@haposoft/cafekit 0.18.0 → 0.18.2

package/bin/__tests__/codex-hooks.test.js

@@ -5,9 +5,84 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { spawnSync } = require('node:child_process');
+const { spawnSync, spawn } = require('node:child_process');
 const { test } = require('node:test');
 
+const OLD_INSPECTION_MATCHER = 'Bash|exec_command|apply_patch|Edit|Write|Read|Glob|Grep|mcp__.*|shell';
+const NEW_INSPECTION_MATCHER = 'Bash|exec_command|shell|apply_patch|mcp__.*|collaborationspawn_agent|collaborationwait_agent';
+function matcherFixture(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-matcher-'));
+  const previous = process.cwd();
+  const config = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../../src/codex/hooks.json'), 'utf8'));
+  const messages = [], warnings = [];
+  const ctx = { dryRun: false, results: { updated: 0, unchanged: 0, errors: 0 },
+    manifest: require('../../src/claude/migration-manifest.json'),
+    ui: { detail: value => messages.push(value), warn: value => warnings.push(value) } };
+  const file = path.join(root, '.codex/hooks.json');
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true }); process.chdir(root);
+    const merge = require('../phases/codex-hooks.js').mergeCodexHooks;
+    run({ root, config, ctx, file, messages, warnings, merge: () => merge(ctx, 'codex', root),
+      save: () => fs.writeFileSync(file, JSON.stringify(config)), read: () => JSON.parse(fs.readFileSync(file, 'utf8')) });
+  } finally { process.chdir(previous); fs.rmSync(root, { recursive: true, force: true }); }
+}
+test('upgrade refreshes a former managed inspection matcher and reports it', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = OLD_INSPECTION_MATCHER; f.save();
+  const before = fs.readFileSync(f.file, 'utf8');
+  f.ctx.dryRun = true; f.merge();
+  assert.equal(fs.readFileSync(f.file, 'utf8'), before);
+  assert.ok(f.messages.some(line => /↻.*matcher updated/.test(line)));
+  f.ctx.dryRun = false; f.messages.length = 0; f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, NEW_INSPECTION_MATCHER);
+  assert.ok(f.messages.some(line => /↻.*matcher updated/.test(line)));
+  assert.ok(!f.messages.some(line => /already registered/.test(line)));
+}));
+test('upgrade preserves a mixed user group and warns', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = OLD_INSPECTION_MATCHER;
+  f.config.hooks.PreToolUse[0].hooks.push({ type: 'command', command: 'echo user-owned' }); f.save(); f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, OLD_INSPECTION_MATCHER);
+  assert.ok(f.read().hooks.PreToolUse[0].hooks.some(h => h.command === 'echo user-owned'));
+  assert.ok(f.warnings.some(line => /matcher.*preserv/i.test(line)));
+}));
+test('reinstall keeps purely user groups unchanged without matcher warnings', () => matcherFixture(f => {
+  const userPre = { matcher: 'Bash', hooks: [{ command: 'my-linter' }] };
+  const userPost = { hooks: [{ command: 'my-logger' }] };
+  f.config.hooks = { PreToolUse: [userPre], PostToolUse: [userPost] }; f.save();
+  const installs = Array.from({ length: 2 }, () => {
+    const result = spawnSync(process.execPath, [path.resolve(__dirname, '../install.js'), '--platform', 'codex', '-y'], {
+      cwd: f.root, encoding: 'utf8',
+    });
+    return { result, config: f.read() };
+  });
+  for (const { result, config } of installs) {
+    assert.equal(result.status, 0, result.stderr);
+    for (const [event, original] of [['PreToolUse', userPre], ['PostToolUse', userPost]]) {
+      const group = config.hooks[event].find(g => g.hooks.some(h => h.command === original.hooks[0].command));
+      assert.equal(JSON.stringify(group), JSON.stringify(original));
+    }
+    assert.doesNotMatch(result.stdout + result.stderr, /matcher preserved/);
+  }
+}));
+test('fresh hook registration uses every template matcher', () => matcherFixture(f => {
+  f.merge();
+  for (const [event, groups] of Object.entries(f.config.hooks)) {
+    assert.deepEqual(f.read().hooks[event].map(g => g.matcher), groups.map(g => g.matcher));
+  }
+}));
+test('upgrade preserves a user-selected managed matcher and warns', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = 'Read|Grep'; f.save(); f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, 'Read|Grep');
+  assert.ok(f.warnings.some(line => /matcher.*preserv/i.test(line)));
+}));
+test('upgrade refreshes the surviving group after retired hooks are pruned', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = OLD_INSPECTION_MATCHER;
+  f.config.hooks.PreToolUse[0].hooks.push({ type: 'command', command: 'node ".codex/hooks/task-scaffold-guard.cjs"' });
+  f.save(); f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, NEW_INSPECTION_MATCHER);
+  assert.ok(!JSON.stringify(f.read()).includes('task-scaffold-guard'));
+  assert.ok(f.messages.some(line => /matcher updated/.test(line)));
+}));
+
 const PACKAGE_ROOT = path.join(__dirname, '../..');
 const CODEX_HOOKS = path.join(PACKAGE_ROOT, 'src/codex/hooks');
 const PROVENANCE = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'));
@@ -19,10 +94,6 @@ const { stateDir: codexStateDir } = require(
 );
 
 function runHook(file, cwd, payload) {
-  if (path.basename(file) === 'spec-gate.cjs') {
-    const rootResult = spawnSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], { encoding: 'utf8' });
-    if (rootResult.status === 0) installFeatureReceipts(rootResult.stdout.trim(), payload.session_id || 'session-a');
-  }
   return spawnSync(process.execPath, [file], {
     cwd,
     input: JSON.stringify(payload),
@@ -34,7 +105,7 @@ function runtimeContext(root, feature = 'auth', session = 'session-a') {
   return PROVENANCE.deriveRuntimeContext({
     projectRoot: root,
     specsRoot: path.join(root, 'specs'),
-    specFile: path.join(root, 'specs', feature, 'spec.json'),
+    specFile: path.join(root, 'specs', feature, 'plan.md'),
     featureName: feature,
     runtimeSession: session,
   });
@@ -55,45 +126,41 @@ function workflowRuntimeContext(root, feature = 'auth', session = 'session-a') {
   });
 }
 
-function installFeatureReceipts(root, session = 'session-a') {
-  const specsRoot = path.join(root, 'specs');
-  if (!fs.existsSync(specsRoot)) return;
-  for (const feature of fs.readdirSync(specsRoot)) {
-    const featureDir = path.join(specsRoot, feature);
-    const specFile = path.join(featureDir, 'spec.json');
-    if (!fs.existsSync(specFile)) continue;
-    let spec;
-    try { spec = JSON.parse(fs.readFileSync(specFile, 'utf8')); } catch { continue; }
-    const lifecyclePhase = spec.current_phase || spec.phase;
-    const explicitCloseout = ['completed', 'complete'].includes(spec.status)
-      || ['closeout', 'completion', 'completed', 'complete'].includes(lifecyclePhase);
-    if (!explicitCloseout) continue;
-    const tasks = Object.values(spec.task_registry || {});
-    if (tasks.length === 0 || tasks.some((task) => task.status !== 'done')) continue;
-    const context = runtimeContext(root, feature, session);
-    fs.writeFileSync(path.join(featureDir, 'feature-receipt.md'), [
-      `Feature: ${feature}`,
-      'Expected: final integration verification passes',
-      'Observed: final integration verification passed',
-      'Verification: PASS',
-      'Command: node --test',
-      'Exit: 0',
-      `Base: ${context.base}`,
-      `Head: ${context.head}`,
-      '',
-    ].join('\n'));
-  }
+/** A process-first packet with one flat task whose Verification Plan runs `command`. */
+function writeProcessTask(featureDir, status, receiptLines = null, command = 'pnpm test', taskName = 'task-01-auth.md') {
+  fs.mkdirSync(featureDir, { recursive: true });
+  fs.writeFileSync(path.join(featureDir, 'plan.md'), '# Plan\nSpecs-Contract: process-first-ready-v1\n');
+  const lines = [
+    '# Task 01', '', `Status: ${status}`, '',
+    '## Dependencies', '', '- none', '',
+    '## Verification Plan', '', `- Command: ${command}`, '',
+  ];
+  if (receiptLines) lines.push('## Receipt', '', ...receiptLines, '');
+  fs.writeFileSync(path.join(featureDir, taskName), lines.join('\n'));
+  return path.join(featureDir, taskName);
 }
 
 function inHookFixture(run, options = {}) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-hooks-'));
   const hooks = path.join(root, '.codex', 'hooks');
+  let deferred = false;
   try {
     fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/inspect-paths.cjs'),
+      path.join(hooks, 'lib/inspect-paths.cjs'),
+    );
     fs.copyFileSync(
       path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-command-analysis.cjs'),
       path.join(hooks, 'lib/privacy-command-analysis.cjs'),
     );
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-paths.cjs'),
+      path.join(hooks, 'lib/privacy-paths.cjs'),
+    );
     fs.copyFileSync(
       path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
       path.join(hooks, 'lib/runtime-path-safety.cjs'),
@@ -121,20 +188,19 @@ function inHookFixture(run, options = {}) {
       path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'),
       path.join(root, '.codex', 'scripts', 'spec-resolver.cjs'),
     );
-    for (const file of ['validate-spec-output.cjs', 'spec-ground.cjs', 'spec-semantic-model.cjs', 'spec-final-state.cjs']) {
-      fs.copyFileSync(
-        path.join(PACKAGE_ROOT, 'src/claude/scripts', file),
-        path.join(root, '.codex', 'scripts', file),
-      );
-    }
     fs.writeFileSync(path.join(root, '.codex', 'scripts', 'spec-scaffold.cjs'), '');
     for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
       const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
       assert.equal(result.status, 0, result.stderr);
     }
-    return run(root, hooks);
+    const result = run(root, hooks);
+    if (result && typeof result.then === 'function') {
+      deferred = true;
+      return result.finally(() => fs.rmSync(root, { recursive: true, force: true }));
+    }
+    return result;
   } finally {
-    fs.rmSync(root, { recursive: true, force: true });
+    if (!deferred) fs.rmSync(root, { recursive: true, force: true });
   }
 }
 
@@ -146,6 +212,116 @@ function processTaskContent(title, status, dependency = 'none') {
   ].join('\n');
 }
 
+function inNoCommitCodexFixture(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-no-commit-'));
+  const hooks = path.join(root, '.codex/hooks');
+  try {
+    fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
+    for (const name of ['privacy-paths.cjs', 'privacy-command-analysis.cjs']) {
+      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib', name), path.join(hooks, 'lib', name));
+    }
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+      path.join(hooks, 'lib/runtime-path-safety.cjs'));
+    const scripts = path.join(root, '.codex/scripts');
+    fs.mkdirSync(scripts, { recursive: true });
+    for (const name of ['workflow-policy.cjs', 'provenance.cjs', 'spec-receipt.cjs', 'spec-resolver.cjs']) {
+      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/scripts', name), path.join(scripts, name));
+    }
+    for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test']]) {
+      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+    }
+    const writePacket = (feature, status) => {
+      const dir = path.join(root, 'specs', feature);
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'plan.md'), '# Plan\nSpecs-Contract: process-first-ready-v1\n');
+      fs.writeFileSync(path.join(dir, 'task-01-work.md'), processTaskContent('Task 01: work', status)
+        + (status === 'done' ? '\n## Receipt\n\nVerification: PASS\n' : ''));
+    };
+    const invoke = (hook, event) => runHook(path.join(hooks, `${hook}.cjs`), root, {
+      cwd: root, session_id: 'no-commit-codex', hook_event_name: event, prompt: 'Continue specs/auth',
+    });
+    run({ writePacket, gate: () => invoke('spec-gate', 'Stop'), state: () => invoke('spec-state', 'UserPromptSubmit') });
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+test('Codex collaborationspawn_agent appears as the latest tracked tool on resume', () => {
+  inHookFixture((root, hooks) => {
+    const state = path.join(hooks, 'state.cjs');
+    const session = { cwd: root, session_id: 'spawn-tracking' };
+    const tracked = runHook(state, root, {
+      ...session, hook_event_name: 'PostToolUse', tool_name: 'collaborationspawn_agent',
+      tool_input: { message: 'Inspect the parser behavior' },
+    });
+    assert.equal(tracked.status, 0, tracked.stderr);
+    const resumed = runHook(state, root, { ...session, hook_event_name: 'SessionStart', source: 'resume' });
+    assert.equal(resumed.status, 0, resumed.stderr);
+    assert.match(resumed.stdout, /Latest Tracked Tool/);
+    assert.match(resumed.stdout, /collaborationspawn_agent/);
+  });
+});
+
+test('Codex collaborationspawn_agent input does not create a pending todo', () => {
+  inHookFixture((root, hooks) => {
+    const state = path.join(hooks, 'state.cjs');
+    const session = { cwd: root, session_id: 'spawn-no-todo' };
+    const title = 'Inspect parser without creating a todo';
+    const tracked = runHook(state, root, {
+      ...session, hook_event_name: 'PostToolUse', tool_name: 'collaborationspawn_agent',
+      tool_input: { id: 'spawn-child', title },
+    });
+    assert.equal(tracked.status, 0, tracked.stderr);
+    const resumed = runHook(state, root, { ...session, hook_event_name: 'SessionStart', source: 'resume' });
+    assert.equal(resumed.status, 0, resumed.stderr);
+    assert.match(resumed.stdout, /Latest Tracked Tool/);
+    assert.match(resumed.stdout, /collaborationspawn_agent/);
+    const pending = resumed.stdout.match(/## What's Left\n([\s\S]*?)(?=\n## |$)/);
+    assert.ok(pending, 'the pending task section must be present');
+    assert.ok(!pending[1].includes(title), 'spawn metadata must not become a pending task');
+  });
+});
+
+test('Codex no commits allows Stop without done tasks and prints one reminder', () => {
+  inNoCommitCodexFixture(({ writePacket, gate, state }) => {
+    writePacket('auth', 'in_progress');
+    const stopped = gate();
+    assert.equal(stopped.status, 0, stopped.stderr);
+    assert.equal(stopped.stdout.trim(), '');
+    const prompted = state();
+    assert.equal(prompted.status, 0, prompted.stderr);
+    assert.match(prompted.stdout, /no commits/);
+    assert.equal(prompted.stdout.trim().split('\n').length, 1);
+    assert.doesNotMatch(prompted.stdout, /Spec tollgate unavailable/);
+  });
+});
+
+test('Codex no commits blocks a done task with first commit guidance', () => {
+  inNoCommitCodexFixture(({ writePacket, gate }) => {
+    writePacket('auth', 'done');
+    const result = gate();
+    assert.equal(result.status, 0, result.stderr);
+    const body = JSON.parse(result.stdout);
+    assert.equal(body.decision, 'block');
+    assert.match(body.reason, /first commit/);
+    assert.doesNotMatch(body.reason, /controlled failure/);
+  });
+});
+
+test('Codex no commits blocks two completed packets with first commit guidance', () => {
+  inNoCommitCodexFixture(({ writePacket, gate }) => {
+    for (const feature of ['auth', 'billing']) writePacket(feature, 'done');
+    const result = gate();
+    assert.equal(result.status, 0, result.stderr);
+    const body = JSON.parse(result.stdout);
+    assert.equal(body.decision, 'block');
+    assert.match(body.reason, /first commit/);
+    assert.doesNotMatch(body.reason, /controlled failure/);
+  });
+});
+
 function canonicalProcessTask(root, title, dependency = 'none') {
   const context = workflowRuntimeContext(root, 'auth', 'session-auth-state');
   return [
@@ -245,6 +421,138 @@ function inInstalledProcessSpecStateFixture(run) {
   });
 }
 
+function writeCodexLegacyPacket(root, name = 'old') {
+  const dir = path.join(root, 'specs', name);
+  fs.mkdirSync(path.join(dir, 'tasks'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'spec.json'), JSON.stringify({
+    feature_name: name,
+    status: 'in_progress',
+    task_registry: { 'tasks/task-R1-01-x.md': { status: 'done' } },
+  }));
+  fs.writeFileSync(path.join(dir, 'tasks', 'task-R1-01-x.md'), '# Task\n\n**Status:** done\n');
+}
+
+const CODEX_LEGACY_NOTICE = /`specs\/old` is a legacy Specs packet without plan\.md; CafeKit no longer reads it/g;
+
+test('Codex spec-state notices a leftover legacy packet once per session, also when it is the only packet', () => {
+  inHookFixture((root, hooks) => {
+    writeCodexLegacyPacket(root);
+    const prompt = (session) => runHook(path.join(hooks, 'spec-state.cjs'), root, {
+      cwd: root, session_id: session, hook_event_name: 'UserPromptSubmit', prompt: 'Continue',
+    });
+    const first = prompt('session-a');
+    assert.equal(first.status, 0, first.stderr);
+    assert.equal((first.stdout.match(CODEX_LEGACY_NOTICE) || []).length, 1);
+    assert.equal((prompt('session-a').stdout.match(CODEX_LEGACY_NOTICE) || []).length, 0, 'the same session is not told twice');
+    assert.equal((prompt('session-b').stdout.match(CODEX_LEGACY_NOTICE) || []).length, 1, 'a new session is told once');
+  });
+});
+
+test('Codex Stop ignores a leftover legacy packet and still blocks a malformed process-first packet', () => {
+  inHookFixture((root, hooks) => {
+    const gate = path.join(hooks, 'spec-gate.cjs');
+    const payload = { cwd: root, session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
+    writeCodexLegacyPacket(root);
+    const legacyOnly = runHook(gate, root, payload);
+    assert.equal(legacyOnly.status, 0, legacyOnly.stderr);
+    assert.equal(legacyOnly.stdout, '', 'a legacy packet alone never blocks');
+
+    const shared = path.join(root, 'specs', '_shared');
+    fs.mkdirSync(shared, { recursive: true });
+    fs.writeFileSync(path.join(shared, 'active-feature.json'), '{"featureName": "old"}\n');
+    assert.equal(runHook(gate, root, payload).stdout, '', 'a recorded legacy packet never blocks');
+    fs.rmSync(shared, { recursive: true, force: true });
+
+    const feature = path.join(root, 'specs', 'cycle');
+    writeProcessTask(feature, 'done', null, 'pnpm test', 'task-01-a.md');
+    writeProcessTask(feature, 'pending', null, 'pnpm test', 'task-02-b.md');
+    for (const [name, dependency] of [['task-01-a.md', 'task-02-b.md'], ['task-02-b.md', 'task-01-a.md']]) {
+      const file = path.join(feature, name);
+      fs.writeFileSync(file, fs.readFileSync(file, 'utf8').replace('- none', `- ${dependency}`));
+    }
+    const cycle = runHook(gate, root, payload);
+    assert.equal(cycle.status, 0, cycle.stderr);
+    const block = JSON.parse(cycle.stdout);
+    assert.equal(block.decision, 'block');
+    assert.match(block.reason, /invalid workflow packet/);
+  });
+});
+
+test('Codex Stop still blocks a recorded missing packet and reads a plan.md + spec.json packet as process-first', () => {
+  inHookFixture((root, hooks) => {
+    const gate = path.join(hooks, 'spec-gate.cjs');
+    const payload = { cwd: root, session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
+    const feature = path.join(root, 'specs', 'auth');
+    writeProcessTask(feature, 'done');
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ feature_name: 'auth' }));
+    const hybrid = runHook(gate, root, payload);
+    assert.equal(hybrid.status, 0, hybrid.stderr);
+    const hybridBlock = JSON.parse(hybrid.stdout);
+    assert.equal(hybridBlock.decision, 'block');
+    assert.match(hybridBlock.reason, /task-01-auth\.md/);
+
+    const shared = path.join(root, 'specs', '_shared');
+    fs.mkdirSync(shared, { recursive: true });
+    fs.writeFileSync(path.join(shared, 'active-feature.json'), '{"featureName": "nope"}\n');
+    const missing = runHook(gate, root, payload);
+    assert.equal(missing.status, 0, missing.stderr);
+    const missingBlock = JSON.parse(missing.stdout);
+    assert.equal(missingBlock.decision, 'block');
+    assert.match(missingBlock.reason, /explicit_not_found/);
+  });
+});
+
+test('Codex installed spec-state uses one snapshot for done task receipts', (t) => {
+  inInstalledProcessSpecStateFixture(({ feature, hooks, root, writeTask }) => {
+    const trace = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-codex-snapshot-count-'));
+    try {
+      const tasks = ['task-01-work.md', 'task-02-work.md'];
+      for (const name of tasks) writeTask(name, name, 'done');
+      writeTask('task-03-work.md', 'Task 03: work', 'in_progress');
+      const scripts = path.join(root, '.codex/scripts');
+      const provenance = require(path.join(scripts, 'provenance.cjs'));
+      const policy = require(path.join(scripts, 'workflow-policy.cjs'));
+      const receipt = require(path.join(scripts, 'spec-receipt.cjs'));
+      const context = provenance.deriveRuntimeContext({ projectRoot: root,
+        specsRoot: path.join(root, 'specs'), specFile: path.join(feature, 'plan.md'),
+        featureName: 'auth', runtimeSession: 'one-snapshot' });
+      for (const name of tasks) {
+        fs.appendFileSync(path.join(feature, name), [
+          '\n## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+          `Base: ${context.base}`, `Head: ${context.head}`, '```text', '1 test passed', '```', '',
+        ].join('\n'));
+        assert.deepEqual(receipt.checkWorkflowTaskReceipt(feature, name, context, policy).failures, []);
+      }
+      const countFile = path.join(trace, 'git-status.txt');
+      const preload = path.join(trace, 'count.cjs');
+      fs.writeFileSync(preload, `
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+for (const method of ['spawnSync', 'execFileSync']) {
+  const original = cp[method];
+  cp[method] = function(command, args, ...rest) {
+    if (path.basename(String(command)) === 'git' && Array.isArray(args) && args.includes('status'))
+      fs.appendFileSync(${JSON.stringify(countFile)}, 'status\\n');
+    return original.call(this, command, args, ...rest);
+  };
+}
+`);
+      const result = spawnSync(process.execPath, [path.join(hooks, 'spec-state.cjs')], {
+        cwd: root, encoding: 'utf8',
+        env: { ...process.env, NODE_OPTIONS: `${process.env.NODE_OPTIONS || ''} --require ${JSON.stringify(preload)}` },
+        input: JSON.stringify({ cwd: root, featureName: 'auth', hook_event_name: 'UserPromptSubmit',
+          session_id: 'one-snapshot', prompt: 'Continue specs/auth' }),
+      });
+      assert.equal(result.status, 0, result.stderr);
+      assert.match(result.stdout, /Spec state changed/);
+      const count = fs.readFileSync(countFile, 'utf8').trim().split('\n').length;
+      t.diagnostic(`Codex git status calls: ${count}`);
+      assert.ok(count > 0 && count <= 2, `git status calls: ${count}; expected at most 2`);
+    } finally { fs.rmSync(trace, { recursive: true, force: true }); }
+  });
+});
+
 test('Codex installed spec-state re-evaluates a standalone task when blocked becomes pending', () => {
   inInstalledProcessSpecStateFixture(({ findCacheFile, hooks, runState, writeTask }) => {
     writeTask('task-01-auth.md', 'Task 01: auth', 'blocked');
@@ -401,6 +709,503 @@ test('Codex resolver accepts unique legacy task numbers, rejects ambiguity, and
   });
 });
 
+test('Codex inspect still denies blocked reads when the configured specs path escapes', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'inspect-block.cjs'), root, {
+      cwd: root, hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: 'dist/index.html' },
+    });
+    assert.equal(result.status, 2);
+    assert.match(result.stderr, /SCOPE LIMIT EXCEEDED/);
+  });
+});
+
+test('Codex rules still inject when the configured specs path escapes', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'rules.cjs'), root, {
+      cwd: root, hook_event_name: 'UserPromptSubmit', session_id: 'invalid-specs-rules',
+    });
+    assert.equal(result.status, 0);
+    assert.match(result.stdout, /## Rules/);
+    assert.ok(result.stdout.includes(`${fs.realpathSync(root)}/specs/`));
+  });
+});
+
+test('Codex rules wait for runtime before reserving the same session', () => {
+  inHookFixture((root, hooks) => {
+    const file = path.join(root, '.codex/runtime.json');
+    const payload = { cwd: root, hook_event_name: 'UserPromptSubmit', session_id: 'waiting-for-runtime' };
+    const hook = path.join(hooks, 'rules.cjs');
+    assert.equal(fs.existsSync(file), false);
+    const absent = runHook(hook, root, payload);
+    assert.equal(absent.status, 0);
+    assert.equal(absent.stdout, '');
+    fs.writeFileSync(file, JSON.stringify({ paths: { specs: 'specs' } }));
+    const present = runHook(hook, root, payload);
+    assert.equal(present.status, 0);
+    assert.match(present.stdout, /## Rules/);
+    assert.equal(runHook(hook, root, payload).stdout, '');
+  });
+});
+
+test('Codex secret guardrail runs from source with its shared keyword shim', () => {
+  const env = { ...process.env };
+  delete env.CLAUDE_PROJECT_DIR;
+  delete env.PROJECT_ROOT;
+  const result = spawnSync(process.execPath, [path.join(CODEX_HOOKS, 'secret-output-guardrail.cjs')], {
+    cwd: PACKAGE_ROOT, env, encoding: 'utf8', input: JSON.stringify({ prompt: 'Explain secret handling.' }),
+  });
+  assert.equal(result.status, 0);
+  assert.equal(result.stderr, '');
+  assert.match(result.stdout, /## Secret handling/);
+});
+
+test('Codex secret guardrail fails open without a keyword library or a stack', () => {
+  inHookFixture((root, hooks) => {
+    fs.unlinkSync(path.join(hooks, 'lib/secret-keywords.cjs'));
+    const result = runHook(path.join(hooks, 'secret-output-guardrail.cjs'), root, { prompt: 'Explain secret handling.' });
+    assert.equal(result.status, 0);
+    assert.equal(result.stdout, '');
+    assert.equal(result.stderr, '');
+    const rows = fs.readFileSync(path.join(hooks, '.logs/hook-log.jsonl'), 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].hook, 'secret-output-guardrail');
+  });
+});
+
+for (const invalidSpecs of [false, true]) {
+  test(`Codex compact warns about pending confirmations${invalidSpecs ? ' with an invalid specs path' : ''}`, () => {
+    inHookFixture((root, hooks) => {
+      fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: invalidSpecs ? '../outside' : 'specs' } }));
+      const result = runHook(path.join(hooks, 'session.cjs'), root, {
+        cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session',
+      });
+      assert.equal(result.status, 0);
+      assert.match(result.stdout, /Pending.*(?:confirmation|approval)/i);
+      assert.match(result.stdout, /(?:request|ask).*?(?:fresh|again|user)/i);
+    });
+  });
+}
+
+test('Codex compact clears its pending privacy request even with an invalid specs path', () => {
+  inHookFixture((root, hooks) => {
+    const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+    privacy.createPending({ projectRoot: root, sessionCwd: root, sessionId: 'compact-session', filePaths: ['.env'] });
+    const dir = path.join(hooks, '.privacy');
+    const pending = () => fs.readdirSync(dir).filter(name => name.startsWith('pending-'));
+    assert.equal(pending().length, 1);
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'session.cjs'), root, {
+      cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session',
+    });
+    assert.equal(result.status, 0);
+    assert.equal(pending().length, 0);
+  });
+});
+
+test('Codex compact releases only its own rules reservation', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), '{}');
+    const prompt = session_id => runHook(path.join(hooks, 'rules.cjs'), root, { cwd: root, hook_event_name: 'UserPromptSubmit', session_id });
+    for (const id of ['session-s', 'session-t']) {
+      assert.match(prompt(id).stdout, /## Rules/);
+      assert.equal(prompt(id).stdout, '');
+    }
+    const compact = runHook(path.join(hooks, 'session.cjs'), root, {
+      cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-s',
+    });
+    assert.equal(compact.status, 0);
+    assert.match(prompt('session-s').stdout, /## Rules/);
+    assert.equal(prompt('session-t').stdout, '');
+  });
+});
+
+test('Codex precompact ignores empty stdin without recording a crash', () => {
+  inHookFixture((root, hooks) => {
+    const result = spawnSync(process.execPath, [path.join(hooks, 'precompact.cjs')], {
+      cwd: root, input: '', encoding: 'utf8',
+    });
+    assert.equal(result.status, 0);
+    assert.equal(result.stderr, '');
+    const file = path.join(hooks, '.logs/hook-log.jsonl');
+    const rows = fs.existsSync(file)
+      ? fs.readFileSync(file, 'utf8').trim().split('\n').filter(Boolean).map(line => JSON.parse(line))
+      : [];
+    assert.equal(rows.filter(row => row.hook === 'precompact' && row.status === 'crash').length, 0);
+  });
+});
+
+test('Codex precompact anchors are restored only to the matching session', () => {
+  inHookFixture((root, hooks) => {
+    const head = spawnSync('git', ['rev-parse', '--short', 'HEAD'], { cwd: root, encoding: 'utf8' }).stdout.trim();
+    const status = spawnSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8' });
+    assert.equal(status.status, 0);
+    const dirty = status.stdout.trim().split('\n').filter(Boolean).length;
+    const capture = runHook(path.join(hooks, 'precompact.cjs'), root, {
+      cwd: root, hook_event_name: 'PreCompact', trigger: 'auto', session_id: 'session-s',
+    });
+    assert.equal(capture.status, 0, capture.stderr);
+    const restart = session_id => runHook(path.join(hooks, 'session.cjs'), root, {
+      cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id,
+    });
+    const own = restart('session-s');
+    assert.equal(own.status, 0);
+    assert.match(own.stdout, /State before compaction/);
+    assert.ok(own.stdout.includes(`HEAD ${head}`));
+    assert.ok(own.stdout.includes(`${dirty} uncommitted path(s)`));
+    const other = restart('session-t');
+    assert.equal(other.status, 0);
+    assert.match(other.stdout, /Pending/i);
+    assert.doesNotMatch(other.stdout, /State before compaction/);
+  });
+});
+
+function sessionWithoutUpdateNetwork(root, hooks, session_id) {
+  const marker = path.join(root, 'update-network-attempted');
+  const preload = path.join(root, 'block-update-network.cjs');
+  fs.writeFileSync(preload, `require('https').get = () => {
+    require('fs').writeFileSync(${JSON.stringify(marker)}, 'attempted');
+    throw new Error('network disabled in update test');
+  };\n`);
+  const result = spawnSync(process.execPath, ['--require', preload, path.join(hooks, 'session.cjs')], {
+    cwd: root, encoding: 'utf8', input: JSON.stringify({ cwd: root, hook_event_name: 'SessionStart', source: 'startup', session_id }),
+  });
+  assert.equal(fs.existsSync(marker), false, 'the cached update check must not attempt a network request');
+  return result;
+}
+
+test('Codex SessionStart prints a newer cached CafeKit version', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    fs.writeFileSync(path.join(root, '.codex/.cafekit-update-cache.json'), JSON.stringify({ ts: Date.now(), latest: '1.3.0' }));
+    const result = sessionWithoutUpdateNetwork(root, hooks, 'cached-update');
+    assert.equal(result.status, 0);
+    assert.ok(result.stdout.includes('\n⚡ CafeKit update available: 1.2.3 → 1.3.0\n   Run: npx @haposoft/cafekit\n'));
+  });
+});
+
+test('Codex SessionStart stays silent about an equal cached CafeKit version', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    fs.writeFileSync(path.join(root, '.codex/.cafekit-update-cache.json'), JSON.stringify({ ts: Date.now(), latest: '1.2.3' }));
+    const result = sessionWithoutUpdateNetwork(root, hooks, 'equal-update');
+    assert.equal(result.status, 0);
+    assert.doesNotMatch(result.stdout, /CafeKit update available/);
+  });
+});
+
+test('Codex update failure still clears pending privacy for the session', () => {
+  inHookFixture((root, hooks) => {
+    const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+    privacy.createPending({ projectRoot: root, sessionCwd: root, sessionId: 'failed-update', filePaths: ['.env'] });
+    fs.writeFileSync(path.join(root, '.codex/cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    fs.writeFileSync(path.join(hooks, 'lib/update-check.cjs'), "module.exports = { checkCafeKitUpdate() { throw new Error('synthetic update failure'); } };\n");
+    const result = sessionWithoutUpdateNetwork(root, hooks, 'failed-update');
+    assert.equal(result.status, 0);
+    assert.equal(result.stderr, '');
+    const pending = fs.readdirSync(path.join(hooks, '.privacy')).filter(name => name.startsWith('pending-'));
+    assert.equal(pending.length, 0);
+  });
+});
+
+test('Codex Stop describes an escaping specs root as an invalid workflow packet', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+      cwd: root, session_id: 'invalid-root-message', hook_event_name: 'Stop', stop_hook_active: false,
+    });
+    assert.equal(result.status, 0);
+    const output = JSON.parse(result.stdout);
+    assert.equal(output.decision, 'block');
+    assert.match(output.reason, /^Completion gate: invalid workflow packet detected \(<specs>\):/);
+    assert.doesNotMatch(output.reason, /controlled failure/);
+  });
+});
+
+test('Codex spec-state shows detailed task status counts on its Phase line', () => {
+  inInstalledProcessSpecStateFixture(({ writeTask, runState }) => {
+    for (const [name, status] of [['task-01-active.md', 'in_progress'], ['task-02-next.md', 'pending'],
+      ['task-03-blocked.md', 'blocked'], ['task-04-later.md', 'pending']]) {
+      writeTask(name, name, status);
+    }
+    const result = runState();
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /^- Phase: .* \| Tasks: 0 done \/ 4 total \(1 in_progress, 2 pending, 1 blocked\)$/m);
+  });
+});
+
+function shortPrivacyFixture(check) {
+  return inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.env'), 'fixture\n');
+    fs.writeFileSync(path.join(root, 'credentials.json'), '{}\n');
+    const dir = path.join(hooks, '.privacy');
+    const session = 'short-approval-session';
+    const payload = (file = '.env', session_id = session) => ({ cwd: root, session_id,
+      hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: `cat ${file}` } });
+    const block = (file, id) => runHook(path.join(hooks, 'privacy-block.cjs'), root, payload(file, id));
+    const submit = (prompt, session_id = session, env = process.env) => spawnSync(process.execPath,
+      [path.join(hooks, 'privacy-approval.cjs')], { cwd: root, encoding: 'utf8', env,
+        input: JSON.stringify({ cwd: root, session_id, hook_event_name: 'UserPromptSubmit', prompt }) });
+    const files = prefix => fs.existsSync(dir) ? fs.readdirSync(dir).filter(name => name.startsWith(prefix)) : [];
+    const id = result => {
+      assert.equal(result.status, 0, result.stderr);
+      const reason = JSON.parse(result.stdout).hookSpecificOutput.permissionDecisionReason;
+      const match = reason.match(/APPROVE CAFEKIT PRIVACY ([a-f0-9]{24})/);
+      assert.ok(match, reason);
+      return match[1];
+    };
+    return check({ root, hooks, dir, session, payload, block, submit, files, id });
+  });
+}
+
+function asyncPrivacyBlock(fixture, file) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [path.join(fixture.hooks, 'privacy-block.cjs')], { cwd: fixture.root });
+    let stdout = '', stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk; });
+    child.stderr.on('data', chunk => { stderr += chunk; });
+    child.on('error', reject);
+    child.on('close', status => resolve({ status, stdout, stderr }));
+    child.stdin.end(JSON.stringify(fixture.payload(file)));
+  });
+}
+
+for (const [label, prompt] of [['y', 'y'], ['yes', 'yes'], ['title-case Vietnamese', 'Có'],
+  ['padded y', ' y '], ['decomposed Vietnamese', 'co\u0301'], ['uppercase Vietnamese', 'CÓ'], ['terminal newline', 'Y\r\n']]) {
+  test(`Codex short privacy approval accepts ${label} and reports granted paths`, () => shortPrivacyFixture(f => {
+    const denied = f.block();
+    const requestId = f.id(denied);
+    const sessionHash = crypto.createHash('sha256').update(f.session).digest('hex');
+    assert.deepEqual(f.files('short-'), [`short-${sessionHash}-${requestId}.json`]);
+    assert.match(denied.stdout, /y \(or yes \/ có\)/);
+    const result = f.submit(prompt);
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /User approved/);
+    assert.match(JSON.parse(result.stdout).hookSpecificOutput.additionalContext, /Tell the user.*\.env.*before reading/i);
+    assert.equal(f.files('token-').length, 1);
+    assert.equal(f.files('short-').length, 0);
+    assert.equal(f.block().stdout, '');
+    assert.equal(f.block().stdout, '', 'the one-hour grant remains reusable');
+  }));
+}
+
+test('Codex short privacy approval is cancelled by an intervening prompt', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  assert.equal(f.submit('ok làm đi').status, 0);
+  const result = f.submit('y');
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.match(f.block().stdout, /"permissionDecision":"deny"/);
+}));
+
+test('Codex short privacy approval stays in its session and requires pending state', () => shortPrivacyFixture(f => {
+  assert.equal(f.submit('y').status, 0);
+  assert.equal(f.files('token-').length, 0);
+  f.id(f.block());
+  assert.doesNotMatch(f.submit('y', 'another-session').stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.match(f.submit('y').stdout, /User approved/);
+}));
+
+for (const [label, prompt] of [['extra Vietnamese text', 'y nhé'], ['extra English text', 'yes please'],
+  ['repeated letter', 'yy'], ['fullwidth letter', 'ｙ'], ['zero-width suffix', 'y\u200b']]) {
+  test(`Codex short privacy approval rejects ${label}`, () => shortPrivacyFixture(f => {
+    f.id(f.block());
+    const result = f.submit(prompt);
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /User approved/);
+    assert.equal(f.files('token-').length, 0);
+    assert.equal(f.files('short-').length, 0);
+    assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  }));
+}
+
+test('Codex short privacy approval refuses two requests while the long phrase selects one', () => shortPrivacyFixture(f => {
+  const first = f.id(f.block());
+  f.id(f.block('credentials.json'));
+  const result = f.submit('y');
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  const exact = f.submit(`APPROVE CAFEKIT PRIVACY ${first}`);
+  assert.match(exact.stdout, /User approved/);
+  assert.match(JSON.parse(exact.stdout).hookSpecificOutput.additionalContext, /Tell the user.*\.env.*before reading/i);
+  assert.equal(f.block().stdout, '');
+  assert.match(f.block('credentials.json').stdout, /"permissionDecision":"deny"/);
+}));
+
+test('parallel Codex privacy blocks preserve both markers and cannot be approved by y', () => shortPrivacyFixture(async f => {
+  const results = await Promise.all([asyncPrivacyBlock(f, '.env'), asyncPrivacyBlock(f, 'credentials.json')]);
+  assert.notEqual(f.id(results[0]), f.id(results[1]));
+  assert.equal(f.files('short-').length, 2);
+  assert.equal(f.submit('y').status, 0);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.match(f.block().stdout, /"permissionDecision":"deny"/);
+  assert.match(f.block('credentials.json').stdout, /"permissionDecision":"deny"/);
+}));
+
+test('repeated Codex blocks for the same path set reuse the request and short marker', () => shortPrivacyFixture(f => {
+  const first = f.id(f.block('.env credentials.json'));
+  assert.equal(f.id(f.block('credentials.json .env')), first);
+  assert.equal(f.files('pending-').length, 1);
+  assert.equal(f.files('short-').length, 1);
+  assert.match(f.submit('y').stdout, /User approved/);
+  assert.equal(f.block('.env credentials.json').stdout, '');
+  assert.match(f.block().stdout, /"permissionDecision":"deny"/);
+}));
+
+test('a later Codex block restores the short marker for the same pending request', () => shortPrivacyFixture(f => {
+  const requestId = f.id(f.block());
+  assert.equal(f.submit('ok làm đi').status, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.equal(f.id(f.block()), requestId);
+  assert.equal(f.files('pending-').length, 1);
+  assert.equal(f.files('short-').length, 1);
+  assert.match(f.submit('y').stdout, /User approved/);
+  assert.equal(f.block().stdout, '');
+  assert.match(f.block('credentials.json').stdout, /"permissionDecision":"deny"/);
+}));
+
+test('an immediate repeated Codex block keeps one short marker without an exclusive-write error', () => shortPrivacyFixture(f => {
+  const requestId = f.id(f.block());
+  assert.equal(f.id(f.block()), requestId);
+  assert.equal(f.files('pending-').length, 1);
+  assert.equal(f.files('short-').length, 1);
+  assert.match(f.submit('y').stdout, /User approved/);
+  assert.equal(f.block().stdout, '');
+}));
+
+test('a Codex prompt error after claiming markers cancels the short approval', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-privacy-fault-'));
+  try {
+    const preload = path.join(outside, 'fault.cjs');
+    fs.writeFileSync(preload, `const fs = require('fs'); const original = fs.readdirSync; let calls = 0;\nfs.readdirSync = function(dir, ...args) { if (String(dir) === ${JSON.stringify(fs.realpathSync(f.dir))} && ++calls === 2) throw new Error('injected state read error'); return original.call(this, dir, ...args); };\n`);
+    const failed = f.submit('ok làm đi', f.session, { ...process.env, NODE_OPTIONS: `--require=${preload}` });
+    assert.equal(failed.status, 0, failed.stderr);
+    assert.match(failed.stdout, /failed safely/);
+    assert.equal(f.files('short-').length, 0);
+    assert.equal(f.files('token-').length, 0);
+    assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  } finally { fs.rmSync(outside, { recursive: true, force: true }); }
+}));
+
+test('a Codex post-claim error cancels a marker created during prompt processing', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-privacy-post-claim-fault-'));
+  try {
+    const preload = path.join(outside, 'fault.cjs');
+    fs.writeFileSync(preload, `const assert = require('node:assert/strict');
+const state = require(${JSON.stringify(path.join(f.hooks, 'lib/privacy-state.cjs'))});
+const claim = state.claimShortMarkers;
+let claimed = false;
+state.claimShortMarkers = (...args) => {
+  const result = claim(...args);
+  if (!claimed) { assert.equal(result.ok, true); assert.equal(result.requestIds.length, 1); claimed = true; }
+  return result;
+};
+state.cleanup = () => {
+  assert.equal(claimed, true);
+  state.createPending(${JSON.stringify({ projectRoot: f.root, sessionCwd: f.root, sessionId: f.session, filePath: 'credentials.json' })});
+  throw new Error('injected processing error after marker claim');
+};\n`);
+    const failed = f.submit('ok làm đi', f.session, { ...process.env, NODE_OPTIONS: `--require=${preload}` });
+    assert.equal(failed.status, 0, failed.stderr);
+    assert.match(failed.stdout, /failed safely/);
+    assert.equal(f.files('pending-').length, 2);
+    assert.equal(f.files('short-').length, 0);
+    assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+    assert.equal(f.files('token-').length, 0);
+  } finally { fs.rmSync(outside, { recursive: true, force: true }); }
+}));
+
+test('a corrupt Codex short marker cannot grant permission even with valid pending state', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const markers = f.files('short-');
+  assert.equal(markers.length, 1);
+  fs.writeFileSync(path.join(f.dir, markers[0]), '{');
+  const result = f.submit('y');
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+}));
+
+for (const unlinkFailure of [false, true]) {
+test(`an unclaimable Codex short marker is cancelled after ${unlinkFailure ? 'rename and unlink errors' : 'a rename error'}`, () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  assert.equal(f.files('short-').length, 1);
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-privacy-rename-fault-'));
+  try {
+    const preload = path.join(outside, 'fault.cjs');
+    const prefix = JSON.stringify(path.join(fs.realpathSync(f.dir), 'short-'));
+    fs.writeFileSync(preload, `const fs = require('fs'); const original = fs.renameSync;\nfs.renameSync = function(from, to) { if (String(from).startsWith(${prefix})) throw new Error('injected rename failure'); return original.call(this, from, to); };\n`
+      + (unlinkFailure ? `const unlink = fs.unlinkSync; fs.unlinkSync = function(file) { if (String(file).startsWith(${prefix})) throw new Error('injected unlink failure'); return unlink.call(this, file); };\n` : ''));
+    const result = f.submit('ok làm đi', f.session, { ...process.env, NODE_OPTIONS: `--require=${preload}` });
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /User approved/);
+    assert.equal(f.files('token-').length, 0);
+  } finally { fs.rmSync(outside, { recursive: true, force: true }); }
+  assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+}));
+}
+
+test('Codex compact clears pending requests and short markers only for its session', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  f.id(f.block('credentials.json', 'other-session'));
+  const result = runHook(path.join(f.hooks, 'session.cjs'), f.root,
+    { source: 'compact', session_id: f.session, cwd: f.root, hook_event_name: 'SessionStart' });
+  assert.equal(result.status, 0, result.stderr);
+  const prefix = `short-${crypto.createHash('sha256').update(f.session).digest('hex')}-`;
+  assert.equal(f.files(prefix).length, 0);
+  assert.equal(f.files('short-').length, 1);
+  assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.match(f.submit('y', 'other-session').stdout, /User approved/);
+}));
+
+test('Codex short approval cannot grant an expired pending request', () => shortPrivacyFixture(f => {
+  const id = f.id(f.block());
+  const file = path.join(f.dir, `pending-${id}.json`);
+  const pending = JSON.parse(fs.readFileSync(file, 'utf8'));
+  pending.expiresAt = Date.now() - 1;
+  fs.writeFileSync(file, JSON.stringify(pending));
+  assert.equal(f.submit('y').status, 0);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+}));
+
+test('Codex cleanup removes expired short markers', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const markers = f.files('short-');
+  assert.equal(markers.length, 1);
+  const file = path.join(f.dir, markers[0]);
+  const marker = JSON.parse(fs.readFileSync(file, 'utf8'));
+  marker.expiresAt = Date.now() - 1;
+  fs.writeFileSync(file, JSON.stringify(marker));
+  require(path.join(f.hooks, 'lib/privacy-state.cjs')).cleanup(f.root);
+  assert.equal(f.files('short-').length, 0);
+}));
+
+test('Codex long privacy approval still works after an intervening prompt and reports paths', () => shortPrivacyFixture(f => {
+  const id = f.id(f.block());
+  assert.equal(f.submit('ok làm đi').status, 0);
+  assert.equal(f.files('short-').length, 0);
+  const result = f.submit(`APPROVE CAFEKIT PRIVACY ${id}`);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /User approved/);
+  assert.match(JSON.parse(result.stdout).hookSpecificOutput.additionalContext, /Tell the user.*\.env.*before reading/i);
+  assert.equal(f.block().stdout, '');
+}));
+
 test('Codex privacy approval is exact, session-bound, and reusable within its window', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
@@ -592,15 +1397,17 @@ test('Codex inspect hook scans native shell commands and structured paths', () =
     for (const command of [
       'rg secret node_modules',
       "sed -n '1,20p' dist/bundle.js",
-      "rg --glob '**/*' symbol src"
+      "rg --glob '**/*' symbol ."
     ]) {
       const result = runHook(inspect, root, payload(command));
       assert.equal(result.status, 2, command);
       assert.match(result.stderr, /SCOPE LIMIT EXCEEDED/);
     }
 
-    const normal = runHook(inspect, root, payload('rg symbol src packages'));
-    assert.equal(normal.status, 0);
+    for (const command of ['rg symbol src packages', "rg --glob '**/*' symbol src"]) {
+      const normal = runHook(inspect, root, payload(command));
+      assert.equal(normal.status, 0);
+    }
 
     const structured = runHook(inspect, root, {
       ...payload(''),
@@ -615,18 +1422,8 @@ test('Codex completion gate cannot be bypassed from a nested cwd', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
     const feature = path.join(root, 'specs', 'auth');
-    const taskPath = 'tasks/task-R0-01-auth.md';
-    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
     fs.mkdirSync(nested, { recursive: true });
-    const spec = {
-      status: 'in_progress',
-      feature_name: 'auth',
-      task_registry: {
-        [taskPath]: { status: 'pending', completed_at: null }
-      }
-    };
-    fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: pending\n');
+    writeProcessTask(feature, 'pending', null, 'node --test');
     const gate = path.join(hooks, 'spec-gate.cjs');
     const payload = {
       cwd: nested,
@@ -640,32 +1437,19 @@ test('Codex completion gate cannot be bypassed from a nested cwd', () => {
     assert.equal(seeded.status, 0);
     assert.equal(seeded.stdout, '');
 
-    spec.task_registry[taskPath] = {
-      status: 'done',
-      completed_at: '2026-07-29T10:00:00.000Z'
-    };
-    fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n');
-
-    const blockedBeforeCloseout = runHook(gate, nested, payload);
-    assert.equal(blockedBeforeCloseout.status, 0);
-    assert.equal(JSON.parse(blockedBeforeCloseout.stdout).decision, 'block');
-    assert.match(JSON.parse(blockedBeforeCloseout.stdout).reason, /verification receipt/);
-
-    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
-      'Status: done', '', '## Evidence', '', 'Verification: PASS',
-      'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
-    ].join('\n'), 'auth'));
-    const validBeforeCloseout = runHook(gate, nested, payload);
-    assert.equal(validBeforeCloseout.status, 0);
-    assert.equal(validBeforeCloseout.stdout, '');
-    assert.equal(fs.existsSync(path.join(feature, 'feature-receipt.md')), false);
-
-    spec.current_phase = 'closeout';
-    fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
-    const closeout = runHook(gate, nested, payload);
-    assert.equal(closeout.status, 0);
-    assert.equal(closeout.stdout, '');
+    writeProcessTask(feature, 'done', null, 'node --test');
+    const blocked = runHook(gate, nested, payload);
+    assert.equal(blocked.status, 0);
+    assert.equal(JSON.parse(blocked.stdout).decision, 'block');
+    assert.match(JSON.parse(blocked.stdout).reason, /verification receipt/);
+
+    writeProcessTask(feature, 'done', bindReceipt(root, [
+      'Verification: PASS', 'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+      '```', 'node --test', 'ok 1', '```',
+    ].join('\n')).split('\n'), 'node --test');
+    const valid = runHook(gate, nested, payload);
+    assert.equal(valid.status, 0);
+    assert.equal(valid.stdout, '');
   });
 });
 
@@ -765,20 +1549,15 @@ test('Codex process-v3 Receipt command must match the exact Verification Plan co
 });
 
 test('Codex recorded active feature turns the identity block into receipt validation', () => {
-  // Issue #79 end to end on this runtime. Two legacy packets both claiming closeout make
-  // the gate answer a missing-receipt violation with an identity complaint whose stated
-  // remedy nothing wrote. Naming the feature resolves it and the violation surfaces.
+  // Issue #79 end to end on this runtime. Two unfinished packets make the gate answer a
+  // missing-receipt violation with an identity complaint; naming the feature resolves it
+  // and the violation surfaces.
   inHookFixture((root, hooks) => {
     for (const name of ['alpha', 'beta']) {
       const feature = path.join(root, 'specs', name);
-      fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify({
-        feature_name: name,
-        status: 'done',
-        current_phase: 'closeout',
-        task_registry: { 'tasks/task-R0-01-x.md': { status: 'done', completed_at: '2026-01-01T00:00:00.000Z' } },
-      }, null, 2)}\n`);
-      fs.writeFileSync(path.join(feature, 'tasks', 'task-R0-01-x.md'), '# Task\n\nStatus: done\n');
+      writeProcessTask(feature, 'done', null, 'node --test', 'task-01-x.md');
+      fs.writeFileSync(path.join(feature, 'task-02-y.md'),
+        '# Task 02\n\nStatus: pending\n\n## Dependencies\n\n- none\n\n## Verification Plan\n\n- Command: node --test\n');
     }
     const payload = { cwd: root, session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
 
@@ -880,16 +1659,7 @@ test('empty or forged Codex hook authority fails closed', () => {
       assert.match(block.reason, /hook payload (is empty|must be a JSON object)/i);
     }
 
-    const feature = path.join(root, 'specs', 'auth');
-    const taskPath = 'tasks/task.md';
-    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
-      status: 'in_progress',
-      current_phase: 'closeout',
-      feature_name: 'auth',
-      task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
-    }));
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n');
+    writeProcessTask(path.join(root, 'specs', 'auth'), 'done');
     fs.writeFileSync(path.join(root, '.codex', 'runtime.json'), JSON.stringify({
       spec: { completion_gate: false },
     }));
@@ -911,37 +1681,19 @@ test('empty or forged Codex hook authority fails closed', () => {
   });
 });
 
-test('explicit Strict Codex completion ignores worker-writable proof strings and remains blocked', () => {
+test('Codex Stop omits secret-related assistant messages from saved state', () => {
   inHookFixture((root, hooks) => {
-    const feature = path.join(root, 'specs', 'auth');
-    const taskPath = 'tasks/task.md';
-    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
-      status: 'in_progress',
-      current_phase: 'closeout',
-      feature_name: 'auth',
-      workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' }),
-      proofs: {
-        needsInspection: 'inspection completed',
-        needsIndependentAudit: 'PASS',
-        needsResearchGrounding: 'research completed',
-      },
-      task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
-    }));
-    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
-      'Status: done', '', '## Evidence', '', 'Verification: PASS',
-      'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
-    ].join('\n'), 'auth'));
-    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
-      cwd: root,
-      session_id: 'session-a',
-      hook_event_name: 'Stop',
-      stop_hook_active: false,
+    const message = 'API key handling was discussed in this synthetic test.';
+    const result = runHook(path.join(hooks, 'state.cjs'), root, {
+      hook_event_name: 'Stop', session_id: 'secret-summary', last_assistant_message: message,
     });
-    assert.equal(result.status, 0, result.stderr);
-    const block = JSON.parse(result.stdout);
-    assert.equal(block.decision, 'block');
-    assert.match(block.reason, /needsInspection|needsIndependentAudit|needsResearchGrounding/);
+    assert.equal(result.status, 0);
+    const dir = codexStateDir(root, 'secret-summary');
+    for (const name of ['data.json', 'latest.md']) {
+      const content = fs.readFileSync(path.join(dir, name), 'utf8');
+      assert.ok(content.includes('[omitted: possible secret]'));
+      assert.ok(!content.includes(message));
+    }
   });
 });
 
@@ -1053,61 +1805,55 @@ test('Codex canonical receipt provenance requires both Base and Head', () => {
   // Integration via spec-gate hook: only Base blocks, both passes
   inHookFixture((root, hooks) => {
     const feature = path.join(root, 'specs', 'auth');
-    const taskPath = 'tasks/task-R0-01-auth.md';
-    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
     const gate = path.join(hooks, 'spec-gate.cjs');
     const payload = { cwd: path.join(root, 'packages', 'app'), session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
+    const output = ['```', 'pnpm test', 'ok 1', '```'];
+    fs.mkdirSync(payload.cwd, { recursive: true });
 
     // only Base -> block
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'closeout', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\n');
-    fs.mkdirSync(payload.cwd, { recursive: true });
+    writeProcessTask(feature, 'done', ['Verification: PASS', 'Command: pnpm test', 'Exit: 0', 'Base: abc', ...output]);
     const blocked = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blocked.stdout).decision, 'block');
     assert.match(JSON.parse(blocked.stdout).reason, /\bprovenance\b/);
 
     // both -> no block
-    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, `Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`));
+    writeProcessTask(feature, 'done', bindReceipt(root, ['Verification: PASS', 'Command: pnpm test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, ...output].join('\n')).split('\n'));
     const passed = runHook(gate, payload.cwd, payload);
     assert.equal(passed.stdout, '');
 
     // empty Base: should block provenance — reset gate cache so re-checked as newly-done
     try { fs.rmSync(path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json'), { force: true }); } catch {}
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase:\nHead: def\n');
+    writeProcessTask(feature, 'done', ['Verification: PASS', 'Command: pnpm test', 'Exit: 0', 'Base:', 'Head: def', ...output]);
     const blockedEmpty = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blockedEmpty.stdout).decision, 'block');
     assert.match(JSON.parse(blockedEmpty.stdout).reason, /\bprovenance\b/);
 
     // bare base_sha without colon should block — reset cache again
     try { fs.rmSync(path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json'), { force: true }); } catch {}
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha head_sha\n');
+    writeProcessTask(feature, 'done', ['Verification: PASS', 'Command: pnpm test', 'Exit: 0', 'base_sha head_sha', ...output]);
     const blockedBare = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blockedBare.stdout).decision, 'block');
     assert.match(JSON.parse(blockedBare.stdout).reason, /\bprovenance\b/);
   });
 });
 
-test('Codex cache hardening: every done re-validated — mutation, deletion, malformed cache, unchanged valid', () => {
+test('Codex cache hardening: every done re-validated — mutation, malformed cache, unchanged valid', () => {
   inHookFixture((root, hooks) => {
     const feature = path.join(root, 'specs', 'auth');
-    const taskPath = 'tasks/task-R0-01-auth.md';
-    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
+    const taskPath = 'task-01-auth.md';
     const gate = path.join(hooks, 'spec-gate.cjs');
     const appCwd = path.join(root, 'packages', 'app');
     fs.mkdirSync(appCwd, { recursive: true });
     const payload = { cwd: appCwd, session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
     const cacheFile = path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json');
-    const validBodyTemplate = [
-      'Status: done', '', '## Evidence', '', 'Verification: PASS',
-      'Command: pnpm test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
-      '```', 'pass', '```', '',
-    ].join('\n');
+    const output = ['```', 'pass', '```'];
+    const writeValid = () => writeProcessTask(feature, 'done', (writeProcessTask(feature, 'done'), bindReceipt(root, [
+      'Verification: PASS', 'Command: pnpm test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, ...output,
+    ].join('\n'))).split('\n'));
 
     // first-run (no cache) with valid receipt → no block, cache seeded
     try { fs.rmSync(cacheFile, { force: true }); } catch {}
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'closeout', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
-    const validBody = bindReceipt(root, validBodyTemplate);
-    fs.writeFileSync(path.join(feature, taskPath), validBody);
+    writeValid();
     let res = runHook(gate, appCwd, payload);
     assert.equal(res.stdout, '', 'first-run valid should not block');
     assert.ok(fs.existsSync(cacheFile), 'cache file must be created on first valid run');
@@ -1119,7 +1865,7 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     assert.equal(res.stdout, '', 'cache-hit unchanged valid must not block');
 
     // mutation: remove Command/Verification → must block even though cache says done
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nExit: 0\nBase: abc123\nHead: def456\n```\npass\n```\n');
+    writeProcessTask(feature, 'done', ['Exit: 0', 'Base: abc123', 'Head: def456', ...output]);
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'mutated receipt missing Verification/Command should block on cache-hit');
     assert.match(JSON.parse(res.stdout).reason, /\bverification_state\b|\bcommand\b/);
@@ -1128,33 +1874,21 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'second hit after mutation still blocks');
 
     // restore valid, then mutate provenance (remove Head) → block
-    fs.writeFileSync(path.join(feature, taskPath), validBody);
+    writeValid();
     assert.equal(runHook(gate, appCwd, payload).stdout, '', 'restored valid should pass again');
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\n```\npass\n```\n');
+    writeProcessTask(feature, 'done', ['Verification: PASS', 'Command: pnpm test', 'Exit: 0', 'Base: abc123', ...output]);
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block');
     assert.match(JSON.parse(res.stdout).reason, /\bprovenance\b/);
 
-    // deletion → block with check a
-    fs.writeFileSync(path.join(feature, taskPath), validBody);
-    assert.equal(runHook(gate, appCwd, payload).stdout, '');
-    fs.unlinkSync(path.join(feature, taskPath));
-    res = runHook(gate, appCwd, payload);
-    assert.equal(JSON.parse(res.stdout).decision, 'block');
-    assert.match(JSON.parse(res.stdout).reason, /\ba\b/);
-    // restore for next sub-test
-    fs.writeFileSync(path.join(feature, taskPath), validBody);
-    try { fs.rmSync(cacheFile, { force: true }); } catch {}
-    assert.equal(runHook(gate, appCwd, payload).stdout, '');
-
     // malformed cache with valid receipt → must still pass (cache parse fail-open)
+    writeValid();
     fs.writeFileSync(cacheFile, '{ malformed');
-    fs.writeFileSync(path.join(feature, taskPath), validBody);
     res = runHook(gate, appCwd, payload);
     assert.equal(res.stdout, '', 'malformed cache with valid receipt must not block');
     // malformed cache with invalid receipt → must still block
     fs.writeFileSync(cacheFile, '{ malformed again');
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n');
+    writeProcessTask(feature, 'done');
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'malformed cache with invalid receipt must block');
   });
@@ -1164,18 +1898,11 @@ test('Codex cache identity separates same-feature receipts from different roots'
   const contexts = [];
   for (let index = 0; index < 2; index += 1) {
     const context = inHookFixture((root, hooks) => {
-      const feature = path.join(root, 'specs', 'auth');
-      const taskPath = 'tasks/task.md';
-      fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
-        status: 'in_progress',
-        feature_name: 'auth',
-        task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
-      }));
-      fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
-        'Status: done', '', '## Evidence', '', 'Verification: PASS',
-        'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
-      ].join('\n')));
+      writeProcessTask(path.join(root, 'specs', 'auth'), 'done', null, 'node --test');
+      writeProcessTask(path.join(root, 'specs', 'auth'), 'done', bindReceipt(root, [
+        'Verification: PASS', 'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+        '```', 'node --test', 'ok 1', '```',
+      ].join('\n')).split('\n'), 'node --test');
       const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
         cwd: root,
         session_id: 'session-a',
@@ -1212,33 +1939,32 @@ test('Codex P0 regression: placeholder, explicit failure, artifact, symlink and
   assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: x\nsha256: TBD\n').includes('artifact_hash'));
   assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: x\nsha256: \n').includes('artifact_hash'));
   assert.deepEqual(specReceipt.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\nArtifact: bundle\nsha256: ${'a'.repeat(64)}\n`), []);
-  // Probe D/E: symlink spec/task
+  // Probe D/E: symlink packet and task
   const tmp = fs2.mkdtempSync(path2.join(os2.tmpdir(), 'cafekit-codex-reg-'));
   try {
     const specsDir = path2.join(tmp, 'specs');
-    fs2.mkdirSync(specsDir, { recursive: true });
-    fs2.mkdirSync(path2.join(specsDir, 'valid'), { recursive: true });
-    fs2.writeFileSync(path2.join(specsDir, 'valid', 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+    writeProcessTask(path2.join(specsDir, 'valid'), 'pending');
     const outside = path2.join(tmp, 'outside');
-    fs2.mkdirSync(outside, { recursive: true });
-    fs2.writeFileSync(path2.join(outside, 'spec.json'), JSON.stringify({ status: 'in_progress' }));
-    const link = path2.join(specsDir, 'linked');
-    fs2.symlinkSync(outside, link);
-    assert.equal(specUtils.resolveActiveSpec(tmp, {}, 'linked', null).error, 'explicit_malformed');
-    assert.equal(specUtils.resolveActiveSpec(tmp, {}, null, path2.join(specsDir, 'linked', 'spec.json')).error, 'explicit_malformed');
-    // task symlink
+    writeProcessTask(outside, 'pending');
+    fs2.symlinkSync(outside, path2.join(specsDir, 'linked'));
+    assert.equal(specUtils.resolveWorkflowCandidate(tmp, {}, 'linked', null).error, 'explicit_malformed');
+    assert.equal(specUtils.resolveWorkflowCandidate(tmp, {}, null, path2.join(specsDir, 'linked', 'plan.md')).error, 'explicit_malformed');
+    fs2.rmSync(path2.join(specsDir, 'linked'));
+    // task symlink to a file outside the packet
     const featDir = path2.join(specsDir, 'valid');
-    fs2.mkdirSync(path2.join(featDir, 'tasks'), { recursive: true });
     const outsideTask = path2.join(tmp, 'outside-task.md');
-    fs2.writeFileSync(outsideTask, '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n');
-    const taskLink = path2.join(featDir, 'tasks', 'task.md');
-    fs2.symlinkSync(outsideTask, taskLink);
-    const fails = specReceipt.checkReceipt(featDir, 'tasks/task.md', { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' });
-    assert.ok(fails.includes('a'));
-    // malformed spec
-    fs2.mkdirSync(path2.join(specsDir, 'bad'), { recursive: true });
-    fs2.writeFileSync(path2.join(specsDir, 'bad', 'spec.json'), '{ bad');
-    const mal = specUtils.resolveActiveSpec(tmp, {}, null, null);
+    fs2.copyFileSync(path2.join(featDir, 'task-01-auth.md'), outsideTask);
+    fs2.symlinkSync(outsideTask, path2.join(featDir, 'task-02-link.md'));
+    const proof = specReceipt.checkWorkflowReceiptDetails(featDir, 'task-02-link.md', null);
+    assert.ok(proof.failures.includes('unsafe_path'), `task symlink must be unsafe, got ${proof.failures}`);
+    assert.equal(specUtils.resolveWorkflowCandidate(tmp, {}, null, null).error, 'invalid_specs');
+    fs2.rmSync(path2.join(featDir, 'task-02-link.md'));
+    // malformed packet: dependency on a missing task
+    const bad = path2.join(specsDir, 'bad');
+    writeProcessTask(bad, 'pending');
+    fs2.writeFileSync(path2.join(bad, 'task-01-auth.md'),
+      fs2.readFileSync(path2.join(bad, 'task-01-auth.md'), 'utf8').replace('- none', '- task-09-missing.md'));
+    const mal = specUtils.resolveWorkflowCandidate(tmp, {}, null, null);
     assert.equal(mal.error, 'invalid_specs');
   } finally {
     fs2.rmSync(tmp, { recursive: true, force: true });
@@ -1289,17 +2015,10 @@ test('Codex adapter parity - phantom vectors via shared validator (r3)', () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-tap-heading-'));
   try {
     const featureDir = path.join(tmp, 'feature');
-    const taskPath = 'tasks/task.md';
-    fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
-    const taskPrefix = ['# Task', '', '**Status:** done', '', '## Evidence', '', base.trim()];
-    fs.writeFileSync(path.join(featureDir, taskPath), [...taskPrefix, '# fail 1', ''].join('\n'));
-    const tapFailure = receipt.checkReceipt(featureDir, taskPath, { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' });
-    assert.ok(tapFailure.includes('c'), 'unindented TAP # fail 1 must reach the shared validator');
-
-    fs.writeFileSync(path.join(featureDir, taskPath), [...taskPrefix, '# Notes', 'FAILED tests/test_demo.py', ''].join('\n'));
-    const markdownBody = receipt.evidenceBody(fs.readFileSync(path.join(featureDir, taskPath), 'utf8'));
-    assert.doesNotMatch(markdownBody, /FAILED tests\/test_demo\.py/);
-    assert.deepEqual(receipt.validateCanonicalReceipt(markdownBody), [], 'a real Markdown heading must still end Evidence');
+    const receiptFields = base.trim().split('\n');
+    writeProcessTask(featureDir, 'done', [...receiptFields, '```', 'pnpm test', '# fail 1', '```']);
+    const tapFailure = receipt.checkWorkflowReceiptDetails(featureDir, 'task-01-auth.md', null);
+    assert.ok(tapFailure.failures.includes('verification_state'), `unindented TAP # fail 1 must reach the shared validator, got ${tapFailure.failures}`);
   } finally {
     fs.rmSync(tmp, { recursive: true, force: true });
   }
@@ -1329,38 +2048,20 @@ test('Codex adapter enforces declared task artifact SHA-256 with missing, invali
   const digest = crypto.createHash('sha256').update(artifact).digest('hex');
   const cases = [
     ['', true],
-    ['sha256: abc123\n', true],
-    [`sha256: ${'0'.repeat(64)}\n`, true],
-    [`sha256: ${digest}\n`, false],
+    ['sha256: abc123', true],
+    [`sha256: ${'0'.repeat(64)}`, true],
+    [`sha256: ${digest}`, false],
   ];
   for (const [hashLine, shouldBlock] of cases) {
     inHookFixture((root, hooks) => {
       const feature = path.join(root, 'specs', 'artifact-demo');
-      const taskPath = 'tasks/task.md';
-      fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
       fs.mkdirSync(path.join(root, 'output'), { recursive: true });
       fs.writeFileSync(path.join(root, 'output', 'bundle.js'), artifact);
-      fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
-        status: 'in_progress',
-        current_phase: 'closeout',
-        feature_name: 'artifact-demo',
-        task_registry: {
-          [taskPath]: {
-            status: 'done',
-            completed_at: '2026-08-11T00:00:00.000Z',
-            artifacts: ['output/bundle.js'],
-          },
-        },
-      }));
-      fs.writeFileSync(path.join(feature, taskPath), [
-        '# Task', '', '**Status:** done', '', '## Evidence', '',
+      writeProcessTask(feature, 'done', null, 'node --test');
+      writeProcessTask(feature, 'done', bindReceipt(root, [
         'Verification: PASS', 'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
-        'Artifact: output/bundle.js', hashLine,
-      ].join('\n'));
-      fs.writeFileSync(
-        path.join(feature, taskPath),
-        bindReceipt(root, fs.readFileSync(path.join(feature, taskPath), 'utf8'), 'artifact-demo'),
-      );
+        'Artifact: output/bundle.js', hashLine, '```', 'node --test', 'ok 1', '```',
+      ].join('\n'), 'artifact-demo').split('\n'), 'node --test');
       const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
         cwd: root,
         session_id: 'session-a',