed: UAC-740/elevation spawn-fail (subnet create needed elevation, but that's not a spawn).
Token design steer: modes 1,2,3,6 are the DANGEROUS silent class (print STARTED/READY-ish then never bind) — a loud ENDPOINT_SPAWN_FAIL{reason} at bind-deadline-miss classifies all four; 4,5 already fail loud pre-spawn (the good shape to match).

**F-027 DESIGN (doyle draft @08d95d6, spt-core docs/F-027-ENDPOINT-SPAWN-FAIL-DESIGN.md, f028-runtruth branch — I did NOT read the tree; from doyle's summary):** Half A (core, todlando): bind-deadline honesty — ENDPOINT_RUN_STARTED moves to AFTER observed bind; deadline miss → `ENDPOINT_SPAWN_FAIL:{id}: reason={WEDGED_PRE_BIND|EXITED_PRE_BIND|NO_SESSION|PRE_SPAWN_FAIL}` on CLI stderr + nonzero exit + perch stamp (list/picker render, cleared on later bind). Half B (core executes, **I own the binary/seeder**): manifest `pre_spawn` key in `[session.<role>]`; broker runs it synchronously pre-spawn under the IDENTICAL env block the session spawn gets (env parity kills account-root-mismatch by construction), install-dir-first, bounded 30s, nonzero aborts spawn loud. My seeder: resolve root as the spawn will (CLAUDE_CONFIG_DIR from own env else ~/.claude), assert forward-slash exact trust key, idempotent.

**MY DESIGN-REVIEW ANSWERS (2026-07-03):** Q1 deadline = 60s default + per-node override (real binds <20s; every >20s bringup was a wedge that never bound → clean separation ≥30s; cold-broker-first-spawn caveat). Q2 = run pre_spawn ON [session.resume] TOO (resume is a distinct CC spawn that re-checks trust; INT-2 showed it re-wedged; not durable). Q3 = mode-6 FIXED on 0.23.0 (out of scope). Q4 = my `[env.CLAUDE_CONFIG_DIR] direction="read" value="~/.claude"` confirmed; **BINDING INVARIANT: the seeder must consume the PERCH-STAMPED CLAUDE_CONFIG_DIR captured at endpoint creation, NEVER its own process env — else parity breaks and account-root-mismatch returns via the back door.** **DESIGN FROZEN @56211da** (spt-core docs/F-027-ENDPOINT-SPAWN-FAIL-DESIGN.md, pushed; all 4 answers folded verbatim-faithful). **MY BUILD when the impl wave opens (post-F-029, doyle sequences+pings): the seeder contract = §3 Half-B tail + §5 adapter-side seed.** Core halves (bind-deadline honesty + pre_spawn exec) = todlando. Nothing on me until the ping.

Related: [[b6-liverepro-hunt]], [[counter43-rc-window]].