Intent: Build slice 0.5's harness as docs/slices.md sets it out and stone agreed: the one program reached four ways from inputs Fossil itself gives, which settles where hook output goes and gives the CGI arbitrary input without a browser.

Expression: spec/fixtures/fossil-2.27 holds what Fossil 2.27 gave an ext CGI, captured from a scratch repository served with --nojail and --extroot (an anonymous GET, a setup login's GET and its POST with a Referer; only the variables Fossil passes, a cookie's value scrubbed, paths, the repository and the program's name as placeholders), and the standard input an after-receive hook got for a forum post made in the browser. spec/ocx/harness_spec.cr replays them, any field or the body changed, as ocx2-cgi or ocx2-cgi-next, and runs the hook, MCP and the CLI. What the capture showed changed the code: Fossil passes an ext program the Referer but not Sec-Fetch-Site or Origin (azCgiEnv in its src/extcgi.c), so the same-site check, which needed Sec-Fetch-Site, refused every browser POST; the CGI now takes a change only from a POST whose Referer has the request's scheme and host, and the wrapper reads REQUEST_SCHEME, HTTP_HOST and HTTP_REFERER instead of HTTP_SEC_FETCH_SITE (the environment guard's list follows). The hook requires --log FILE, writes nothing to standard output (Fossil closes it unread), takes each line's first token as the artifact, and says on standard error only why it cannot log. Status names the checkout and the request fields the CGI read. docs/slices.md records the capture's findings (also that a GET leaves the CGI's standard input open, so the CGI reads exactly CONTENT_LENGTH bytes) and the request row; docs/interfaces.md's CGI row follows and is pinned by the harness too; the survey gives the hook's behavior to the harness spec with its new shape. Slice 0's list of data files that name source files is kept, shorter, so slices.md stays within 400 lines.

Demonstrates: harness_spec answers an anonymous GET as nobody with the fields read and not read, a setup GET as JSON valid against status's output schema, a setup POST taken by its captured Referer and refused with none, another host's or another scheme's, an accept with another body against a release root, the preview's forms, the hook's log line from the captured forum post with nothing on standard output and its refusals on standard error, and MCP and the CLI answering status with the same fields. crystal run ci.cr green, 133 examples, 100% coverage, 1 tool builds.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LvS1YtczzW32vo9g9CkGv2 check-in: 4f86166b27 user: opus-ocx2 tags: ocx2

Intent: stone in session: the log directory can always be mounted into future bwrap sessions. Expression: docs/slices.md's harness says the outer sandbox writes /var/log/ocx and a session's sandbox can have it bound in to read, instead of only the outer sandbox reaching it. Demonstrates: crystal run ci.cr green, 138 examples. Documents only.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LvS1YtczzW32vo9g9CkGv2 check-in: cce626447a user: opus-ocx2 tags: ocx2