@junghanacs/entwurf 0.20.1 → 0.22.0

package/scripts/raw-codex-measure/README.md

@@ -4,10 +4,10 @@ Lane: `docs/adding-a-harness.md` step 1 (six measurements) + §3.5 citizen scope
 tool-name dialect + step 6's join. The oracle is the vendor artifact or the vendor process,
 never our assembler.
 
-This file is a MEASUREMENT-ONLY ledger. Nothing here was written by an entwurf installer,
-no meta-record was minted, and no operator config was edited. The one entwurf-owned artifact
-touched at all is the pre-existing `[mcp_servers.entwurf-bridge]` entry in the operator's own
-`~/.codex/config.toml`, which was READ, not written.
+This file is a MEASUREMENT-ONLY ledger of the **2026-09-08 step-1 state**. At that
+measurement date, nothing here had been written by an Entwurf Codex installer, no
+Codex meta-record had been minted, and no operator config had been edited. Later #95
+candidate work exists; this dated ledger is evidence for it, not current product status.
 
 Evidence-state vocabulary: **[source]** = read at `file:line` in the vendor checkout;
 **[host]** = measured on this host (`oracle`, 2026-09-08 KST) with the receipt named;
@@ -207,11 +207,11 @@ it carried is what S1b-B was run to settle.)*
 (`thread/queue/add|start|list|…`) that did not exist at 0.136. No hook or extension wake
 surface was added (see M1). The measured route is unchanged and green: **M-B** below.
 
-## M5 — Parent process topology (the step-6 join)
+## M5 — Parent process topology (measured refutation of a universal join)
 
-The join `docs/adding-a-harness.md` step 6 requires is `hook.ppid == mcp.ppid == the harness
-host pid`. **It holds on Codex — but WHICH process is the host depends on the launch mode, and
-that difference is the finding.**
+The then-current `docs/adding-a-harness.md` step 6 asked whether
+`hook.ppid == mcp.ppid == harness host pid`. The measurement below preserves the
+answer and explains why that equality is not a universal sender-identity contract.
 
 **Embedded mode** (a standalone `codex` TUI with its own `CODEX_HOME`, no app-server):
 
@@ -240,23 +240,20 @@ pid=1733 (entwurf-bridge) ppid=1393   # 1393 = codex app-server --listen
 pid=1616                              # = the plain codex TUI. Not the parent.
 ```
 
-So in the delivery-capable mode the join still holds — `hook.ppid == mcp.ppid` — but both
-resolve to the app-server.
+In the delivery-capable mode, `hook.ppid == mcp.ppid`, but both resolve to the
+app-server rather than to an attached TUI.
 
-**That the app-server is SHARED across citizens was an inference in the first draft, and it
-was published without a label.** `[source]` supports it
-(`app-server/src/request_processors/initialize_processor.rs:63-68` is a multi-client
-shared-thread surface), but the run above shows the parent of ONE attached TUI; reading N from
-one is not a measurement. Independent audit (terra, 2026-09-08) caught the missing label.
-**It has since been measured directly — see S1b-C below — and the answer is the one the
-inference guessed:** two live threads on one app-server, two separate visible TUIs, and every
-hook and every MCP child of BOTH threads reports the same `ppid`.
+The first draft inferred that this app-server was shared across citizens. Independent
+audit caught the missing evidence label; **S1b-C** then measured it directly: two live
+threads, two visible TUIs, and every hook/MCP child of both threads reported the same
+parent pid.
 
-**[host]** So this is now a measured fact rather than a structural read: **a sender marker
-keyed by parent pid would be one marker for N citizens**, which is precisely the uniqueness the
-V3 store contract (Hard Rule 7, `nativeSessionId` ownership) forbids. **This is the
-load-bearing result of the whole step**, and it is a design input for step 6, not a defect to
-fix here.
+That is the result: a parent-pid marker would be one marker for N Codex citizens. The
+topology is useful negative evidence, not the Codex join. **S1b-D** found the
+vendor-authoritative alternative on each MCP request, and the current candidate strictly
+joins that request metadata to `record.nativeSessionId`. Other measured harnesses still
+use pid/start-key markers where their vendor topology makes that carrier authoritative;
+the general doctrine is the vendor-authoritative record join.
 
 **[host]** A second consequence, measured on the same two runs: the hook's environment is the
 HOST process's snapshot, so it changes with the mode.
@@ -646,11 +643,11 @@ identifier**, and `record.nativeSessionId = threadId` needs no mapping layer. Th
 `nativeIdLabel: "threadId"` in `pi/entwurf-capabilities.json` is, on this axis, correct — which
 is worth saying precisely, because its `deliveryLevel: "D6"` on the same row still is not.
 
-**What this changes.** The step-6 question "who sent this?" does not need a parent-pid marker on
-codex, and the answer S1b-C ruled out was the wrong shape rather than a dead end: the caller is
-named on every call. `[source]` today's bridge reads a `PI_SESSION_ID`/`PI_AGENT_ID` pair or a
-native marker looked up by parent pid, and neither exists here — so consuming `_meta` would be
-new bridge code. **That is step 6, and nothing here implements it.**
+**What this changed on 2026-09-08.** The step-6 question did not need a parent-pid
+marker on Codex: every call named the thread. At that measurement date the bridge only
+read a complete pi env pair or a native pid marker, so consuming `_meta` still required
+new code. The later #95 candidate implements a strict request-metadata join; that later
+implementation is not evidence supplied by this ledger.
 
 One vendor fact this run also surfaced, recorded because it belongs to step 9 clause 2: the
 first `tools/call` raised an interactive approval prompt —
@@ -660,24 +657,95 @@ beside the model-facing `mcp__entwurf_bridge__entwurf_peers`. Copilot's "one too
 lesson repeats here. `entwurf_peers` itself answered from that session, which is the plain
 external-MCP-host row of `docs/external-mcp-host.md` behaving as designed.
 
-## What this measurement does NOT establish
-
-- The source layer WAS independently audited on 2026-09-08 (terra, on commit `87ac7ad`):
-  **20/20 quotations CONFIRMED, 0 corrected, 0 unverifiable**, tag identity re-derived
-  independently (`rust-v0.153.4^{}` = `3d2ee51ca2d5db578f328aa75e20aa22c0197c9a`). Three prose
-  defects it raised are folded in above and marked as corrections; none was a wrong vendor
-  fact. The S1b-* sections were added AFTER that audit and carry no second reader yet.
-- Evidence level L4 at best: one Linux host (`oracle`, aarch64, NixOS), one CLI version, one
-  run per claim except M-B (three runs).
-- **No entwurf unit was built or installed.** No record, no hook, no marker, no doctor.
-  Steps 3–10 are untouched by design; this ledger is step 1 only.
-- **Step 2 is a pre-existing surprise, not this lane's work, and it is wrong.** `codex` is
-  ALREADY in `META_BACKENDS` (`pi-extensions/lib/meta-session.ts:84`) and
-  `META_CITIZEN_BACKENDS` (`:308`), and `pi/entwurf-capabilities.json` grades it
-  `wakeMode: "direct-inject"`, `deliveryLevel: "D6"`, `nativeIdLabel: "threadId"` — a grade
-  with no channel behind it, the exact failure `docs/adding-a-harness.md` step 8(c) names.
-  It is also the declared pre-#82 legacy exception `check-harness-admission-parity` reads out
-  of `DELIVERY.md`. Nothing here changes it; a reader should not take that D6 as evidence.
+## S1c — vendor queue and visible-fresh argv (2026-09-10)
+
+Codex 0.153.4 has the narrow delivery primitive this lane was missing:
+
+```sh
+codex queue \
+  --remote unix://$SOCKET \
+  --thread 01a08bb0-999a-71b2-be36-357eedc26542 \
+  --message 'Reply exactly CODEX-QUEUE-Q1'
+```
+
+The command exited 0 and printed one explicit acceptance receipt:
+
+```text
+Queued message 01a08bb2-c70f-75f3-88c6-48cdffa4d64d for thread 01a08bb0-999a-71b2-be36-357eedc26542.
+```
+
+The attached TUI produced `CODEX-QUEUE-Q1`. A second run queued a turn that executed
+`sleep 12`; a third message was queued immediately while that turn was active. The CLI returned
+two different message ids, and the TUI completed `CODEX-QUEUE-Q2` before
+`CODEX-QUEUE-Q3`. **The vendor owns queue serialization and message identity.** Entwurf should
+exec this command once and validate its receipt; it should not recreate `turn/start`, a second
+queue, or an idempotency ledger. A nonexistent thread exited 1 with
+`thread/queue/add failed: failed to read thread: invalid thread-store request: no rollout found`
+and no acceptance receipt.
+
+The ordinary pnpm-installed binary also owns the usable app-server shape:
+
+```sh
+codex app-server --listen unix://$SOCKET
+```
+
+It created a mode-0600 UDS and served WebSocket JSON-RPC. By contrast,
+`codex app-server daemon start` refused this installation because its managed-daemon path
+requires `~/.codex/packages/standalone/current/codex`. Entwurf must not install that separate
+vendor runtime or hide this distinction behind a wrapper: the lightweight contract is to
+detect one already-running ordinary app-server at the fixed vendor socket.
+
+The complete fresh argv was then exercised against that app-server:
+
+```sh
+codex \
+  --remote unix://$SOCKET \
+  --model gpt-5.6-sol \
+  --dangerously-bypass-approvals-and-sandbox \
+  --no-alt-screen \
+  'Call mcp__entwurf_bridge__entwurf_peers as your first action …'
+```
+
+The visible TUI reported `gpt-5.6-sol high` and `YOLO`; MCP startup completed; the first turn
+called `entwurf-bridge.entwurf_peers` successfully. `--no-alt-screen` was only an observation
+aid and is not part of the launch contract. The fixed launch facts are `--remote`, explicit
+`--model`, the explicit task-wide permission token, and one positional first prompt. Unlike the
+OMP race, the Codex MCP tool was callable on that first turn.
+
+The same socket accepted
+`thread/name/set {threadId,name:"20260910T235959-codex"}` with `{}` and the attached TUI
+immediately rendered `Session renamed to 20260910T235959-codex`; a second call restored the
+captured preimage `Entwirf raw queue probe Q1`. This closes the naming primitive only. The
+current footer did not include `thread-title`, so the separate user-config atom remains necessary
+before a garden id is continuously visible.
+
+One lifecycle caveat is now bounded rather than hidden. Closing a TUI client does not
+immediately remove its thread from `thread/loaded/list`; the vendor keeps a loaded thread after
+the last subscriber disconnects and unloads it after 30 minutes without subscribers or thread
+activity (`app-server/README.md`, `thread/unsubscribe`). During that vendor-owned loaded lifetime
+`codex queue` remains the acceptance boundary. This is not a pane/process liveness claim and must
+not be re-described as one.
+
+These observations make 0.153.4 the first measured coordinate, **not a hard product floor**.
+No silent older-version failure has been measured, so Entwurf should report drift and fail a
+missing capability, not invent a lower-bound promise.
+
+## What this dated measurement did NOT establish
+
+- The source layer was independently audited on 2026-09-08 (terra, commit `87ac7ad`):
+  **20/20 quotations CONFIRMED**. The later S1b sections had no second reader then.
+- Evidence was L4 at best: one Linux host (`oracle`, aarch64, NixOS), Codex 0.153.4,
+  one run per claim except M-B.
+- **As of the 2026-09-08 measurement**, no Entwurf Codex unit had been built or
+  installed, no product record/doctor existed, and steps 3–10 were untouched by that
+  lane. These are historical scope statements, not claims about the later candidate.
+- Step 2 was already present but unearned at that date: registry/capability rows named
+  Codex before a production channel existed. Later #95 code supplies the candidate
+  record/native-push/fresh path; its parser, env-boundary, setup, preflight, and clause-7
+  amendments plus deep/installed-host acceptance are outside this raw ledger.
+- The hook-trust and visible-name questions were closed by S1b-A/B. The remaining
+  release evidence is owned by the current candidate's gates and actual host, not by
+  reinterpreting these measurements.
 - *(Two entries lived here until 2026-09-08 and are now **closed by measurement**, not moved:
   "clause 4 has no working candidate" was retired by **S1b-B**, and "the hook trust gate has no
   measured non-interactive path" by **S1b-A**. What each one costs is stated in its section.)*

package/scripts/smoke-agy-native-push-live.ts

@@ -128,9 +128,11 @@ async function main(): Promise<void> {
 	try {
 		// ── 1. probe the REAL conversation directly (route diagnostics; proves the live host) ──
 		const probe = await antigravityAdapter.probe(conversationId);
-		if (probe.status === "alive") {
+		if (probe.status === "alive" && probe.route.backend === "antigravity") {
 			artifacts["route"] = probe.route.lsAddress;
 			console.log(`  ..    probe: alive via ${probe.route.lsAddress}`);
+		} else if (probe.status === "alive") {
+			artifacts["probe"] = `alive with unexpected ${probe.route.backend} route`;
 		} else {
 			artifacts["probe"] = `${probe.status}: ${probe.reason}`;
 		}

package/scripts/smoke-codex-birth.sh

@@ -0,0 +1,347 @@
+#!/usr/bin/env bash
+# smoke-codex-birth — hermetic install/doctor/inverse contract for the Codex
+# birth unit. No Codex process, no model turn, no host path: HOME, XDG_DATA_HOME and
+# CODEX_HOME are all sandboxed, so every byte this gate judges was written inside the fixture.
+#
+# The five things it exists to prove, none of which a reading of the script can establish:
+#   1. the published declaration is the EXACT trust identity (matcher-less, type/command/
+#      timeout, quoted fixed launcher path) — because that identity is what an operator
+#      approves once, and any drift in it costs a second approval;
+#   2. config.toml is neither read nor written, so the vendor's [hooks.state] and entwurf's
+#      own two user atoms survive install AND inverse byte-for-byte;
+#   3. a foreign or edited hooks.json is a ZERO-WRITE refusal, never an adoption — this unit
+#      owns the file whole, so adopting one would delete somebody else's hooks;
+#   4. the inverse removes exactly what the state vouches for, and REFUSES a drifted path
+#      instead of deleting an edit nobody can read back;
+#   5. the doctor never claims the vendor's trust decision as its own green.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+INSTALL="$REPO_DIR/scripts/codex-birth-install.sh"
+UNINSTALL="$REPO_DIR/scripts/codex-birth-uninstall.sh"
+DOCTOR="$REPO_DIR/scripts/codex-birth-doctor.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+safe_umask_fail() { die "[QK:CODEX-BIRTH-INSTALL-SAFE-UMASK] $1"; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+refuses() { # <label> <expected-substring-on-stderr> <cmd...>
+  local label="$1" needle="$2"; shift 2
+  local err rc=0
+  err="$("$@" 2>&1 >/dev/null)" || rc=$?
+  [ "$rc" -ne 0 ] && printf '%s' "$err" | grep -q "$needle" || die "$label (rc=$rc, stderr: $err)"
+  ok "$label"
+}
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export CODEX_HOME="$HOME/.codex"
+export PYTHONDONTWRITEBYTECODE=1
+mkdir -p "$CODEX_HOME" "$XDG_DATA_HOME"
+
+HOOKS="$CODEX_HOME/hooks.json"
+CFG="$CODEX_HOME/config.toml"
+UNIT_ROOT="$XDG_DATA_HOME/entwurf/codex-birth"
+HELPER="$UNIT_ROOT/helper"
+LAUNCHER="$HELPER/codex-birth-launch.sh"
+STATE="$UNIT_ROOT/install-state.json"
+
+seed_config() { # an operator config that ALREADY carries entwurf's two user atoms and the
+  # vendor's own hook-trust state — the exact shape this unit must never touch.
+  cat > "$CFG" <<'EOF'
+model = "gpt-5.6-luna"
+approval_policy = "never"
+[tui]
+status_line = ["thread-title", "model-with-reasoning", "current-dir"]
+theme = "zenburn"
+[hooks.state."/sandbox/.codex/hooks.json:session_start:0:0"]
+trusted_hash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+[mcp_servers.entwurf-bridge]
+command = "entwurf-bridge"
+EOF
+}
+seed_config
+cp "$CFG" "$SB/config.before.toml"
+
+###############################################################################
+# install — the declaration, the closure, and the state
+###############################################################################
+"$INSTALL" >"$SB/out" 2>&1 || die "install failed: $(cat "$SB/out")"
+want "install reports success" "grep -q '^\[codex-birth-install\] installed$' '$SB/out'"
+want "the declaration exists as a regular file" "[ -f '$HOOKS' ] && [ ! -L '$HOOKS' ]"
+want "the launcher is published and executable" "[ -f '$LAUNCHER' ] && [ -x '$LAUNCHER' ]"
+want "the closure is published whole" "[ -f '$HELPER/meta-bridge-hook-codex.ts' ] && [ -f '$HELPER/lib/meta-session.ts' ] && [ -f '$HELPER/lib/native-push/codex-ws-client.ts' ] && [ -f '$HELPER/lib/session-id.js' ] && [ -f '$HELPER/entwurf-capabilities.json' ]"
+want "the state is a regular non-symlink file" "[ -f '$STATE' ] && [ ! -L '$STATE' ]"
+want "the state is bound to the fixed paths and finished publishing" \
+  "node -e 'const s=require(process.argv[1]); if(s.schema!==\"codex-birth-install-state/v1\")throw 0; if(s.status!==\"installed\")throw 0; if(s.hooksFile!==process.argv[2])throw 0; if(s.helperDir!==process.argv[3])throw 0;' '$STATE' '$HOOKS' '$HELPER'"
+want "the state records a digest for every published byte" \
+  "node -e 'const s=require(process.argv[1]); const hex=v=>/^[0-9a-f]{64}\$/.test(v); if(!hex(s.hooksSha256))throw 0; if(s.helperFiles.length!==6)throw 0; for(const f of s.helperFiles){if(!hex(f.sha256))throw 0;}' '$STATE'"
+
+# The trust identity, asserted field by field. This is the cell that costs a second operator
+# approval if it ever drifts, so it is checked literally rather than by shape.
+want "the declaration is the EXACT trust identity (matcher-less, type/command/timeout, quoted fixed launcher)" \
+  "node -e '
+    const f=require(process.argv[1]);
+    if(Object.keys(f).sort().join(\",\")!==\"description,hooks\")throw new Error(\"top level\");
+    if(Object.keys(f.hooks).join(\",\")!==\"SessionStart\")throw new Error(\"events\");
+    const g=f.hooks.SessionStart; if(g.length!==1)throw new Error(\"groups\");
+    if(\"matcher\" in g[0])throw new Error(\"matcher present\");
+    if(Object.keys(g[0]).join(\",\")!==\"hooks\")throw new Error(\"group keys\");
+    if(g[0].hooks.length!==1)throw new Error(\"handlers\");
+    const h=g[0].hooks[0];
+    if(Object.keys(h).sort().join(\",\")!==\"command,timeout,type\")throw new Error(\"handler keys\");
+    if(h.type!==\"command\"||h.timeout!==30)throw new Error(\"type/timeout\");
+    if(h.command!==\"'\"'\"'\"+process.argv[2]+\"'\"'\"'\")throw new Error(\"command \"+h.command);
+  ' '$HOOKS' '$LAUNCHER'"
+want "the declaration carries no trust key of any kind" "! grep -qi 'trusted_hash\|hooks.state' '$HOOKS'"
+want "the launcher bakes a resolved absolute node and execs the published payload" \
+  "grep -qE '^NODE_BIN=\"/' '$LAUNCHER' && grep -q 'PAYLOAD=\"$HELPER/meta-bridge-hook-codex.ts\"' '$LAUNCHER' && grep -q '^exec \"\$NODE_BIN\" --experimental-strip-types' '$LAUNCHER'"
+
+# config.toml — the file the vendor keeps [hooks.state] in, and the one entwurf's other two
+# user atoms own. This unit must not have opened it for writing at all.
+cmp -s "$SB/config.before.toml" "$CFG" && ok "install left config.toml byte-identical (vendor trust state and entwurf atoms intact)" || die "install modified config.toml"
+
+###############################################################################
+# TRUST — the vendor's receipt, read and never written
+#
+# The bytes being ours is half the verdict. The other half belongs to the operator: until
+# the vendor records their one-time "Trust all" for THIS declaration identity, the hook is
+# declared and never runs, and a doctor that called that green would sell a birth nobody
+# will ever have. The sandbox has no vendor, so the receipt is forged here as a FIXTURE —
+# what is under test is the reading, never the deciding.
+###############################################################################
+# The seed already carries a receipt for SOMEBODY ELSE's declaration — the honest starting
+# shape on a host whose operator has trusted other hooks before. It is not ours.
+"$DOCTOR" >"$SB/out" 2>&1 && die "[QK:CODEX-BIRTH-DOCTOR-REQUIRES-TRUST] the doctor was green with no vendor trust receipt for THIS declaration"
+want "a receipt at a foreign key is refused by name" "grep -q \"NONE at this unit's key\" '$SB/out'"
+want "the red carries the operator instruction, not a repair this unit could do" \
+  "grep -q \"open a visible plain Codex\" '$SB/out' && grep -q \"Trust all and continue\" '$SB/out'"
+# ...and with no [hooks.state] at all the refusal names that instead of guessing.
+grep -v '^\[hooks.state' "$SB/config.before.toml" | grep -v '^trusted_hash' > "$CFG"
+"$DOCTOR" >"$SB/out" 2>&1 && die "the doctor was green with no [hooks.state] table at all"
+want "trust-absent is red and says which table is missing" "grep -q 'no vendor trust receipt for this declaration' '$SB/out' && grep -q 'no \[hooks.state\] table' '$SB/out'"
+cp "$SB/config.before.toml" "$CFG"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 || safe_umask_fail "--unit-only should be green on intact bytes: $(cat "$SB/out")"
+want "--unit-only reports the trust axis as SKIPPED, never as green" \
+  "grep -q 'the TRUST axis was skipped' '$SB/out' && grep -q 'This is a skipped axis, not a green one' '$SB/out'"
+
+trust_receipt() { # $1 = the key to write a well-formed receipt under
+  cp "$SB/config.before.toml" "$CFG"
+  printf '\n[hooks.state."%s"]\ntrusted_hash = "sha256:%s"\n' "$1" "4647c53b6948cd38f2283a3fdf63e40e83b7ff29ecf14650b7e61eec9315e1cc" >> "$CFG"
+}
+trust_receipt "$HOOKS:session_start:0:0"
+sed -i 's/^trusted_hash = .*/trusted_hash = "not-a-digest"/' "$CFG"
+"$DOCTOR" >"$SB/out" 2>&1 && die "a malformed trusted_hash was accepted"
+want "a malformed trusted_hash is refused by shape" "grep -q 'trusted_hash is not sha256:<64 hex>' '$SB/out'"
+trust_receipt "$HOOKS:session_start:0:0"
+cp "$CFG" "$SB/config-trusted.toml"
+"$DOCTOR" >"$SB/out" 2>&1 || die "the doctor should be green once the vendor receipt is present: $(cat "$SB/out")"
+want "the full doctor is green with unit bytes AND the vendor receipt" \
+  "grep -q 'the vendor trust receipt is present for this declaration' '$SB/out'"
+want "the green is worded as a vendor RECEIPT, never as a validated hash" \
+  "grep -q 'not a cryptographic validation' '$SB/out' && ! grep -qi 'valid trust\|verified hash' '$SB/out'"
+cmp -s "$SB/config-trusted.toml" "$CFG" && ok "reading the receipt wrote nothing back to the vendor config" || die "the doctor modified config.toml"
+cp "$SB/config.before.toml" "$CFG"
+
+###############################################################################
+# idempotence — the strongest form is an untouched file
+###############################################################################
+MT1="$(stat -c %Y "$HOOKS")"; sleep 1.1
+"$INSTALL" >"$SB/out" 2>&1 || die "reinstall failed: $(cat "$SB/out")"
+MT2="$(stat -c %Y "$HOOKS")"
+want "reinstall does not rewrite the declaration" "[ '$MT1' = '$MT2' ]"
+want "reinstall adopts its own published declaration by digest" "grep -q 'adopting the hooks.json this unit published' '$SB/out'"
+cmp -s "$SB/config.before.toml" "$CFG" && ok "reinstall still left config.toml byte-identical" || die "reinstall modified config.toml"
+
+###############################################################################
+# reinstall over an edited closure — a REFUSAL, never a silent repair
+#
+# The declaration is licensed by digest; the closure must be too, and for a sharper
+# reason: publishing a new generation copies over these exact paths, so a member that
+# drifted is somebody's edit that a `cp` would destroy with no trace. The unit repairs
+# only what it can prove it wrote, so present-and-different stops the whole publish and
+# every byte — hooks.json, helper members, state — must come out unchanged.
+###############################################################################
+cp "$HOOKS" "$SB/pre-drift-hooks.json"
+cp "$STATE" "$SB/pre-drift-state.json"
+cp "$LAUNCHER" "$SB/pre-drift-launcher.sh"
+printf '# operator edit\n' >> "$LAUNCHER"
+cp "$LAUNCHER" "$SB/drifted-launcher.sh"
+DRIFT_ERR="$("$INSTALL" 2>&1 >/dev/null)" && die "[QK:CODEX-BIRTH-REINSTALL-REFUSES-CLOSURE-DRIFT] reinstall over an edited launcher was ACCEPTED instead of refused"
+ok "reinstall over an edited launcher is refused, not silently repaired"
+printf '%s' "$DRIFT_ERR" | grep -qE "$LAUNCHER was edited after install \(live [0-9a-f]{64}, recorded [0-9a-f]{64}\)" \
+  && ok "the refusal names the exact drifted path and both digests" \
+  || die "the refusal did not name the path and both digests: $DRIFT_ERR"
+cmp -s "$SB/drifted-launcher.sh" "$LAUNCHER" && ok "the edited launcher survives the refused reinstall byte-for-byte" || die "the refused reinstall overwrote the edited launcher"
+cmp -s "$SB/pre-drift-hooks.json" "$HOOKS" && ok "the refused reinstall left the declaration byte-identical" || die "the refused reinstall rewrote hooks.json"
+cmp -s "$SB/pre-drift-state.json" "$STATE" && ok "the refused reinstall left the ownership state byte-identical" || die "the refused reinstall rewrote the state"
+cmp -s "$SB/config.before.toml" "$CFG" && ok "the refused reinstall left config.toml byte-identical" || die "the refused reinstall modified config.toml"
+
+# A drifted PAYLOAD member is the same refusal — the rule is the inventory, not the launcher.
+cp "$SB/pre-drift-launcher.sh" "$LAUNCHER"
+printf '// operator edit\n' >> "$HELPER/meta-bridge-hook-codex.ts"
+refuses "reinstall over an edited closure member is refused too" "meta-bridge-hook-codex.ts was edited after install" "$INSTALL"
+want "the drifted payload is still there" "[ -f '$HELPER/meta-bridge-hook-codex.ts' ]"
+
+# ...and an ABSENT member is not drift: a publish interrupted after the state write must
+# stay repairable by the same command, exactly as the inverse calls an absent path done.
+rm -f "$HELPER/meta-bridge-hook-codex.ts"
+"$INSTALL" >"$SB/out" 2>&1 || die "reinstall should REPAIR an absent closure member: $(cat "$SB/out")"
+want "an absent closure member is republished, not refused" "grep -q 'closure member absent, will be republished' '$SB/out' && [ -f '$HELPER/meta-bridge-hook-codex.ts' ]"
+"$DOCTOR" --unit-only >/dev/null 2>&1 || die "the unit axis should be green again after the repair"
+ok "the unit axis is green again after the absent member was republished"
+
+###############################################################################
+# refusals — a foreign file, an edited file, a symlink; each ZERO-WRITE
+###############################################################################
+"$UNINSTALL" >/dev/null 2>&1 || die "clean uninstall before the refusal cells failed"
+printf '{"hooks":{"SessionStart":[{"hooks":[{"type":"command","command":"/opt/operator/own-hook.sh","timeout":10}]}]}}\n' > "$HOOKS"
+cp "$HOOKS" "$SB/foreign-hooks.json"
+refuses "[QK:CODEX-BIRTH-FOREIGN-HOOKS-REFUSED] a foreign hooks.json is refused, not adopted" "already exists and this host has NO entwurf ownership state" "$INSTALL"
+cmp -s "$SB/foreign-hooks.json" "$HOOKS" && ok "the foreign declaration survives the refusal byte-for-byte" || die "the foreign hooks.json was overwritten"
+want "the foreign refusal wrote no state and no helper" "[ ! -e '$STATE' ] && [ ! -e '$HELPER' ]"
+rm -f "$HOOKS"
+
+ln -s "$SB/foreign-hooks.json" "$HOOKS"
+refuses "a symlinked hooks.json is refused" "is a SYMLINK" "$INSTALL"
+want "the symlink refusal wrote no state" "[ ! -e '$STATE' ] && [ -L '$HOOKS' ]"
+rm -f "$HOOKS"
+
+"$INSTALL" >/dev/null 2>&1 || die "install before the edited-declaration cell failed"
+printf '\n' >> "$HOOKS"
+cp "$HOOKS" "$SB/edited-hooks.json"
+refuses "an edited declaration is refused instead of republished" "was edited after install" "$INSTALL"
+cmp -s "$SB/edited-hooks.json" "$HOOKS" && ok "the edited declaration survives the refusal byte-for-byte" || die "the edited hooks.json was overwritten"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "the unit axis should be red while the declaration is edited"
+want "the doctor names the edited declaration" "grep -q 'was EDITED after install' '$SB/out'"
+
+###############################################################################
+# inverse — exact removal, and a refusal that leaves drift in place
+###############################################################################
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse should refuse while the declaration is drifted"
+want "the inverse refuses the drifted declaration" "grep -q 'DRIFT: the declaration was edited after install' '$SB/out'"
+want "the drifted declaration is LEFT IN PLACE" "[ -f '$HOOKS' ]"
+want "the inverse keeps the state so a later run can still license the path" "[ -f '$STATE' ]"
+cmp -s "$SB/edited-hooks.json" "$HOOKS" && ok "the drifted declaration is byte-identical after the refused inverse" || die "the refused inverse changed the drifted file"
+
+cp "$SB/edited-hooks.json" "$SB/keep.json"
+rm -f "$HOOKS"
+"$INSTALL" >/dev/null 2>&1 || die "reinstall after clearing the drift failed"
+printf '# operator edit\n' >> "$LAUNCHER"
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse should refuse while the launcher is drifted"
+want "the inverse refuses a drifted helper member by digest" "grep -q 'DRIFT: helper member was edited after install' '$SB/out'"
+want "the drifted launcher is LEFT IN PLACE" "[ -f '$LAUNCHER' ]"
+want "the declaration it already removed is gone, and the state remains" "[ ! -e '$HOOKS' ] && [ -f '$STATE' ]"
+
+rm -f "$LAUNCHER"
+"$INSTALL" >/dev/null 2>&1 || die "reinstall before the exact-inverse cell failed"
+"$UNINSTALL" >"$SB/out" 2>&1 || die "the exact inverse failed: $(cat "$SB/out")"
+want "the inverse removed the declaration" "[ ! -e '$HOOKS' ]"
+want "the inverse removed the helper closure and its directory" "[ ! -e '$HELPER' ]"
+want "the inverse removed its own state" "[ ! -e '$STATE' ]"
+want "the inverse says config.toml was never touched" "grep -q 'config.toml was neither read nor written' '$SB/out'"
+cmp -s "$SB/config.before.toml" "$CFG" && ok "the full install/inverse cycle left config.toml byte-identical" || die "the cycle modified config.toml"
+# An absent unit is RED, not a note. A host that trusted an OLDER declaration still carries a
+# vendor receipt, so a doctor that shrugged at "nothing installed" could report green over an
+# empty unit on the strength of somebody else's approval — measured exactly that way once.
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "[QK:CODEX-BIRTH-DOCTOR-ABSENT-IS-RED] the unit axis was green with NOTHING installed"
+want "an absent unit is named as red, not as an informational note" "grep -q 'no Codex birth unit is installed here' '$SB/out'"
+trust_receipt "$HOOKS:session_start:0:0"
+"$DOCTOR" >"$SB/out" 2>&1 && die "a stale vendor receipt made an ABSENT unit green"
+want "a stale receipt cannot carry an absent unit" "grep -q 'no Codex birth unit is installed here' '$SB/out'"
+cp "$SB/config.before.toml" "$CFG"
+
+###############################################################################
+# unsafe paths — ownership the unit cannot vouch for
+###############################################################################
+"$INSTALL" >/dev/null 2>&1 || die "install before the unsafe-path cell failed"
+chmod 0777 "$HELPER"
+refuses "a group/world-writable helper directory is refused" "group/world-writable" "$INSTALL"
+chmod 0755 "$HELPER"
+chmod 0666 "$STATE"
+refuses "a group/world-writable ownership state cannot license anything" "group/world-writable" "$INSTALL"
+refuses "the inverse refuses the same unsafe state" "group/world-writable" "$UNINSTALL"
+chmod 0644 "$STATE"
+"$UNINSTALL" >/dev/null 2>&1 || die "final cleanup uninstall failed"
+
+###############################################################################
+# a hostile umask, a short inventory, and a relative root
+###############################################################################
+# `umask 000` is the operator's shell, not our decision. A directory published under it that
+# anyone can rewrite would let a third party swap the launcher between the digest we record
+# and the exec codex performs — the closure would still match its state and still be somebody
+# else's code.
+rm -rf "$CODEX_HOME/hooks.json" "$UNIT_ROOT"
+( umask 000; "$INSTALL" >/dev/null 2>&1 ) || die "install under umask 000 failed"
+UNSAFE_DIRS="$(find "$XDG_DATA_HOME" "$CODEX_HOME" -type d -perm /022 2>/dev/null || true)"
+[ -z "$UNSAFE_DIRS" ] && ok "every directory published under umask 000 is non-group/world-writable" \
+  || safe_umask_fail "umask 000 published writable directories: $UNSAFE_DIRS"
+want "the published files are not group/world-writable either" \
+  "[ -z \"\$(find '$UNIT_ROOT' -type f -perm /022 2>/dev/null)\" ] && [ ! -w /dev/null -o -z \"\$(find '$HOOKS' -perm /022 2>/dev/null)\" ]"
+
+# The inventory IS the authority. A state naming only the launcher would leave the payload
+# unlisted: nothing could reclaim it, and nothing would judge it.
+python3 - "$STATE" <<'PY_INV'
+import json, sys
+s = json.load(open(sys.argv[1]))
+s["helperFiles"] = [f for f in s["helperFiles"] if f["path"] == "codex-birth-launch.sh"]
+open(sys.argv[1], "w").write(json.dumps(s))
+PY_INV
+printf '// unlisted\n' >> "$HELPER/meta-bridge-hook-codex.ts"
+refuses "[QK:CODEX-BIRTH-EXACT-CLOSURE-INVENTORY] a short closure inventory is refused by the installer" "exact six members" "$INSTALL"
+want "the unlisted payload survives that refusal" "grep -q '^// unlisted$' '$HELPER/meta-bridge-hook-codex.ts'"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "the doctor accepted a short closure inventory"
+want "the doctor names the missing inventory members" "grep -q 'recorded closure inventory is missing' '$SB/out'"
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse accepted a short closure inventory"
+want "the inverse refuses and removes NOTHING" \
+  "grep -q 'exact six members' '$SB/out' && [ -f '$HOOKS' ] && [ -f '$HELPER/meta-bridge-hook-codex.ts' ] && [ -f '$STATE' ]"
+rm -rf "$CODEX_HOME/hooks.json" "$UNIT_ROOT"
+
+# An unknown status is not a receipt, however well its digests match. `publishing` is the one
+# interrupted generation the installer knows how to finish; anything else is a state this unit
+# never wrote, and adopting it would let a stranger's file license our next publish.
+"$INSTALL" >/dev/null 2>&1 || die "install before the status cell failed"
+python3 -c 'import json,sys; s=json.load(open(sys.argv[1])); s["status"]="garbage"; open(sys.argv[1],"w").write(json.dumps(s))' "$STATE"
+cp "$STATE" "$SB/garbage-state.json"; cp "$HOOKS" "$SB/garbage-hooks.json"
+refuses "[QK:CODEX-BIRTH-INSTALL-REFUSES-UNKNOWN-STATUS] a state in an unknown status is refused even with exact digests" "unknown state status" "$INSTALL"
+want "that refusal wrote nothing" \
+  "cmp -s '$SB/garbage-state.json' '$STATE' && cmp -s '$SB/garbage-hooks.json' '$HOOKS'"
+# ...while the interrupted generation the installer DOES define is still repairable.
+python3 -c 'import json,sys; s=json.load(open(sys.argv[1])); s["status"]="publishing"; open(sys.argv[1],"w").write(json.dumps(s))' "$STATE"
+"$INSTALL" >/dev/null 2>&1 || die "an interrupted `publishing` state should be finishable, not refused"
+want "the finished publish records installed" "grep -q '\"status\": \"installed\"' '$STATE'"
+
+# The directory holding the receipt carries the receipt's authority. Children untouched: what
+# changed is only who may replace the inventory every digest is compared against.
+chmod 0777 "$UNIT_ROOT"
+refuses "[QK:CODEX-BIRTH-STATE-PARENT-AUTHORITY] reinstall refuses a unit root anyone can rewrite" "group/world-writable" "$INSTALL"
+want "the refused reinstall neither repaired nor published over the unsafe root" \
+  "[ \"\$(stat -c %a '$UNIT_ROOT')\" = '777' ]"
+"$DOCTOR" --unit-only >"$SB/out" 2>&1 && die "the doctor accepted a unit root anyone can rewrite"
+want "the doctor names the writable unit root" "grep -q 'unit root.*group/world-writable' '$SB/out'"
+"$UNINSTALL" >"$SB/out" 2>&1 && die "the inverse removed things on the word of a state anyone can replace"
+want "the inverse refuses and removes NOTHING from an unsafe root" \
+  "grep -q 'group/world-writable' '$SB/out' && [ -f '$STATE' ] && [ -f '$HOOKS' ] && [ -f '$LAUNCHER' ]"
+chmod 0755 "$UNIT_ROOT"
+"$DOCTOR" --unit-only >/dev/null 2>&1 || die "the unit axis should be green once the root is safe again"
+ok "the unit axis is green again once the root is no longer writable"
+"$UNINSTALL" >/dev/null 2>&1 || die "cleanup uninstall after the parent-authority cell failed"
+
+# A relative root would make "the fixed launcher path" depend on the caller's cwd — and that
+# path is exactly what the vendor keys its trust receipt to.
+( cd "$SB" && CODEX_HOME="relative/.codex" "$INSTALL" >"$SB/out" 2>&1 ) && die "[QK:CODEX-BIRTH-REFUSES-RELATIVE-ROOT] a relative CODEX_HOME was accepted"
+want "a relative CODEX_HOME is refused zero-write" \
+  "grep -q 'CODEX_HOME resolves to a relative path' '$SB/out' && [ ! -e '$SB/relative' ]"
+( cd "$SB" && XDG_DATA_HOME="relative/share" "$INSTALL" >"$SB/out" 2>&1 ) && die "a relative XDG_DATA_HOME was accepted"
+want "a relative XDG_DATA_HOME is refused zero-write" \
+  "grep -q 'unit root resolves to a relative path' '$SB/out' && [ ! -e '$SB/relative' ]"
+( cd "$SB" && CODEX_HOME="relative/.codex" "$DOCTOR" --unit-only >"$SB/out" 2>&1 ) && die "the doctor judged a relative CODEX_HOME"
+want "the doctor refuses a relative CODEX_HOME before judging anything" "grep -q \"CODEX_HOME resolves to a relative path\" '$SB/out'"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] && ok "the checkout is untouched (every byte lived in the sandbox)" || die "this gate modified the repository"
+
+printf '\nsmoke-codex-birth: %d checks passed\n' "$pass"