@ccoalm/ccl-skills 0.15.1 → 0.15.3

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py

@@ -419,10 +419,12 @@ CONTROLLER_OWNED_FIELDS = {
     "challenge_index",
     "challenge_rounds_remaining",
     "completion_gated",
+    "completion_basis",
     "completion_review_result_sha256",
     "decision",
     "delivery",
     "findings_require_implementer_self_review",
+    "finding_dispositions_sha256",
     "human_decision_required",
     "native_skill_binding",
     "owner_selection_evidence",
@@ -436,6 +438,7 @@ CONTROLLER_OWNED_FIELDS = {
     "prior_challenge_focuses",
     "prior_review_result_sha256",
     "residual_risks",
+    "resolved_finding_occurrences",
     "review_chain_id",
     "review_chain_tracked",
     "review_depth",
@@ -524,6 +527,11 @@ class GateError(RuntimeError):
         self.reason_code = reason_code
 
 
+class CompletionFindingsError(GateError):
+    def __init__(self, reason: str) -> None:
+        super().__init__(reason, "completion_checkpoint_invalid")
+
+
 class GateArgumentParser(argparse.ArgumentParser):
     def error(self, message: str) -> None:
         raise GateError(message)
@@ -1550,8 +1558,17 @@ def _canonical_review_scope(profile: dict[str, Any]) -> dict[str, Any]:
     return scope
 
 
+def _unique_json_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError(f"duplicate JSON key: {key}")
+        result[key] = value
+    return result
+
+
 def _load_prior_review_result(
-    path_value: str, expected_index: int
+    path_value: str, expected_index: int, *, strict_json: bool = False
 ) -> tuple[dict[str, Any], str]:
     source = Path(path_value)
     if not source.is_absolute():
@@ -1571,10 +1588,13 @@ def _load_prior_review_result(
             ),
             reason_code="review_chain_invalid",
         )
-        payload = json.loads(encoded.decode("utf-8"))
+        payload = json.loads(
+            encoded.decode("utf-8"),
+            object_pairs_hook=_unique_json_object if strict_json else None,
+        )
     except GateError:
         raise
-    except (UnicodeError, json.JSONDecodeError) as exc:
+    except (UnicodeError, ValueError) as exc:
         raise GateError(
             f"cannot read prior review result {expected_index}: {exc}",
             "review_chain_invalid",
@@ -2648,7 +2668,7 @@ def freeze_review_profile(
             or args.challenge_index
             or args.review_chain_id
             or args.autonomous_review_index is not None
-            or args.prior_review_result_file
+            or (args.prior_review_result_file and not args.finding_dispositions_file)
             or args.predecessor_chain_result_file
         ):
             raise GateError(
@@ -2660,6 +2680,11 @@ def freeze_review_profile(
             "--completion-review-result-file is only valid in complete mode",
             "completion_checkpoint_invalid",
         )
+    if args.finding_dispositions_file and args.mode != "complete":
+        raise GateError(
+            "--finding-dispositions-file is only valid in complete mode",
+            "completion_checkpoint_invalid",
+        )
     risk_tags = sorted(set(args.risk_tag))
     if len(risk_tags) > 20:
         raise GateError("--risk-tag may be supplied at most 20 unique times")
@@ -2982,7 +3007,9 @@ def freeze_review_profile(
     else:
         if (
             args.autonomous_review_index is not None
-            or args.prior_review_result_file
+            or (args.prior_review_result_file and not (
+                args.mode == "complete" and args.finding_dispositions_file
+            ))
             or args.predecessor_chain_result_file
         ):
             raise GateError(
@@ -3622,10 +3649,12 @@ def validate_completion_checkpoint(
     args: argparse.Namespace,
     packet_hash: str,
     profile: dict[str, Any],
+    *,
+    original_round: bool = False,
 ) -> tuple[str, dict[str, Any]]:
     try:
         prior, result_hash = _load_prior_review_result(
-            args.completion_review_result_file, 1
+            args.completion_review_result_file, 1, strict_json=original_round
         )
     except GateError as exc:
         raise GateError(exc.reason, "completion_checkpoint_invalid") from exc
@@ -3666,6 +3695,16 @@ def validate_completion_checkpoint(
         and isinstance(prior_gate, dict)
         and prior_gate.get("required") is False
     )
+    findings_checkpoint = (
+        prior.get("status") == "findings"
+        and prior.get("next_action") in (
+            "implementer_self_review", "triage_findings_and_continue_independent_work"
+        )
+        and isinstance(prior_gate, dict)
+        and prior_gate.get("required") is True
+        and isinstance(prior_gate.get("required_triggers"), list)
+        and "findings_returned" in prior_gate["required_triggers"]
+    )
     if (
         prior.get("schema_version") != 3
         or prior.get("mode") not in ("review", "challenge")
@@ -3673,8 +3712,11 @@ def validate_completion_checkpoint(
             prior.get("mode") == "challenge"
             and prior.get("review_chain_tracked") is not True
         )
-        or prior.get("status") != "passed"
-        or prior.get("findings") != []
+        or not (
+            (prior.get("status") == "passed" and prior.get("findings") == [])
+            or (prior.get("status") == "findings"
+                and isinstance(prior.get("findings"), list) and prior["findings"])
+        )
         or prior.get("candidate_sha256") != packet_hash
         or prior.get("packet_sha256") != packet_hash
         or prior.get("stage") != profile["stage"]
@@ -3728,15 +3770,178 @@ def validate_completion_checkpoint(
         or prior["wording_only_proof_sha256"] is not None
         or "wording_only_scope" not in prior
         or prior["wording_only_scope"] is not None
-        or not (final_round_checkpoint or early_challenge_checkpoint)
+        or not (original_round or final_round_checkpoint or early_challenge_checkpoint or findings_checkpoint)
     ):
         raise GateError(
             "completion review result does not bind a passed exact candidate awaiting deep self-review",
             "completion_checkpoint_invalid",
         )
+    if prior["status"] == "findings" and not original_round:
+        raise CompletionFindingsError(
+            "exact-candidate findings require complete source-refutation dispositions"
+        )
     return result_hash, prior
 
 
+def validate_finding_dispositions(
+    args: argparse.Namespace,
+    packet_hash: str,
+    profile: dict[str, Any],
+) -> tuple[str, dict[str, Any], dict[str, Any]]:
+    # These checks bind accountable local source reasoning to immutable receipt
+    # occurrences. They validate structure and provenance, not that reasoning's truth.
+    paths = [*args.prior_review_result_file, args.completion_review_result_file]
+    if not 2 <= len(paths) <= profile["challenge_budget"] + 1:
+        raise CompletionFindingsError("source refutation requires the full review-then-challenge chain")
+    receipt_hashes: list[str] = []
+    focuses: list[str] = []
+    occurrences: list[dict[str, str]] = []
+    seen_occurrences: set[tuple[str, str]] = set()
+    chain_id = None
+    for index, path in enumerate(paths, 1):
+        round_args = argparse.Namespace(**vars(args))
+        round_args.completion_review_result_file = path
+        receipt_hash, receipt = validate_completion_checkpoint(
+            round_args, packet_hash, profile, original_round=True
+        )
+        if index == 1:
+            chain_id = receipt.get("review_chain_id")
+        challenge_index = receipt.get("challenge_index")
+        expected_review_state = (
+            "post_review_budget"
+            if receipt["status"] == "findings" and receipt["autonomous_reviews_remaining"] == 0
+            else "findings_pending"
+            if receipt["status"] == "findings"
+            else "reviewed"
+        )
+        receipt_gate = receipt.get("self_review_gate")
+        if (
+            receipt.get("mode") != ("review" if index == 1 else "challenge")
+            or receipt.get("review_chain_tracked") is not True
+            or receipt.get("review_chain_id") != chain_id
+            or receipt.get("autonomous_review_index") != index
+            or type(challenge_index) is not int
+            or challenge_index != index - 1
+            or receipt.get("challenge_rounds_remaining") != profile["challenge_budget"] - challenge_index
+            or receipt.get("prior_review_result_sha256") != receipt_hashes
+            or receipt.get("prior_challenge_focuses") != focuses
+            or receipt.get("review_state") != expected_review_state
+            or receipt.get("human_decision_required") is not (expected_review_state == "post_review_budget")
+            or (
+                receipt["status"] == "findings"
+                and (
+                    not isinstance(receipt_gate, dict)
+                    or receipt_gate.get("required") is not True
+                    or not isinstance(receipt_gate.get("required_triggers"), list)
+                    or "findings_returned" not in receipt_gate["required_triggers"]
+                )
+            )
+            or any(receipt.get(key) is not None for key in (
+                "predecessor_chain_id", "predecessor_result_sha256", "predecessor_candidate_sha256"
+            ))
+            or receipt.get("predecessor_challenge_focuses") not in (None, [])
+        ):
+            raise CompletionFindingsError("source refutation requires original contiguous normal-chain receipts")
+        focus = receipt.get("challenge_focus")
+        if index > 1:
+            if not isinstance(focus, str) or not focus.strip() or focus in focuses:
+                raise CompletionFindingsError("source refutation requires distinct recorded challenge focuses")
+            focuses.append(focus)
+        elif focus is not None:
+            raise CompletionFindingsError("initial review cannot carry a challenge focus")
+        for finding in receipt["findings"]:
+            if (
+                not isinstance(finding, dict)
+                or finding.get("severity") not in ("P0", "P1", "P2")
+                or type(finding.get("line")) is not int
+                or finding["line"] < 1
+                or any(not isinstance(finding.get(key), str) or not finding[key].strip()
+                       for key in ("file", "failure_path", "smallest_fix"))
+            ):
+                raise CompletionFindingsError("original receipt contains an invalid finding")
+            try:
+                finding_hash = _canonical_digest(finding)
+            except (UnicodeError, ValueError) as exc:
+                raise CompletionFindingsError("original finding must be canonical UTF-8 JSON") from exc
+            pair = (receipt_hash, finding_hash)
+            if pair in seen_occurrences:
+                # Identical canonical content shares one occurrence identity;
+                # preserve every entry in the original receipt unchanged.
+                continue
+            seen_occurrences.add(pair)
+            occurrences.append({"receipt_sha256": receipt_hash, "finding_sha256": finding_hash})
+        receipt_hashes.append(receipt_hash)
+    if not occurrences:
+        raise CompletionFindingsError("source refutation requires at least one original finding")
+    source = Path(args.finding_dispositions_file)
+    if not source.is_absolute():
+        raise CompletionFindingsError("finding dispositions path must be absolute")
+    try:
+        encoded = read_bounded_regular_file(
+            source,
+            label="finding dispositions",
+            maximum=MAX_RESULT_BYTES,
+            regular_error="finding dispositions must be a bounded regular JSON file",
+            oversized_error="finding dispositions exceed the size limit",
+            reason_code="completion_checkpoint_invalid",
+        )
+        manifest = json.loads(encoded.decode("utf-8"), object_pairs_hook=_unique_json_object)
+    except GateError:
+        raise
+    except (UnicodeError, ValueError) as exc:
+        raise CompletionFindingsError(f"cannot read finding dispositions: {exc}") from exc
+    if (
+        not isinstance(manifest, dict)
+        or set(manifest) != {"schema_version", "candidate_sha256", "review_result_sha256", "dispositions"}
+        or type(manifest.get("schema_version")) is not int
+        or manifest["schema_version"] != 1
+        or manifest.get("candidate_sha256") != packet_hash
+        or manifest.get("review_result_sha256") != receipt_hashes
+        or not isinstance(manifest.get("dispositions"), list)
+        or len(manifest["dispositions"]) != len(occurrences)
+    ):
+        raise CompletionFindingsError("finding dispositions do not bind the exact candidate and full original chain")
+    for disposition, occurrence in zip(manifest["dispositions"], occurrences):
+        if (
+            not isinstance(disposition, dict)
+            or set(disposition) != {"receipt_sha256", "finding_sha256", "disposition", "evidence"}
+            or disposition.get("receipt_sha256") != occurrence["receipt_sha256"]
+            or disposition.get("finding_sha256") != occurrence["finding_sha256"]
+            or disposition.get("disposition") != "source_refuted"
+        ):
+            raise CompletionFindingsError("finding dispositions must cover every original occurrence once in order")
+        evidence = disposition.get("evidence")
+        if (
+            not isinstance(evidence, list)
+            or not evidence
+            or any(
+                not isinstance(item, str) or item != item.strip() or not 1 <= len(item) <= 1000
+                for item in evidence
+            )
+            or len(set(evidence)) != len(evidence)
+        ):
+            raise CompletionFindingsError("each source refutation requires nonempty bounded distinct evidence")
+        if any(
+            ord(char) < 0x20
+            or 0x7F <= ord(char) <= 0x9F
+            or char in "\u2028\u2029"
+            or unicodedata.category(char) == "Cf"
+            for item in evidence
+            for char in item
+        ):
+            raise CompletionFindingsError("source-refutation evidence must not contain control or format characters")
+        try:
+            for item in evidence:
+                item.encode("utf-8")
+        except UnicodeError as exc:
+            raise CompletionFindingsError("source-refutation evidence must be valid UTF-8 text") from exc
+    return receipt_hashes[-1], receipt, {
+        "completion_basis": "source_refuted_findings",
+        "finding_dispositions_sha256": hashlib.sha256(encoded).hexdigest(),
+        "resolved_finding_occurrences": occurrences,
+    }
+
+
 def record_skip(
     result: dict[str, Any],
     client: str,
@@ -3875,6 +4080,7 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--prior-review-result-file", action="append", default=[])
     parser.add_argument("--predecessor-chain-result-file", default=None)
     parser.add_argument("--completion-review-result-file")
+    parser.add_argument("--finding-dispositions-file")
     parser.add_argument("--allow-fallback-egress", action="store_true")
     parser.add_argument("--host-remediation-attempted", action="store_true")
     parser.add_argument("--review-harness", action="store_true")
@@ -3991,24 +4197,30 @@ def main(argv: list[str] | None = None) -> int:
         )
         if args.mode == "complete":
             try:
-                (
-                    completion_result_hash,
-                    completed_review,
-                ) = validate_completion_checkpoint(args, packet_hash, profile)
+                if args.finding_dispositions_file:
+                    completion_result_hash, completed_review, completion_metadata = validate_finding_dispositions(
+                        args, packet_hash, profile
+                    )
+                else:
+                    completion_result_hash, completed_review = validate_completion_checkpoint(
+                        args, packet_hash, profile
+                    )
+                    completion_metadata = {"completion_basis": "external_pass"}
             except GateError as exc:
+                resolve_findings = isinstance(exc, CompletionFindingsError) or bool(args.finding_dispositions_file)
                 result.update(
                     reason=exc.reason,
                     reason_code=exc.reason_code,
-                    next_action="run_external_review_for_current_candidate",
+                    next_action=("resolve_review_findings" if resolve_findings else "run_external_review_for_current_candidate"),
                     review_state="self_reviewing",
                     self_review_gate=self_review_gate(
-                        required_triggers=["material_candidate_change"],
+                        required_triggers=(["findings_returned", "before_completion_claim"] if resolve_findings else ["material_candidate_change"]),
                         satisfied_triggers=profile["self_review_satisfied_triggers"],
                         blocks=["completion_claim"],
                         allowed_next_actions=[
                             "deep_self_review",
                             "continue_implementation",
-                            "run_external_review_after_self_review",
+                            "resolve_review_findings" if resolve_findings else "run_external_review_after_self_review",
                         ],
                     ),
                 )
@@ -4036,6 +4248,7 @@ def main(argv: list[str] | None = None) -> int:
                     satisfied_triggers=["before_completion_claim"]
                 ),
             )
+            result.update(completion_metadata)
             return emit(result, 0)
         last_reason_code = "no_independent_reviewer_available"
         for client in order:
@@ -4271,6 +4484,7 @@ def main(argv: list[str] | None = None) -> int:
                             "post_review_budget_checkpoint"
                         )
                         allowed_self_review_actions.append("continue_independent_work")
+                    allowed_self_review_actions.append("resolve_review_findings")
                     current_self_review_gate = self_review_gate(
                         required_triggers=required_self_review_triggers,
                         satisfied_triggers=profile["self_review_satisfied_triggers"],

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh

@@ -652,7 +652,7 @@ cat >"$WORK/bin/codex" <<'CODEX_STUB'
 #!/usr/bin/env bash
 set -u
 state="$REVIEW_WRAPPER_TEST_STATE"
-if [ "${1:-}" = exec ] && [ "${2:-}" = --disable ] && [ "${3:-}" = hooks ] && [ "${4:-}" = --help ]; then
+if [ "${1:-}" = exec ] && [[ " $* " = *" --help "* ]]; then
   if [ "${STUB_BEHAVIOR:-}" = help_hang ]; then
     trap '' TERM
     while :; do /bin/sleep 1; done
@@ -667,16 +667,72 @@ if [ "${1:-}" = exec ] && [ "${2:-}" = --disable ] && [ "${3:-}" = hooks ] && [
 fi
 if [ "${1:-}" = features ] && [ "${2:-}" = list ]; then
   touch "$state/codex_features_invoked"
-  if [ "${STUB_BEHAVIOR:-pass}" = missing_hooks_feature ]; then
-    printf '%s\n' 'apply_patch_freeform                 removed            false'
-    exit 0
-  fi
-  if [ "${STUB_BEHAVIOR:-pass}" = removed_hooks_feature ]; then
-    printf '%s\n' 'hooks                                removed            true'
+  hooks_enabled=true
+  shell_enabled=true
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --disable)
+        case "${2:-}" in hooks) hooks_enabled=false ;; shell_tool) shell_enabled=false ;; esac
+        shift 2 ;;
+      *) shift ;;
+    esac
+  done
+  case "${STUB_BEHAVIOR:-pass}" in
+    missing_hooks_feature) ;;
+    removed_hooks_feature) printf '%s\n' 'hooks                                removed            false' ;;
+    *) printf 'hooks                                stable             %s\n' "$hooks_enabled" ;;
+  esac
+  case "${STUB_BEHAVIOR:-pass}" in
+    missing_shell_feature) ;;
+    removed_shell_feature) printf '%s\n' 'shell_tool                           removed            false' ;;
+    ignored_shell_disable) printf '%s\n' 'shell_tool                           stable             true' ;;
+    *) printf 'shell_tool                           stable             %s\n' "$shell_enabled" ;;
+  esac
+  exit 0
+fi
+if [ "${1:-}" = mcp ] && [ "${2:-}" = list ]; then
+  touch "$state/codex_mcp_probe_invoked"
+  if [ "${STUB_BEHAVIOR:-pass}" = mcp_capability_missing ]; then
+    printf '%s\n' '[]'
     exit 0
   fi
-  printf '%s\n' 'hooks                                stable             true'
-  exit 0
+  python3 - "$@" <<'PY_MCP_LIST'
+import json, os, sys, tomllib
+
+arguments = iter(sys.argv[1:])
+servers = {}
+inherited_names = {
+    "inherited_mcp": "unrelated",
+    "inherited_mcp_dot": "unrelated.name",
+    "inherited_mcp_space": "unrelated name",
+    "inherited_mcp_quote": 'unrelated"name',
+}
+inherited_name = inherited_names.get(os.environ.get("STUB_BEHAVIOR"))
+if inherited_name is not None:
+    servers[inherited_name] = {"command": "/bin/false", "args": [], "enabled": True}
+for argument in arguments:
+    if argument in {"-c", "--config"}:
+        # Codex splits the override path separately from its TOML value;
+        # quotes in a dotted left-hand key are not TOML key quoting.
+        key, value = next(arguments).split("=", 1)
+        decoded = tomllib.loads("value=" + value)["value"]
+        if key == "mcp_servers":
+            configured_servers = decoded
+        elif key.startswith("mcp_servers."):
+            _, name, field = key.split(".")
+            configured_servers = {name: {field: decoded}}
+        else:
+            continue
+        for name, settings in configured_servers.items():
+            servers.setdefault(name, {}).update(settings)
+print(json.dumps([
+    {"name": name, "enabled": server.get("enabled", True),
+     "transport": {"type": "stdio", "command": server["command"],
+                   "args": server.get("args", [])}}
+    for name, server in servers.items()
+]))
+PY_MCP_LIST
+  exit $?
 fi
 touch "$state/codex_invoked"
 printf '%s' "$0" >"$state/codex_argv0"
@@ -687,14 +743,19 @@ has_read_only=no
 has_ephemeral=no
 has_ignore_rules=no
 has_hooks_disabled=no
+has_shell_disabled=no
 workspace=""
+: >"$state/codex_configs"
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --output-last-message) last_message="$2"; shift 2 ;;
     --model|-m) has_model=yes; shift 2 ;;
     --sandbox) [ "$2" = read-only ] && has_read_only=yes; shift 2 ;;
     --ephemeral) has_ephemeral=yes; shift ;;
-    --disable) [ "$2" = hooks ] && has_hooks_disabled=yes; shift 2 ;;
+    --disable)
+      case "$2" in hooks) has_hooks_disabled=yes ;; shell_tool) has_shell_disabled=yes ;; esac
+      shift 2 ;;
+    -c|--config) printf '%s\n' "$2" >>"$state/codex_configs"; shift 2 ;;
     --ignore-rules) has_ignore_rules=yes; shift ;;
     -C) workspace="$2"; shift 2 ;;
     *) shift ;;
@@ -705,6 +766,7 @@ printf '%s' "$has_read_only" >"$state/codex_read_only"
 printf '%s' "$has_ephemeral" >"$state/codex_ephemeral"
 printf '%s' "$has_ignore_rules" >"$state/codex_ignore_rules"
 printf '%s' "$has_hooks_disabled" >"$state/codex_hooks_disabled"
+printf '%s' "$has_shell_disabled" >"$state/codex_shell_disabled"
 [ -z "$workspace" ] || printf '%s' "$workspace" >"$state/codex_workspace"
 if [ -n "$workspace" ] && [ -L "$workspace/.agents/skills/testing-strategy" ]; then
   readlink "$workspace/.agents/skills/testing-strategy" >"$state/codex_skill_link"
@@ -741,7 +803,8 @@ fi
 printf '%s\n' '{"type":"thread.started","thread_id":"test-thread"}'
 printf '%s\n' '{"type":"turn.started"}'
 case "$behavior" in
-  pass|skills_budget_warning|skills_budget_warning_after_concern|hook_trust_warning|hook_trust_warning_started|hook_trust_warning_repeated_after_concern|unknown_error_valid_result) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
+  packet_read|packet_search|packet_tampered) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
+  pass|shell_disable_required|missing_shell_feature|removed_shell_feature|ignored_shell_disable|mcp_capability_missing|inherited_mcp|inherited_mcp_dot|inherited_mcp_space|inherited_mcp_quote|skills_budget_warning|skills_budget_warning_after_concern|hook_trust_warning|hook_trust_warning_started|hook_trust_warning_repeated_after_concern|unknown_error_valid_result) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
   legacy_pass) printf '%s\n' '{"status":"passed","findings":[]}' >"$last_message" ;;
   stream_gap) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
   tool) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
@@ -750,9 +813,46 @@ case "$behavior" in
   invalid) printf '%s\n' 'not-json' >"$last_message" ;;
   invalid_concern) printf '%s\n' 'P1 src/example.py:7 concern without valid JSON' >"$last_message" ;;
 esac
+if [[ "$behavior" = packet_* ]]; then
+  python3 - "$state" "$behavior" <<'PY_PACKET_CALL'
+import json, subprocess, sys, tomllib
+from pathlib import Path
+
+state, behavior = Path(sys.argv[1]), sys.argv[2]
+servers = {}
+for override in (state / "codex_configs").read_text().splitlines():
+    key, value = override.split("=", 1)
+    if key == "mcp_servers":
+        servers = tomllib.loads("servers=" + value)["servers"]
+server = servers["code_review_packet"]
+tool = "search_packet" if behavior == "packet_search" else "read_packet"
+arguments = ({"query": "diff --git", "byte_offset": 0, "limit": 1}
+             if tool == "search_packet" else {"byte_offset": 0, "max_bytes": 46000})
+request = {"jsonrpc": "2.0", "id": 1, "method": "tools/call",
+           "params": {"name": tool, "arguments": arguments}}
+response = subprocess.run([server["command"], *server["args"]],
+                          input=json.dumps(request) + "\n", text=True,
+                          capture_output=True, timeout=5, check=True)
+result = json.loads(response.stdout)["result"]
+assert not result.get("isError"), result
+if behavior == "packet_tampered":
+    result["content"][0]["text"] += "forged packet bytes"
+item = {"type": "mcp_tool_call", "id": "packet-call-1",
+        "server": "code_review_packet", "tool": tool, "arguments": arguments,
+        "status": "in_progress"}
+print(json.dumps({"type": "item.started", "item": item}))
+item.update(status="completed", result=result)
+print(json.dumps({"type": "item.completed", "item": item}))
+(state / "codex_packet_call").write_text(tool)
+PY_PACKET_CALL
+  [ "$?" = 0 ] || exit 42
+fi
 if [ "$behavior" = stream_gap ]; then
   printf '%s\n' '{"type":"item.completed","item":{"type":"error","message":"in-process app-server event stream lagged; dropped 2 events"}}'
 fi
+if [ "$behavior" = shell_disable_required ] && [ "$has_shell_disabled" != yes ]; then
+  printf '%s\n' '{"type":"item.completed","item":{"type":"command_execution","command":"pwd"}}'
+fi
 if [ "$behavior" = tool ]; then
   printf '%s\n' '{"type":"item.completed","item":{"type":"command_execution","command":"pwd"}}'
 elif [ "$behavior" = foreign_tool ]; then
@@ -1676,6 +1776,60 @@ out="$(run_codex removed_hooks_feature)"; rc=$?
 check "Codex with a removed hooks feature key falls back before inference" \
   '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_hook_disable_unavailable ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ ! -e "$WORK/state/codex_invoked" ]'
 
+out="$(run_codex shell_disable_required)"; rc=$?
+check "Codex disables shell execution before the reviewer can request a command" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(cat "$WORK/state/codex_shell_disabled")" = yes ]'
+
+for shell_capability in missing_shell_feature removed_shell_feature ignored_shell_disable; do
+  rm -f "$WORK/state/codex_invoked"
+  out="$(run_codex "$shell_capability")"; rc=$?
+  check "Codex $shell_capability falls back before inference" \
+    '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_shell_disable_unavailable ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ ! -e "$WORK/state/codex_invoked" ]'
+done
+
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex mcp_capability_missing)"; rc=$?
+check "Codex without the bounded packet MCP server falls back before inference" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+for packet_tool in read search; do
+  rm -f "$WORK/state/codex_packet_call"
+  out="$(run_codex "packet_$packet_tool")"; rc=$?
+  check "Codex accepts a real frozen packet $packet_tool through wrapper and parser" \
+    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(cat "$WORK/state/codex_packet_call")" = "${packet_tool}_packet" ]'
+done
+out="$(run_codex packet_tampered)"; rc=$?
+check "Codex rejects altered packet tool bytes through wrapper and parser" \
+  '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
+
+for inherited_mcp_case in inherited_mcp inherited_mcp_dot inherited_mcp_space inherited_mcp_quote; do
+  case "$inherited_mcp_case" in
+    inherited_mcp) inherited_mcp_name=unrelated ;;
+    inherited_mcp_dot) inherited_mcp_name=unrelated.name ;;
+    inherited_mcp_space) inherited_mcp_name='unrelated name' ;;
+    inherited_mcp_quote) inherited_mcp_name='unrelated"name' ;;
+  esac
+  rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+  out="$(run_codex "$inherited_mcp_case")"; rc=$?
+  inherited_mcp_disabled="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_DISABLED'
+import sys, tomllib
+from pathlib import Path
+
+path = Path(sys.argv[2])
+tables = []
+for override in path.read_text().splitlines() if path.exists() else []:
+    key, value = override.split("=", 1)
+    if key.strip() == "mcp_servers":
+        tables.append(tomllib.loads("servers=" + value)["servers"])
+print(len(tables) == 1
+      and tables[0].get(sys.argv[1], {}).get("enabled") is False
+      and "code_review_packet" in tables[0])
+PY_MCP_DISABLED
+)"
+  check "Codex encodes and disables the inherited MCP key ($inherited_mcp_case)" \
+    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_disabled" = True ]'
+done
+
 rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_help_invoked"
 probe_started=$SECONDS
 out="$(run_codex help_hang)"; rc=$?