@junghanacs/entwurf 0.20.1 → 0.22.0

package/run.sh

@@ -119,8 +119,8 @@ run_vitest() {
 usage() {
   cat <<'EOF'
 Usage:
-  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently)/omp (four units: birth→MCP→tools.xdev setting→receiver, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
-  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
+  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
+  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
@@ -134,9 +134,17 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
+  ./run.sh check-codex-app-server-launch # #95 gate: the MANAGED app-server launch `entwurf codex-app-server`, driven through its public address against a FAKE VENDOR on a sandbox PATH. The injected `app-server --listen unix://<socket>` required to equal the product's own resolveCodexDefaultSocketPath over an env matrix that includes the inputs a bash transcription was MEASURED to diverge on (BOM-only CODEX_HOME, trailing slash, `..`), non-absolute and control-character addresses refused before any write, byte-identical operator argv, exec (not fork) parent identity, exit passthrough, live-socket and indeterminate-socket and second---listen and recursion refusals, dead-socket launch-over, the tmux fact line, and both identity carriers stripped. Hermetic; no Codex, no app-server, no model turn
   ./run.sh check-copilot-statusline   # #82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
   ./run.sh check-omp-fresh-preflight   # #87 C: the OMP fresh preflight reproduces omp_agent_dir and the tools.xdev read in TS (it runs from two emit depths and cannot call a sibling script). This drives the SHIPPED shell/python leaves over the same inputs — refusals included — and requires the TS half to agree, so the reproduction cannot silently drift from the installer's own oracle
+  ./run.sh check-codex-sender-identity # Codex tools/call _meta triple agreement + addressable record join + cross-carrier conflict refusal
+  ./run.sh check-codex-bridge-identity # real MCP bridge request identity for entwurf_self/v2/fresh; malformed or conflicting _meta fails loud
+  ./run.sh check-codex-native-push    # app-server WebSocket-over-UDS probe + measured one-shot codex queue delivery; no replay
+  ./run.sh check-codex-birth-hook     # sandboxed payload + declaration: first-turn V3 birth, one record per thread, top-level event predicate, no markers
+  ./run.sh check-codex-fresh-preflight # pre-mutation birth/MCP/thread-title/default-app-server readiness
+  ./run.sh smoke-codex-config-state   # sandboxed MCP + status-line ownership/install/doctor/inverse lifecycle
+  ./run.sh smoke-codex-birth          # sandboxed birth unit: exact trust identity, the vendor trust receipt read (never written), config.toml untouched, foreign/edited/symlink refusals, drift-refusing inverse
   ./run.sh check-harness-admission-parity  # #87 C: the EDGE the two closed parity loops never had. Every citizen backend is fresh-openable or a declared pre-#82 legacy admission whose exception a reader finds in DELIVERY.md — so a post-contract harness that mints records but cannot be opened by entwurf_fresh_call blocks the release package instead of only carrying an `unsupported` note (docs/adding-a-harness.md step 9)
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
@@ -149,12 +157,13 @@ Usage:
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
-  ./run.sh check-entwurf-v2-contract   # deterministic gate (0.11 Stage 0 step 4-pre, 동결결정 10 + Fable R1-R5): FROZEN entwurf_v2 contract — R1 control-socket domain (currently pi; claude/codex/agy=unsupported, not folded), 3-cell intent×liveness table (single verdict, 1 allow/2 reject after the visible-first cut), N1 indeterminate-no-spawn, R3 table↔receipt round-trip, R5 taxonomy, schema↔types drift; pure, no API
+  ./run.sh check-entwurf-v2-contract   # FROZEN entwurf_v2 contract — control-socket liveness domain is currently pi; self-fetch/native-push citizens are out of that domain, not globally unsupported; pure, no IO
   ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
   ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
   ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/native-push + bad-target/conflict/locked/undeliverable/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
   ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — the spawn-observation policy and its four release events went with the transport in the visible-first cut, so the shipped machine is meta-mailbox=never release (no lock) + control-socket=release once on send-final; decideReleasePolicy still enforces the lock-nullness invariant; pure, no IO
   ./run.sh check-entwurf-v2-send       # deterministic gate (0.11 Stage 0 step 5c-2a): control-socket SEND hand (executeControlSocketSend) wiring transport IO onto the 5c-1 reducer — ack→sent, in-band reject→rejected (no fallback), dead→same-lock one-shot re-resolve (control retry / mailbox enqueue), indeterminate→failed+rethrow with NO fallback (no double-delivery); release exactly once, releaseLock throw never masks the send error; IO-via-dep
+  ./run.sh check-compaction-send-guard # deterministic gate (#111): control-socket send during Pi compaction — event-armed refuse compacting, quiet unknown non-idle refuse busy (ctx.signal is not isStreaming); no pi.sendMessage, no delivered:true; idle/live-run steer/followUp preserved; pure, no IO
   ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (nothing is ever launched), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
   ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/mailbox→matching hand with decision.lock verbatim / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
   ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
@@ -166,12 +175,14 @@ Usage:
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+  ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
+  ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
-  ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — listAllMetaIdentities→scanSocketProbes→pre-quarantine out-of-socket-domain/socket conflicts→resolveFactList(clean)→{facts,diagnostics}; C-원칙: expected corruption (parse/collision)→diagnostics (listing survives), impossible invariant (dup/unprobed)→throw; collision quarantines BOTH PeerFact+socket; deps injected, no IO
+  ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — full-store parse/probe/quarantine/resolve stays intact; #112 bounds expensive receiver/transcript observation to the newest 32 rendered rows while older machine rows say unobserved; Q112 pins full payload + exact observer budget; C-원칙 keeps corruption diagnostic and impossible wiring loud; deps injected, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
   ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta splits by RAIL: self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows), native-push ⟺ recordBacked ∧ probeAlive (separate axis — no mailbox fact may rescue or sink it), unsupplied rail fail-closed; SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected AND renders the meta rail per-rail (mailbox only inside the self-fetch branch; native-push denies an inbox and gates injection on the probe)
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
@@ -240,6 +251,20 @@ Usage:
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
   ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
   ./run.sh doctor-agy-bridge          # fail-loud doctor: MCP config + exact permission rule + state + live probe label
+  ./run.sh install-codex-birth        # publish $CODEX_HOME/hooks.json + the helper closure; no root, and the operator trusts the declaration once in their own Codex
+  ./run.sh uninstall-codex-birth      # exact inverse from the install-state digest inventory; refuses drifted bytes instead of deleting them
+  ./run.sh doctor-codex-birth         # RUNTIME + UNIT bytes/ownership + the vendor TRUST receipt for this declaration (--unit-only skips the receipt; sandboxes only)
+  ./run.sh install-codex-mcp          # own only [mcp_servers.entwurf-bridge] in the user's Codex config
+  ./run.sh uninstall-codex-mcp        # remove/restore only the recorded MCP atom
+  ./run.sh doctor-codex-mcp           # effective config + ownership + actual bridge boot
+  ./run.sh install-codex-statusline   # add thread-title to tui.status_line for visible garden ids
+  ./run.sh uninstall-codex-statusline # remove only the recorded status-line atom
+  ./run.sh doctor-codex-statusline    # effective visible-identity config + ownership verdict
+  ./run.sh install-codex-terminal-title   # add thread-id to tui.terminal_title so the multiplexer reports the caller's thread in #{pane_title} (#95 placement input, never an address)
+  ./run.sh uninstall-codex-terminal-title # remove only the recorded terminal-title atom
+  ./run.sh doctor-codex-terminal-title    # effective caller-seat config + ownership verdict
+  ./run.sh codex-socket-path              # #95 INTERNAL (the launcher asks this; you do not need it): print the Codex app-server default control-socket path for this environment, from the SAME resolver delivery and preflight read
+  ./run.sh codex-app-server [args...]     # #95: the ONE COMMAND that starts the operator's Codex app-server. exec()s `codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"` in THIS terminal (cwd/pid/exit are the vendor's, Ctrl-C is yours) — entwurf owns the SPELLING of that address, never the process's lifecycle: no supervisor, no restart, no daemon, no pid file. It does no path arithmetic: the address comes from `codex-socket-path`, the one leaf every other Codex surface reads, and a resolved address that is not absolute or carries a control character is refused before anything is created. Your arguments are forwarded byte-identical after it; a second --listen is refused by name. Refuses on a live socket (names the /proc owner it can read) or an indeterminate one, and reports which tmux server this seat gives caller-seat lookups. Run it in a DETACHED tmux session other than the one you work in
   ./run.sh install-agy-statusline     # own the agy statusLine subtree with bare entwurf-agy-statusline; preserve unrelated settings
   ./run.sh uninstall-agy-statusline   # honest inverse from statusline install-state
   ./run.sh doctor-agy-statusline      # fail-loud statusLine config/bin/state doctor + honest live SKIP
@@ -581,6 +606,56 @@ install_local_package() {
 _pi_package_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-package/install-state.json"; }
 _pi_provider_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"; }
 
+_codex_home() { echo "${CODEX_HOME:-$HOME/.codex}"; }
+_codex_config() { echo "$(_codex_home)/config.toml"; }
+_codex_mcp_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-mcp/install-state.json"; }
+_codex_statusline_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-statusline/install-state.json"; }
+_codex_terminal_title_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-terminal-title/install-state.json"; }
+
+codex_mcp() {
+  local verb="$1" config state
+  config="$(_codex_config)"
+  state="$(_codex_mcp_state)"
+  case "$verb" in
+    install) python3 "$REPO_DIR/scripts/codex-mcp-config.py" install "$config" "entwurf-bridge" "$state" ;;
+    uninstall) python3 "$REPO_DIR/scripts/codex-mcp-config.py" uninstall "$state" ;;
+    doctor)
+      python3 "$REPO_DIR/scripts/codex-mcp-config.py" doctor-static "$config" "entwurf-bridge" "$state"
+      local invocation
+      invocation="$(python3 "$REPO_DIR/scripts/codex-mcp-config.py" doctor-invocation "$config")"
+      run_ts scripts/probe-bridge-command.ts --invocation-json "$invocation"
+      ;;
+  esac
+}
+
+codex_statusline() {
+  local verb="$1" config state
+  config="$(_codex_config)"
+  state="$(_codex_statusline_state)"
+  case "$verb" in
+    install) python3 "$REPO_DIR/scripts/codex-statusline-config.py" install "$config" "$state" ;;
+    uninstall) python3 "$REPO_DIR/scripts/codex-statusline-config.py" uninstall "$state" ;;
+    doctor) python3 "$REPO_DIR/scripts/codex-statusline-config.py" doctor-static "$config" "$state" ;;
+  esac
+}
+
+# #95 lane B: the SECOND visible-identity atom, and a different axis from the
+# status line. `status_line`'s thread-title is what a HUMAN reads in the TUI;
+# `terminal_title`'s thread-id is what the MULTIPLEXER reports back as
+# `#{pane_title}`, which is the only value a Codex caller's `_meta.threadId`
+# can be matched against to find the pane it is sitting in. Placement input
+# only — never an address, delivery or liveness fact.
+codex_terminal_title() {
+  local verb="$1" config state
+  config="$(_codex_config)"
+  state="$(_codex_terminal_title_state)"
+  case "$verb" in
+    install) python3 "$REPO_DIR/scripts/codex-terminal-title-config.py" install "$config" "$state" ;;
+    uninstall) python3 "$REPO_DIR/scripts/codex-terminal-title-config.py" uninstall "$state" ;;
+    doctor) python3 "$REPO_DIR/scripts/codex-terminal-title-config.py" doctor-static "$config" "$state" ;;
+  esac
+}
+
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
@@ -831,6 +906,18 @@ smoke_omp_fresh_live() {
   run_ts scripts/smoke-omp-fresh-live.ts
 }
 
+smoke_codex_fresh_live() {
+  # #95 first-admission RELEASE MUST. The explicit operator-owned app-server PID is the
+  # seat authority: validate its Codex app-server argv and /proc TMUX/TMUX_PANE, then use
+  # that exact environment for the record-backed receipt fixture and stable-id cleanup.
+  # Through public MCP calls: fixture opens visible Pi; Pi opens visible Codex, correlates
+  # its exact callback and addresses it through native-push v2; Codex opens visible Pi,
+  # correlates that callback, and sends final evidence. The four actor/seat coordinates
+  # travel in receipts and Codex/app-server-MCP/outbound-Pi sessions must be identical.
+  # LIVE!=1 is the only host-prerequisite SKIP after admission; missing facts FAIL.
+  run_ts scripts/smoke-codex-fresh-live.ts
+}
+
 check_omp_fresh_preflight() {
   # #87 Bundle C. The OMP fresh preflight REPRODUCES two resolvers that already exist
   # in this repo in another language — omp_agent_dir (scripts/omp-bridge-oracle.sh) and
@@ -963,6 +1050,14 @@ check_copilot_launch() {
   run_ts scripts/check-copilot-launch.ts
 }
 
+check_codex_app_server_launch() {
+  # #95: the managed app-server SPELLING, proved against a fake vendor. There is no second
+  # spelling of the address to compare any more — the launcher asks `codex-socket-path` — so
+  # these cells are a WIRING oracle, and they carry the hostile inputs a transcription was
+  # measured to diverge on so that re-deriving the path here goes red rather than passing.
+  run_ts scripts/check-codex-app-server-launch.ts
+}
+
 check_copilot_receive_arm() {
   # #82 RAIL 5 gate: drives the REAL receiver installer into a temp extensions dir, then
   # forks the REAL extension.mjs with the SDK specifier resolved by a loader hook (the
@@ -1219,6 +1314,14 @@ check_entwurf_control_rpc() {
   run_ts scripts/check-entwurf-control-rpc.ts
 }
 
+check_compaction_send_guard() {
+  # Deterministic gate for #111: a compacting Pi citizen is neither idle nor an ordinary
+  # streaming turn. Event-armed refuse is `compacting`; quiet unknown non-idle is `busy`
+  # (`ctx.signal` is not isStreaming). Either token: no pi.sendMessage, no delivered:true.
+  # Pure admission predicate + resident wiring/event source guard. No IO.
+  run_ts scripts/check-compaction-send-guard.ts
+}
+
 check_entwurf_resume_args() {
   # Deterministic gate for the resume-argv SSOT (buildResumePiArgs). S1 replaced the headless
   # shape with the VISIBLE one, measured against the runtime before the consumer was written:
@@ -1333,14 +1436,20 @@ check_mux_fresh_call() {
   # could not see: real bridge boot → tools/list schema/description, Rust-regex-family pattern
   # validity on every emitted pattern (the #62 escape), and the schema riding the actual
   # anthropic-messages request body. No fake tmux: the real-window axis is smoke-mux-fresh-call-live.
-  # copilot-fresh-preflight rides here rather than in its own gate: it exists only as
-  # freshCall's pre-mutation branch (#82 RAIL 9), and splitting it would let the two halves
-  # of one refusal be certified in different runs.
+  # copilot-fresh-preflight and codex-fresh-preflight ride here rather than in
+  # separate gates: each exists only as freshCall's pre-mutation branch, and
+  # splitting one would let the two halves of a refusal be certified separately.
   # omp-fresh-bootstrap.contract rides here for the same reason and one more: it is the ONLY
   # place the launcher's payload and the installed birth extension's decoder are read together.
   # They ship in different directories and cannot import each other (#87 Bundle C), so this
   # lane is what keeps a deliberate duplication from becoming drift.
-  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts
+  # tmux-coordinate-row rides here because it is the parse every tmux COORDINATE in this lane's
+  # LIVE siblings depends on, and because it is the only half of a measured LIVE failure that a
+  # deterministic gate can own: the row is the input, so no tmux and no model turn is needed.
+  # codex-caller-seat rides here for the same reason as the two preflights: the leaf exists
+  # only as freshCall's Codex placement input (#95 lane B), so certifying it apart from the
+  # composition it feeds would let the two halves of one seat decision drift.
+  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts test/codex-caller-seat.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -1701,11 +1810,13 @@ check_entwurf_fact_provider() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4b): the
   # ASSEMBLY layer listEntwurfFacts. listAllMetaIdentities → scanSocketProbes →
   # pre-quarantine out-of-socket-domain/socket conflicts → resolveFactList(clean) →
-  # {facts, diagnostics}. Throw-vs-diagnostics policy (GPT힣 C-원칙): expected
-  # corruption (parse failure / gardenId↔socket collision) → diagnostics, listing
-  # survives; impossible wiring invariant (resolveFactList duplicate/unprobed) →
-  # throw, never swallowed. A collision quarantines BOTH the PeerFact and the
-  # socket (gid is the universal address). meta + socket deps injected, no IO.
+  # {facts, diagnostics}. #112 keeps the whole-store parse/probe/diagnostic/payload
+  # while running expensive receiver/transcript observation for exactly the newest
+  # 32 human-rendered rows; older payload rows say unobserved. Q112 pins that budget.
+  # Throw-vs-diagnostics policy (GPT힣 C-원칙): expected corruption (parse failure /
+  # gardenId↔socket collision) → diagnostics, listing survives; impossible wiring
+  # invariant (resolveFactList duplicate/unprobed) → throw, never swallowed. A
+  # collision quarantines BOTH the PeerFact and socket. deps injected, no IO.
   run_ts scripts/check-entwurf-fact-provider.ts
 }
 
@@ -1907,7 +2018,7 @@ assert.equal(peerDepTui, expectedPeer,
 // read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
 // because it was outside this list. Its declaration is a plain range, so the
 // range scan below binds it — no new PROSE_DECL is needed for it.
-const BASELINE_DOCS = ['AGENTS.md', 'README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
+const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
   const text = readFileSync(file, 'utf8');
@@ -1932,7 +2043,6 @@ const PROSE_DECLS = [
   ['demo/README.md', /current floor (\d+\.\d+\.\d+)/, 'current floor <version>'],
   ['ROADMAP.md', /\bpi (\d+\.\d+\.\d+) fence\b/, 'pi <version> fence'],
   ['ROADMAP.md', /floor = \*\*(\d+\.\d+\.\d+)\*\*/, 'floor = **<version>**'],
-  ['AGENTS.md', /devDep exact `(\d+\.\d+\.\d+)`/, 'devDep exact `<version>`'],
 ];
 for (const [file, re, shape] of PROSE_DECLS) {
   const m = readFileSync(file, 'utf8').match(re);
@@ -2084,7 +2194,7 @@ check_claude_floor_coherence() {
   # DERIVE it at runtime through scripts/meta-bridge-claude-floor.sh, so they carry no
   # literal to drift — that shared file is itself part of the contract and is asserted
   # below. What remains are the human-facing declarations (the launcher's refusal
-  # message, docs, AGENTS) plus every fake `claude` CLI stub the gates spawn: a stub
+  # message and docs) plus every fake `claude` CLI stub the gates spawn: a stub
   # that reports a version BELOW the floor would make the doctor legitimately refuse
   # its own fixture, so those are bound too — as `>=`, not equality, since a stub may
   # honestly claim a newer version.
@@ -2124,7 +2234,6 @@ const SITES = [
   ['pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh', /Claude Code >= (\d+\.\d+\.\d+)/g, 1, 'launcher refusal message'],
   ['scripts/meta-bridge-claude-floor.sh', /THE FLOOR IS (\d+\.\d+\.\d+)/g, 1, 'floor helper rationale header'],
   ['docs/setup-clean-host.md', /`>=(\d+\.\d+\.\d+)`\*\* — the exec-form hook floor/g, 1, 'clean-host pin matrix'],
-  ['AGENTS.md', /Claude Code `>=(\d+\.\d+\.\d+)`/g, 1, 'AGENTS rule 14'],
   ['README.md', /supported floor `>=(\d+\.\d+\.\d+)`/g, 1, 'README doctor description'],
   ['scripts/check-hook-launch-topology.ts', /\/(\d+)\\\.(\d+)\\\.(\d+)\//g, 1, 'topology gate floor assertion'],
 ];
@@ -3788,10 +3897,10 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   # SAME installed candidate, on a FRESH sandbox home with every harness absent.
   # This is the first living consumer of package-installed `entwurf setup`:
   # mode=installed decided by name before anything else, NO pnpm bootstrap inside
-  # node_modules, pi/claude/agy/copilot/omp explicit zero-state SKIPs, stable bins
-  # PASS as npm-provided, core bridge boundary PASS, computed green, zero
-  # harness/auth writes. Harness probes are pinned absent via the FIVE
-  # PI_BIN/CLAUDE_BIN/AGY_BIN/COPILOT_BIN/OMP_BIN seams so the gate host's real
+  # node_modules, every harness explicit zero-state SKIP, stable bins PASS as
+  # npm-provided, core bridge boundary PASS, computed green, zero
+  # harness/auth writes. Harness probes are pinned absent via the SIX
+  # PI_BIN/CLAUDE_BIN/AGY_BIN/COPILOT_BIN/OMP_BIN/CODEX_BIN seams so the gate host's real
   # harnesses never leak in.
   #
   # OMP_BIN was MISSING here from the 0.16.0 OMP admission until 2026-09-06, while
@@ -3803,7 +3912,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   # ambiguous. Nothing was wrong with the product; the fixture was. It stayed
   # invisible because CI runners carry no omp AND `release_gate()` does not run
   # this gate (it is prepublishOnly + the CI install-surface job). The skip probe
-  # below now requires FIVE zero-states, so a sixth harness cannot be admitted
+  # below now requires SIX zero-states, so a seventh harness cannot be admitted
   # while this seam is quietly left behind again.
   local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
   mkdir -p "$setup_home/.pi/agent" "$setup_proj"
@@ -3815,7 +3924,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
     XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
-    COPILOT_BIN="$npm_tmp/definitely-absent" OMP_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" OMP_BIN="$npm_tmp/definitely-absent" CODEX_BIN="$npm_tmp/definitely-absent" \
     "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
   setup_rc=$?
   set -e
@@ -3835,9 +3944,9 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     return 1
   fi
   local skip_probe
-  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP" "omp: SKIP"; do
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP" "omp: SKIP" "codex: SKIP"; do
     if ! grep -q "$skip_probe" <<<"$setup_out"; then
-      fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
+      fail "[QK:CODEX-PACK-SETUP-ZERO-STATE] [check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
       echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
       return 1
     fi
@@ -3852,7 +3961,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
     return 1
   fi
-  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ]; then
+  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ] || [ -e "$setup_home/.codex" ]; then
     fail "[check-pack-install] installed all-absent setup wrote harness state (must be zero-write)"
     return 1
   fi
@@ -3860,7 +3969,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
     return 1
   fi
-  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 5x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 6x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
 
   # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
   # bin on a fresh sandbox home, with the shared fake vendor
@@ -3886,7 +3995,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
     XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
-    OMP_BIN="$npm_tmp/definitely-absent" \
+    OMP_BIN="$npm_tmp/definitely-absent" CODEX_BIN="$npm_tmp/definitely-absent" \
     COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
     "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
   setup_rc=$?
@@ -4424,6 +4533,57 @@ JS
   fi
   echo "[check-pack-install] installed 'entwurf copilot' reached the vendor with the scan flag and the managed argv"
 
+  # #95 — the managed app-server SPELLING, from the INSTALLED package. Same packaging risk as
+  # the copilot cell above and the same reason a file-list assertion cannot stand in for it:
+  # `scripts/codex-app-server-launch.sh` has to be in the tarball AND resolve its siblings
+  # correctly once it lives under node_modules. What makes this cell worth its seconds is the
+  # ADDRESS: this verb exists so a consumer never types that socket path, so the one thing an
+  # installed run must prove is that the path it hands the vendor is the one the product's own
+  # resolver computes — read here from the INSTALLED tree, never from this checkout.
+  local cx_launch_home="$npm_tmp/codex-appserver-home" cx_launch_bin="$npm_tmp/codex-appserver-bin"
+  mkdir -p "$cx_launch_home" "$cx_launch_bin"
+  {
+    printf '#!/usr/bin/env bash\n'
+    printf 'for a in "$@"; do printf "ARG<%%s>\\n" "$a"; done\n'
+  } > "$cx_launch_bin/codex"
+  chmod +x "$cx_launch_bin/codex"
+  # The expectation is read from the INSTALLED COMPILED resolver, not from this checkout and
+  # not transcribed here: compiled JS is what an installed consumer surface reaches (Hard Rule
+  # 11), so this asks the packed tree itself what address it believes in.
+  local cx_resolver="$npm_pkg/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/codex-ws-client.js" cx_want
+  if [ ! -f "$cx_resolver" ]; then
+    fail "[check-pack-install] the tarball carries no compiled Codex socket resolver at $cx_resolver"
+    return 1
+  fi
+  if ! cx_want=$(CODEX_HOME="$cx_launch_home/.codex" node --input-type=module -e "
+import { resolveCodexDefaultSocketPath } from '$cx_resolver';
+process.stdout.write(resolveCodexDefaultSocketPath(process.env));
+" 2>&1); then
+    fail "[check-pack-install] the INSTALLED compiled socket resolver would not load:"
+    echo "$cx_want" | tail -4 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! op_out=$(env -u ENTWURF_CODEX_APP_SERVER_ACTIVE -u TMUX \
+      HOME="$cx_launch_home" CODEX_HOME="$cx_launch_home/.codex" PATH="$cx_launch_bin:$PATH" \
+      "$installed_entwurf" codex-app-server --config probe=1 2>&1); then
+    fail "[check-pack-install] installed 'entwurf codex-app-server' FAILED to reach the vendor:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  for want in "ARG<app-server>" "ARG<--listen>" "ARG<unix://$cx_want>" "ARG<--config>" "ARG<probe=1>"; do
+    if ! printf '%s' "$op_out" | grep -qF "$want"; then
+      fail "[check-pack-install] installed 'entwurf codex-app-server' did not hand the vendor the resolved address and argv (missing $want):"
+      echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if printf '%s' "$op_out" | grep -qF 'ARG<codex-app-server>'; then
+    fail "[check-pack-install] installed 'entwurf codex-app-server' leaked the dispatcher verb into the vendor's argv:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed 'entwurf codex-app-server' reached the vendor at the INSTALLED resolver's address ($cx_want)"
+
   # The generation verb must reach its verdict from under node_modules. On the
   # sandbox 0-record agent dir it archives nothing and opens a fresh generation.
   # The exit code alone can't tell a verdict from a fence crash, so read the line.
@@ -5203,6 +5363,49 @@ setup_all() {
     fi
   fi
 
+
+  # ── codex ── Entwurf owns three configuration atoms, never the harness, its app-server, or
+  # the operator's trust decision. The birth unit is now setup's to install: its paths are the
+  # operator's own, so nothing here needs root — but the VENDOR still has to agree to run the
+  # hook, and only the operator can answer that, once, in their own visible Codex. So a first
+  # setup on a Codex host writes the bytes and is honestly NON-GREEN until that answer exists.
+  # It never writes `[hooks.state]`: forging the receipt in a file we already own would turn a
+  # security prompt into a silent install.
+  local codex_rc
+  if ! command -v "${CODEX_BIN:-codex}" >/dev/null 2>&1; then
+    setup_result codex SKIP "codex not on PATH — zero Codex wiring written"
+  else
+    section "codex units (native harness detected: OpenAI Codex CLI)"
+    codex_rc=0; (cd "$REPO_DIR" && bash scripts/codex-birth-install.sh) || codex_rc=$?
+    if [ "$codex_rc" -ne 0 ]; then
+      setup_result codex-birth FAIL "detected codex, but publishing the SessionStart birth unit did not complete (see above)"
+    else
+      codex_rc=0; (cd "$REPO_DIR" && bash scripts/codex-birth-doctor.sh) >/dev/null || codex_rc=$?
+      if [ "$codex_rc" -eq 0 ]; then
+        setup_harness_result codex-birth "SessionStart birth unit published and trusted by the vendor" "./run.sh doctor-codex-birth"
+      else
+        setup_result codex-birth FAIL "the birth unit is published, but the vendor has recorded no trust receipt for it yet, so the hook is declared and never runs. Open a visible plain Codex, answer its prompt with 'Trust all and continue', send one first turn, then re-run setup (or './run.sh doctor-codex-birth')"
+      fi
+    fi
+    codex_rc=0; codex_mcp install || codex_rc=$?
+    if [ "$codex_rc" -eq 0 ]; then
+      setup_harness_result codex-mcp "MCP server registered" "./run.sh doctor-codex-mcp"
+    else
+      setup_result codex-mcp FAIL "detected codex, but the MCP registration did not complete (see above)"
+    fi
+    codex_rc=0; codex_statusline install || codex_rc=$?
+    if [ "$codex_rc" -eq 0 ]; then
+      setup_harness_result codex-statusline "thread-title visible identity enabled" "./run.sh doctor-codex-statusline"
+    else
+      setup_result codex-statusline FAIL "detected codex, but the visible-identity setting did not complete (see above)"
+    fi
+    codex_rc=0; codex_terminal_title install || codex_rc=$?
+    if [ "$codex_rc" -eq 0 ]; then
+      setup_harness_result codex-terminal-title "thread-id terminal title enabled (caller-seat placement input)" "./run.sh doctor-codex-terminal-title"
+    else
+      setup_result codex-terminal-title FAIL "detected codex, but the terminal-title setting did not complete (see above)"
+    fi
+  fi
   # ── core bridge boundary ── deterministic preflight lives in `pnpm run
   # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
   # release-gate <scratch> --cut`. Setup is the install path, so it verifies the
@@ -5707,6 +5910,14 @@ release_gate() {
   # applied from omp onward; it does not retroactively redesign Copilot's operator-metered
   # exclusion.
   run_live_step "smoke-omp-fresh-live (#87 bundle C: entwurf_fresh_call opens omp, exact nonce callback, addressed receive)" gate bash "$self" smoke-omp-fresh-live
+  # #95 first-admission LIVE acceptance. Unlike the older on-demand loaded-thread smoke,
+  # this gate owns all three windows it opens and therefore needs no pre-existing TUI/thread id.
+  # It still does not own the app-server: ENTWURF_CODEX_APP_SERVER_PID explicitly names the
+  # operator-started process, whose /proc TMUX/TMUX_PANE is the only seat authority.
+  # A real initial Pi opens Codex, correlates its callback and addresses it through native-push;
+  # Codex then opens the outbound Pi and correlates that callback. Actor coordinates travel,
+  # and fresh Codex == app-server/MCP inherited session == outbound Pi is a hard check.
+  run_live_step "smoke-codex-fresh-live (#95: visible Pi -> visible Codex/callback/addressed v2 -> visible Pi/callback)" gate bash "$self" smoke-codex-fresh-live
 
   # 4. BEHAVIOR lane (advisory, non-blocking). Model-in-loop gates that probe
   #     whether the model AUTONOMOUSLY drives the MCP entwurf surface. These never
@@ -5873,6 +6084,9 @@ case "$cmd" in
   check-copilot-statusline)
     check_copilot_statusline
     ;;
+  check-codex-app-server-launch)
+    check_codex_app_server_launch
+    ;;
   check-copilot-launch)
     check_copilot_launch
     ;;
@@ -5921,6 +6135,9 @@ case "$cmd" in
   check-entwurf-control-rpc)
     check_entwurf_control_rpc
     ;;
+  check-compaction-send-guard)
+    check_compaction_send_guard
+    ;;
   check-entwurf-v2-production)
     check_entwurf_v2_production
     ;;
@@ -6248,6 +6465,16 @@ case "$cmd" in
     # LIVE!=1. doctor-static preflight FAILs before the agy bridge is wired (③).
     run_ts scripts/smoke-agy-native-push-live.ts
     ;;
+  smoke-codex-native-push-live)
+    # Codex native-push LIVE acceptance. The operator owns both the app-server and visible
+    # attached TUI; this command only proves the shipped record/probe/delivery composition.
+    run_ts scripts/smoke-codex-native-push-live.ts
+    ;;
+  smoke-codex-fresh-live)
+    # First-admission LIVE acceptance: real visible Pi -> Codex -> Pi, using only the
+    # operator-owned app-server explicitly named by ENTWURF_CODEX_APP_SERVER_PID.
+    run_ts scripts/smoke-codex-fresh-live.ts
+    ;;
   smoke-user-scope-citizen)
     # 0.12.6 install-boundary gate: register-pi-package.py is the shared
     # packages[] SSOT for project/user install and remove; user scope makes
@@ -6454,6 +6681,65 @@ case "$cmd" in
     shift || true
     run_ts scripts/omp-receive-facts.ts "$@"
     ;;
+  install-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/codex-birth-install.sh "$@")
+    ;;
+  uninstall-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/codex-birth-uninstall.sh "$@")
+    ;;
+  doctor-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/codex-birth-doctor.sh "$@")
+    ;;
+  install-codex-mcp)
+    codex_mcp install
+    ;;
+  uninstall-codex-mcp)
+    codex_mcp uninstall
+    ;;
+  doctor-codex-mcp)
+    codex_mcp doctor
+    ;;
+  install-codex-statusline)
+    codex_statusline install
+    ;;
+  uninstall-codex-statusline)
+    codex_statusline uninstall
+    ;;
+  doctor-codex-statusline)
+    codex_statusline doctor
+    ;;
+  install-codex-terminal-title)
+    codex_terminal_title install
+    ;;
+  uninstall-codex-terminal-title)
+    codex_terminal_title uninstall
+    ;;
+  doctor-codex-terminal-title)
+    codex_terminal_title doctor
+    ;;
+  codex-socket-path)
+    # #95 INTERNAL: print the Codex app-server default control-socket path for this
+    # environment. It exists because `entwurf codex-app-server` is bash and cannot import
+    # `resolveCodexDefaultSocketPath`; re-deriving that path in bash was MEASURED to diverge
+    # (BOM-only CODEX_HOME, path normalization), so the launcher asks instead of transcribing.
+    # `run_ts` is the crossing (compiled twin when installed, strip-types in a clone), which is
+    # the whole reason this sits in the dispatcher rather than inside the leaf.
+    shift || true
+    run_ts scripts/codex-socket-path.ts "$@"
+    ;;
+  codex-app-server)
+    # #95: the managed app-server SPELLING. Same shape and same reasons as the `copilot`
+    # branch below — `exec`, no subshell and no cd, because this operates on the operator's
+    # own session rather than on the repo, and the `shift` keeps the dispatcher verb out of
+    # the vendor's argv. It is NOT the same KIND of thing: `entwurf copilot` becomes a
+    # sibling-bearing CLI, while this becomes the long-lived server those siblings' MCP
+    # children hang off. Neither one supervises what it becomes.
+    shift || true
+    exec bash "$REPO_DIR/scripts/codex-app-server-launch.sh" "$@"
+    ;;
   copilot)
     # #82 RAIL 7: the managed launch. `exec` and NO subshell/cd on purpose — the vendor
     # must inherit this terminal exactly: the caller's cwd, this pid, this tty, and its own
@@ -6745,6 +7031,34 @@ case "$cmd" in
     # Hermetic (mkdtemp worlds + the store env seam); no model, no network.
     (cd "$REPO_DIR" && bash scripts/check-fresh-cut-gate.sh "$@")
     ;;
+  check-codex-sender-identity)
+    shift || true
+    run_ts scripts/check-codex-sender-identity.ts "$@"
+    ;;
+  check-codex-bridge-identity)
+    shift || true
+    run_ts scripts/check-codex-bridge-identity.ts "$@"
+    ;;
+  check-codex-native-push)
+    shift || true
+    run_ts scripts/check-codex-native-push.ts "$@"
+    ;;
+  check-codex-birth-hook)
+    shift || true
+    run_ts scripts/check-codex-birth-hook.ts "$@"
+    ;;
+  check-codex-fresh-preflight)
+    shift || true
+    (cd "$REPO_DIR" && pnpm exec vitest run test/codex-fresh-preflight.test.ts "$@")
+    ;;
+  smoke-codex-config-state)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/smoke-codex-config-state.sh "$@")
+    ;;
+  smoke-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/smoke-codex-birth.sh "$@")
+    ;;
   check-pack)
     check_pack
     ;;