@junghanacs/entwurf 0.20.0 → 0.21.0

package/scripts/register-pi-package.py

@@ -22,29 +22,36 @@ settings-RELATIVE entry that resolves to repo_dir (see below). A look-alike repo
 removed. Every non-entwurf package and every other settings key is preserved.
 
 CANONICAL IS NOT ONLY THE ABSOLUTE PATH. A packages[] entry is resolved by pi
-against the SETTINGS FILE'S OWN DIRECTORY, so this repo's committed
-`.pi/settings.json` names itself portably as `".."` — the exact form
-check-install-surface S7c pins. Comparing entries against the resolved absolute
-path ALONE did not recognize that as entwurf, so `setup` appended the absolute
-path beside it and rewrote the tracked, biome-governed file in a foreign style:
-a dev clone went RED at `pnpm check` step 1, diagnosed as a "formatting" error
-(#53 B). Two rules follow, and they are the same rule read forwards and backwards:
+against the SETTINGS FILE'S OWN DIRECTORY, so a settings-relative entry such as
+`".."` can name the very repo being registered. Comparing entries against the
+resolved absolute path ALONE did not recognize that as entwurf, so `setup` appended
+the absolute path beside it and rewrote a tracked, biome-governed file in a foreign
+style: a dev clone went RED at `pnpm check` step 1, diagnosed as a "formatting"
+error (#53 B). Two rules follow, and they are the same rule read forwards and
+backwards:
   - register: an entry that RESOLVES to repo_dir is already canonical → no-op, and
     when a rewrite is genuinely needed a settings-relative self-reference is kept
     as the survivor, so the portable form is never silently absolutized;
   - remove: register only ever WRITES the absolute form, so a settings-relative
-    self-reference cannot be install's own output — it was authored by the repo
-    (this one commits `".."`) or by the operator. Uninstall is install's inverse,
-    not a settings editor: it leaves that ONE class in place and SAYS SO on stdout,
-    rather than deleting source bytes install never wrote. The cost is stated
-    rather than hidden: on a settings file whose only entwurf entry is relative,
-    `--remove` is a no-op and the package stays registered until a human edits it.
-    would_remove() asks the same split, so `--dry-run` can never disagree with what
-    `--remove` does.
+    self-reference cannot be install's own output — it was authored by hand.
+    Uninstall is install's inverse, not a settings editor: it leaves that ONE class
+    in place and SAYS SO on stdout, rather than deleting source bytes install never
+    wrote. The cost is stated rather than hidden: on a settings file whose only
+    entwurf entry is relative, `--remove` is a no-op and the package stays
+    registered until a human edits it. would_remove() asks the same split, so
+    `--dry-run` can never disagree with what `--remove` does.
+This repo's own `.pi/settings.json` USED to be the load-bearing instance of that
+shape. It no longer carries a packages[] entry at all: entwurf's checkout
+self-registers through USER scope only, because a project entry naming "whichever
+checkout I am in" plus a user entry naming the installed one are two package
+identities to pi, and a second checkout then loads a rival copy of pi-extensions
+and wins `--entwurf-control` (#110). The predicate stays because the shape is still
+writable by hand, and because resolving-then-comparing is also what keeps an
+unrelated relative package like `../../repos/gh/andenken` from being read as ours.
 A rewrite also preserves the file's existing indentation instead of forcing 2
 spaces. That is narrower than it sounds — it keeps the indent UNIT, not a
-formatter's line-collapsing decisions — so the byte-identity guarantee this repo's
-own settings depend on comes from the no-op path, never from the writer's style.
+formatter's line-collapsing decisions — so a byte-identity guarantee always comes
+from the no-op path, never from the writer's style.
 
 This wiring (user scope) dropped when `pi install` was removed from setup
 (2026-07-03: `--entwurf-control` unknown in a foreign cwd). Extracting it here
@@ -129,11 +136,11 @@ def source_of(item: object) -> object:
 def is_settings_relative_self(source: str, settings_dir: str, repo_dir: str) -> bool:
     """True iff this entry is a SETTINGS-RELATIVE path naming repo_dir itself.
 
-    This is the repo's own committed portable form (`".."` in
-    <repo>/.pi/settings.json) — functionally identical to the absolute entry,
-    because pi resolves a relative package source against the settings file's own
-    directory. It is also the one shape register never writes, which is what lets
-    remove treat it as source rather than as install state.
+    The portable form (`".."` in <repo>/.pi/settings.json) — functionally identical
+    to the absolute entry, because pi resolves a relative package source against the
+    settings file's own directory. It is also the one shape register never writes,
+    which is what lets remove treat it as source rather than as install state. This
+    repo stopped shipping it at #110; an operator may still write it by hand.
 
     Anything carrying a scheme (npm:/git:/https:) is a spec, not a path; anything
     absolute (`/`, `~`) is not settings-relative. Everything else is resolved and
@@ -159,8 +166,8 @@ def is_entwurf_source(source: str, repo_dir: str, settings_dir: str | None = Non
       - the exact resolved repo dir;
       - an npm install path ending in node_modules/@junghanacs/entwurf;
       - an explicit npm package source for @junghanacs/entwurf;
-      - a settings-relative path that RESOLVES to the repo dir (the committed
-        portable `".."`), when the caller supplies settings_dir;
+      - a settings-relative path that RESOLVES to the repo dir (the portable
+        `".."` form), when the caller supplies settings_dir;
       - a local filesystem path whose final directory is literally "entwurf"
         (dev clone / stale move). Remote URL/git-like strings are NOT treated as
         local paths merely because their last segment is "entwurf".
@@ -242,7 +249,7 @@ def register(settings_path: Path, repo_dir_arg: str) -> str:
     # the canonical absolute string or as a settings-relative path resolving there.
     # Both are the same registration to pi, so both are a no-op: order-insensitive, no
     # rewrite, mtime stable. Recognizing only the absolute form is what made `setup`
-    # duplicate this repo's own committed `".."` and restyle the tracked file (#53 B).
+    # duplicate a settings-relative `".."` and restyle the tracked file (#53 B).
     # Both arms require the STRING form, so an object-form entry still collapses to a
     # canonical string exactly as before.
     if len(entwurf_entries) == 1 and isinstance(entwurf_entries[0], str) and (
@@ -252,8 +259,9 @@ def register(settings_path: Path, repo_dir_arg: str) -> str:
         return "noop"
 
     # A rewrite keeps the PORTABLE form when the file already had one: absolutizing a
-    # committed `".."` would repair the duplicate and dirty the tracked bytes in the
-    # same breath. Otherwise the canonical absolute path is what install writes.
+    # hand-written `".."` would repair the duplicate and dirty bytes install never
+    # wrote in the same breath. Otherwise the canonical absolute path is what install
+    # writes.
     survivor = next(
         (
             source_of(e) for e in entwurf_entries
@@ -277,7 +285,7 @@ def _removable(packages: list, repo_dir: str, settings_dir: str) -> tuple[list,
 
     PRESERVED = settings-relative self-references, the one shape register CANNOT
     have produced (it always writes the resolved absolute path). Such an entry is
-    the repo's committed portable registration or the operator's own hand edit.
+    the operator's own hand edit.
     Deleting it would make uninstall a source editor, which is the defect #53 B is
     about, pointed the other way. main() prints what was kept so the incompleteness
     is loud rather than silent.
@@ -665,7 +673,7 @@ def remove_user(settings_path: Path, repo_dir_arg: str, state_path: Path, orphan
     else:
         print(f"remove: no entwurf packages[] entry naming this root ({settings_path})")
     if preserved_rel:
-        print(f"remove: kept {len(preserved_rel)} settings-relative entwurf entr{'y' if len(preserved_rel) == 1 else 'ies'} — committed/operator source, not install state")
+        print(f"remove: kept {len(preserved_rel)} settings-relative entwurf entr{'y' if len(preserved_rel) == 1 else 'ies'} — operator source, not install state")
     if foreign_like:
         print(f"remove: kept {len(foreign_like)} entwurf-shaped entr{'y' if len(foreign_like) == 1 else 'ies'} with no recorded owner "
               "(not provably this root's) — use './run.sh doctor-pi-package' / takeover-user-scope to resolve ownership")
@@ -829,7 +837,7 @@ def main(argv: list[str]) -> int:
         if kept:
             print(
                 f"remove: kept {kept} settings-relative entwurf entr{'y' if kept == 1 else 'ies'} "
-                f"({settings_path}) — install never writes that form, so it is committed/operator "
+                f"({settings_path}) — install never writes that form, so it is operator "
                 "source, not install state; edit the file by hand to drop it"
             )
         return 0

package/scripts/register-pi-provider.py

@@ -25,8 +25,9 @@ Scope asymmetry (봉인계약 4·6, REASONED — not the unfounded asymmetry dev
            of our key is tidied; siblings kept.
   project  <repo>/.pi/settings.json — checkout-LOCAL, disposable, re-creatable, and `run.sh
            remove` already covers it → NO state. install normalizes the command; remove strips
-           our-managed shapes (the bare bin AND the legacy repo path). project-scope state is a
-           NAMED FOLLOW-UP (NEXT), deliberately out of this lane.
+           our-managed shapes (the bare bin AND the legacy repo path). project scope takes NO
+           state, deliberately: it is checkout-local, disposable, and `run.sh remove` is its
+           whole inverse.
 
 USER-SCOPE OWNER BINDING (#86 C2): the user install-state additionally records
 `installerRoot` (the repo/package root that installed the key), so an old root's

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.75.1) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.76.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-agy-native-push-live.ts

@@ -128,9 +128,11 @@ async function main(): Promise<void> {
 	try {
 		// ── 1. probe the REAL conversation directly (route diagnostics; proves the live host) ──
 		const probe = await antigravityAdapter.probe(conversationId);
-		if (probe.status === "alive") {
+		if (probe.status === "alive" && probe.route.backend === "antigravity") {
 			artifacts["route"] = probe.route.lsAddress;
 			console.log(`  ..    probe: alive via ${probe.route.lsAddress}`);
+		} else if (probe.status === "alive") {
+			artifacts["probe"] = `alive with unexpected ${probe.route.backend} route`;
 		} else {
 			artifacts["probe"] = `${probe.status}: ${probe.reason}`;
 		}

package/scripts/smoke-codex-birth.sh

@@ -0,0 +1,347 @@
+#!/usr/bin/env bash
+# smoke-codex-birth — hermetic install/doctor/inverse contract for the Codex
+# birth unit. No Codex process, no model turn, no host path: HOME, XDG_DATA_HOME and
+# CODEX_HOME are all sandboxed, so every byte this gate judges was written inside the fixture.
+#
+# The five things it exists to prove, none of which a reading of the script can establish:
+#   1. the published declaration is the EXACT trust identity (matcher-less, type/command/
+#      timeout, quoted fixed launcher path) — because that identity is what an operator
+#      approves once, and any drift in it costs a second approval;
+#   2. config.toml is neither read nor written, so the vendor's [hooks.state] and entwurf's
+#      own two user atoms survive install AND inverse byte-for-byte;
+#   3. a foreign or edited hooks.json is a ZERO-WRITE refusal, never an adoption — this unit
+#      owns the file whole, so adopting one would delete somebody else's hooks;
+#   4. the inverse removes exactly what the state vouches for, and REFUSES a drifted path
+#      instead of deleting an edit nobody can read back;
+#   5. the doctor never claims the vendor's trust decision as its own green.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+INSTALL="$REPO_DIR/scripts/codex-birth-install.sh"
+UNINSTALL="$REPO_DIR/scripts/codex-birth-uninstall.sh"
+DOCTOR="$REPO_DIR/scripts/codex-birth-doctor.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+safe_umask_fail() { die "[QK:CODEX-BIRTH-INSTALL-SAFE-UMASK] $1"; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+refuses() { # <label> <expected-substring-on-stderr> <cmd...>
+  local label="$1" needle="$2"; shift 2
+  local err rc=0
+  err="$("$@" 2>&1 >/dev/null)" || rc=$?
+  [ "$rc" -ne 0 ] && printf '%s' "$err" | grep -q "$needle" || die "$label (rc=$rc, stderr: $err)"
+  ok "$label"
+}
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export CODEX_HOME="$HOME/.codex"
+export PYTHONDONTWRITEBYTECODE=1
+mkdir -p "$CODEX_HOME" "$XDG_DATA_HOME"
+
+HOOKS="$CODEX_HOME/hooks.json"
+CFG="$CODEX_HOME/config.toml"
+UNIT_ROOT="$XDG_DATA_HOME/entwurf/codex-birth"
+HELPER="$UNIT_ROOT/helper"
+LAUNCHER="$HELPER/codex-birth-launch.sh"
+STATE="$UNIT_ROOT/install-state.json"
+
+seed_config() { # an operator config that ALREADY carries entwurf's two user atoms and the
+  # vendor's own hook-trust state — the exact shape this unit must never touch.
+  cat > "$CFG" <<'EOF'
+model = "gpt-5.6-luna"
+approval_policy = "never"
+[tui]
+status_line = ["thread-title", "model-with-reasoning", "current-dir"]
+theme = "zenburn"
+[hooks.state."/sandbox/.codex/hooks.json:session_start:0:0"]
+trusted_hash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+[mcp_servers.entwurf-bridge]
+command = "entwurf-bridge"
+EOF
+}
+seed_config
+cp "$CFG" "$SB/config.before.toml"
+
+###############################################################################
+# install — the declaration, the closure, and the state
+###############################################################################
+"$INSTALL" >"$SB/out" 2>&1 || die "install failed: $(cat "$SB/out")"
+want "install reports success" "grep -q '^\[codex-birth-install\] installed$' '$SB/out'"
+want "the declaration exists as a regular file" "[ -f '$HOOKS' ] && [ ! -L '$HOOKS' ]"
+want "the launcher is published and executable" "[ -f '$LAUNCHER' ] && [ -x '$LAUNCHER' ]"
+want "the closure is published whole" "[ -f '$HELPER/meta-bridge-hook-codex.ts' ] && [ -f '$HELPER/lib/meta-session.ts' ] && [ -f '$HELPER/lib/native-push/codex-ws-client.ts' ] && [ -f '$HELPER/lib/session-id.js' ] && [ -f '$HELPER/entwurf-capabilities.json' ]"
+want "the state is a regular non-symlink file" "[ -f '$STATE' ] && [ ! -L '$STATE' ]"
+want "the state is bound to the fixed paths and finished publishing" \
+  "node -e 'const s=require(process.argv[1]); if(s.schema!==\"codex-birth-install-state/v1\")throw 0; if(s.status!==\"installed\")throw 0; if(s.hooksFile!==process.argv[2])throw 0; if(s.helperDir!==process.argv[3])throw 0;' '$STATE' '$HOOKS' '$HELPER'"
+want "the state records a digest for every published byte" \
+  "node -e 'const s=require(process.argv[1]); const hex=v=>/^[0-9a-f]{64}\$/.test(v); if(!hex(s.hooksSha256))throw 0; if(s.helperFiles.length!==6)throw 0; for(const f of s.helperFiles){if(!hex(f.sha256))throw 0;}' '$STATE'"
+
+# The trust identity, asserted field by field. This is the cell that costs a second operator
+# approval if it ever drifts, so it is checked literally rather than by shape.
+want "the declaration is the EXACT trust identity (matcher-less, type/command/timeout, quoted fixed launcher)" \
+  "node -e '
+    const f=require(process.argv[1]);
+    if(Object.keys(f).sort().join(\",\")!==\"description,hooks\")throw new Error(\"top level\");
+    if(Object.keys(f.hooks).join(\",\")!==\"SessionStart\")throw new Error(\"events\");
+    const g=f.hooks.SessionStart; if(g.length!==1)throw new Error(\"groups\");
+    if(\"matcher\" in g[0])throw new Error(\"matcher present\");
+    if(Object.keys(g[0]).join(\",\")!==\"hooks\")throw new Error(\"group keys\");
+    if(g[0].hooks.length!==1)throw new Error(\"handlers\");
+    const h=g[0].hooks[0];
+    if(Object.keys(h).sort().join(\",\")!==\"command,timeout,type\")throw new Error(\"handler keys\");
+    if(h.type!==\"command\"||h.timeout!==30)throw new Error(\"type/timeout\");
+    if(h.command!==\"'\"'\"'\"+process.argv[2]+\"'\"'\"'\")throw new Error(\"command \"+h.command);
+  ' '$HOOKS' '$LAUNCHER'"
+want "the declaration carries no trust key of any kind" "! grep -qi 'trusted_hash\|hooks.state' '$HOOKS'"
+want "the launcher bakes a resolved absolute node and execs the published payload" \
+  "grep -qE '^NODE_BIN=\"/' '$LAUNCHER' && grep -q 'PAYLOAD=\"$HELPER/meta-bridge-hook-codex.ts\"' '$LAUNCHER' && grep -q '^exec \"\$NODE_BIN\" --experimental-strip-types' '$LAUNCHER'"
+
+# config.toml — the file the vendor keeps [hooks.state] in, and the one entwurf's other two
+# user atoms own. This unit must not have opened it for writing at all.
+cmp -s "$SB/config.before.toml" "$CFG" && ok "install left config.toml byte-identical (vendor trust state and entwurf atoms intact)" || die "install modified config.toml"
+
+###############################################################################
+# TRUST — the vendor's receipt, read and never written
+#
+# The bytes being ours is half the verdict. The other half belongs to the operator: until
+# the vendor records their one-time "Trust all" for THIS declaration identity, the hook is
+# declared and never runs, and a doctor that called that green would sell a birth nobody
+# will ever have. The sandbox has no vendor, so the receipt is forged here as a FIXTURE —
+# what is under test is the reading, never the deciding.
+###############################################################################
+# The seed already carries a receipt for SOMEBODY ELSE's declaration — the honest starting
+# shape on a host whose operator has trusted other hooks before. It is not ours.
+"$DOCTOR" >"$SB/out" 2>&1 && die "[QK:CODEX-BIRTH-DOCTOR-REQUIRES-TRUST] the doctor was green with no vendor trust receipt for THIS declaration"
+want "a receipt at a foreign key is refused by name" "grep -q \"NONE at this unit's key\" '$SB/out'"
+want "the red carries the operator instruction, not a repair this unit could do" \
+  "grep -q \"open a visible plain Codex\" '$SB/out' && grep -q \"Trust all and continue\" '$SB/out'"
+# ...and with no [hooks.state] at all the refusal names that instead of guessing.
+grep -v '^\[hooks.state' "$SB/config.before.toml" | grep -v '^trusted_hash' > "$CFG"
+"$DOCTOR" >"$SB/out" 2>&1 && die "the doctor was green with no [hooks.state] table at all"
+want "trust-absent is red and says which table is missing" "grep -q 'no vendor trust receipt for this declaration' '$SB/out' && grep -q 'no \[hooks.state\] table' '$SB/out'"
+cp "$SB/config.before.toml" "$CFG"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 || safe_umask_fail "--unit-only should be green on intact bytes: $(cat "$SB/out")"
+want "--unit-only reports the trust axis as SKIPPED, never as green" \
+  "grep -q 'the TRUST axis was skipped' '$SB/out' && grep -q 'This is a skipped axis, not a green one' '$SB/out'"
+
+trust_receipt() { # $1 = the key to write a well-formed receipt under
+  cp "$SB/config.before.toml" "$CFG"
+  printf '\n[hooks.state."%s"]\ntrusted_hash = "sha256:%s"\n' "$1" "4647c53b6948cd38f2283a3fdf63e40e83b7ff29ecf14650b7e61eec9315e1cc" >> "$CFG"
+}
+trust_receipt "$HOOKS:session_start:0:0"
+sed -i 's/^trusted_hash = .*/trusted_hash = "not-a-digest"/' "$CFG"
+"$DOCTOR" >"$SB/out" 2>&1 && die "a malformed trusted_hash was accepted"
+want "a malformed trusted_hash is refused by shape" "grep -q 'trusted_hash is not sha256:<64 hex>' '$SB/out'"
+trust_receipt "$HOOKS:session_start:0:0"
+cp "$CFG" "$SB/config-trusted.toml"
+"$DOCTOR" >"$SB/out" 2>&1 || die "the doctor should be green once the vendor receipt is present: $(cat "$SB/out")"
+want "the full doctor is green with unit bytes AND the vendor receipt" \
+  "grep -q 'the vendor trust receipt is present for this declaration' '$SB/out'"
+want "the green is worded as a vendor RECEIPT, never as a validated hash" \
+  "grep -q 'not a cryptographic validation' '$SB/out' && ! grep -qi 'valid trust\|verified hash' '$SB/out'"
+cmp -s "$SB/config-trusted.toml" "$CFG" && ok "reading the receipt wrote nothing back to the vendor config" || die "the doctor modified config.toml"
+cp "$SB/config.before.toml" "$CFG"
+
+###############################################################################
+# idempotence — the strongest form is an untouched file
+###############################################################################
+MT1="$(stat -c %Y "$HOOKS")"; sleep 1.1
+"$INSTALL" >"$SB/out" 2>&1 || die "reinstall failed: $(cat "$SB/out")"
+MT2="$(stat -c %Y "$HOOKS")"
+want "reinstall does not rewrite the declaration" "[ '$MT1' = '$MT2' ]"
+want "reinstall adopts its own published declaration by digest" "grep -q 'adopting the hooks.json this unit published' '$SB/out'"
+cmp -s "$SB/config.before.toml" "$CFG" && ok "reinstall still left config.toml byte-identical" || die "reinstall modified config.toml"
+
+###############################################################################
+# reinstall over an edited closure — a REFUSAL, never a silent repair
+#
+# The declaration is licensed by digest; the closure must be too, and for a sharper
+# reason: publishing a new generation copies over these exact paths, so a member that
+# drifted is somebody's edit that a `cp` would destroy with no trace. The unit repairs
+# only what it can prove it wrote, so present-and-different stops the whole publish and
+# every byte — hooks.json, helper members, state — must come out unchanged.
+###############################################################################
+cp "$HOOKS" "$SB/pre-drift-hooks.json"
+cp "$STATE" "$SB/pre-drift-state.json"
+cp "$LAUNCHER" "$SB/pre-drift-launcher.sh"
+printf '# operator edit\n' >> "$LAUNCHER"
+cp "$LAUNCHER" "$SB/drifted-launcher.sh"
+DRIFT_ERR="$("$INSTALL" 2>&1 >/dev/null)" && die "[QK:CODEX-BIRTH-REINSTALL-REFUSES-CLOSURE-DRIFT] reinstall over an edited launcher was ACCEPTED instead of refused"
+ok "reinstall over an edited launcher is refused, not silently repaired"
+printf '%s' "$DRIFT_ERR" | grep -qE "$LAUNCHER was edited after install \(live [0-9a-f]{64}, recorded [0-9a-f]{64}\)" \
+  && ok "the refusal names the exact drifted path and both digests" \
+  || die "the refusal did not name the path and both digests: $DRIFT_ERR"
+cmp -s "$SB/drifted-launcher.sh" "$LAUNCHER" && ok "the edited launcher survives the refused reinstall byte-for-byte" || die "the refused reinstall overwrote the edited launcher"
+cmp -s "$SB/pre-drift-hooks.json" "$HOOKS" && ok "the refused reinstall left the declaration byte-identical" || die "the refused reinstall rewrote hooks.json"
+cmp -s "$SB/pre-drift-state.json" "$STATE" && ok "the refused reinstall left the ownership state byte-identical" || die "the refused reinstall rewrote the state"
+cmp -s "$SB/config.before.toml" "$CFG" && ok "the refused reinstall left config.toml byte-identical" || die "the refused reinstall modified config.toml"
+
+# A drifted PAYLOAD member is the same refusal — the rule is the inventory, not the launcher.
+cp "$SB/pre-drift-launcher.sh" "$LAUNCHER"
+printf '// operator edit\n' >> "$HELPER/meta-bridge-hook-codex.ts"
+refuses "reinstall over an edited closure member is refused too" "meta-bridge-hook-codex.ts was edited after install" "$INSTALL"
+want "the drifted payload is still there" "[ -f '$HELPER/meta-bridge-hook-codex.ts' ]"
+
+# ...and an ABSENT member is not drift: a publish interrupted after the state write must
+# stay repairable by the same command, exactly as the inverse calls an absent path done.
+rm -f "$HELPER/meta-bridge-hook-codex.ts"
+"$INSTALL" >"$SB/out" 2>&1 || die "reinstall should REPAIR an absent closure member: $(cat "$SB/out")"
+want "an absent closure member is republished, not refused" "grep -q 'closure member absent, will be republished' '$SB/out' && [ -f '$HELPER/meta-bridge-hook-codex.ts' ]"
+"$DOCTOR" --unit-only >/dev/null 2>&1 || die "the unit axis should be green again after the repair"
+ok "the unit axis is green again after the absent member was republished"
+
+###############################################################################
+# refusals — a foreign file, an edited file, a symlink; each ZERO-WRITE
+###############################################################################
+"$UNINSTALL" >/dev/null 2>&1 || die "clean uninstall before the refusal cells failed"
+printf '{"hooks":{"SessionStart":[{"hooks":[{"type":"command","command":"/opt/operator/own-hook.sh","timeout":10}]}]}}\n' > "$HOOKS"
+cp "$HOOKS" "$SB/foreign-hooks.json"
+refuses "[QK:CODEX-BIRTH-FOREIGN-HOOKS-REFUSED] a foreign hooks.json is refused, not adopted" "already exists and this host has NO entwurf ownership state" "$INSTALL"
+cmp -s "$SB/foreign-hooks.json" "$HOOKS" && ok "the foreign declaration survives the refusal byte-for-byte" || die "the foreign hooks.json was overwritten"
+want "the foreign refusal wrote no state and no helper" "[ ! -e '$STATE' ] && [ ! -e '$HELPER' ]"
+rm -f "$HOOKS"
+
+ln -s "$SB/foreign-hooks.json" "$HOOKS"
+refuses "a symlinked hooks.json is refused" "is a SYMLINK" "$INSTALL"
+want "the symlink refusal wrote no state" "[ ! -e '$STATE' ] && [ -L '$HOOKS' ]"
+rm -f "$HOOKS"
+
+"$INSTALL" >/dev/null 2>&1 || die "install before the edited-declaration cell failed"
+printf '\n' >> "$HOOKS"
+cp "$HOOKS" "$SB/edited-hooks.json"
+refuses "an edited declaration is refused instead of republished" "was edited after install" "$INSTALL"
+cmp -s "$SB/edited-hooks.json" "$HOOKS" && ok "the edited declaration survives the refusal byte-for-byte" || die "the edited hooks.json was overwritten"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "the unit axis should be red while the declaration is edited"
+want "the doctor names the edited declaration" "grep -q 'was EDITED after install' '$SB/out'"
+
+###############################################################################
+# inverse — exact removal, and a refusal that leaves drift in place
+###############################################################################
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse should refuse while the declaration is drifted"
+want "the inverse refuses the drifted declaration" "grep -q 'DRIFT: the declaration was edited after install' '$SB/out'"
+want "the drifted declaration is LEFT IN PLACE" "[ -f '$HOOKS' ]"
+want "the inverse keeps the state so a later run can still license the path" "[ -f '$STATE' ]"
+cmp -s "$SB/edited-hooks.json" "$HOOKS" && ok "the drifted declaration is byte-identical after the refused inverse" || die "the refused inverse changed the drifted file"
+
+cp "$SB/edited-hooks.json" "$SB/keep.json"
+rm -f "$HOOKS"
+"$INSTALL" >/dev/null 2>&1 || die "reinstall after clearing the drift failed"
+printf '# operator edit\n' >> "$LAUNCHER"
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse should refuse while the launcher is drifted"
+want "the inverse refuses a drifted helper member by digest" "grep -q 'DRIFT: helper member was edited after install' '$SB/out'"
+want "the drifted launcher is LEFT IN PLACE" "[ -f '$LAUNCHER' ]"
+want "the declaration it already removed is gone, and the state remains" "[ ! -e '$HOOKS' ] && [ -f '$STATE' ]"
+
+rm -f "$LAUNCHER"
+"$INSTALL" >/dev/null 2>&1 || die "reinstall before the exact-inverse cell failed"
+"$UNINSTALL" >"$SB/out" 2>&1 || die "the exact inverse failed: $(cat "$SB/out")"
+want "the inverse removed the declaration" "[ ! -e '$HOOKS' ]"
+want "the inverse removed the helper closure and its directory" "[ ! -e '$HELPER' ]"
+want "the inverse removed its own state" "[ ! -e '$STATE' ]"
+want "the inverse says config.toml was never touched" "grep -q 'config.toml was neither read nor written' '$SB/out'"
+cmp -s "$SB/config.before.toml" "$CFG" && ok "the full install/inverse cycle left config.toml byte-identical" || die "the cycle modified config.toml"
+# An absent unit is RED, not a note. A host that trusted an OLDER declaration still carries a
+# vendor receipt, so a doctor that shrugged at "nothing installed" could report green over an
+# empty unit on the strength of somebody else's approval — measured exactly that way once.
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "[QK:CODEX-BIRTH-DOCTOR-ABSENT-IS-RED] the unit axis was green with NOTHING installed"
+want "an absent unit is named as red, not as an informational note" "grep -q 'no Codex birth unit is installed here' '$SB/out'"
+trust_receipt "$HOOKS:session_start:0:0"
+"$DOCTOR" >"$SB/out" 2>&1 && die "a stale vendor receipt made an ABSENT unit green"
+want "a stale receipt cannot carry an absent unit" "grep -q 'no Codex birth unit is installed here' '$SB/out'"
+cp "$SB/config.before.toml" "$CFG"
+
+###############################################################################
+# unsafe paths — ownership the unit cannot vouch for
+###############################################################################
+"$INSTALL" >/dev/null 2>&1 || die "install before the unsafe-path cell failed"
+chmod 0777 "$HELPER"
+refuses "a group/world-writable helper directory is refused" "group/world-writable" "$INSTALL"
+chmod 0755 "$HELPER"
+chmod 0666 "$STATE"
+refuses "a group/world-writable ownership state cannot license anything" "group/world-writable" "$INSTALL"
+refuses "the inverse refuses the same unsafe state" "group/world-writable" "$UNINSTALL"
+chmod 0644 "$STATE"
+"$UNINSTALL" >/dev/null 2>&1 || die "final cleanup uninstall failed"
+
+###############################################################################
+# a hostile umask, a short inventory, and a relative root
+###############################################################################
+# `umask 000` is the operator's shell, not our decision. A directory published under it that
+# anyone can rewrite would let a third party swap the launcher between the digest we record
+# and the exec codex performs — the closure would still match its state and still be somebody
+# else's code.
+rm -rf "$CODEX_HOME/hooks.json" "$UNIT_ROOT"
+( umask 000; "$INSTALL" >/dev/null 2>&1 ) || die "install under umask 000 failed"
+UNSAFE_DIRS="$(find "$XDG_DATA_HOME" "$CODEX_HOME" -type d -perm /022 2>/dev/null || true)"
+[ -z "$UNSAFE_DIRS" ] && ok "every directory published under umask 000 is non-group/world-writable" \
+  || safe_umask_fail "umask 000 published writable directories: $UNSAFE_DIRS"
+want "the published files are not group/world-writable either" \
+  "[ -z \"\$(find '$UNIT_ROOT' -type f -perm /022 2>/dev/null)\" ] && [ ! -w /dev/null -o -z \"\$(find '$HOOKS' -perm /022 2>/dev/null)\" ]"
+
+# The inventory IS the authority. A state naming only the launcher would leave the payload
+# unlisted: nothing could reclaim it, and nothing would judge it.
+python3 - "$STATE" <<'PY_INV'
+import json, sys
+s = json.load(open(sys.argv[1]))
+s["helperFiles"] = [f for f in s["helperFiles"] if f["path"] == "codex-birth-launch.sh"]
+open(sys.argv[1], "w").write(json.dumps(s))
+PY_INV
+printf '// unlisted\n' >> "$HELPER/meta-bridge-hook-codex.ts"
+refuses "[QK:CODEX-BIRTH-EXACT-CLOSURE-INVENTORY] a short closure inventory is refused by the installer" "exact six members" "$INSTALL"
+want "the unlisted payload survives that refusal" "grep -q '^// unlisted$' '$HELPER/meta-bridge-hook-codex.ts'"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "the doctor accepted a short closure inventory"
+want "the doctor names the missing inventory members" "grep -q 'recorded closure inventory is missing' '$SB/out'"
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse accepted a short closure inventory"
+want "the inverse refuses and removes NOTHING" \
+  "grep -q 'exact six members' '$SB/out' && [ -f '$HOOKS' ] && [ -f '$HELPER/meta-bridge-hook-codex.ts' ] && [ -f '$STATE' ]"
+rm -rf "$CODEX_HOME/hooks.json" "$UNIT_ROOT"
+
+# An unknown status is not a receipt, however well its digests match. `publishing` is the one
+# interrupted generation the installer knows how to finish; anything else is a state this unit
+# never wrote, and adopting it would let a stranger's file license our next publish.
+"$INSTALL" >/dev/null 2>&1 || die "install before the status cell failed"
+python3 -c 'import json,sys; s=json.load(open(sys.argv[1])); s["status"]="garbage"; open(sys.argv[1],"w").write(json.dumps(s))' "$STATE"
+cp "$STATE" "$SB/garbage-state.json"; cp "$HOOKS" "$SB/garbage-hooks.json"
+refuses "[QK:CODEX-BIRTH-INSTALL-REFUSES-UNKNOWN-STATUS] a state in an unknown status is refused even with exact digests" "unknown state status" "$INSTALL"
+want "that refusal wrote nothing" \
+  "cmp -s '$SB/garbage-state.json' '$STATE' && cmp -s '$SB/garbage-hooks.json' '$HOOKS'"
+# ...while the interrupted generation the installer DOES define is still repairable.
+python3 -c 'import json,sys; s=json.load(open(sys.argv[1])); s["status"]="publishing"; open(sys.argv[1],"w").write(json.dumps(s))' "$STATE"
+"$INSTALL" >/dev/null 2>&1 || die "an interrupted `publishing` state should be finishable, not refused"
+want "the finished publish records installed" "grep -q '\"status\": \"installed\"' '$STATE'"
+
+# The directory holding the receipt carries the receipt's authority. Children untouched: what
+# changed is only who may replace the inventory every digest is compared against.
+chmod 0777 "$UNIT_ROOT"
+refuses "[QK:CODEX-BIRTH-STATE-PARENT-AUTHORITY] reinstall refuses a unit root anyone can rewrite" "group/world-writable" "$INSTALL"
+want "the refused reinstall neither repaired nor published over the unsafe root" \
+  "[ \"\$(stat -c %a '$UNIT_ROOT')\" = '777' ]"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "the doctor accepted a unit root anyone can rewrite"
+want "the doctor names the writable unit root" "grep -q 'unit root.*group/world-writable' '$SB/out'"
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse removed things on the word of a state anyone can replace"
+want "the inverse refuses and removes NOTHING from an unsafe root" \
+  "grep -q 'group/world-writable' '$SB/out' && [ -f '$STATE' ] && [ -f '$HOOKS' ] && [ -f '$LAUNCHER' ]"
+chmod 0755 "$UNIT_ROOT"
+"$DOCTOR" --unit-only >/dev/null 2>&1 || die "the unit axis should be green once the root is safe again"
+ok "the unit axis is green again once the root is no longer writable"
+"$UNINSTALL" >/dev/null 2>&1 || die "cleanup uninstall after the parent-authority cell failed"
+
+# A relative root would make "the fixed launcher path" depend on the caller's cwd — and that
+# path is exactly what the vendor keys its trust receipt to.
+( cd "$SB" && CODEX_HOME="relative/.codex" "$INSTALL" >"$SB/out" 2>&1 ) && die "[QK:CODEX-BIRTH-REFUSES-RELATIVE-ROOT] a relative CODEX_HOME was accepted"
+want "a relative CODEX_HOME is refused zero-write" \
+  "grep -q 'CODEX_HOME resolves to a relative path' '$SB/out' && [ ! -e '$SB/relative' ]"
+( cd "$SB" && XDG_DATA_HOME="relative/share" "$INSTALL" >"$SB/out" 2>&1 ) && die "a relative XDG_DATA_HOME was accepted"
+want "a relative XDG_DATA_HOME is refused zero-write" \
+  "grep -q 'unit root resolves to a relative path' '$SB/out' && [ ! -e '$SB/relative' ]"
+( cd "$SB" && CODEX_HOME="relative/.codex" "$DOCTOR" --unit-only >"$SB/out" 2>&1 ) && die "the doctor judged a relative CODEX_HOME"
+want "the doctor refuses a relative CODEX_HOME before judging anything" "grep -q \"CODEX_HOME resolves to a relative path\" '$SB/out'"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] && ok "the checkout is untouched (every byte lived in the sandbox)" || die "this gate modified the repository"
+
+printf '\nsmoke-codex-birth: %d checks passed\n' "$pass"