@arbiterforge/ca-pi 0.17.4 → 0.17.6

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.25.3" src="https://img.shields.io/badge/version-2.25.3-2b7489">
+<img alt="version 2.25.5" src="https://img.shields.io/badge/version-2.25.5-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.4",
+  "version": "0.17.6",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.17.6] - 2026-10-10
+
+### Fixed
+
+- Preserve the shared engine's Codex native V2 review bindings and bounded
+  verification context storage. Pi verification and review authority remain
+  unsupported; this shared payload update does not enable those host seams.
+
+## [0.17.5] - 2026-10-10
+
+### Fixed
+
+- Preserve the shared adapter's bounded native completion-review context
+  references and complete review-result prompt contract (#921).
+- Fingerprint complete completion-review workspaces up to 1 GiB independently
+  of the 256 MiB selected verification-input budget. Preserve full content
+  hashing, freshness checks, and the 32 MiB member and 50,000 entry limits.
+- Preserve the shared engine's distinct fresh-verification completion profile
+  and historical receipt validation. Pi verification and review authority remain
+  unsupported; this shared payload change does not enable those host seams.
+
 ## [0.17.4] - 2026-10-09
 
 ### Changed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "433780fa59913512346069f9e1891e306a8bec41ed6fcc7cd26b50748d03ae06",
+      "sha256": "7b9e95dba78bda2962d1b879c373a835466fe59aa082a3afb6efbc1fb3de454d",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "b68192c7a1da2cd2f9031f71ab4c7e015673f060d6bfdfa3aa4b57d9f090bf34",
+      "sha256": "2469bd38df4e241f19bb443c4388283aaadc0638951a77331b25be81929d4f4c",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "09582eabdef3f828a12de21b85ccc7b52a188651c2a4f69f3f776a2e62c86036",
+      "sha256": "cf4116c08afa66426c3b9d78853dfc09b608e05412054b6fe18817a65db96a76",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "f7699ce8f2f07200ea8508f21a6d369506443392aa8897d84e9d5e7dd6469770",
+      "sha256": "b1e92f0d279fe04b61dd287a4b20fc1db4abc3722c0325f5294a55bb1a972895",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "9a0f186e2a1bcfd92c8f9db5cb0aa2f6dfb128dd6f0dad2708a78596f0364e16",
+      "sha256": "d8fa783dc8d30c5d48a8c336bca8ee5fd85be4c72629d7ac7246842b89c5135c",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "3f1bc7d00f9488b4a4a9f21e5ca414fd5c97031ad7b1c2b52c02f5d7f2956e3a",
+      "sha256": "2df30c81eb58d502aa9a146563b9dd725176cac9f907ebf36b73c157e5de2124",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "433780fa59913512346069f9e1891e306a8bec41ed6fcc7cd26b50748d03ae06",
-      "observation_sha256": "017903dc1173484279e8029e5edee028cd81d1eb71c60e706b0476d7ea1d0e42",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38042731230",
+      "binary_sha256": "7b9e95dba78bda2962d1b879c373a835466fe59aa082a3afb6efbc1fb3de454d",
+      "observation_sha256": "c359781d36118baf2ebe6b73bb0ecefb59f4ca500b31a6f7e5baf52474e1127c",
+      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "b68192c7a1da2cd2f9031f71ab4c7e015673f060d6bfdfa3aa4b57d9f090bf34",
-      "observation_sha256": "28682b5ece3e695125587ff8578d22ce5ccd75f6643f626b64246bc7dd664716",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38042731230",
+      "binary_sha256": "2469bd38df4e241f19bb443c4388283aaadc0638951a77331b25be81929d4f4c",
+      "observation_sha256": "2d4c75ec50210c0bbf4b8c9a754a0fd89ee81dc60c9607066cf17c4e1af2050a",
+      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "09582eabdef3f828a12de21b85ccc7b52a188651c2a4f69f3f776a2e62c86036",
-      "observation_sha256": "0782dc40b8b03584b6f048204234fbf3896e0ee33ebfb52da4b72237d18679a6",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38042731230",
+      "binary_sha256": "cf4116c08afa66426c3b9d78853dfc09b608e05412054b6fe18817a65db96a76",
+      "observation_sha256": "0a57cde8e4f251ee5faf2cd2dc256638622464030cda79988c11295dec6dfec9",
+      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "f7699ce8f2f07200ea8508f21a6d369506443392aa8897d84e9d5e7dd6469770",
-      "observation_sha256": "451808d71946bed78727672d0c8ed94903eb9179a3907dd86248c1885eb7b094",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38042731230",
+      "binary_sha256": "b1e92f0d279fe04b61dd287a4b20fc1db4abc3722c0325f5294a55bb1a972895",
+      "observation_sha256": "926d97ef85d2cd9caa658db620c7f135ea5a07873a188f289181a37ae636921d",
+      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "9a0f186e2a1bcfd92c8f9db5cb0aa2f6dfb128dd6f0dad2708a78596f0364e16",
-      "observation_sha256": "336b9ea6f4b53b2aaa98cf5ee47f7d2792e2ece09eaafef8f37b0ae51c222275",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38042731230",
+      "binary_sha256": "d8fa783dc8d30c5d48a8c336bca8ee5fd85be4c72629d7ac7246842b89c5135c",
+      "observation_sha256": "70827706a7d231df640f9d4b27b4250f81311bfd89bee11b65ff48b985c1085c",
+      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "3f1bc7d00f9488b4a4a9f21e5ca414fd5c97031ad7b1c2b52c02f5d7f2956e3a",
-      "observation_sha256": "817414c35d85c544d9554544af86fc14aa11f866f0df0f6fe28f64adda5bfe1a",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38042731230",
+      "binary_sha256": "2df30c81eb58d502aa9a146563b9dd725176cac9f907ebf36b73c157e5de2124",
+      "observation_sha256": "f15d9d9894d0ae845e14c3bfba1cf1528f1debe166850e9fb0b46aee27d99dbd",
+      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -82,6 +82,18 @@ REQUEST_LOCK_WAIT_SECONDS = 5.0
 CLAUDE_JOIN_LOCK_WAIT_SECONDS = 30.0
 MAX_OUTPUT = 8 << 20
 MAX_DECISION = 65536
+# Verification and native completion reviews retain the complete immutable context by
+# exact reference instead of duplicating it in every mutable request state.
+CONTEXT_STORAGE = "frozen-reference/0.1.0"
+CONTEXT_REFERENCE = {"format": "codearbiter.evidence-context-reference/0.1.0"}
+# The native canonical decoder already bounds each complete context at 8 MiB.
+MAX_EVIDENCE_CONTEXT = 8 << 20
+# Frozen evidence reads can outlast the ordinary client's 30-second budget.
+EVIDENCE_ENGINE_TIMEOUT_SECONDS = 120
+# ASCII canonical JSON can expand each input UTF-8 byte to at most six bytes.
+# Reserve that closed decision budget plus 32 bounded 256-byte lifecycle slots
+# (host identities, content-addressed locators, their keys and delimiters).
+REVIEW_RESULT_RESERVE = 6 * MAX_DECISION + 32 * 256
 MAX_COMPLETION_FILES = 16
 MAX_COMPLETION_FILE_BYTES = 64 << 10
 MAX_COMPLETION_TOTAL_BYTES = 256 << 10
@@ -104,9 +116,13 @@ CLAUDE_REVIEWER_MODELS = frozenset({"opus", "sonnet", "haiku"})
 CLAUDE_REVIEW_PROFILE = "claude-review/0.1.0"
 CODEX_REVIEW_PROFILE = "codex-review/0.1.0"
 CODEX_NATIVE_V1 = "codex-native-v1/0.145.0"
+CODEX_NATIVE_V2 = "codex-native-v2/0.162.0-alpha.2"
+CODEX_NATIVE_PROFILES = frozenset({CODEX_NATIVE_V1, CODEX_NATIVE_V2})
 CODEX_UUID_RE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
+CODEX_AGENT_PATH_RE = re.compile(r"/root(?:/[a-z0-9_]+)*")
 CODEX_STEERING_TOOLS = frozenset({
     "multi_agent_v1send_input", "multi_agent_v1resume_agent", "multi_agent_v1close_agent",
+    "collaborationsend_message", "collaborationfollowup_task", "collaborationinterrupt_agent",
 })
 CODEX_REVIEW_TOOLS = frozenset({"spawn_agent", "collaborationspawn_agent"}) | CODEX_STEERING_TOOLS
 CODEX_CHILD_FORMAT = "codearbiter.codex-native-child/0.1.0"
@@ -404,9 +420,129 @@ def _request_lock(spool: Path, relative: Path, wait: float | None = None):
         # Do not unlink: a peer may already be waiting on this same inode.
 
 
+def _referenced_review_state(value: dict[str, Any]) -> dict[str, Any]:
+    if (value.get("context_storage") != CONTEXT_STORAGE
+            or value.get("codex_review_profile") not in CODEX_NATIVE_PROFILES
+            or value.get("host", "codex") != "codex"
+            or value.get("activity") not in REVIEW_ACTIVITIES
+            or "completion" not in value["context"] or "handback" in value):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "context reference is not a native completion review")
+    base = dict(value, state="ARMED", launch=None, observation_ref=None,
+                observation_sha256=None, receipt=None, recovery=None)
+    for field in ("payload", "authority_source"):
+        base.pop(field, None)
+    base["integrity_sha256"] = "0" * 64
+    stored_base = dict(base, context=CONTEXT_REFERENCE)
+    context = value["context"]
+    # Quality review additionally copies its exact task hashes into the result.
+    static_payload = {"input_sha256": context["input_sha256"],
+                      "spec_sha256": context["spec_sha256"],
+                      "completion_sha256": context["completion_sha256"]}
+    if value["activity"] == "spec_review":
+        static_payload["task_sha256"] = context["task_sha256"]
+    else:
+        static_payload.update(base_input_sha256=context["base_input_sha256"],
+                              task_hashes=context["task_hashes"])
+    if len(_canonical(stored_base)) + len(_canonical(static_payload)) + REVIEW_RESULT_RESERVE > MAX_STATE:
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "review result has no bounded lifecycle reserve")
+    return dict(value, context=CONTEXT_REFERENCE)
+
+
+def _valid_verification_binding_values(binding: dict[str, Any]) -> bool:
+    def path(value: Any) -> bool:
+        return isinstance(value, str) and bool(value) and "\0" not in value and Path(value).is_absolute()
+
+    def identity(value: Any) -> bool:
+        return isinstance(value, str) and re.fullmatch(r"[0-9]+:[0-9]+", value) is not None
+
+    def digest(value: Any) -> bool:
+        return isinstance(value, str) and SHA256_RE.fullmatch(value) is not None
+
+    argv, files, collector = binding["argv"], binding["launch_files"], binding["collector_profile"]
+    if (not isinstance(argv, list) or not argv
+            or any(not isinstance(item, str) or not item or "\0" in item for item in argv)
+            or not path(argv[0])
+            or not isinstance(collector, str) or collector not in COLLECTORS
+            or any(not path(binding[field]) for field in ("cwd", "workspace_root", "git_common_dir"))
+            or any(not identity(binding[field]) for field in (
+                "cwd_filesystem_id", "workspace_filesystem_id", "git_common_filesystem_id"))
+            or any(not digest(binding[field]) for field in ("definition_sha256", "executable_sha256"))
+            or not isinstance(files, list) or not files):
+        return False
+    # These are the roles emitted by _native_launch, _bind_commands and its
+    # nested npm qualifier. Validate serialization without replacing rebinding.
+    roles = {"declared-executable", "node-runtime", "npm-cli", "runner-entrypoint",
+             "npm-manifest", "npm-workspace-manifest", "npm-prefix"}
+    return all(isinstance(item, dict) and set(item) == {"path", "sha256", "filesystem_id", "role"}
+               and path(item["path"]) and digest(item["sha256"]) and identity(item["filesystem_id"])
+               and isinstance(item["role"], str) and item["role"] in roles for item in files)
+
+
+def _referenced_verification_state(value: dict[str, Any]) -> dict[str, Any]:
+    context = value["context"]
+    subject = context.get("subject", {})
+    _validate_context(context, subject.get("artifact_id"), subject.get("record_id"), "verification")
+    binding_fields = {"definition_sha256", "argv", "collector_profile", "launch_files", "cwd",
+                      "cwd_filesystem_id", "workspace_root", "workspace_filesystem_id", "git_common_dir",
+                      "git_common_filesystem_id", "executable_sha256"}
+    if (value.get("context_storage") != CONTEXT_STORAGE
+            or value.get("activity") != "verification"
+            or value.get("host", "codex") not in HOSTS
+            or value.get("state") not in STATES
+            or value.get("launch") is not None
+            or any(field in value for field in (
+                "codex_review_profile", "handback", "dispatch_prompt", "review_contract_sha256",
+                "required_coverage", "launch_envelope"))
+            or not isinstance(value.get("command_bindings"), list)
+            or len(value["command_bindings"]) != len(context.get("commands", []))
+            or any(not isinstance(binding, dict)
+                   or set(binding) != binding_fields
+                   or not _valid_verification_binding_values(binding)
+                   or binding.get("definition_sha256") != command["definition_sha256"]
+                   for binding, command in zip(value["command_bindings"], context.get("commands", [])))):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "context reference is not closed verification")
+    # Reserve the exact closed result (including every required test name), a
+    # wrapper with the bound commands/workspaces, and bounded host/lifecycle IDs.
+    # Large manifests stay immutable; large mutable results must still refuse.
+    commands = [{
+        "definition_sha256": command["definition_sha256"], "exit": command["definition"]["expected_exit"],
+        "tests": [{"name": name, "status": "pass"} for name in command["definition"]["required_tests"]],
+        "stdout_sha256": "0" * 64, "stderr_sha256": "0" * 64,
+    } for command in context["commands"]]
+    workspaces = {binding["workspace_root"]: {
+        "root": binding["workspace_root"], "filesystem_id": binding["workspace_filesystem_id"],
+        "git_common_dir": binding["git_common_dir"], "git_common_filesystem_id": binding["git_common_filesystem_id"],
+        "head": "0" * 64, "status_sha256": "0" * 64, "content_sha256": "0" * 64,
+    } for binding in value["command_bindings"]}
+    base = dict(value, context=CONTEXT_REFERENCE, state="CAPTURED", attempt="0" * 32,
+                observation_ref=None, observation_sha256=None, receipt=None, recovery=None)
+    base.pop("authority_source", None)
+    base["integrity_sha256"] = "0" * 64
+    base["payload"] = {field: context[field] for field in ("input_sha256", "spec_sha256", "task_sha256")}
+    base["payload"]["commands"] = commands
+    base["wrapper"] = {
+        "state": "CORROBORATED", "session_id": "s" * 256, "tool_use_id": "t" * 256,
+        "prompt_id" if value.get("host", "codex") == "claude" else "turn_id": "p" * 256,
+        "command_bindings": value["command_bindings"], "workspace_before": list(workspaces.values()),
+    }
+    if len(_canonical(base)) + 32 * 256 > MAX_STATE:
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "verification result has no bounded lifecycle reserve")
+    return dict(value, context=CONTEXT_REFERENCE)
+
+
+def _referenced_state(value: dict[str, Any]) -> dict[str, Any]:
+    if value.get("activity") == "verification":
+        return _referenced_verification_state(value)
+    return _referenced_review_state(value)
+
+
 def _save(root: Path, value: dict[str, Any]) -> None:
     expected = value.get("integrity_sha256")
     updated = dict(value)
+    if "context_storage" in updated:
+        if _read_context(root, updated["context_ref"], updated["context_sha256"]) != updated["context"]:
+            raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "stored context changed")
+        updated = _referenced_state(updated)
     updated["integrity_sha256"] = _integrity(updated)
     legacy_abandonment = (
         value["state"] == "ABANDONED"
@@ -468,7 +604,7 @@ def _load(
         "authority_source", "dispatch_prompt", "review_contract_sha256",
         "required_coverage", "wrapper", "command_bindings", "recovery",
         "launch_envelope", "workspace_roots", "host", "codex_review_profile",
-        "handback",
+        "handback", "context_storage", "codex_native_trace",
     }
     if (
         not isinstance(value, dict)
@@ -491,11 +627,21 @@ def _load(
     ):
         raise AuthorityError("INVALID_AUTHORITY_STATE", "request state failed validation")
     if "codex_review_profile" in value and (
-        value["codex_review_profile"] != CODEX_NATIVE_V1
+        value["codex_review_profile"] not in CODEX_NATIVE_PROFILES
         or value.get("host", "codex") != "codex"
         or value["activity"] not in REVIEW_ACTIVITIES
     ):
         raise AuthorityError("INVALID_AUTHORITY_STATE", "Codex review profile is unsupported")
+    if "context_storage" in value:
+        if value["context"] != CONTEXT_REFERENCE:
+            raise AuthorityError("INVALID_AUTHORITY_STATE", "stored context reference is malformed")
+        value["context"] = _read_context(root, value["context_ref"], value["context_sha256"])
+        subject = value["context"].get("subject", {})
+        _validate_context(value["context"], subject.get("artifact_id"),
+                          subject.get("record_id"), value["activity"])
+        _referenced_state(value)
+    elif value["context"] == CONTEXT_REFERENCE:
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "context reference lacks its closed storage profile")
     if len(raw) > MAX_STATE:
         if recover_armed_review and value["state"] == "ABANDONED":
             # Only an abandonment can have retained this; recovering it again is
@@ -526,15 +672,25 @@ def _validate_hash(value: Any, field: str) -> str:
     return value
 
 
-def _read_context(root: Path, context_ref: str, context_hash: str) -> dict[str, Any]:
+def _read_context(
+    root: Path, context_ref: str, context_hash: str
+) -> dict[str, Any]:
     _validate_hash(context_hash, "context_sha256")
     expected_ref = f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
     if context_ref != expected_ref:
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context locator is not content addressed")
     try:
-        raw = (root / expected_ref).read_bytes()
+        path = root / expected_ref
+        _safe_directory(root, Path(expected_ref).parent, create=False)
+        _path_identity(path)
+        if not stat.S_ISREG(path.lstat().st_mode):
+            raise ValueError("context is not a regular file")
+        with path.open("rb") as stream:
+            raw = stream.read(MAX_EVIDENCE_CONTEXT + 1)
+        if len(raw) > MAX_EVIDENCE_CONTEXT:
+            raise ValueError("context exceeds the native canonical budget")
         context = json.loads(raw.decode("utf-8"))
-    except (OSError, UnicodeError, ValueError) as exc:
+    except (OSError, UnicodeError, ValueError, AuthorityError) as exc:
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes are unavailable") from exc
     if not isinstance(context, dict) or _digest(raw) != context_hash or raw != _native_context_canonical(context):
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes changed or are not canonical")
@@ -567,7 +723,10 @@ def _completion_client(root: Path) -> Any:
     """Use the native engine shipped with this adapter, never PATH or a caller."""
     import _artifactlib
 
-    return _artifactlib.ArtifactClient(root, _artifactlib.helper_installation(__file__))
+    return _artifactlib.ArtifactClient(
+        root, _artifactlib.helper_installation(__file__),
+        timeout=EVIDENCE_ENGINE_TIMEOUT_SECONDS,
+    )
 
 
 def _context(
@@ -1020,6 +1179,7 @@ def _reject_overlapping_authority(session_id: str, turn_id: str) -> None:
         launch = request.get("launch") or {}
         if (
             request["state"] in {"LAUNCHING", "RUNNING"}
+            and request.get("codex_review_profile") != CODEX_NATIVE_V2
             and launch.get("parent_session_id") == session_id
             and launch.get("parent_turn_id") == turn_id
         ):
@@ -1340,7 +1500,12 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
         "these settings do not provide an OS sandbox.\n"
         if request.get("codex_review_profile") == CODEX_NATIVE_V1 else ""
     )
+    if request.get("codex_review_profile") == CODEX_NATIVE_V2:
+        profile = (f"Native review profile: {CODEX_NATIVE_V2}. This review was dispatched through "
+                   "collaboration.spawn_agent with default role and fork_turns=none. Read-only conduct "
+                   "is cooperative; these settings do not provide an OS sandbox.\n")
     completion = ""
+    completion_fields = ""
     if "completion" in context:
         completion = (
             "This explicit completion review assesses performed work against every selected task's "
@@ -1366,11 +1531,28 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
             "done_when:<1-based index>. Each object has task_id, obligation, status (substantiated or "
             "missing), assessment (nonempty reasons with concrete source locations, including file paths "
             "and lines), and evidence_refs (nonempty unique exact selected receipt/source/event/observation/"
-            "context refs, mapped workspace_root, or material source_path). Reference the selected facts "
+            f"context refs, {'mapped workspace_root' if legacy_inline else 'raw workspace_root path'}, "
+            "or material source_path). Reference the selected facts "
             "that support each conclusion. Missing or unreadable facts require status=missing and "
             "decision=changes_requested. A passing decision requires every completion obligation "
             "substantiated; a claimed coverage list is insufficient.\n"
+            "Separate required task/obligation pairs: "
+            + json.dumps(sorted(_completion_obligations(context)), ensure_ascii=True) + ".\n"
         )
+        completion_fields = ", completion_sha256 (exact selected packet hash), completion_assessment (separate obligation rows)"
+        if not legacy_inline:
+            references = {task_id: sorted(refs) for task_id, refs in _completion_references(context).items()}
+            completion += (
+                "Exact allowed evidence_refs by task_id (JSON):\n"
+                + _canonical(references).decode("ascii") + "\n"
+                "Copy decoded JSON string values exactly into evidence_refs; choose only entries for "
+                "that row's task_id, never another task's references. Do not add labels or prefixes, "
+                "line numbers, descriptions, or alter path spelling. A raw workspace_root path is the "
+                "listed path itself, without a mapped workspace_root: prefix. The verification-context "
+                "refs listed here belong to selected published verifications; the current review container "
+                "shown as Frozen context above is not an allowed evidence ref unless listed for that task. "
+                "Put concrete source locations and lines in assessment, not in evidence_refs.\n"
+            )
     return (
         f"[CODEARBITER_AUTHORITY_REQUEST:{request['request_id']}]\n"
         f"Target repository: {request['repository']['path']}\n"
@@ -1384,7 +1566,8 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
         + json.dumps(request["required_coverage"], ensure_ascii=True)
         + ". Fields: format, request_id, target_sha256, contract_sha256, decision "
           "(pass or changes_requested), coverage (unique strings), findings (objects with "
-          "severity, code, message), assessment (non-empty string). Reply with the JSON "
+          "severity, code, message), assessment (non-empty string)"
+        + completion_fields + ". Reply with the JSON "
           "object only: no code fence and no other text."
     )
 
@@ -1417,7 +1600,7 @@ def arm_request(
     if host == "claude" and reviewer_model not in CLAUDE_REVIEWER_MODELS:
         raise AuthorityError("INVALID_AUTHORITY_REQUEST", "reviewer model is unsupported")
     if codex_review_profile is not None and (
-        codex_review_profile != "native-v1" or host != "codex" or activity not in REVIEW_ACTIVITIES
+        codex_review_profile not in {"native-v1", "native-v2"} or host != "codex" or activity not in REVIEW_ACTIVITIES
     ):
         raise AuthorityError("INVALID_AUTHORITY_REQUEST", "Codex review profile is unsupported")
     completion_selection = None
@@ -1466,8 +1649,12 @@ def arm_request(
     }
     if host != "codex":
         seed_value["host"] = host
+    if activity == "verification":
+        seed_value["context_storage"] = CONTEXT_STORAGE
     if codex_review_profile is not None:
-        seed_value["codex_review_profile"] = CODEX_NATIVE_V1
+        seed_value["codex_review_profile"] = CODEX_NATIVE_V1 if codex_review_profile == "native-v1" else CODEX_NATIVE_V2
+        if completion_selection is not None:
+            seed_value["context_storage"] = CONTEXT_STORAGE
     seed = _canonical(seed_value)
     request_id = _digest(seed)
     request = {
@@ -1491,8 +1678,12 @@ def arm_request(
     }
     if host != "codex":
         request["host"] = host
+    if activity == "verification":
+        request["context_storage"] = CONTEXT_STORAGE
     if codex_review_profile is not None:
-        request["codex_review_profile"] = CODEX_NATIVE_V1
+        request["codex_review_profile"] = seed_value["codex_review_profile"]
+        if completion_selection is not None:
+            request["context_storage"] = CONTEXT_STORAGE
     if activity in REVIEW_ACTIVITIES:
         request["review_contract_sha256"], request["required_coverage"] = _review_binding(context)
         request["dispatch_prompt"] = _dispatch_prompt(request)
@@ -1503,7 +1694,7 @@ def arm_request(
                 "subagent_type": CLAUDE_REVIEWER,
                 "model": reviewer_model,
             }
-        elif codex_review_profile is not None:
+        elif codex_review_profile == "native-v1":
             request["launch_envelope"] = {
                 "message": request["dispatch_prompt"], "fork_context": False,
             }
@@ -1526,7 +1717,7 @@ def arm_request(
         result["required_coverage"] = request["required_coverage"]
         result["launch_envelope"] = request["launch_envelope"]
         if codex_review_profile is not None:
-            result["codex_review_profile"] = CODEX_NATIVE_V1
+            result["codex_review_profile"] = request["codex_review_profile"]
         if completion_selection is not None:
             result["completion_sha256"] = context["completion_sha256"]
     return result
@@ -2388,6 +2579,24 @@ def run_verification(
         request["context"], request["context_ref"], request["context_sha256"],
     ):
         raise AuthorityError("WORKSPACE_DRIFT", "repository content changed after arm")
+    def normalized_workspace():
+        result = client.call("evidence-context", {
+            "artifact_id": request["context"]["subject"]["artifact_id"],
+            "record_id": request["context"]["subject"]["record_id"],
+            "activity": "verification",
+            "verification_command_bindings": request["command_bindings"],
+        })
+        if (not isinstance(result, dict)
+                or result.get("context_ref") != request["context_ref"]
+                or result.get("context_sha256") != request["context_sha256"]
+                or not isinstance(result.get("completion_workspace_after"), list)
+                or not result["completion_workspace_after"]):
+            raise AuthorityError("WORKSPACE_DRIFT", "engine completion closure is absent or changed context")
+        return result["completion_workspace_after"]
+
+    # The engine alone normalizes validated native bookkeeping. Raw snapshots
+    # still freeze every byte across the actual command execution interval.
+    completion_workspace_before = normalized_workspace()
     workspace_before = _workspace_snapshots(request["command_bindings"])
     if workspace_before != wrapper.get("workspace_before"):
         raise AuthorityError("WORKSPACE_DRIFT", "workspace changed after wrapper authorization")
@@ -2422,6 +2631,9 @@ def run_verification(
     workspace_after = _workspace_snapshots(request["command_bindings"])
     if workspace_after != workspace_before:
         raise AuthorityError("WORKSPACE_DRIFT", "verification changed the frozen workspace")
+    completion_workspace_after = normalized_workspace()
+    if completion_workspace_after != completion_workspace_before:
+        raise AuthorityError("WORKSPACE_DRIFT", "verification changed the normalized completion workspace")
     final_context, final_ref, final_hash = _context(
         root, client, request["context"]["subject"]["artifact_id"],
         request["context"]["subject"]["record_id"], "verification",
@@ -2435,6 +2647,7 @@ def run_verification(
         "command_bindings": request["command_bindings"],
         "workspace_before": workspace_before,
         "workspace_after": workspace_after,
+        "completion_workspace_after": completion_workspace_after,
         "commands": commands,
     }
     payload = {
@@ -2444,7 +2657,7 @@ def run_verification(
         "commands": commands,
     }
     observation = _closed_observation(
-        request, payload, "declared-command/0.2.0", request["attempt"],
+        request, payload, "declared-command/0.3.0", request["attempt"],
         producer_result,
     )
     _observation(root, request, observation)
@@ -2730,6 +2943,145 @@ def _codex_uuid(value: Any) -> str:
     return value
 
 
+@contextmanager
+def _codex_transcript(path: Any):
+    """Open the hook-owned native file, never a caller-selected linked path."""
+    if not isinstance(path, str) or not Path(path).is_absolute():
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native transcript path must be absolute")
+    target = Path(path)
+    try:
+        for component in (*reversed(target.parents), target):
+            info = component.lstat()
+            if stat.S_ISLNK(info.st_mode) or getattr(info, "st_file_attributes", 0) & 0x400:
+                raise OSError("linked transcript component")
+        if not stat.S_ISREG(info.st_mode):
+            raise OSError("nonregular transcript")
+        flags = os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0)
+        with os.fdopen(os.open(target, flags), "rb") as stream:
+            opened = os.fstat(stream.fileno())
+            if (opened.st_dev, opened.st_ino) != (info.st_dev, info.st_ino):
+                raise OSError("changed transcript")
+            yield stream, opened
+    except OSError as exc:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native transcript is unavailable or unsafe") from exc
+
+
+def _codex_metadata(stream) -> tuple[bytes, dict[str, Any]]:
+    stream.seek(0)
+    raw = stream.readline(MAX_DECISION + 1)
+    try:
+        value = json.loads(raw.decode("utf-8"), object_pairs_hook=_unique_json_pairs,
+                           parse_constant=_invalid_json_constant)
+        if (len(raw) > MAX_DECISION or not raw.endswith(b"\n") or not isinstance(value, dict)
+                or value.get("type") != "session_meta" or not isinstance(value.get("payload"), dict)):
+            raise ValueError("unsupported metadata")
+        return raw, value["payload"]
+    except (ValueError, UnicodeError, RecursionError) as exc:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native session metadata is malformed or oversized") from exc
+
+
+def _codex_v2_trace_anchor(event: dict[str, Any], task_name: str) -> dict[str, Any]:
+    with _codex_transcript(event.get("transcript_path")) as (stream, info):
+        raw, meta = _codex_metadata(stream)
+        thread = _codex_uuid(meta.get("id"))
+        session = meta.get("session_id", thread)
+        parent_path = meta.get("agent_path") or "/root"
+        if (session != event.get("session_id") or not isinstance(parent_path, str)
+                or CODEX_AGENT_PATH_RE.fullmatch(parent_path) is None
+                or not re.fullmatch(r"authority_[0-9a-f]{12}", task_name)):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native parent session or task path differs")
+        offset = info.st_size
+        tail_start = max(0, offset - MAX_DECISION)
+        stream.seek(tail_start)
+        tail = stream.read(offset - tail_start)
+        if not tail.endswith(b"\n"):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native parent transcript is not materialized")
+        return {"path": event["transcript_path"], "device": info.st_dev, "inode": info.st_ino,
+                "offset": offset, "tail_start": tail_start, "tail_sha256": _digest(tail),
+                "metadata_sha256": _digest(raw), "parent_thread_id": thread,
+                "parent_agent_path": parent_path, "agent_path": parent_path + "/" + task_name}
+
+
+def _codex_v2_activity(event: dict[str, Any], request: dict[str, Any]) -> dict[str, Any]:
+    anchor = request.get("codex_native_trace")
+    launch = request["launch"]
+    if not isinstance(anchor, dict) or event.get("transcript_path") != anchor.get("path"):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native parent transcript locator changed")
+    with _codex_transcript(anchor["path"]) as (stream, info):
+        raw, _ = _codex_metadata(stream)
+        if ((info.st_dev, info.st_ino) != (anchor["device"], anchor["inode"])
+                or info.st_size < anchor["offset"] or _digest(raw) != anchor["metadata_sha256"]):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native parent transcript identity changed")
+        stream.seek(anchor["tail_start"])
+        if _digest(stream.read(anchor["offset"] - anchor["tail_start"])) != anchor["tail_sha256"]:
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native parent transcript prefix changed")
+        stream.seek(anchor["offset"])
+        suffix = stream.read(MAX_OUTPUT + 1)
+    if len(suffix) > MAX_OUTPUT or not suffix.endswith(b"\n"):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native activity suffix is absent, incomplete or oversized")
+    matches = []
+    try:
+        # JSONL records end at LF; Unicode line separators are valid string data.
+        for line in suffix.decode("utf-8").split("\n")[:-1]:
+            value = json.loads(line, object_pairs_hook=_unique_json_pairs, parse_constant=_invalid_json_constant)
+            payload = value.get("payload") if isinstance(value, dict) else None
+            item = payload.get("item") if isinstance(payload, dict) else None
+            if (value.get("type") == "event_msg" and isinstance(item, dict)
+                    and item.get("type") == "SubAgentActivity" and payload.get("type") == "item_completed"
+                    and item.get("id") == launch["tool_use_id"]):
+                matches.append(payload)
+    except (ValueError, UnicodeError, AttributeError, RecursionError) as exc:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native activity suffix is not strict JSONL") from exc
+    if len(matches) != 1:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native activity for exact call is missing or ambiguous")
+    activity = matches[0]
+    item = activity["item"]
+    if (set(activity) != {"type", "thread_id", "turn_id", "item", "started_at_ms", "completed_at_ms"}
+            or set(item) != {"type", "id", "kind", "agent_thread_id", "agent_path"}
+            or activity["thread_id"] != anchor["parent_thread_id"] or activity["turn_id"] != launch["parent_turn_id"]
+            or item["kind"] != "started" or item["agent_path"] != anchor["agent_path"]
+            or any(type(activity[key]) is not int or activity[key] < 0 for key in ("started_at_ms", "completed_at_ms"))
+            or activity["completed_at_ms"] < activity["started_at_ms"]):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native activity binding differs from the exact launch")
+    _codex_uuid(item["agent_thread_id"])
+    return activity
+
+
+def _codex_v2_child(event: dict[str, Any]) -> dict[str, Any] | None:
+    # Historical V1 lifecycle fixtures/hosts need no native rollout metadata.
+    if event.get("transcript_path") is None:
+        return None
+    try:
+        with _codex_transcript(event["transcript_path"]) as (stream, _):
+            raw, meta = _codex_metadata(stream)
+    except AuthorityError:
+        # A V1 Start did not promise native metadata. V2 binding below requires
+        # qualified metadata; missing/unsafe bytes still cannot pass V2.
+        return None
+    if meta.get("cli_version") != "0.162.0-alpha.2":
+        return None
+    identity = {"cli_version": meta["cli_version"], "thread_id": _codex_uuid(meta.get("id")),
+                "parent_thread_id": _codex_uuid(meta.get("parent_thread_id")),
+                "session_id": _host_id(meta.get("session_id"), "session_id"),
+                "agent_path": meta.get("agent_path"), "metadata_sha256": _digest(raw)}
+    if (identity["thread_id"] != event["agent_id"] or identity["session_id"] != event.get("session_id")
+            or not isinstance(identity["agent_path"], str)
+            or CODEX_AGENT_PATH_RE.fullmatch(identity["agent_path"]) is None):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native child metadata differs from its lifecycle")
+    return identity
+
+
+def _codex_v2_bind_child(request: dict[str, Any], child: dict[str, Any]) -> None:
+    identity = child.get("native_v2")
+    launch = request["launch"]
+    if (not isinstance(identity, dict) or identity.get("parent_thread_id") != launch["parent_thread_id"]
+            or identity.get("thread_id") != launch["agent_id"]
+            or identity.get("session_id") != launch["parent_session_id"]
+            or identity.get("agent_path") != launch["task_name"]):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native V2 child runtime or parent association is unqualified")
+    launch["native_child"] = identity
+
+
 def _codex_native_marker(agent_id: str) -> Path:
     # UUID, not arrival order or session, is the direct host-observed join key.
     # Retaining this marker also prevents reuse across requests and sessions.
@@ -2794,8 +3146,10 @@ def _read_codex_child(path: Path, agent_id: str, session_id: str) -> dict[str, A
     start = value.get("start") if isinstance(value, dict) else None
     if (
         len(raw) > MAX_CHILD_MARKER or not isinstance(value, dict)
-        or set(value) != {"format", "agent_id", "session_id", "request_id", "start", "stop_seen",
-                          "rejected", "integrity_sha256"}
+        or set(value) - {"format", "agent_id", "session_id", "request_id", "start", "stop_seen",
+                        "rejected", "integrity_sha256", "native_v2"}
+        or not {"format", "agent_id", "session_id", "request_id", "start", "stop_seen",
+                "rejected", "integrity_sha256"} <= set(value)
         or value.get("format") != CODEX_CHILD_FORMAT or value.get("agent_id") != agent_id
         or not isinstance(value.get("session_id"), str) or not HOST_ID_RE.fullmatch(value["session_id"])
         or (value.get("request_id") is not None and (
@@ -2808,6 +3162,19 @@ def _read_codex_child(path: Path, agent_id: str, session_id: str) -> dict[str, A
             or not CODEX_UUID_RE.fullmatch(start["turn_id"])))
     ):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native Codex child marker failed validation")
+    if "native_v2" in value:
+        identity = value["native_v2"]
+        if (not isinstance(identity, dict) or set(identity) != {
+                "cli_version", "thread_id", "parent_thread_id", "session_id", "agent_path", "metadata_sha256"}
+                or identity.get("cli_version") != "0.162.0-alpha.2"
+                or identity.get("thread_id") != agent_id or identity.get("session_id") != value["session_id"]
+                or not isinstance(identity.get("parent_thread_id"), str)
+                or CODEX_UUID_RE.fullmatch(identity["parent_thread_id"]) is None
+                or not isinstance(identity.get("agent_path"), str)
+                or CODEX_AGENT_PATH_RE.fullmatch(identity["agent_path"]) is None
+                or not isinstance(identity.get("metadata_sha256"), str)
+                or SHA256_RE.fullmatch(identity["metadata_sha256"]) is None):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native child runtime metadata failed validation")
     return value
 
 
@@ -2846,10 +3213,13 @@ def _codex_native_post(event: dict[str, Any], root: Path, request: dict[str, Any
             _reject(root, current, "invalid-first-native-review-post")
         if isinstance(exc, AuthorityError):
             raise
-        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result is malformed") from exc
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native spawn result is malformed") from exc
 
 
 def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str, Any]) -> dict[str, Any]:
+    expected_tool = "collaborationspawn_agent" if request.get("codex_review_profile") == CODEX_NATIVE_V2 else "spawn_agent"
+    if event.get("tool_name") != expected_tool:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native review PostToolUse tool differs from its launch profile")
     if _canonical(event.get("tool_input")) != _canonical(request["launch_envelope"]):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native review PostToolUse envelope was changed")
     _require_frozen_context(root, request)
@@ -2860,11 +3230,20 @@ def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str
         response = json.loads(raw, object_pairs_hook=_unique_json_pairs, parse_constant=_invalid_json_constant)
     except ValueError as exc:
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result is not strict JSON") from exc
-    if (not isinstance(response, dict) or set(response) != {"agent_id", "nickname"}
+    activity = None
+    if request.get("codex_review_profile") == CODEX_NATIVE_V2:
+        if (not isinstance(response, dict) or set(response) not in ({"task_name"}, {"task_name", "nickname"})
+                or response.get("task_name") != request["codex_native_trace"]["agent_path"]
+                or ("nickname" in response and (not isinstance(response["nickname"], str) or len(response["nickname"]) > 256))):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v2 spawn result fields or canonical task path differ")
+        activity = _codex_v2_activity(event, request)
+        agent_id = _codex_uuid(activity["item"]["agent_thread_id"])
+    elif (not isinstance(response, dict) or set(response) != {"agent_id", "nickname"}
             or (response["nickname"] is not None and (
                 not isinstance(response["nickname"], str) or len(response["nickname"]) > 256))):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result fields are unsupported")
-    agent_id = _codex_uuid(response.get("agent_id"))
+    else:
+        agent_id = _codex_uuid(response.get("agent_id"))
     session_id = request["launch"]["parent_session_id"]
     with _codex_child_lock(agent_id, session_id) as (path, child):
         request = _load(root, request["request_id"])
@@ -2880,7 +3259,11 @@ def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str
             _codex_native_refuse(root, request, "native reviewer stopped or conflicted before association")
         launch = request["launch"]
         launch.update(agent_id=agent_id, post_confirmed=True)
+        if activity is not None:
+            launch.update(native_activity=activity, native_activity_sha256=_engine_digest(activity))
         if child["start"] is not None:
+            if request.get("codex_review_profile") == CODEX_NATIVE_V2:
+                _codex_v2_bind_child(request, child)
             launch.update(child_turn_id=child["start"]["turn_id"], agent_type="default")
             request["state"] = "RUNNING"
         _save(root, request)
@@ -2921,7 +3304,7 @@ def _codex_native_lifecycle(event: dict[str, Any]) -> dict[str, Any] | None:
     except (AuthorityError, OSError) as exc:
         _claim_codex_event(agent_id, "failed")
         for root, request in _registered_requests():
-            if (request.get("codex_review_profile") == CODEX_NATIVE_V1
+            if (request.get("codex_review_profile") in CODEX_NATIVE_PROFILES
                     and request["state"] in {"LAUNCHING", "RUNNING"}
                     and (request.get("launch") or {}).get("agent_id") == agent_id):
                 _reject(root, request, "failed-native-review-lifecycle")
@@ -2949,6 +3332,9 @@ def _codex_native_lifecycle_join(event: dict[str, Any]) -> dict[str, Any] | None
         if name == "SubagentStart":
             valid = valid and start is None
             if valid:
+                identity = _codex_v2_child(event)
+                if identity is not None:
+                    child["native_v2"] = identity
                 child["start"] = {"turn_id": event["turn_id"], "agent_type": "default"}
         else:
             valid = (valid and start is not None and start["turn_id"] == event.get("turn_id")
@@ -2962,7 +3348,7 @@ def _codex_native_lifecycle_join(event: dict[str, Any]) -> dict[str, Any] | None
             return None
         root, request = _registered_request(child["request_id"])
         launch = request.get("launch") or {}
-        if (not valid or request.get("codex_review_profile") != CODEX_NATIVE_V1
+        if (not valid or request.get("codex_review_profile") not in CODEX_NATIVE_PROFILES
                 or launch.get("parent_session_id") != child["session_id"]
                 or launch.get("agent_id") != agent_id or launch.get("post_confirmed") is not True
                 or event.get("turn_id") == launch.get("parent_turn_id")):
@@ -2970,6 +3356,8 @@ def _codex_native_lifecycle_join(event: dict[str, Any]) -> dict[str, Any] | None
         if name == "SubagentStart":
             if request["state"] != "LAUNCHING":
                 _codex_native_refuse(root, request, "native reviewer start was repeated")
+            if request.get("codex_review_profile") == CODEX_NATIVE_V2:
+                _codex_v2_bind_child(request, child)
             launch.update(child_turn_id=event["turn_id"], agent_type="default")
             request["state"] = "RUNNING"
             _save(root, request)
@@ -3010,6 +3398,43 @@ def _codex_native_steering(event: dict[str, Any]) -> None:
     if not isinstance(tool_input, dict):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native reviewer steering input is malformed")
     agent_id = _codex_steering_uuid(tool_input.get(field))
+    if event["tool_name"].startswith("collaboration"):
+        target = tool_input.get("target")
+        canonical_path = None
+        if isinstance(target, str) and CODEX_AGENT_PATH_RE.fullmatch(target):
+            canonical_path = target
+        child_identity = None
+        if agent_id is not None:
+            _claim_codex_event(agent_id, "failed")
+            with _codex_child_lock(agent_id, _host_id(event.get("session_id"), "session_id")) as (path, child):
+                child_identity = child.get("native_v2")
+                child["rejected"] = True
+                _write_codex_child(path, child)
+        for root, request in _registered_requests(strict=True):
+            launch = request.get("launch") or {}
+            if (request.get("codex_review_profile") != CODEX_NATIVE_V2
+                    or request["state"] not in {"LAUNCHING", "RUNNING"}
+                    or launch.get("parent_session_id") != event.get("session_id")):
+                continue
+            # Caller-relative identity matters only to an active review here.
+            if canonical_path is None and isinstance(target, str) and re.fullmatch(r"[a-z0-9_]+(?:/[a-z0-9_]+)*", target):
+                with _codex_transcript(event.get("transcript_path")) as (stream, _):
+                    _, meta = _codex_metadata(stream)
+                caller_path = meta.get("agent_path") or "/root"
+                if isinstance(caller_path, str) and CODEX_AGENT_PATH_RE.fullmatch(caller_path):
+                    canonical_path = caller_path + "/" + target
+            matches = canonical_path == launch.get("task_name") or (
+                agent_id is not None and (launch.get("agent_id") == agent_id or
+                isinstance(child_identity, dict) and child_identity.get("agent_path") == launch.get("task_name")
+                and child_identity.get("parent_thread_id") == launch.get("parent_thread_id")))
+            if not matches and agent_id is not None and launch.get("agent_id") is None:
+                try:
+                    matches = _codex_v2_activity(event, request)["item"]["agent_thread_id"] == agent_id
+                except AuthorityError:
+                    pass  # Missing direct evidence never supplies an association.
+            if matches:
+                _codex_native_refuse(root, request, "native reviewer cannot be steered or interrupted")
+        return None
     if agent_id is None:
         return None
     _claim_codex_event(agent_id, "failed")
@@ -3033,25 +3458,28 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             return native
     session_id = _host_id(event.get("session_id"), "session_id")
 
-    if name in {"PreToolUse", "PostToolUse"} and event.get("tool_name") == "collaborationspawn_agent":
+    if name == "PreToolUse" and event.get("tool_name") == "collaborationspawn_agent":
         tool_input = event.get("tool_input")
         message = tool_input.get("message") if isinstance(tool_input, dict) else None
         if isinstance(message, str) and message.startswith("[CODEARBITER_AUTHORITY_REQUEST:"):
-            raise AuthorityError(
-                "UNSUPPORTED_HOST_SEAM",
-                "default Codex v2 has no direct child UUID binding; qualify the native-v1 interface and arm a fresh request",
-            )
-        if name == "PreToolUse":
+            _, candidate = _registered_request(_request_id_from_prompt(message))
+            if candidate.get("codex_review_profile") != CODEX_NATIVE_V2:
+                raise AuthorityError(
+                    "UNSUPPORTED_HOST_SEAM",
+                    "Codex v2 requires a fresh qualified native-v2 request with direct activity UUID binding; "
+                    "otherwise qualify native-v1 and arm a fresh request",
+                )
+        else:
             turn_id = _host_id(event.get("turn_id"), "turn_id")
             _record_ordinary_spawn(session_id, turn_id)
             _reject_overlapping_authority(session_id, turn_id)
-        return None
+            return None
 
     if name in {"PreToolUse", "PostToolUse"} and event.get("tool_name") in CODEX_STEERING_TOOLS:
         return _codex_native_steering(event)
 
     if name == "PreToolUse":
-        if event.get("tool_name") != "spawn_agent":
+        if event.get("tool_name") not in {"spawn_agent", "collaborationspawn_agent"}:
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "only spawn_agent can launch a reviewer")
         tool_use_id = _host_id(event.get("tool_use_id"), "tool_use_id")
         turn_id = _host_id(event.get("turn_id"), "turn_id")
@@ -3073,8 +3501,11 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review request is not launchable")
         if _canonical(tool_input) != _canonical(request.get("launch_envelope")):
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch envelope was changed")
+        is_v2 = request.get("codex_review_profile") == CODEX_NATIVE_V2
+        if is_v2 != (event["tool_name"] == "collaborationspawn_agent"):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native review profile differs from launch tool")
         _require_frozen_context(root, request)
-        if _ordinary_spawn_marker(session_id, turn_id).exists():
+        if not is_v2 and _ordinary_spawn_marker(session_id, turn_id).exists():
             request["state"] = "REJECTED"
             request["recovery"] = {
                 "mode": "overlapping-subagent-launch",
@@ -3095,6 +3526,11 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
                 codex_review_profile=CODEX_NATIVE_V1, child_turn_id=None,
                 fork_context=False,
             )
+        elif is_v2:
+            anchor = _codex_v2_trace_anchor(event, tool_input["task_name"])
+            request["codex_native_trace"] = anchor
+            request["launch"].update(codex_review_profile=CODEX_NATIVE_V2, child_turn_id=None,
+                parent_thread_id=anchor["parent_thread_id"], task_name=anchor["agent_path"], fork_turns="none")
         else:
             request["launch"].update(task_name=tool_input["task_name"], fork_turns=tool_input["fork_turns"])
         request["state"] = "LAUNCHING"
@@ -3102,7 +3538,7 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         return {"request_id": request_id, "state": "LAUNCHING"}
 
     if name == "PostToolUse":
-        if event.get("tool_name") != "spawn_agent":
+        if event.get("tool_name") not in {"spawn_agent", "collaborationspawn_agent"}:
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "post-tool event is not reviewer launch")
         tool_use_id = _host_id(event.get("tool_use_id"), "tool_use_id")
         turn_id = _host_id(event.get("turn_id"), "turn_id")
@@ -3121,7 +3557,7 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         if len(matches) != 1:
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch correlation is ambiguous")
         root, request = matches[0]
-        if request.get("codex_review_profile") == CODEX_NATIVE_V1:
+        if request.get("codex_review_profile") in CODEX_NATIVE_PROFILES:
             return _codex_native_post(event, root, request)
         response = event.get("tool_response")
         if not isinstance(response, dict):
@@ -3139,7 +3575,7 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         matches = []
         same_turn = []
         for candidate_root, candidate in _registered_requests():
-            if candidate.get("codex_review_profile") == CODEX_NATIVE_V1:
+            if candidate.get("codex_review_profile") in CODEX_NATIVE_PROFILES:
                 continue
             launch = candidate.get("launch") or {}
             if (

package/plugins/ca-pi/hooks/_artifactlib.py

@@ -447,7 +447,8 @@ def _installed_workflow_preflight(installation: Path) -> dict[str, object]:
     tools = ("Bash", "Agent") if host == "claude" else (
         "Bash", "shell_command", "exec_command", "unified_exec", "spawn_agent",
         "collaborationspawn_agent", "multi_agent_v1send_input", "multi_agent_v1resume_agent",
-        "multi_agent_v1close_agent")
+        "multi_agent_v1close_agent", "collaborationsend_message", "collaborationfollowup_task",
+        "collaborationinterrupt_agent")
     required += [(event, tool, "artifact-authority-hook.py")
                  for event in ("PreToolUse", "PostToolUse") for tool in tools]
     required += [(event, None, "artifact-authority-hook.py")

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.17.4"
+    adapter_version = "0.17.6"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/artifact-authority.py

@@ -52,8 +52,8 @@ def main(argv=None) -> int:
         default="opus", help="Claude reviewer model pinned into the launch envelope",
     )
     arm.add_argument(
-        "--codex-review-profile", choices=("native-v1",), default=None,
-        help="select only after qualifying the actual registered native V1 UUID interface",
+        "--codex-review-profile", choices=("native-v1", "native-v2"), default=None,
+        help="select only after qualifying the actual registered native interface and lifecycle",
     )
     context_arm = sub.add_parser("arm-context")
     context_arm.add_argument("--root", required=True)
@@ -80,7 +80,8 @@ def main(argv=None) -> int:
         print(json.dumps(_artifactauthoritylib.cancel_context_preview(root, args.document_id), sort_keys=True))
         return 0
     client = _artifactlib.ArtifactClient(
-        root, _artifactlib.helper_installation(__file__)
+        root, _artifactlib.helper_installation(__file__),
+        timeout=_artifactauthoritylib.EVIDENCE_ENGINE_TIMEOUT_SECONDS,
     )
     if args.command == "arm":
         workspaces = _workspace_map(args.workspace)
@@ -93,7 +94,7 @@ def main(argv=None) -> int:
                 and args.codex_review_profile is None):
             raise _artifactauthoritylib.AuthorityError(
                 "UNSUPPORTED_HOST_SEAM",
-                "Codex review requires explicit --codex-review-profile native-v1 after live interface qualification",
+                "Codex review requires an explicit native-v1 or native-v2 profile after live interface qualification",
             )
         result = _artifactauthoritylib.arm_request(
             root, client, args.artifact_id, args.record_id, args.activity,

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.25.3"
+    adapter_version = "2.25.5"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/artifacts.md

@@ -287,9 +287,11 @@ options. Local executables shadowing nested npm are rejected.
 Direct Node script entrypoints are also pinned. These launch-file bindings do
 not establish transitive dependency closure for deliberately excluded inputs.
 
-New observations use the closed `declared-command/0.2.0` producer profile to
-retain collector and launch-file identities. Historical `0.1.0` bindings remain
-separate and cannot be relabelled as qualified launch evidence.
+New observations use the closed `declared-command/0.3.0` producer profile to
+retain collector and launch-file identities plus an engine-produced normalized
+completion closure. Raw workspace fingerprints must still match before and
+after command execution. Historical `0.1.0` and `0.2.0` bindings retain their
+original contracts and cannot be relabelled as newer evidence.
 
 For `spec_review` or `quality_review`, arm the corresponding activity without
 workspace mappings and dispatch the returned `launch_envelope` unchanged to one
@@ -332,10 +334,13 @@ acceptance. Scope review uses validated task completion bindings. If verificatio
 is rerun, obtain and record its completed task review before selecting that run
 for scope review; do not infer equivalence between receipts.
 
-Creating the first completion context recomputes the current raw worktree
-fingerprint and requires it to match the selected verifier's recorded fingerprint.
-Later freshness checks allow native task-status and execution bookkeeping updates
-in validated canonical artifacts while retaining their normative content hashes.
+Creating a completion context for a `0.3.0` verification recomputes the normalized
+worktree closure bound during that verification. Only validated native outputs
+and execution bookkeeping are normalized; their publication must not invalidate
+unchanged source. Historical `0.2.0` verification retains its initial exact raw
+fingerprint comparison. Later freshness checks allow native task-status and
+execution bookkeeping updates in validated canonical artifacts while retaining
+their normative content hashes.
 Changes to task definitions, other HTML or other governance files still affect
 freshness under the normal snapshot policy. The closure covers
 tracked working-tree bytes and non-ignored untracked files, not ignored
@@ -349,6 +354,16 @@ the scope reaches `REVIEW`, reverify against one current source snapshot, run th
 combined quality review, and use `accept-scope` once. Do not accept tasks
 individually.
 
+Current Codex native V1 completion reviews retain the full frozen context in
+its immutable, content-addressed file and keep only its closed reference in
+mutable request state. Loading validates the exact context locator, hash,
+canonical bytes and review kind. The native context budget remains 8 MiB;
+mutable request state remains bounded at 1 MiB. Before dispatch, the adapter
+reserves the exact fixed result identities, six times the 64 KiB decision
+budget for canonical JSON escaping, and 32 bounded 256-byte lifecycle slots.
+A request without that capacity is refused before child launch. Historical
+inline requests retain their existing limits and abandonment-only recovery.
+
 An ARMED review that never launched can be abandoned through the adapter:
 
 ```sh

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.4",
+  "version": "0.17.6",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",