@junghanacs/entwurf 0.20.1 → 0.21.0

package/docs/setup-clean-host.md

@@ -8,8 +8,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
   (`macos-install-surface`). Weaker than a physical-host doctor green. §1 is
   this surface.
 - **NOT CERTIFIED — pending physical host** — **on macOS**, every garden-native
-  harness rail in §2–§6 (pi, Claude, Copilot, OMP, agy), marker join, ACP turn,
-  mux. Wiring may be written; that is not a rail receipt. The remaining
+  harness rail in §2–§6 (pi, Claude, Copilot, OMP, agy, Codex), marker/request join,
+  ACP turn, mux. Wiring may be written; that is not a rail receipt. The remaining
   unmeasured Darwin doctor reason is per-process environment DISCOVERY
   (start-key is portable).
 - **UNSUPPORTED** — native Windows only. macOS is never this.
@@ -20,13 +20,14 @@ evidence split, and its three states must not collapse into "macOS is supported"
 |---|---|---|
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
-| Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot wiring writers |
+| Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
 | pi | optional-by-presence, `>=0.85.1 <0.86` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
+| OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all three operator-owned units (birth/MCP/status-line) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires an operator-owned existing tmux session named `codex`, with its app-server and supported TUIs seated there | native-push and visible fresh, supported in 0.21.0 |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
 Claude Code >=2.1.217 is required for the managed exec-hook lifecycle. The package
@@ -52,9 +53,9 @@ harness. The wiring is written; the row is FAIL:
 > platform. Tracking: #78.
 
 That FAIL is honest: setup runs no doctor, and no physical-host rail
-receipt exists — it is not an install failure. An Entwurf-only host (no
-harness on PATH) stays green (five SKIP, `bins: PASS`, `core: PASS`,
-`result: green`), which is what CERTIFIED (CI) observed.
+receipt exists — it is not an install failure. An Entwurf-only host with no
+harness on PATH stays green (six SKIP, `bins: PASS`, `core: PASS`,
+`result: green`), which is what CERTIFIED (CI) observes.
 
 A physical Mac can send host facts without installing entwurf or logging
 into a harness: `scripts/raw-macos-measure/probe.sh` (`/bin/sh`, ~3.5s,
@@ -91,10 +92,10 @@ npx entwurf check-bridge
 `check-bridge` is auth-free. It proves the installed prebuilt MCP server boots and
 lists the seven garden tools; it does not prove a backend model turn or native hook.
 
-Neither npm form installs a harness runtime. `pi`, Claude Code, Copilot CLI, agy, Cortex and their
-authentication remain operator-owned optional prerequisites for the integrations that use them;
-all may be absent on an Entwurf-only host. A source checkout's pinned Pi development packages are
-for building and testing this repo, not a transitive product installation promise.
+Neither npm form installs a harness runtime. `pi`, Claude Code, Copilot CLI, Codex CLI, agy,
+Cortex, and their authentication remain operator-owned optional prerequisites for the
+integrations that use them; all may be absent on an Entwurf-only host. A source checkout's
+pinned Pi development packages are for building and testing this repo, not a transitive product installation promise.
 
 Maintainers using a source checkout do not install a second global entwurf package. Full source
 setup currently requires Node 24, pnpm, and Python 3 on PATH; every harness — including pi — is
@@ -109,12 +110,14 @@ cd ~/repos/gh/entwurf
 
 This owns `~/.local/bin/entwurf` as a symlink to that checkout's `run.sh` and fails if the
 link is foreign, outside PATH, or shadowed by another command. It detects and wires
-pi/Claude/agy/Copilot/OMP by presence and prints a computed per-component PASS/SKIP/FAIL summary — a
-detected harness that cannot be completed makes setup exit nonzero. A detected `copilot`
-composes all four native units (birth → MCP → receiver → visible footer) with independent
-per-unit verdicts (#86 C3b), and a detected `omp` composes its own four (birth → MCP →
-`tools.xdev` setting → receiver) the same way; §4 and §4b keep the explicit per-unit
-install/doctor/inverse surfaces for repair.
+pi/Claude/agy/Copilot/OMP/Codex by presence and prints a computed per-component
+PASS/SKIP/FAIL summary — a detected harness that cannot be completed makes setup exit nonzero.
+A detected `copilot` composes all four native units, and a detected `omp` composes its own four.
+A detected Codex install is a supported 0.21.0 path: setup composes its user-scope birth,
+MCP, and status-line atoms but never escalates or starts the app-server. It reports independent
+component outcomes, preserves exact env forwarding and idempotence, and returns a named
+`codex-birth FAIL` until the vendor trust receipt exists.
+§4, §4b, and §4c keep the explicit per-unit install/doctor/inverse surfaces.
 
 ### 1.1 User-scope ownership (one shared registration, one recorded owner)
 
@@ -396,6 +399,92 @@ The MCP entry deliberately uses the same server key as any Claude Code import so
 SHADOWS it; see [`external-mcp-host.md`](./external-mcp-host.md) for why that key is pinned and
 why `disabledServers` is never the way to hide an import.
 
+## 4c. Optional OpenAI Codex CLI native citizen
+
+Supported in 0.21.0 with Linux-focused evidence; on macOS it is NOT CERTIFIED —
+pending physical host. It is native, not ACP: the purpose is to preserve the operator's
+Codex tools, delegation, and work context rather than provide another GPT access path.
+Entwurf owns three atoms, not the harness and not a daemon:
+
+```bash
+# All three are operator-scope; `entwurf setup` runs them when it detects Codex. No root.
+entwurf install-codex-birth
+entwurf install-codex-mcp
+entwurf install-codex-statusline
+
+entwurf doctor-codex-birth
+entwurf doctor-codex-mcp
+entwurf doctor-codex-statusline
+```
+
+The birth atom publishes a `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its
+launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`; it mints a V3 record on the
+thread's first turn and sets the thread title to the garden id.
+
+**One step is the operator's, and no command can do it for them.** The vendor will not run a
+user-layer hook until it has been trusted once: open a visible plain Codex, answer
+`Trust all and continue`, then send one first turn. `doctor-codex-birth` reads the receipt the
+vendor writes for that declaration and is RED without it — entwurf never writes, pre-seeds or
+recomputes that value, because it is the operator's security decision, not ours. After the one
+answer, later sessions raise no prompt and are born automatically. The MCP writer owns
+`[mcp_servers.entwurf-bridge]` in `$CODEX_HOME/config.toml`. Its exact `env_vars` allowlist is
+`CODEX_HOME`, `ENTWURF_DIR`, `PI_CODING_AGENT_DIR`, `ENTWURF_META_SESSIONS_DIR`,
+`ENTWURF_META_MAILBOX_DIR`, `ENTWURF_META_SENDERS_DIR`, `ENTWURF_META_RECEIVERS_DIR`,
+`TMUX`, and `TMUX_PANE`.
+The status-line writer owns only `thread-title`. Foreign or symlinked config is refused.
+
+Native delivery requires the operator-owned default app-server and one existing tmux session
+named exactly `codex`. Start the app-server from a pane there and seat supported Codex TUIs there:
+
+```bash
+# Run these commands inside the operator-owned tmux session named exactly `codex`.
+CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
+mkdir -p "$CODEX_HOME/app-server-control"
+codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+codex --remote "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+```
+
+Omitted Codex fresh placement resolves exact `codex` on the caller's tmux server. The app-server's
+`TMUX`/`TMUX_PANE` is forwarded to its MCP child, so a Codex citizen's omitted outbound Pi placement
+stays in that home. It is **not** an arbitrary attached-TUI pane join. Exact Codex 0.153.4 source
+exposes no request→attached-TUI-seat carrier, so clients attached from other sessions have no
+adjacency claim; that wider topology is unsupported and unclaimed. Entwurf does not guess panes,
+create the tmux home, expose a generic app-server manager/API, or start/restart the server. Custom
+`CODEX_HOME` and Entwurf roots cross the same explicit `env_vars` boundary. Strict request `_meta`
+identifies the thread caller, not its seat. Delivery uses one `codex queue` invocation with no retry.
+
+The 2026-09-11 loaded-thread run remains pre-amendment native-push/identity evidence. The final
+first-admission acceptance passed on 2026-09-12: real initial Pi outside `codex`, then omitted-placement
+Codex and outbound Pi inside it, with exact callbacks and addressed delivery both ways. `DELIVERY.md`
+owns the 57-assertion receipt, four coordinates, and digest.
+
+`entwurf_fresh_call` accepts backend `codex` — supported in 0.21.0 — and requires an explicit model. Its
+preflight must prove the safe birth closure, exact MCP/env atom, `thread-title`, and app-server
+socket before tmux mutation. The sibling's garden id comes from the callback sender envelope,
+never the launch receipt. There is no Codex resume surface, watcher, supervisor, or app-server
+lifecycle ownership. The accepted LIVE used a real record-backed visible Pi for the first leg;
+release-gate stripped ambient `PI_SESSION_ID`/`PI_AGENT_ID`, and the fixture/self-fetch citizen only
+collected receipts. The smoke reported initial Pi, app-server, fresh Codex, and outbound Pi
+coordinates separately: the initial Pi differed and the latter three matched the exact `codex` home.
+Qualification and the frozen full floor are complete for this lane: `check-gate-qualification`
+killed 475/475 across 43 lanes with origin purity green, `check:full` exited 0, and the LIVE release
+gate reported MUST 24/0/0 with `cut: OK`. The bounds above are unchanged — no request→arbitrary
+attached-TUI seat join, no resume surface, and macOS remains NOT CERTIFIED pending a physical host.
+
+Oracle runs the first-admission LIVE with explicit ownership/model selectors:
+
+```bash
+LIVE=1 \
+ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid> \
+ENTWURF_CODEX_FRESH_MODEL=<codex-model> \
+ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
+entwurf smoke-codex-fresh-live
+```
+
+Run this from a tmux session other than `codex`. The entrypoint name does not waive the contract
+above. A fixture/self-fetch citizen may collect receipts but cannot replace the real visible Pi leg;
+a Pi that starts inside the Codex home proves only the weaker shared-seat mechanism.
+
 ## 5. Optional Antigravity native citizen
 
 This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
@@ -464,7 +553,7 @@ rail receipt. Doctors refuse on Darwin until a physical-host receipt
 exists.
 
 If install or doctor reports an unreadable/old active citizen generation, do not edit
-records by hand. Close pi, Claude, Copilot, and agy sessions first, run
+records by hand. Close pi, Claude, Copilot, OMP, agy, and Codex sessions first, run
 `entwurf meta-bridge-fresh-cut`, and read its exit status before any install. Then choose the
 installation mode you actually own:
 
@@ -496,6 +585,7 @@ PASS/SKIP/FAIL summary. The complete quiescence, archive, and exit-code contract
 - `scripts/raw-macos-measure/probe.sh`: physical-Darwin host facts (~3.5s,
   no install, no login). Measurement, not a certification path.
 - `doctor-meta-bridge`: one installed real Claude host, only with a new live session.
+- `doctor-codex-{birth,mcp,statusline}` plus `LIVE=1 CODEX_LIVE_THREAD_ID=<id> entwurf smoke-codex-native-push-live`: one installed Codex host; the aggregate does not own a loaded thread.
 - `LIVE=1 entwurf release-gate /path/to/scratch --cut`: aggregate runtime acceptance (`--cut` makes any MUST SKIP red; without it the run is a diagnostic pass).
 
 Keep these verdicts separate. Current protocol is [VERIFY.md](../VERIFY.md); recorded
@@ -519,6 +609,9 @@ entwurf uninstall-copilot-bridge
 entwurf uninstall-agy-hooks
 entwurf uninstall-agy-statusline
 entwurf uninstall-agy-bridge
+entwurf uninstall-codex-statusline
+entwurf uninstall-codex-mcp
+entwurf uninstall-codex-birth
 entwurf remove ~/entwurf-smoke
 # only when no other project uses the shared user-scope pi registration:
 entwurf remove-user-scope

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -64,16 +64,17 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.js";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
-import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
+import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
-import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
+import { probeNativeSenderAlive, reconcileSenderIdentityClaims, resolveCodexRequestSenderIdentity, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
 import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
@@ -128,11 +129,11 @@ function textErr(msg) {
 const server = new McpServer({ name: "entwurf-bridge", version: "0.1.0" });
 // Transparency envelope.
 //
-// Record-backed pi and trusted native-marker senders carry a structured envelope
-// so the receiver renders WHO (agentId, sessionId), FROM WHERE (cwd), and WHEN
-// (timestamp UTC, displayed in KST). `entwurf_self` is identity-required: pi's env
-// is a child carrier for the garden id established by record birth; a native sender
-// marker is accepted only through its backing record. Plain anonymous external hosts
+// Record-backed pi, pid-marker native senders, and request-scoped Codex senders carry a
+// structured envelope so the receiver renders WHO (agentId, sessionId), FROM WHERE (cwd), and
+// WHEN (timestamp UTC, displayed in KST). `entwurf_self` is identity-required: pi's env is a
+// child carrier for the garden id established by record birth; a native sender marker or Codex
+// request selector is accepted only through its backing record. Plain anonymous external hosts
 // fail. #50 C4: v2 delivery is identity-REQUIRED by default — "if we don't know
 // who sent it, we don't send it" holds on every install surface, not only where
 // an installer remembered to set a flag. The ONE documented escape hatch is
@@ -144,27 +145,25 @@ const server = new McpServer({ name: "entwurf-bridge", version: "0.1.0" });
 class EntwurfEnvelopeWiringError extends Error {
     constructor(missing) {
         super(`entwurf sender envelope wiring incomplete — missing env: ${missing.join(", ")}, ` +
-            "and no trusted meta-sender marker was found. This MCP child should either inherit " +
-            "PI_SESSION_ID + PI_AGENT_ID (from an entwurf-control pi session), " +
-            "or run inside a garden-native meta-session whose own native hook wrote a live " +
-            "sender marker (Claude Code writes it from SessionStart, Antigravity from PreInvocation). " +
-            "entwurf_self is only callable when one of those authoritative identity paths is present.");
+            "and no record-backed native sender claim was found. This MCP child should inherit " +
+            "PI_SESSION_ID + PI_AGENT_ID from an entwurf-control pi session, carry a live sender marker " +
+            "written by its native hook, or be the managed Codex MCP child whose current tool request " +
+            "names a thread backed by a Codex citizen record. entwurf_self is callable only while one of " +
+            "those authoritative identity paths is present.");
     }
 }
-// #50 C4: anonymous sends are refused BY DEFAULT — a send with no pi-session
-// identity AND no trusted meta-sender marker does not go out as anonymous
-// external-mcp unless the operator explicitly wired the escape hatch.
+// #50 C4: anonymous sends are refused BY DEFAULT — a send with no pi-session identity,
+// trusted pid marker, or request-scoped Codex record does not go out as anonymous external-mcp
+// unless the operator explicitly wired the escape hatch.
 // "If we don't know who sent it, we don't send it."
 class EntwurfSenderIdentityError extends Error {
     constructor() {
         super("entwurf-bridge refused: no authoritative sender identity. Anonymous external sends are " +
-            "refused by default, and no pi-session env (PI_SESSION_ID + PI_AGENT_ID) or live meta-sender " +
-            "marker was found for this process. Each native backend writes that marker from its OWN hook, keyed " +
-            "by the native host's parent pid + start-time (Claude Code from SessionStart, Antigravity from " +
-            "PreInvocation) — open this session through the installed meta-bridge so your garden id is " +
-            "registered, then retry. A deliberately-anonymous external MCP host may set " +
-            "ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1 (explicit operator wiring; the send is then marked " +
-            "external/non-replyable).");
+            "refused by default, and this request has no complete pi-session env, live record-backed " +
+            "sender marker, or managed Codex thread selector backed by a Codex citizen record. Open the " +
+            "session through its installed birth/MCP integration, then retry. A deliberately-anonymous " +
+            "external MCP host may set ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1 (explicit operator wiring; " +
+            "the send is then marked external/non-replyable).");
     }
 }
 function buildStrictPiSenderEnvelope() {
@@ -203,41 +202,7 @@ function buildStrictPiSenderEnvelope() {
         replyable: self.replyable,
     };
 }
-async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
-    // No pi-session identity. Try the meta-sender marker: a native backend that minted a
-    // garden-id from its own hook (Claude SessionStart / agy PreInvocation). The marker is
-    // keyed by the shared parent pid — this MCP child's process.ppid IS the native host the
-    // hook ran under (NOT cwd inference). A trusted marker promotes this process from
-    // anonymous external-mcp to a meta-session sender addressed by its garden-id.
-    const trusted = resolveTrustedMetaSenderIdentity({
-        markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
-    });
-    if (!trusted)
-        return null;
-    const { marker, identity } = trusted;
-    // Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
-    // rail a reply would ride (보정①). THREE values, not a native-push-or-self-fetch binary:
-    //   native-push ← nativePushSupported(backend). NOT wakeMode: `direct-inject` also covers
-    //     codex/pi, which have no native-push adapter.
-    //   self-fetch  ← resolveMailboxWakeModeCapability (the decider's mailbox seam — one owner
-    //     with dispatch). A new hardcoded backend list would drift the moment the registry
-    //     admits another self-fetch citizen.
-    //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
-    //     this as self-fetch printed a mailboxPath nothing drains.
-    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
-    //     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
-    //     uses, so a citizen's self-reported replyability can never disagree with what dispatch
-    //     decides about it. It reads the presence marker (a dead/reused owner already folds to
-    //     null) AND, where the watch owner is the sender-marker process, the #101 join that says
-    //     the owner is still serving THIS garden rather than one it switched away from.
-    //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
-    //     live app-server conversation, so only an adapter probe can answer. Composing the
-    //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
-    //     every agy citizen would report replyable:false forever.
-    // Either way an inactive/unreachable citizen STILL returns its identity (who-sent must
-    // survive; degrading to null would erase the sender) — only with replyable:false.
-    // The rail, named ONCE and reused for both the predicate and the caller's rendering —
-    // so entwurf_self can never re-derive it differently from what decided `replyable`.
+async function buildMetaSenderEnvelope(identity, cwd, trustedMarker) {
     const metaDeliveryDomain = nativePushSupported(identity.backend)
         ? "native-push"
         : resolveMailboxWakeModeCapability(identity)
@@ -252,6 +217,9 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         }
         : metaDeliveryDomain === "self-fetch"
             ? (() => {
+                if (!trustedMarker) {
+                    throw new Error(`entwurf-bridge: ${identity.backend} resolved as self-fetch without the sender marker its receiver join requires`);
+                }
                 const receiver = resolveMailboxReceiverFacts(identity, {
                     readReceiverMarker: (gardenId) => readMetaReceiverMarker({ gardenId }),
                     readSenderMarker: (backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
@@ -274,7 +242,7 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         envelope: {
             sessionId: identity.gardenId,
             agentId: `meta-session/${identity.backend}`,
-            cwd: marker.cwd || cwd,
+            cwd,
             timestamp: new Date().toISOString(),
             origin: "meta-session",
             replyable: self.replyable,
@@ -282,17 +250,43 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         metaDeliveryDomain,
     };
 }
-// async only for the native-push branch's adapter probe: a pi sender and a claude-code
-// sender still resolve from files alone, so their cost is unchanged.
-async function buildAuthoritativeSelfEnvelope() {
+async function resolveAuthoritativeSender(context, cwd = process.cwd()) {
+    const sessionId = process.env.PI_SESSION_ID?.trim();
+    const agentId = process.env.PI_AGENT_ID?.trim();
+    const pi = sessionId && agentId && cwd ? buildStrictPiSenderEnvelope() : null;
+    const marker = resolveTrustedMetaSenderIdentity({
+        markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
+    });
+    const codex = resolveCodexRequestSenderIdentity({
+        provenance: process.env.ENTWURF_BRIDGE_NATIVE_HOST,
+        clientInfo: server.server.getClientVersion(),
+        requestMeta: context.requestMeta,
+    });
+    const selected = reconcileSenderIdentityClaims([
+        ...(pi ? [{ rail: "pi-session", id: pi.sessionId }] : []),
+        ...(marker ? [{ rail: "meta-sender-marker", id: marker.identity.gardenId }] : []),
+        ...(codex ? [{ rail: "codex-request", id: codex.identity.gardenId }] : []),
+    ]);
+    if (!selected)
+        return null;
+    if (codex && codex.identity.gardenId === selected.id) {
+        return buildMetaSenderEnvelope(codex.identity, codex.identity.cwd);
+    }
+    if (marker && marker.identity.gardenId === selected.id) {
+        return buildMetaSenderEnvelope(marker.identity, marker.marker.cwd || cwd, marker);
+    }
+    if (pi && pi.sessionId === selected.id)
+        return { envelope: pi };
+    throw new Error(`entwurf-bridge: reconciled sender ${selected.id} has no matching identity source`);
+}
+// Async only when the selected sender rides native-push: replyability is the adapter's live fact.
+async function buildAuthoritativeSelfEnvelope(context = {}) {
+    const resolved = await resolveAuthoritativeSender(context);
+    if (resolved)
+        return resolved;
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
     const cwd = process.cwd();
-    if (sessionId && agentId && cwd)
-        return { envelope: buildStrictPiSenderEnvelope() };
-    const meta = await buildTrustedMetaSenderEnvelope(cwd);
-    if (meta)
-        return meta;
     const missing = [];
     if (!sessionId)
         missing.push("PI_SESSION_ID");
@@ -302,18 +296,11 @@ async function buildAuthoritativeSelfEnvelope() {
         missing.push("cwd");
     throw new EntwurfEnvelopeWiringError(missing);
 }
-async function buildSendSenderEnvelope() {
-    const sessionId = process.env.PI_SESSION_ID?.trim();
-    const agentId = process.env.PI_AGENT_ID?.trim();
+async function buildSendSenderEnvelope(context = {}) {
+    const resolved = await resolveAuthoritativeSender(context);
+    if (resolved)
+        return resolved.envelope;
     const cwd = process.cwd();
-    if (sessionId && agentId && cwd)
-        return buildStrictPiSenderEnvelope();
-    const meta = await buildTrustedMetaSenderEnvelope(cwd);
-    // Delivery takes the WIRE envelope only — the rail axis is rendering-local.
-    if (meta)
-        return meta.envelope;
-    // No marker. #50 C4: anonymous external is refused UNLESS the operator wired the
-    // explicit escape hatch — identity-required is the default, not an install flag.
     if (process.env.ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER !== "1") {
         throw new EntwurfSenderIdentityError();
     }
@@ -365,12 +352,11 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     "outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
     "entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
     "citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
-    '"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
-    "gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
-    "all. THERE IS A THIRD RESULT: the mailbox delivers only to a DELIVERABLE citizen, so a terminated " +
-    "session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
-    "inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
-    "native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
+    '"no control-socket probe." The decider resolves the actual rail at dispatch time: a self-fetch ' +
+    "mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, " +
+    "or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; " +
+    "native-push has NO mailbox: dead → native-push-target-dead; indeterminate → " +
+    "native-push-probe-indeterminate. " +
     "DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
     "— same receiver rule as the mailbox, no active drainer means no delivery. " +
     "The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
@@ -402,11 +388,11 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         "follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
         "effect on those rails."),
     wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
-}, async ({ target, intent, message, mode, wants_reply }) => {
+}, async ({ target, intent, message, mode, wants_reply }, extra) => {
     try {
         // Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
         // + the mailbox body sender share one envelope. No replyability gate (see above).
-        const sender = await buildSendSenderEnvelope();
+        const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
         const rendered = await runAndRenderEntwurfV2FromSurface({ target, intent, message, mode, wants_reply }, 
         // No trust-preflight inputs are passed, and none exist to pass: the preflight on this
         // path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
@@ -424,15 +410,14 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
     "degrading it to nothing would erase who-sent. Use to confirm WHO you " +
     "are (agentId, sessionId), FROM WHERE (cwd), and WHEN this snapshot was taken. " +
     "Works for pi sessions (PI_SESSION_ID / PI_AGENT_ID) and for garden-native meta-sessions, whose " +
-    "garden id comes from a trusted sender marker their OWN native hook wrote (Claude Code from " +
-    "SessionStart, Antigravity from PreInvocation). For a meta-session it also reports WHICH rail a " +
-    "reply rides, because that differs by backend: a self-fetch citizen (Claude Code) has a drainable " +
-    "mailbox and its path is shown, while a native-push citizen (Antigravity) has NO mailbox at all — " +
-    "a reply is injected straight into its live conversation. Do not expect a mailbox just because " +
-    "origin is meta-session. Throws for plain anonymous external MCP hosts because they have no " +
-    "authoritative reply address.", {}, async () => {
+    "garden id comes from the matching record plus either a trusted native process marker or Codex's " +
+    "request-scoped thread selector. For a meta-session it also reports WHICH rail a reply rides, " +
+    "because that differs by backend: a self-fetch citizen has a drainable mailbox, while a " +
+    "native-push citizen has NO mailbox at all — a reply is injected straight into its live native " +
+    "conversation/thread. Do not expect a mailbox just because origin is meta-session. Throws for " +
+    "plain anonymous external MCP hosts because they have no authoritative reply address.", {}, async (_args, request) => {
     try {
-        const self = await buildAuthoritativeSelfEnvelope();
+        const self = await buildAuthoritativeSelfEnvelope({ requestMeta: request._meta });
         const sender = self.envelope;
         const kst = formatKstTimestamp(sender.timestamp);
         const extra = {};
@@ -522,6 +507,9 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
             readRecord: makeStoreRecordReader(sessionsDir),
             // Socket axis: the same dir dispatch uses (grammar SSOT), scan-internal only.
             socket: { dir: ENTWURF_DIR },
+            // #112: observe only rows this human surface can render. Full store facts,
+            // diagnostics, liveness, and machine payload remain intact.
+            observationLimit: ENTWURF_PEERS_RENDER_LIMIT,
         });
         const { text } = renderEntwurfPeers(result);
         return textOk(text);
@@ -610,29 +598,29 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed " +
-    "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Five fixed " +
+    "backends only: pi, claude-code, copilot, omp, codex. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
     "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot; a fuzzy model pattern for omp). A copilot launch goes through entwurf's own managed " +
-    "invocation and is refused BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or " +
-    "visible-footer units; an omp launch is refused the same way if this host lacks the OMP birth, MCP, receiver or " +
-    "visible-status units, or if omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the " +
-    "prompt, so the sibling could not call you back at all). An optional " +
+    "or `auto` for copilot; a fuzzy model pattern for omp or codex). Copilot, omp, and codex are refused BEFORE " +
+    "any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent. " +
+    "Codex additionally requires the operator-owned default app-server socket; entwurf never starts or supervises it. " +
+    "An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
-    "An optional placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an " +
-    "absent SESSION is tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. " +
+    "An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own tmux server. " +
+    "When omitted, Codex targets the exact existing `codex` home session; other backends target the caller's session. " +
+    "A missing named/home session is tmux-session-missing and NOTHING is created. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot", "omp"])
-        .describe("Which fixed runtime to open. Only these four; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp", "codex"])
+        .describe("Which fixed runtime to open. Only these five; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -646,7 +634,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         // as an unused suppression while the escape goes back to being fixable.
         // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto)."),
+        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
     task: z
         .string()
         .min(1)
@@ -663,11 +651,11 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
             .describe("EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid."),
     })
         .optional()
-        .describe("Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id."),
-}, async ({ backend, model, task, cwd, placement }) => {
+        .describe("Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server. When omitted, Codex selects the exact existing `codex` home session; other backends use the caller's session. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id."),
+}, async ({ backend, model, task, cwd, placement }, extra) => {
     let callerGardenId = null;
     try {
-        const self = await buildAuthoritativeSelfEnvelope();
+        const self = await buildAuthoritativeSelfEnvelope({ requestMeta: extra._meta });
         callerGardenId = self.envelope.sessionId;
     }
     catch (err) {
@@ -683,7 +671,11 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, placement, callerGardenId }));
+        const missing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
+        const result = missing
+            ? { ok: false, reason: missing }
+            : freshCall({ backend, model, task, cwd, placement, callerGardenId });
+        const rendered = renderFreshCall(result);
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {