[egerev]

Bare/native Android turns omitted owner_instruction and stringified task parameters, losing original words and restrictions. Deliver the five existing task-input fields losslessly, preserve natural replies, and reject changed typed input on the same request ID without another native turn. Provenance and enforced limits remain in transport/storage.

The first exact-head CI run also exposed test-process contamination: two in-process backup_runner.main call sites left umask0077 behind. Later root-owned namespace result files became0600 and unprivileged firewall tests could not read them. Restore the exact prior mask in finally at those two test boundaries; explicitly use022 only for synthetic namespace results inside private test directories. Production backup/firewall code, modes, assertions, timeout/error behavior and test identities remain unchanged.

Spec: ANYM-993, ANYM-971, ANYM-693, ANYM-727
Change path: AUTO (existing input-contract and narrowly allocated verification-fixture defects; no permissions, policy, CI or production change)
Review record: none (owner 11-11: no reviews)
Owner note: Original instructions and typed task values reach the Android agent alongside the goal.
Model: gpt-6.1-sol medium
Settle text: none

Validation:

• Failing-first synthetic exec stdin/native turn-start input tests and changed-type replay regression;93 focused Android core tests pass after the fixture fixes.
• Exact first-head CI run43412277217/attempt1: checks/verify passed; Python9/11 failed3 unchanged firewall tests with PermissionError reading root-created files. No rerun or bypass.
• Each implicated backup test independently passed but changed process umask022 to077, confirmed around its complete pytest protocol including teardown. After finally restoration,124 tests in the two full backup modules pass; every protocol retains its incoming mask.
• New ANYM-693 test_namespace_outputs_ignore_caller_umask_without_hiding_exit_or_errors first failed at actual inherited0077 vs expected0022. Genuine sudo/unshare/iptables and raw hook ran in a unique disposable container, with exit17 and stderr preserved. Full firewall module25 passed,0 skipped. An actual nonroot reader failed on original root0600 and read corrected root0644 inside its owned0700 directory. Parent0077 retained. This local fixture proof used container Python3.11; required CI verifies Python3.13. No host firewall or sudoers change. Task container stopped and removed.
• Ruff and conflict guard. No provider, model, phone or live session calls.

Baseline: source d72 and private retrospective confirm omitted owner_instruction. This slice proves protocol input delivery and test isolation only; no speed or live-order completion claim. Root owns native dialogue/tier/context followups and integrated same-goal live acceptance.

Undo: ordinary source revert. No deployment/runtime change occurred.

Spec impact:

• ANYM-993: keeps — complete original nonsecret input; ordinary natural-output contract retained; integrated acceptance remains open.
• ANYM-971: keeps — guarded lifecycle, identity and enforced limits; typed conflicts reject without another turn.
• ANYM-693: keeps — real namespace/iptables assertions, errors and timeouts remain; explicit synthetic output boundary survives restrictive caller mask.
• ANYM-727: keeps — existing backup-runner test assertions unchanged; caller process mask restored after in-process CLI entry.