@arbiterforge/ca-pi 0.15.1 → 0.15.3

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -26,6 +26,8 @@ than one SubagentStop; only the first is a review result.
 
 from __future__ import annotations
 
+from contextlib import contextmanager
+import errno
 import hashlib
 import json
 import os
@@ -63,6 +65,9 @@ REQUEST_RE = re.compile(r"[0-9a-f]{64}")
 TOKEN_RE = re.compile(r"[A-Za-z0-9_-]{12,128}")
 HOST_ID_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}")
 MAX_STATE = 1 << 20
+# Only terminal abandonment can read a legacy inline-context review this large.
+MAX_RECOVERY_STATE = 2 << 20
+REQUEST_LOCK_WAIT_SECONDS = 5.0
 MAX_OUTPUT = 8 << 20
 MAX_DECISION = 65536
 REGISTRY_PARENT = Path(tempfile.gettempdir())
@@ -71,6 +76,14 @@ CLAUDE_REVIEWER = "ca:authority-reviewer"
 CLAUDE_REVIEWER_MODELS = frozenset({"opus", "sonnet", "haiku"})
 CLAUDE_REVIEW_PROFILE = "claude-review/0.1.0"
 CODEX_REVIEW_PROFILE = "codex-review/0.1.0"
+CODEX_NATIVE_V1 = "codex-native-v1/0.145.0"
+CODEX_UUID_RE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
+CODEX_STEERING_TOOLS = frozenset({
+    "multi_agent_v1send_input", "multi_agent_v1resume_agent", "multi_agent_v1close_agent",
+})
+CODEX_REVIEW_TOOLS = frozenset({"spawn_agent", "collaborationspawn_agent"}) | CODEX_STEERING_TOOLS
+CODEX_CHILD_FORMAT = "codearbiter.codex-native-child/0.1.0"
+MAX_CHILD_MARKER = 4096
 # None means the real ~/.claude/agents (plus CLAUDE_CONFIG_DIR/agents); tests
 # point it at a fixture directory.
 CLAUDE_USER_AGENT_DIR: Path | None = None
@@ -253,27 +266,129 @@ def _spool_root(root: Path) -> Path:
         raise AuthorityError("AUTHORITY_BUSY", "resolved git-common authority spool is unavailable") from exc
 
 
+@contextmanager
+def _request_lock(spool: Path, relative: Path):
+    """Keep one OS-owned lock inode for all writers of this request."""
+    path = spool / f"{relative.name}.lock"
+    fd = None
+
+    def check_path() -> None:
+        info = path.lstat()
+        if (
+            stat.S_ISLNK(info.st_mode)
+            or getattr(info, "st_file_attributes", 0) & 0x400
+            or not stat.S_ISREG(info.st_mode)
+        ):
+            raise OSError("request lock path is unsafe")
+        if fd is not None:
+            opened = os.fstat(fd)
+            if (info.st_dev, info.st_ino) != (opened.st_dev, opened.st_ino):
+                raise OSError("request lock path changed")
+
+    try:
+        check_path()
+    except FileNotFoundError:
+        pass
+    flags = (
+        os.O_RDWR | os.O_CREAT | getattr(os, "O_BINARY", 0)
+        | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+    )
+    fd = os.open(path, flags, 0o600)
+    locked = False
+    try:
+        check_path()
+        deadline = time.monotonic() + REQUEST_LOCK_WAIT_SECONDS
+        if os.name == "nt":
+            import msvcrt
+        else:
+            import fcntl
+        while True:
+            try:
+                if os.name == "nt":
+                    # Windows permits a byte-range lock beyond EOF. Never seed
+                    # or truncate the lock file, including on an unsafe path.
+                    os.lseek(fd, 0, os.SEEK_SET)
+                    msvcrt.locking(fd, msvcrt.LK_NBLCK, 1)
+                else:
+                    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                locked = True
+                break
+            except OSError as exc:
+                if (
+                    exc.errno not in {errno.EACCES, errno.EAGAIN, errno.EDEADLK, 36}
+                    and getattr(exc, "winerror", None) not in {32, 33}
+                ):
+                    raise
+                if time.monotonic() >= deadline:
+                    raise AuthorityError("AUTHORITY_BUSY", "request transition lock timed out") from exc
+                time.sleep(0.01)
+        check_path()
+        yield
+    finally:
+        try:
+            if locked:
+                if os.name == "nt":
+                    os.lseek(fd, 0, os.SEEK_SET)
+                    msvcrt.locking(fd, msvcrt.LK_UNLCK, 1)
+                else:
+                    fcntl.flock(fd, fcntl.LOCK_UN)
+        finally:
+            os.close(fd)
+        # Do not unlink: a peer may already be waiting on this same inode.
+
+
 def _save(root: Path, value: dict[str, Any]) -> None:
-    value = dict(value)
-    value["integrity_sha256"] = _integrity(value)
+    expected = value.get("integrity_sha256")
+    updated = dict(value)
+    updated["integrity_sha256"] = _integrity(updated)
     try:
-        _atomic_replace(_spool_root(root), _request_path(value["request_id"]), _canonical(value))
-        if value["state"] in TERMINAL_STATES:
-            (_registry_root() / f"{value['request_id']}.json").unlink(missing_ok=True)
+        spool = _spool_root(root)
+        relative = _request_path(value["request_id"])
+        with _request_lock(spool, relative):
+            try:
+                (spool / relative).lstat()
+            except FileNotFoundError:
+                if expected is not None:
+                    raise AuthorityError("STALE_AUTHORITY_REQUEST", "loaded request state disappeared")
+            else:
+                if expected is None:
+                    raise AuthorityError("STALE_AUTHORITY_REQUEST", "request state already exists")
+                legacy_abandonment = (
+                    value["state"] == "ABANDONED"
+                    and value["activity"] in REVIEW_ACTIVITIES
+                    and value.get("recovery") == {
+                        "disposition": "abandoned", "previous_attempt": None, "rerun_permitted": False,
+                    }
+                )
+                current = _load(root, value["request_id"], recover_armed_review=legacy_abandonment)
+                if current["integrity_sha256"] != expected:
+                    raise AuthorityError("STALE_AUTHORITY_REQUEST", "request state changed since it was loaded")
+            _atomic_replace(spool, relative, _canonical(updated))
+            # A live operation can save several times without loading again.
+            value["integrity_sha256"] = updated["integrity_sha256"]
+            if value["state"] in TERMINAL_STATES:
+                (_registry_root() / f"{value['request_id']}.json").unlink(missing_ok=True)
     except OSError as exc:
         raise AuthorityError("AUTHORITY_BUSY", "request state could not be written") from exc
 
 
-def _load(root: Path, request_id: str) -> dict[str, Any]:
+def _load(
+    root: Path, request_id: str, *, recover_armed_review: bool = False
+) -> dict[str, Any]:
     path = _spool_root(root) / _request_path(request_id)
+    limit = MAX_RECOVERY_STATE if recover_armed_review else MAX_STATE
     try:
         info = path.lstat()
         reparse = getattr(info, "st_file_attributes", 0) & 0x400
         if stat.S_ISLNK(info.st_mode) or reparse or not stat.S_ISREG(info.st_mode):
             raise OSError("not regular")
-        if info.st_size > MAX_STATE:
+        if info.st_size > limit:
+            raise OSError("oversized")
+        with path.open("rb") as stream:
+            raw = stream.read(limit + 1)
+        if len(raw) > limit:
             raise OSError("oversized")
-        value = json.loads(path.read_text(encoding="utf-8"))
+        value = json.loads(raw.decode("utf-8"))
     except (OSError, UnicodeError, ValueError) as exc:
         raise AuthorityError("INVALID_AUTHORITY_STATE", "request state is unreadable") from exc
     allowed = {
@@ -282,7 +397,7 @@ def _load(root: Path, request_id: str) -> dict[str, Any]:
         "observation_sha256", "receipt", "integrity_sha256", "payload",
         "authority_source", "dispatch_prompt", "review_contract_sha256",
         "required_coverage", "wrapper", "command_bindings", "recovery",
-        "launch_envelope", "workspace_roots", "host",
+        "launch_envelope", "workspace_roots", "host", "codex_review_profile",
     }
     if (
         not isinstance(value, dict)
@@ -303,6 +418,17 @@ def _load(root: Path, request_id: str) -> dict[str, Any]:
         or SHA256_RE.fullmatch(value.get("context_sha256", "")) is None
     ):
         raise AuthorityError("INVALID_AUTHORITY_STATE", "request state failed validation")
+    if "codex_review_profile" in value and (
+        value["codex_review_profile"] != CODEX_NATIVE_V1
+        or value.get("host", "codex") != "codex"
+        or value["activity"] not in REVIEW_ACTIVITIES
+    ):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "Codex review profile is unsupported")
+    if len(raw) > MAX_STATE:
+        try:
+            _validate_legacy_review_recovery(root, value)
+        except (AuthorityError, KeyError, TypeError, ValueError) as exc:
+            raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy review recovery binding failed") from exc
     return value
 
 
@@ -312,6 +438,27 @@ def _validate_hash(value: Any, field: str) -> str:
     return value
 
 
+def _read_context(root: Path, context_ref: str, context_hash: str) -> dict[str, Any]:
+    _validate_hash(context_hash, "context_sha256")
+    expected_ref = f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
+    if context_ref != expected_ref:
+        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context locator is not content addressed")
+    try:
+        raw = (root / expected_ref).read_bytes()
+        context = json.loads(raw.decode("utf-8"))
+    except (OSError, UnicodeError, ValueError) as exc:
+        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes are unavailable") from exc
+    if not isinstance(context, dict) or _digest(raw) != context_hash or raw != _canonical(context):
+        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes changed or are not canonical")
+    return context
+
+
+def _require_frozen_context(root: Path, request: dict[str, Any]) -> None:
+    context = _read_context(root, request["context_ref"], request["context_sha256"])
+    if context != request["context"]:
+        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "frozen context differs from the request")
+
+
 def _context(
     root: Path, client: Any, artifact_id: str, record_id: str, activity: str
 ) -> tuple[dict[str, Any], str, str]:
@@ -322,16 +469,14 @@ def _context(
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "engine context result is malformed")
     context_hash = _validate_hash(result.get("context_sha256"), "context_sha256")
     context_ref = result.get("context_ref")
-    expected_ref = f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
-    if context_ref != expected_ref:
-        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context locator is not content addressed")
-    try:
-        raw = (root / expected_ref).read_bytes()
-        context = json.loads(raw.decode("utf-8"))
-    except (OSError, UnicodeError, ValueError) as exc:
-        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes are unavailable") from exc
-    if _digest(raw) != context_hash or raw != _canonical(context):
-        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes changed or are not canonical")
+    context = _read_context(root, context_ref, context_hash)
+    _validate_context(context, artifact_id, record_id, activity)
+    return context, context_ref, context_hash
+
+
+def _validate_context(
+    context: dict[str, Any], artifact_id: str, record_id: str, activity: str
+) -> None:
     subject = context.get("subject") if isinstance(context, dict) else None
     if (
         not isinstance(context, dict)
@@ -339,7 +484,9 @@ def _context(
         or not isinstance(subject, dict)
         or subject.get("artifact_id") != artifact_id
         or subject.get("record_id") != record_id
-        or context["activity"] != activity
+        or context.get("activity") != activity
+        or not isinstance(artifact_id, str)
+        or not isinstance(record_id, str)
         or not ID_RE.fullmatch(artifact_id)
         or not ID_RE.fullmatch(record_id)
     ):
@@ -380,7 +527,6 @@ def _context(
         _validate_hash(context.get("base_input_sha256"), "base_input_sha256")
         if not isinstance(context.get("task_hashes"), dict) or not isinstance(context.get("tasks"), list):
             raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "quality-review scope is incomplete")
-    return context, context_ref, context_hash
 
 
 def _review_binding(context: dict[str, Any]) -> tuple[str, list[str]]:
@@ -403,6 +549,69 @@ def _review_binding(context: dict[str, Any]) -> tuple[str, list[str]]:
     return _digest(_canonical(contract)), coverage
 
 
+def _never_launched_review(request: dict[str, Any]) -> bool:
+    return (
+        request["state"] == "ARMED"
+        and request["activity"] in REVIEW_ACTIVITIES
+        and all(field in request and request[field] is None for field in (
+            "attempt", "launch", "observation_ref", "observation_sha256", "receipt", "wrapper", "recovery",
+        ))
+        and "payload" not in request
+        and "authority_source" not in request
+    )
+
+
+def _validate_legacy_review_recovery(root: Path, request: dict[str, Any]) -> None:
+    """Admit only the old duplicate-context shape, solely to retain and abandon it."""
+    if not _never_launched_review(request) or request["repository"] != _repository_identity(root):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy request is not an unlaunched review")
+    context = request["context"]
+    subject = context["subject"]
+    _validate_context(context, subject["artifact_id"], subject["record_id"], request["activity"])
+    context_hash = _digest(_canonical(context))
+    records = [context["task"]] if request["activity"] == "spec_review" else context["tasks"]
+    if any(not isinstance(record, dict) for record in records):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy review records are malformed")
+    contract_hash, coverage = _review_binding(context)
+    if (
+        request["context_sha256"] != context_hash
+        or request["context_ref"] != f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
+        or request.get("review_contract_sha256") != contract_hash
+        or request.get("required_coverage") != coverage
+        or request.get("command_bindings") != []
+        or request.get("workspace_roots") != {}
+    ):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy review context binding differs")
+    # Recovery validates the retained snapshot; it neither recreates absent
+    # evidence files nor upgrades the legacy prompt into launchable authority.
+    prompt = _dispatch_prompt(request, legacy_inline=True)
+    # Qualified Codex 0.13.11 predates both the host field and JSON-only suffix.
+    # Admit that one exact earlier form, without normalizing retained text.
+    original_prompt = request.get("dispatch_prompt")
+    if (
+        "host" not in request
+        and isinstance(original_prompt, str)
+        and original_prompt + " Reply with the JSON object only: no code fence and no other text." == prompt
+    ):
+        prompt = original_prompt
+    if not isinstance(request.get("launch_envelope"), dict):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy launch envelope is malformed")
+    if request.get("host", "codex") == "claude":
+        model = request["launch_envelope"].get("model")
+        if model not in CLAUDE_REVIEWER_MODELS:
+            raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy reviewer model is unsupported")
+        envelope = {
+            "description": f"codeArbiter {request['activity']} {request['request_id'][:12]}",
+            "prompt": prompt, "subagent_type": CLAUDE_REVIEWER, "model": model,
+        }
+    else:
+        envelope = {
+            "message": prompt, "task_name": f"authority_{request['request_id'][:12]}", "fork_turns": "none",
+        }
+    if request.get("dispatch_prompt") != prompt or request.get("launch_envelope") != envelope:
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "legacy launch envelope differs")
+
+
 def _repository_identity(root: Path) -> dict[str, str]:
     info = os.stat(root)
     return {
@@ -895,15 +1104,34 @@ def _workspace_snapshots(bindings: list[dict[str, Any]]) -> list[dict[str, str]]
     return [unique[key] for key in sorted(unique)]
 
 
-def _dispatch_prompt(request: dict[str, Any]) -> str:
+def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) -> str:
     context = request["context"]
+    if legacy_inline:
+        # Used only to validate an oversized historical request for abandonment.
+        target = "Frozen target data follows as canonical JSON:\n" + _canonical(context).decode("ascii") + "\n"
+    else:
+        target = (
+            f"Review activity: {request['activity']}; subject: "
+            f"{context['subject']['artifact_id']}/{context['subject']['record_id']}\n"
+            "Read the frozen context from that repository-relative path before reviewing. "
+            "The adapter verifies its exact digest before launch and publication. Inspect its "
+            "activity, subject, input_sha256, task definitions and criterion coverage against "
+            "these bindings, then inspect the input manifest and referenced target files. "
+            "Do not pass if the evidence is missing, unreadable or inconsistent. The locator "
+            "is a reference to the complete immutable evidence, not replacement authority.\n"
+        )
+    profile = (
+        f"Native review profile: {CODEX_NATIVE_V1}. This review was dispatched through "
+        "multi_agent_v1.spawn_agent with default role and fork_context=false. Read-only conduct is cooperative; "
+        "these settings do not provide an OS sandbox.\n"
+        if request.get("codex_review_profile") == CODEX_NATIVE_V1 else ""
+    )
     return (
         f"[CODEARBITER_AUTHORITY_REQUEST:{request['request_id']}]\n"
         f"Target repository: {request['repository']['path']}\n"
         f"Frozen context: {request['context_ref']} sha256={request['context_sha256']}\n"
-        "Frozen target data follows as canonical JSON:\n"
-        + _canonical(context).decode("ascii") + "\n"
-        "Act as a fresh read-only independent codeArbiter reviewer. Do not edit files or "
+        + target + profile
+        + "Act as a fresh read-only independent codeArbiter reviewer. Do not edit files or "
         "delegate. Review only the frozen target and return exactly one JSON object using "
         f"format {DECISION_FORMAT}. Bind request_id={request['request_id']}, "
         f"target_sha256={context['input_sha256']}, "
@@ -927,6 +1155,7 @@ def arm_request(
     workspace_roots: dict[str, str | Path] | None = None,
     host: str = "codex",
     reviewer_model: str = "opus",
+    codex_review_profile: str | None = None,
     **unexpected: Any,
 ) -> dict[str, Any]:
     if unexpected:
@@ -940,6 +1169,10 @@ def arm_request(
         raise AuthorityError("INVALID_AUTHORITY_REQUEST", "host is unsupported")
     if host == "claude" and reviewer_model not in CLAUDE_REVIEWER_MODELS:
         raise AuthorityError("INVALID_AUTHORITY_REQUEST", "reviewer model is unsupported")
+    if codex_review_profile is not None and (
+        codex_review_profile != "native-v1" or host != "codex" or activity not in REVIEW_ACTIVITIES
+    ):
+        raise AuthorityError("INVALID_AUTHORITY_REQUEST", "Codex review profile is unsupported")
     root = _real_root(root)
     if host == "claude" and activity in REVIEW_ACTIVITIES:
         _refuse_shadowed_reviewer(root)
@@ -965,6 +1198,8 @@ def arm_request(
     }
     if host != "codex":
         seed_value["host"] = host
+    if codex_review_profile is not None:
+        seed_value["codex_review_profile"] = CODEX_NATIVE_V1
     seed = _canonical(seed_value)
     request_id = _digest(seed)
     request = {
@@ -988,6 +1223,8 @@ def arm_request(
     }
     if host != "codex":
         request["host"] = host
+    if codex_review_profile is not None:
+        request["codex_review_profile"] = CODEX_NATIVE_V1
     if activity in REVIEW_ACTIVITIES:
         request["review_contract_sha256"], request["required_coverage"] = _review_binding(context)
         request["dispatch_prompt"] = _dispatch_prompt(request)
@@ -998,6 +1235,10 @@ def arm_request(
                 "subagent_type": CLAUDE_REVIEWER,
                 "model": reviewer_model,
             }
+        elif codex_review_profile is not None:
+            request["launch_envelope"] = {
+                "message": request["dispatch_prompt"], "fork_context": False,
+            }
         else:
             request["launch_envelope"] = {
                 "message": request["dispatch_prompt"],
@@ -1016,6 +1257,8 @@ def arm_request(
         result["review_contract_sha256"] = request["review_contract_sha256"]
         result["required_coverage"] = request["required_coverage"]
         result["launch_envelope"] = request["launch_envelope"]
+        if codex_review_profile is not None:
+            result["codex_review_profile"] = CODEX_NATIVE_V1
     return result
 
 
@@ -1842,8 +2085,8 @@ def _parse_decision(raw: Any, request: dict[str, Any]) -> dict[str, Any]:
     if not isinstance(raw, str) or len(raw.encode("utf-8")) > MAX_DECISION:
         raise AuthorityError("INVALID_REVIEW_DECISION", "review decision is absent or oversized")
     try:
-        value = json.loads(raw)
-    except ValueError as exc:
+        value = json.loads(raw, object_pairs_hook=_unique_json_pairs, parse_constant=_invalid_json_constant)
+    except (ValueError, RecursionError) as exc:
         raise AuthorityError("INVALID_REVIEW_DECISION", "review decision is not JSON") from exc
     expected = {
         "format", "request_id", "target_sha256", "contract_sha256", "decision",
@@ -1861,6 +2104,7 @@ def _parse_decision(raw: Any, request: dict[str, Any]) -> dict[str, Any]:
         or not isinstance(value.get("assessment"), str)
         or not value["assessment"].strip()
         or not isinstance(value.get("coverage"), list)
+        or any(not isinstance(item, str) or not item for item in value["coverage"])
         or len(set(value["coverage"])) != len(value["coverage"])
         or not isinstance(value.get("findings"), list)
     ):
@@ -1882,13 +2126,329 @@ def _parse_decision(raw: Any, request: dict[str, Any]) -> dict[str, Any]:
     return value
 
 
+def _codex_uuid(value: Any) -> str:
+    if not isinstance(value, str) or CODEX_UUID_RE.fullmatch(value) is None:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child identity is not a UUID")
+    return value
+
+
+def _codex_native_marker(agent_id: str) -> Path:
+    # UUID, not arrival order or session, is the direct host-observed join key.
+    # Retaining this marker also prevents reuse across requests and sessions.
+    key = _digest(_canonical({"profile": CODEX_NATIVE_V1, "agent_id": _codex_uuid(agent_id)}))
+    return _registry_root() / f"codex-native-{key}.marker"
+
+
+def _codex_claimed(agent_id: str, kind: str) -> bool:
+    path = _codex_native_marker(agent_id).with_suffix("." + kind)
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        return False
+    if (stat.S_ISLNK(info.st_mode) or getattr(info, "st_file_attributes", 0) & 0x400
+            or not stat.S_ISREG(info.st_mode) or info.st_size != 0):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native child event claim is unsafe")
+    return True
+
+
+def _claim_codex_event(agent_id: str, kind: str) -> bool:
+    """Atomic, single-use refusal evidence independent of the child mutex.
+
+    Zero-byte claims grant no authority. They retain the first lifecycle attempt
+    even when its marker lock times out or its process dies before joining.
+    """
+    path = _codex_native_marker(agent_id).with_suffix("." + kind)
+    try:
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0), 0o600)
+    except FileExistsError:
+        _codex_claimed(agent_id, kind)
+        return False
+    except OSError as exc:
+        raise AuthorityError("AUTHORITY_BUSY", "native child first event could not be retained") from exc
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+    return True
+
+
+def _read_codex_child(path: Path, agent_id: str, session_id: str) -> dict[str, Any]:
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        return {
+            "format": CODEX_CHILD_FORMAT, "agent_id": agent_id, "session_id": session_id,
+            "request_id": None, "start": None, "stop_seen": False, "rejected": False,
+        }
+    if (stat.S_ISLNK(info.st_mode) or getattr(info, "st_file_attributes", 0) & 0x400
+            or not stat.S_ISREG(info.st_mode) or info.st_size > MAX_CHILD_MARKER):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child marker is unsafe")
+    flags = os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0)
+    with os.fdopen(os.open(path, flags), "rb") as stream:
+        opened = os.fstat(stream.fileno())
+        if (opened.st_dev, opened.st_ino) != (info.st_dev, info.st_ino):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child marker changed")
+        raw = stream.read(MAX_CHILD_MARKER + 1)
+    try:
+        value = json.loads(raw, object_pairs_hook=_unique_json_pairs, parse_constant=_invalid_json_constant)
+    except (ValueError, UnicodeError) as exc:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child marker is unreadable") from exc
+    start = value.get("start") if isinstance(value, dict) else None
+    if (
+        len(raw) > MAX_CHILD_MARKER or not isinstance(value, dict)
+        or set(value) != {"format", "agent_id", "session_id", "request_id", "start", "stop_seen",
+                          "rejected", "integrity_sha256"}
+        or value.get("format") != CODEX_CHILD_FORMAT or value.get("agent_id") != agent_id
+        or not isinstance(value.get("session_id"), str) or not HOST_ID_RE.fullmatch(value["session_id"])
+        or (value.get("request_id") is not None and (
+            not isinstance(value["request_id"], str) or not REQUEST_RE.fullmatch(value["request_id"])))
+        or type(value.get("stop_seen")) is not bool or type(value.get("rejected")) is not bool
+        or value.get("integrity_sha256") != _integrity(value)
+        or (start is not None and (
+            not isinstance(start, dict) or set(start) != {"turn_id", "agent_type"}
+            or start.get("agent_type") != "default" or not isinstance(start.get("turn_id"), str)
+            or not CODEX_UUID_RE.fullmatch(start["turn_id"])))
+    ):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child marker failed validation")
+    return value
+
+
+def _write_codex_child(path: Path, child: dict[str, Any]) -> None:
+    child["integrity_sha256"] = _integrity(child)
+    raw = _canonical(child)
+    if len(raw) > MAX_CHILD_MARKER:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child marker is oversized")
+    _atomic_replace(path.parent, Path(path.name), raw)
+
+
+@contextmanager
+def _codex_child_lock(agent_id: str, session_id: str):
+    path = _codex_native_marker(agent_id)
+    try:
+        with _request_lock(path.parent, Path(path.name)):
+            yield path, _read_codex_child(path, agent_id, session_id)
+    except OSError as exc:
+        raise AuthorityError("AUTHORITY_BUSY", "native Codex child transition is unavailable") from exc
+
+
+def _codex_native_refuse(root: Path, request: dict[str, Any], reason: str) -> None:
+    if request["state"] in {"LAUNCHING", "RUNNING"}:
+        _reject(root, request, reason)
+    raise AuthorityError("UNSUPPORTED_HOST_SEAM", reason)
+
+
+def _codex_native_post(event: dict[str, Any], root: Path, request: dict[str, Any]) -> dict[str, Any]:
+    try:
+        return _codex_native_post_join(event, root, request)
+    except (AuthorityError, ValueError, TypeError, RecursionError) as exc:
+        # S/P/C has already identified this exact call. Its first failed Post
+        # cannot be discarded in favor of a later successful replacement.
+        current = _load(root, request["request_id"])
+        if current["state"] in {"LAUNCHING", "RUNNING"}:
+            _reject(root, current, "invalid-first-native-review-post")
+        if isinstance(exc, AuthorityError):
+            raise
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result is malformed") from exc
+
+
+def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str, Any]) -> dict[str, Any]:
+    if _canonical(event.get("tool_input")) != _canonical(request["launch_envelope"]):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native review PostToolUse envelope was changed")
+    _require_frozen_context(root, request)
+    raw = event.get("tool_response")
+    if not isinstance(raw, str) or len(raw.encode("utf-8")) > MAX_DECISION:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result must be a bounded JSON string")
+    try:
+        response = json.loads(raw, object_pairs_hook=_unique_json_pairs, parse_constant=_invalid_json_constant)
+    except ValueError as exc:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result is not strict JSON") from exc
+    if (not isinstance(response, dict) or set(response) != {"agent_id", "nickname"}
+            or (response["nickname"] is not None and (
+                not isinstance(response["nickname"], str) or len(response["nickname"]) > 256))):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result fields are unsupported")
+    agent_id = _codex_uuid(response.get("agent_id"))
+    session_id = request["launch"]["parent_session_id"]
+    with _codex_child_lock(agent_id, session_id) as (path, child):
+        request = _load(root, request["request_id"])
+        if request["state"] != "LAUNCHING" or request["launch"].get("post_confirmed"):
+            _codex_native_refuse(root, request, "native reviewer launch was already associated")
+        if child["request_id"] is not None or child["session_id"] != session_id:
+            _codex_native_refuse(root, request, "native reviewer UUID was already used")
+        child["request_id"] = request["request_id"]
+        _write_codex_child(path, child)
+        if (child["rejected"] or child["stop_seen"] or _codex_claimed(agent_id, "failed")
+                or _codex_claimed(agent_id, "stop") or (child["start"] is not None
+                and child["start"]["turn_id"] == request["launch"]["parent_turn_id"])):
+            _codex_native_refuse(root, request, "native reviewer stopped or conflicted before association")
+        launch = request["launch"]
+        launch.update(agent_id=agent_id, post_confirmed=True)
+        if child["start"] is not None:
+            launch.update(child_turn_id=child["start"]["turn_id"], agent_type="default")
+            request["state"] = "RUNNING"
+        _save(root, request)
+        return {"request_id": request["request_id"], "state": request["state"]}
+
+
+def _codex_review_complete(root: Path, request: dict[str, Any], agent_id: str, decision: dict[str, Any]) -> dict[str, Any]:
+    payload = {
+        "input_sha256": request["context"]["input_sha256"],
+        "spec_sha256": request["context"]["spec_sha256"], "assessment": decision["assessment"],
+    }
+    if request["activity"] == "spec_review":
+        payload["task_sha256"] = request["context"]["task_sha256"]
+    else:
+        payload["base_input_sha256"] = request["context"]["base_input_sha256"]
+        payload["task_hashes"] = request["context"]["task_hashes"]
+    observation = _closed_observation(
+        request, payload, request.get("codex_review_profile", CODEX_REVIEW_PROFILE), agent_id,
+        {"launch": request["launch"], "decision": decision},
+    )
+    _observation(root, request, observation)
+    request["payload"] = payload
+    request["state"] = "COMPLETED"
+    _save(root, request)
+    return {"request_id": request["request_id"], "state": "COMPLETED"}
+
+
+def _codex_native_lifecycle(event: dict[str, Any]) -> dict[str, Any] | None:
+    agent_id = _codex_uuid(event.get("agent_id"))
+    try:
+        kind = "start" if event["hook_event_name"] == "SubagentStart" else "stop"
+        if not _claim_codex_event(agent_id, kind):
+            _claim_codex_event(agent_id, "failed")
+        return _codex_native_lifecycle_join(event)
+    except (AuthorityError, OSError) as exc:
+        _claim_codex_event(agent_id, "failed")
+        for root, request in _registered_requests():
+            if (request.get("codex_review_profile") == CODEX_NATIVE_V1
+                    and request["state"] in {"LAUNCHING", "RUNNING"}
+                    and (request.get("launch") or {}).get("agent_id") == agent_id):
+                _reject(root, request, "failed-native-review-lifecycle")
+        if isinstance(exc, AuthorityError):
+            raise
+        raise AuthorityError("AUTHORITY_BUSY", "native child lifecycle could not be retained") from exc
+
+
+def _codex_native_lifecycle_join(event: dict[str, Any]) -> dict[str, Any] | None:
+    agent_id = _codex_uuid(event.get("agent_id"))
+    observed_session = event.get("session_id")
+    session_valid = isinstance(observed_session, str) and HOST_ID_RE.fullmatch(observed_session) is not None
+    # A malformed first event with a known child UUID still consumes that
+    # child's evidence. Do not discard it and accept a later replacement Stop.
+    session_id = observed_session if session_valid else "invalid-session"
+    name = event["hook_event_name"]
+    with _codex_child_lock(agent_id, session_id) as (path, child):
+        start = child["start"]
+        valid = (
+            session_valid and child["session_id"] == session_id and not child["rejected"] and not child["stop_seen"]
+            and not _codex_claimed(agent_id, "failed")
+            and event.get("agent_type") == "default" and isinstance(event.get("turn_id"), str)
+            and CODEX_UUID_RE.fullmatch(event["turn_id"]) is not None
+        )
+        if name == "SubagentStart":
+            valid = valid and start is None
+            if valid:
+                child["start"] = {"turn_id": event["turn_id"], "agent_type": "default"}
+        else:
+            valid = (valid and start is not None and start["turn_id"] == event.get("turn_id")
+                     and event.get("stop_hook_active") is False and child["request_id"] is not None)
+            # First stop is durable even before Post associates the UUID. A later
+            # follow-up turn/result can never replace evidence we could not join.
+            child["stop_seen"] = True
+        child["rejected"] = child["rejected"] or not valid
+        _write_codex_child(path, child)
+        if child["request_id"] is None:
+            return None
+        root, request = _registered_request(child["request_id"])
+        launch = request.get("launch") or {}
+        if (not valid or request.get("codex_review_profile") != CODEX_NATIVE_V1
+                or launch.get("parent_session_id") != child["session_id"]
+                or launch.get("agent_id") != agent_id or launch.get("post_confirmed") is not True
+                or event.get("turn_id") == launch.get("parent_turn_id")):
+            _codex_native_refuse(root, request, "native reviewer lifecycle is conflicting or out of order")
+        if name == "SubagentStart":
+            if request["state"] != "LAUNCHING":
+                _codex_native_refuse(root, request, "native reviewer start was repeated")
+            launch.update(child_turn_id=event["turn_id"], agent_type="default")
+            request["state"] = "RUNNING"
+            _save(root, request)
+            return {"request_id": request["request_id"], "state": "RUNNING"}
+        if (request["state"] != "RUNNING" or launch.get("child_turn_id") != event["turn_id"]
+                or launch.get("agent_type") != "default"):
+            _codex_native_refuse(root, request, "native reviewer stop is out of order")
+        try:
+            _require_frozen_context(root, request)
+            decision = _parse_decision(event.get("last_assistant_message"), request)
+        except (AuthorityError, TypeError, ValueError, RecursionError) as exc:
+            _reject(root, request, "invalid-first-native-review-stop")
+            if isinstance(exc, AuthorityError):
+                raise
+            raise AuthorityError("INVALID_REVIEW_DECISION", "native first review decision is malformed") from exc
+        launch["first_stop"] = True
+        return _codex_review_complete(root, request, agent_id, decision)
+
+
+def _codex_steering_uuid(value: Any) -> str | None:
+    # Pinned Codex uses uuid 1.20.0 parse_str: simple, hyphenated, braced,
+    # and lowercase urn:uuid: prefix; hex digits may use either case.
+    # This normalization is solely for denying steering, never lifecycle proof.
+    if not isinstance(value, str):
+        return None
+    if len(value) == 38 and value.startswith("{") and value.endswith("}"):
+        value = value[1:-1]
+    elif len(value) == 45 and value.startswith("urn:uuid:"):
+        value = value[9:]
+    if len(value) == 32 and re.fullmatch(r"[0-9a-fA-F]{32}", value):
+        value = "-".join((value[:8], value[8:12], value[12:16], value[16:20], value[20:]))
+    return value.lower() if CODEX_UUID_RE.fullmatch(value.lower()) else None
+
+
+def _codex_native_steering(event: dict[str, Any]) -> None:
+    tool_input = event.get("tool_input")
+    field = "id" if event["tool_name"] == "multi_agent_v1resume_agent" else "target"
+    if not isinstance(tool_input, dict):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native reviewer steering input is malformed")
+    agent_id = _codex_steering_uuid(tool_input.get(field))
+    if agent_id is None:
+        return None
+    _claim_codex_event(agent_id, "failed")
+    with _codex_child_lock(agent_id, _host_id(event.get("session_id"), "session_id")) as (path, child):
+        child["rejected"] = True
+        _write_codex_child(path, child)
+        if child["request_id"] is not None:
+            root, request = _registered_request(child["request_id"])
+            _codex_native_refuse(root, request, "native reviewer cannot be resumed, steered or closed")
+
+
 def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any]:
     _real_root(root)  # Invocation repository is observed but cannot select authority.
     if not isinstance(event, dict):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "hook event is malformed")
     name = event.get("hook_event_name")
+    if (name in {"SubagentStart", "SubagentStop"} and isinstance(event.get("agent_id"), str)
+            and CODEX_UUID_RE.fullmatch(event["agent_id"])):
+        native = _codex_native_lifecycle(event)
+        if native is not None:
+            return native
     session_id = _host_id(event.get("session_id"), "session_id")
 
+    if name in {"PreToolUse", "PostToolUse"} and event.get("tool_name") == "collaborationspawn_agent":
+        tool_input = event.get("tool_input")
+        message = tool_input.get("message") if isinstance(tool_input, dict) else None
+        if isinstance(message, str) and message.startswith("[CODEARBITER_AUTHORITY_REQUEST:"):
+            raise AuthorityError(
+                "UNSUPPORTED_HOST_SEAM",
+                "default Codex v2 has no direct child UUID binding; qualify the native-v1 interface and arm a fresh request",
+            )
+        if name == "PreToolUse":
+            turn_id = _host_id(event.get("turn_id"), "turn_id")
+            _record_ordinary_spawn(session_id, turn_id)
+            _reject_overlapping_authority(session_id, turn_id)
+        return None
+
+    if name in {"PreToolUse", "PostToolUse"} and event.get("tool_name") in CODEX_STEERING_TOOLS:
+        return _codex_native_steering(event)
+
     if name == "PreToolUse":
         if event.get("tool_name") != "spawn_agent":
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "only spawn_agent can launch a reviewer")
@@ -1910,8 +2470,9 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             or request["state"] != "ARMED"
         ):
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review request is not launchable")
-        if tool_input != request.get("launch_envelope"):
+        if _canonical(tool_input) != _canonical(request.get("launch_envelope")):
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch envelope was changed")
+        _require_frozen_context(root, request)
         if _ordinary_spawn_marker(session_id, turn_id).exists():
             request["state"] = "REJECTED"
             request["recovery"] = {
@@ -1927,9 +2488,14 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             "parent_session_id": session_id, "parent_turn_id": turn_id,
             "tool_use_id": tool_use_id, "post_confirmed": False,
             "agent_id": None, "agent_type": None,
-            "task_name": tool_input["task_name"],
-            "fork_turns": tool_input["fork_turns"],
         }
+        if request.get("codex_review_profile") == CODEX_NATIVE_V1:
+            request["launch"].update(
+                codex_review_profile=CODEX_NATIVE_V1, child_turn_id=None,
+                fork_context=False,
+            )
+        else:
+            request["launch"].update(task_name=tool_input["task_name"], fork_turns=tool_input["fork_turns"])
         request["state"] = "LAUNCHING"
         _save(root, request)
         return {"request_id": request_id, "state": "LAUNCHING"}
@@ -1939,12 +2505,8 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "post-tool event is not reviewer launch")
         tool_use_id = _host_id(event.get("tool_use_id"), "tool_use_id")
         turn_id = _host_id(event.get("turn_id"), "turn_id")
-        response = event.get("tool_response")
-        if not isinstance(response, dict):
-            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "spawn result is malformed")
-        task_name = _host_id(response.get("task_name"), "task_name")
         matches = []
-        for candidate_root, candidate in _registered_requests():
+        for candidate_root, candidate in _registered_requests(strict=True):
             launch = candidate.get("launch") or {}
             if (
                 candidate["state"] in {"LAUNCHING", "RUNNING"}
@@ -1958,6 +2520,12 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         if len(matches) != 1:
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch correlation is ambiguous")
         root, request = matches[0]
+        if request.get("codex_review_profile") == CODEX_NATIVE_V1:
+            return _codex_native_post(event, root, request)
+        response = event.get("tool_response")
+        if not isinstance(response, dict):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "spawn result is malformed")
+        task_name = _host_id(response.get("task_name"), "task_name")
         if task_name != request["launch"].get("task_name"):
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "spawn result task_name differs")
         request["launch"]["post_confirmed"] = True
@@ -1970,6 +2538,8 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         matches = []
         same_turn = []
         for candidate_root, candidate in _registered_requests():
+            if candidate.get("codex_review_profile") == CODEX_NATIVE_V1:
+                continue
             launch = candidate.get("launch") or {}
             if (
                 launch.get("parent_session_id") == session_id
@@ -2015,26 +2585,7 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             request["state"] = "REJECTED"
             _save(root, request)
             raise
-        payload = {
-            "input_sha256": request["context"]["input_sha256"],
-            "spec_sha256": request["context"]["spec_sha256"],
-            "assessment": decision["assessment"],
-        }
-        if request["activity"] == "spec_review":
-            payload["task_sha256"] = request["context"]["task_sha256"]
-        else:
-            payload["base_input_sha256"] = request["context"]["base_input_sha256"]
-            payload["task_hashes"] = request["context"]["task_hashes"]
-        producer_result = {"launch": request["launch"], "decision": decision}
-        observation = _closed_observation(
-            request, payload, CODEX_REVIEW_PROFILE, agent_id,
-            producer_result,
-        )
-        _observation(root, request, observation)
-        request["payload"] = payload
-        request["state"] = "COMPLETED"
-        _save(root, request)
-        return {"request_id": request["request_id"], "state": "COMPLETED"}
+        return _codex_review_complete(root, request, agent_id, decision)
 
     raise AuthorityError("UNSUPPORTED_HOST_SEAM", "hook event is not supported")
 
@@ -2116,6 +2667,7 @@ def observe_claude_hook(root: str | Path, event: dict[str, Any]) -> dict[str, An
         if tool_input != request.get("launch_envelope"):
             _reject(root, request, "changed-launch-envelope")
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch envelope was changed")
+        _require_frozen_context(root, request)
         try:
             _refuse_shadowed_reviewer(root, session_root)
         except AuthorityError:
@@ -2317,6 +2869,10 @@ def publish_request(
         wrapper = request.get("wrapper")
         if not isinstance(wrapper, dict) or wrapper.get("state") != "CORROBORATED":
             raise AuthorityError("AUTHORITY_NOT_COMPLETE", "verifier wrapper completion is uncorroborated")
+    else:
+        # Check the original reference before the engine can recreate missing
+        # derived bytes while computing the current context.
+        _require_frozen_context(root, request)
     current, current_ref, current_hash = _context(
         root, client, request["context"]["subject"]["artifact_id"],
         request["context"]["subject"]["record_id"],
@@ -2354,11 +2910,11 @@ def publish_request(
 
 
 def recover_request(root: str | Path, request_id: str, disposition: str) -> dict[str, Any]:
-    """Retain an uncertain attempt and close it without ever rerunning commands."""
+    """Retain an uncertain attempt or abandon a review that never launched."""
     root = _real_root(root)
     if disposition not in {"failed", "abandoned"}:
         raise AuthorityError("INVALID_RECOVERY", "recovery disposition must be failed or abandoned")
-    request = _load(root, request_id)
+    request = _load(root, request_id, recover_armed_review=disposition == "abandoned")
     recoverable_completed = (
         request["state"] == "COMPLETED"
         and request["activity"] == "verification"
@@ -2371,7 +2927,11 @@ def recover_request(root: str | Path, request_id: str, disposition: str) -> dict
         and isinstance(request.get("wrapper"), dict)
         and request["wrapper"].get("state") in {"AUTHORIZED", "FAILED"}
     )
-    if request["state"] not in {"RUNNING", "LAUNCHING"} and not recoverable_completed and not recoverable_authorized:
+    abandonable_review = disposition == "abandoned" and _never_launched_review(request)
+    if (
+        request["state"] not in {"RUNNING", "LAUNCHING"}
+        and not recoverable_completed and not recoverable_authorized and not abandonable_review
+    ):
         raise AuthorityError("INVALID_RECOVERY", "only an interrupted active attempt can be recovered")
     request["state"] = disposition.upper()
     request["recovery"] = {