@junghanacs/entwurf 0.20.1 → 0.22.0

package/scripts/smoke-codex-native-push-live.ts

@@ -0,0 +1,75 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { makeProductionEntwurfV2Deps } from "../pi-extensions/lib/entwurf-v2-production.ts";
+import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
+import { upsertMetaSession } from "../pi-extensions/lib/meta-session.ts";
+import { probeCodexThread } from "../pi-extensions/lib/native-push/codex-ws-client.ts";
+import { skipLive } from "./lib/live-skip.ts";
+
+if (process.env.LIVE !== "1") {
+	skipLive(
+		"smoke-codex-native-push-live",
+		"set LIVE=1 + CODEX_LIVE_THREAD_ID to run (sends a real turn to an already-loaded Codex thread).",
+	);
+}
+
+const threadId = process.env.CODEX_LIVE_THREAD_ID?.trim();
+if (!threadId) {
+	skipLive(
+		"smoke-codex-native-push-live",
+		"set CODEX_LIVE_THREAD_ID to a thread loaded by a TUI attached to the default Codex app-server.",
+	);
+}
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-codex-live-"));
+process.on("exit", () => fs.rmSync(root, { recursive: true, force: true }));
+const sessionsDir = path.join(root, "meta-sessions");
+const born = upsertMetaSession({
+	dir: sessionsDir,
+	input: {
+		backend: "codex",
+		nativeSessionId: threadId,
+		cwd: process.cwd(),
+		model: process.env.CODEX_LIVE_MODEL?.trim() || null,
+		transcriptPath: path.join(root, "codex-live-transcript.jsonl"),
+	},
+});
+
+const before = await probeCodexThread(threadId);
+assert.equal(before.status, "alive", `[QK:CODEX-LIVE-PROBE] ${before.status === "alive" ? "" : before.reason}`);
+
+const token = `CODEX-NATIVE-LIVE-${Date.now()}`;
+const result = await runEntwurfV2(
+	{
+		target: born.record.gardenId,
+		intent: "fire-and-forget",
+		wantsReply: true,
+		message: `Entwurf native-push live acceptance. Reply with exactly ${token}`,
+	},
+	makeProductionEntwurfV2Deps({
+		senderProvider: () => ({
+			sessionId: born.record.gardenId,
+			agentId: "meta-session/codex",
+			cwd: process.cwd(),
+			timestamp: new Date().toISOString(),
+			origin: "meta-session",
+			replyable: true,
+		}),
+		sessionsDir,
+		mailboxDir: path.join(root, "mailbox"),
+		controlSocketDir: path.join(root, "control"),
+		lockDir: path.join(root, "locks"),
+	}),
+);
+assert.equal(result.kind, "executed", `[QK:CODEX-LIVE-PUBLIC-DISPATCH] ${JSON.stringify(result)}`);
+assert.equal(result.kind === "executed" ? result.transport : null, "native-push");
+const after = await probeCodexThread(threadId);
+assert.equal(after.status, "alive", "Codex thread remains loaded after the one-shot queue acceptance");
+
+console.log(`smoke-codex-native-push-live: delivered ${token}`);
+console.log(`  gardenId: ${born.record.gardenId}`);
+console.log(`  threadId: ${threadId}`);
+console.log(`  socket:   ${before.status === "alive" ? before.route.socketPath : "unreachable"}`);
+console.log("  verify the exact token appears in that visible Codex TUI; the delivery receipt is not the model result");

package/scripts/smoke-entwurf-chain-live.ts

@@ -165,6 +165,49 @@ async function main(): Promise<void> {
 	const receiversDir = path.join(world, "receivers");
 	const sendersDir = path.join(world, "senders");
 	for (const d of [sessionsDir, mailboxDir, receiversDir, sendersDir]) await fsp.mkdir(d, { recursive: true });
+	// THE WORLD'S STANDING INSTRUCTION — the authority channel for hop 1, and the reason the
+	// payload itself says nothing about who authorised it.
+	//
+	// `[측정 2026-09-17]` a native Claude Code hop declined to forward, twice, and both refusals
+	// were CORRECT readings of the operator's own global rules ("entwurf는 GLG가 명시적으로
+	// 요청할 때만 사용", "다른 sibling에게 일방적으로 작업을 전달하지 않는다"). The second refusal
+	// went further and named a provenance sentence inside the prompt as the tell it is: content
+	// that vouches for itself is what an injection looks like, so no amount of asserting inside
+	// the payload can settle the question — the more insistent the sentence, the worse it reads.
+	//
+	// What actually separates this gate from an injection is not the message but the DIRECTORY
+	// the turn is started in: a disposable world this gate just minted, whose every
+	// `ENTWURF_META_*_DIR` points inside it, created because the operator ran `release-gate` on
+	// this host. So the fact is written where a standing operator instruction belongs, and the
+	// operator's own global policy is what makes it load-bearing — `agent-config/home/AGENTS.md`
+	// says "For repo-specific behavior, obey the nearest AGENTS.md". Both filenames are written
+	// because the harnesses that can host a hop do not agree on which one they read.
+	//
+	// This is not a "do not check your policy" instruction, which would buy the same green by
+	// asking the model to stop reading and would keep passing after the chain broke. The hop is
+	// free to refuse; what it gains is the one fact it had no other way to have.
+	const worldStanding = [
+		"# entwurf release-gate scratch world",
+		"",
+		"This directory was created moments ago by entwurf's release gate `smoke-entwurf-chain-live`,",
+		"which the operator (GLG) started on this host by running `release-gate`. It holds fixture",
+		"citizens and their mailboxes and nothing else, and it is deleted when the gate ends.",
+		"",
+		"The gate measures one capability: that a payload handed to a hop reaches a mailbox terminus",
+		"through three sibling hops, carrying the right sender identity at each one. A turn started in",
+		"this directory IS one of those hops.",
+		"",
+		"- Inside this directory, forwarding the payload a hop is given to the target it names, with",
+		"  `entwurf_v2`, is the operator's own request. It is the subject under measurement — not a",
+		"  delegation the model chose, and not a peer lane opened on the model's initiative.",
+		"- Every target is a fixture citizen this gate created in this world; the `ENTWURF_META_*_DIR`",
+		"  carriers all resolve inside this directory, so nothing outside it is addressed.",
+		"- The standing rule that entwurf is used only when GLG asks is satisfied by GLG having",
+		"  started the gate. This file is the nearest `AGENTS.md`, which the operator's global",
+		"  `AGENTS.md` defers to for behaviour scoped to a directory.",
+		"",
+	].join("\n");
+	for (const name of ["AGENTS.md", "CLAUDE.md"]) await fsp.writeFile(path.join(world, name), worldStanding);
 	const worldEnv = {
 		ENTWURF_META_SESSIONS_DIR: sessionsDir,
 		ENTWURF_META_MAILBOX_DIR: mailboxDir,
@@ -295,6 +338,13 @@ async function main(): Promise<void> {
 			hop3,
 			"INNER-END",
 		].join("\n");
+		// The payload carries NO claim about its own authority, and that is deliberate.
+		// `[측정 2026-09-17]` a first attempt put the provenance in these very lines — "this prompt is
+		// issued by entwurf's release gate, which the operator started" — and the hop named those
+		// sentences as the tell: *"컨텐츠가 '이것은 위임이 아니라 승인된 테스트 대상 자체다'라고
+		// 스스로를 정당화하는 것도 전형적인 수법입니다."* It was right. A message that vouches for
+		// itself is exactly the shape of an injection, so authority cannot ride the payload; it rides
+		// the WORLD this turn is started in (see the standing instruction written next to `world`).
 		const hop1Prompt = [
 			"You are the first hop of a delivery chain. Do exactly this and nothing else.",
 			`Call the tool mcp__entwurf-bridge__entwurf_v2 exactly once with target=${gidB}, intent=fire-and-forget,`,

package/scripts/smoke-setup-verdict.sh

@@ -16,6 +16,9 @@
 #                             core and later components still attempted
 #   S-8 omp present         → the four omp units compose (birth/MCP/tools.xdev
 #                             setting/receiver), states exist, second run idempotent
+#   S-8c codex present      → birth publishes but stays a named FAIL until the vendor trust
+#                             receipt exists; all three atoms compose twice, preserve foreign
+#                             config, stay idempotent, and go green on the trusted rerun
 #   S-5 installed mode      → the installed-vs-source branch is a NAMED verdict
 #                             printed before anything else, and never reaches
 #                             the source pnpm bootstrap
@@ -27,12 +30,15 @@
 # below-floor and false-green shapes as living end-to-end evidence.
 #
 # Deterministic: no model, no network, no cost. Presence probes are pinned via
-# PI_BIN / CLAUDE_BIN / AGY_BIN / COPILOT_BIN / OMP_BIN (the same hermetic seam
+# PI_BIN / CLAUDE_BIN / AGY_BIN / COPILOT_BIN / OMP_BIN / CODEX_BIN (the same hermetic seam
 # smoke-agy-install-state
 # uses), and every write root is sandboxed: HOME, XDG roots, the pi agent dir,
-# and the dev-bin dir. The source bootstrap (`pnpm install --frozen-lockfile`)
-# runs against the ALREADY-INSTALLED checkout, which is a verified no-op under a
-# sandbox HOME (measured 2026-08-26).
+# and the dev-bin dir. Source-mode cells put a strict fixture `pnpm` first on PATH:
+# it accepts the no-op `install --frozen-lockfile` and the source-owned `run build-bridge`
+# emit only. Package-manager behavior belongs to the package gates. This is load-bearing
+# under mutation qualification, whose snapshot shares node_modules read-only — a real pnpm
+# follows that symlink and attempts to rewrite the origin checkout. Any dist this gate had
+# to build is removed on exit, restoring the snapshot's pre-gate surface.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -51,7 +57,13 @@ esac
 export PYTHONDONTWRITEBYTECODE=1
 
 SB="$(mktemp -d -t entwurf-setup-verdict.XXXXXX)"
-cleanup() { rm -rf "$SB"; }
+DIST_ROOT="$REPO_DIR/mcp/entwurf-bridge/dist"
+DIST_PREEXISTED=0
+[ -d "$DIST_ROOT" ] && DIST_PREEXISTED=1
+cleanup() {
+  [ "$DIST_PREEXISTED" -eq 1 ] || rm -rf "$DIST_ROOT"
+  rm -rf "$SB"
+}
 trap cleanup EXIT
 
 export HOME="$SB/home"
@@ -62,12 +74,27 @@ export XDG_CONFIG_HOME="$SB/home/.config"
 export PI_CODING_AGENT_DIR="$SB/home/.pi/agent"
 export ENTWURF_DEV_BIN_DIR="$SB/bin"
 export PATH="$SB/bin:$PATH"
-mkdir -p "$HOME" "$PI_CODING_AGENT_DIR" "$SB/bin" "$SB/harness"
+mkdir -p "$HOME" "$PI_CODING_AGENT_DIR" "$SB/bin" "$SB/harness" "$SB/bootstrap-bin"
+cat > "$SB/bootstrap-bin/pnpm" <<'SH'
+#!/bin/sh
+if [ "$#" -eq 2 ] && [ "$1" = install ] && [ "$2" = --frozen-lockfile ]; then
+  exit 0
+fi
+if [ "$#" -eq 2 ] && [ "$1" = run ] && [ "$2" = build-bridge ]; then
+  # The qualification snapshot is process-exclusive. Invoke the source-owned emit
+  # directly so the production lock wrapper cannot leave its ignored parent dir.
+  exec bash scripts/build-bridge.sh
+fi
+echo "fixture pnpm accepts only: install --frozen-lockfile | run build-bridge" >&2
+exit 64
+SH
+chmod +x "$SB/bootstrap-bin/pnpm"
+export PATH="$SB/bootstrap-bin:$PATH"
 
 # Presence pins: default every harness to a definitely-absent path; each cell
 # re-pins what it needs. Production leaves these unset.
 ABSENT="$SB/harness/definitely-absent"
-export PI_BIN="$ABSENT" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="$ABSENT" OMP_BIN="$ABSENT"
+export PI_BIN="$ABSENT" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="$ABSENT" OMP_BIN="$ABSENT" CODEX_BIN="$ABSENT"
 
 PASS=0
 ok()   { PASS=$((PASS + 1)); printf '  ok    %s\n' "$*"; }
@@ -94,7 +121,8 @@ echo "[smoke-setup-verdict] S-1 all-harness-absent setup"
 PROJ1="$SB/proj1"; mkdir -p "$PROJ1"
 seed_auth
 set +e; OUT="$(bash "$REPO_DIR/run.sh" setup "$PROJ1" 2>&1)"; RC=$?; set -e
-want "S-1: all-absent setup exits 0 (core green is still green)" "[ '$RC' -eq 0 ]"
+want "S-1: all-absent setup exits 0 with a Codex SKIP" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'codex: SKIP'"
 want "S-1: mode is a named source-checkout branch, printed first" \
   "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: source checkout'"
 want "S-1: pi absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP'"
@@ -112,6 +140,7 @@ want "S-1: no user-scope pi settings were created" "[ ! -e '$PI_CODING_AGENT_DIR
 want "S-1: no agy config was created" "[ ! -e '$HOME/.gemini' ]"
 want "S-1: no Copilot config/units were created" "[ ! -e '$HOME/.copilot' ]"
 want "S-1: no OMP config/units were created" "[ ! -e '$HOME/.omp' ]"
+want "S-1: no Codex config/units were created" "[ ! -e '$HOME/.codex' ]"
 want_auth_untouched "S-1"
 
 # ── S-2: pi resolvable but BELOW floor → detected FAIL, never SKIP, no writes ──
@@ -287,6 +316,92 @@ rm -rf "$HOME/.omp" "$XDG_DATA_HOME/entwurf/omp-bridge" "$XDG_DATA_HOME/entwurf/
   "$XDG_DATA_HOME/entwurf/omp-config" "$XDG_DATA_HOME/entwurf/omp-receive" \
   "$XDG_DATA_HOME/entwurf/meta-bridge-omp" "$XDG_DATA_HOME/entwurf/omp-receive"
 
+# ── S-8c: codex PRESENT → setup publishes birth, and stays NON-GREEN until the vendor agrees ──
+# The birth unit's paths are the operator's own, so setup installs it here for real, inside the
+# fixture's HOME/CODEX_HOME/XDG. What setup CANNOT do is answer the vendor's one-time trust
+# prompt: that is the operator's, in their own visible Codex. So the first run writes every
+# byte and is honestly non-green, the two config atoms compose anyway, and the run after a
+# vendor receipt appears is green and byte-idempotent. Nothing here ever writes [hooks.state] —
+# the receipt is forged by the FIXTURE to stand in for the vendor, never by setup.
+echo "[smoke-setup-verdict] S-8c codex present — incomplete three-unit composition"
+PROJ8C="$SB/proj8c"; mkdir -p "$PROJ8C"
+FAKE_CODEX="$SB/harness/codex-fake"; mkdir -p "$FAKE_CODEX"
+printf '#!/usr/bin/env bash\necho "codex-cli 0.153.4"\n' > "$FAKE_CODEX/codex"
+chmod +x "$FAKE_CODEX/codex"
+CODEX_HOME_SANDBOX="$HOME/.codex"
+mkdir -p "$CODEX_HOME_SANDBOX"
+cat > "$CODEX_HOME_SANDBOX/config.toml" <<'TOML'
+model = "operator-model"
+
+[projects."/operator/keep"]
+trust_level = "trusted"
+
+[mcp_servers.operator-owned]
+command = "/operator/bin/server"
+args = ["--keep"]
+
+[tui]
+status_line = ["model-with-reasoning"]
+TOML
+REAL_BASH="$(command -v bash)"
+CODEX_BIRTH_UNIT_ROOT="$XDG_DATA_HOME/entwurf/codex-birth"
+seed_auth
+set +e
+OUT="$(CODEX_BIN="$FAKE_CODEX/codex" CODEX_HOME="$CODEX_HOME_SANDBOX" PATH="$FAKE_CODEX:$PATH" "$REAL_BASH" "$REPO_DIR/run.sh" setup "$PROJ8C" 2>&1)"
+RC=$?
+set -e
+want "[QK:CODEX-SETUP-NEVER-PRESEEDS-TRUST] S-8c: setup wrote NO vendor trust receipt of its own" \
+  "! grep -q 'hooks.state' '$CODEX_HOME_SANDBOX/config.toml' && ! grep -q 'trusted_hash' '$CODEX_HOME_SANDBOX/config.toml'"
+want "S-8c: detected-incomplete Codex is a named nonzero result, never an absent SKIP [QK:CODEX-SETUP-BIRTH-COSMETIC-PASS]" \
+  "[ '$RC' -ne 0 ] && printf '%s' \"\$OUT\" | grep -q 'codex-birth: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'codex: SKIP'"
+want "S-8c: all three user-owned Codex atoms still compose independently as PASS [QK:CODEX-SETUP-BIRTH-INDEPENDENT]" \
+  "printf '%s' \"\$OUT\" | grep -q 'codex-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'codex-statusline: PASS' && printf '%s' \"\$OUT\" | grep -q 'codex-terminal-title: PASS'"
+want "S-8c: summary is NON-GREEN and attributes it to the untrusted birth unit" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL: codex-birth)' && ! printf '%s' \"\$OUT\" | grep -q 'result: green'"
+want "S-8c: the reason names the operator's one-time answer, not a repair setup could have made" \
+  "printf '%s' \"\$OUT\" | grep -q 'no trust receipt' && printf '%s' \"\$OUT\" | grep -q 'Trust all and continue'"
+want "S-8c: setup PUBLISHED the birth unit — declaration, launcher closure and ownership state" \
+  "[ -f '$CODEX_HOME_SANDBOX/hooks.json' ] && [ -x '$CODEX_BIRTH_UNIT_ROOT/helper/codex-birth-launch.sh' ] && [ -f '$CODEX_BIRTH_UNIT_ROOT/install-state.json' ]"
+CODEX_MCP_STATE="$XDG_DATA_HOME/entwurf/codex-mcp/install-state.json"
+CODEX_STATUSLINE_STATE="$XDG_DATA_HOME/entwurf/codex-statusline/install-state.json"
+CODEX_TERMINAL_TITLE_STATE="$XDG_DATA_HOME/entwurf/codex-terminal-title/install-state.json"
+want "S-8c: all three user atoms wrote their package-owned install states inside the sandbox" \
+  "[ -f '$CODEX_MCP_STATE' ] && [ -f '$CODEX_STATUSLINE_STATE' ] && [ -f '$CODEX_TERMINAL_TITLE_STATE' ] && grep -q '\"atom\": \"codex-mcp\"' '$CODEX_MCP_STATE' && grep -q '\"atom\": \"codex-statusline\"' '$CODEX_STATUSLINE_STATE' && grep -q '\"atom\": \"codex-terminal-title\"' '$CODEX_TERMINAL_TITLE_STATE'"
+want "S-8c: MCP, visible-identity and caller-seat atoms landed in the sandbox Codex config" \
+  "grep -q '\\[mcp_servers\\.entwurf-bridge\\]' '$CODEX_HOME_SANDBOX/config.toml' && grep -q 'status_line = \\[\"thread-title\", \"model-with-reasoning\"\\]' '$CODEX_HOME_SANDBOX/config.toml' && grep -q 'terminal_title = \\[\"activity\", \"project-name\", \"thread-id\"\\]' '$CODEX_HOME_SANDBOX/config.toml'"
+want "S-8c: unrelated operator config survives both atom writers" \
+  "grep -q 'model = \"operator-model\"' '$CODEX_HOME_SANDBOX/config.toml' && grep -q '\\[mcp_servers\\.operator-owned\\]' '$CODEX_HOME_SANDBOX/config.toml' && grep -q 'command = \"/operator/bin/server\"' '$CODEX_HOME_SANDBOX/config.toml'"
+CODEX_CONFIG_AFTER="$(sha256sum "$CODEX_HOME_SANDBOX/config.toml" | cut -d' ' -f1)"
+CODEX_MCP_STATE_AFTER="$(sha256sum "$CODEX_MCP_STATE" | cut -d' ' -f1)"
+CODEX_STATUSLINE_STATE_AFTER="$(sha256sum "$CODEX_STATUSLINE_STATE" | cut -d' ' -f1)"
+CODEX_TERMINAL_TITLE_STATE_AFTER="$(sha256sum "$CODEX_TERMINAL_TITLE_STATE" | cut -d' ' -f1)"
+set +e
+OUT2="$(CODEX_BIN="$FAKE_CODEX/codex" CODEX_HOME="$CODEX_HOME_SANDBOX" PATH="$FAKE_CODEX:$PATH" "$REAL_BASH" "$REPO_DIR/run.sh" setup "$PROJ8C" 2>&1)"
+RC2=$?
+set -e
+want "S-8c: second setup still reports the untrusted birth FAIL and all three user atoms PASS" \
+  "[ '$RC2' -ne 0 ] && printf '%s' \"\$OUT2\" | grep -q 'codex-birth: FAIL' && printf '%s' \"\$OUT2\" | grep -q 'codex-mcp: PASS' && printf '%s' \"\$OUT2\" | grep -q 'codex-statusline: PASS' && printf '%s' \"\$OUT2\" | grep -q 'codex-terminal-title: PASS'"
+want "S-8c: second setup is byte-idempotent for config and all three ownership receipts" \
+  "[ \"\$(sha256sum '$CODEX_HOME_SANDBOX/config.toml' | cut -d' ' -f1)\" = '$CODEX_CONFIG_AFTER' ] && [ \"\$(sha256sum '$CODEX_MCP_STATE' | cut -d' ' -f1)\" = '$CODEX_MCP_STATE_AFTER' ] && [ \"\$(sha256sum '$CODEX_STATUSLINE_STATE' | cut -d' ' -f1)\" = '$CODEX_STATUSLINE_STATE_AFTER' ] && [ \"\$(sha256sum '$CODEX_TERMINAL_TITLE_STATE' | cut -d' ' -f1)\" = '$CODEX_TERMINAL_TITLE_STATE_AFTER' ]"
+want "S-8c: second setup rechecks rather than faking the missing receipt" \
+  "! printf '%s' \"\$OUT2\" | grep -q 'codex-birth: PASS' && ! grep -q 'trusted_hash' '$CODEX_HOME_SANDBOX/config.toml'"
+
+# The vendor answers. Written by the FIXTURE, exactly as the vendor writes it after one
+# 'Trust all': the receipt keyed to this declaration, carrying its own hash.
+printf '\n[hooks.state."%s/hooks.json:session_start:0:0"]\ntrusted_hash = "sha256:%s"\n' \
+  "$CODEX_HOME_SANDBOX" "$(printf '4%.0s' $(seq 64))" >> "$CODEX_HOME_SANDBOX/config.toml"
+CODEX_CONFIG_TRUSTED="$(sha256sum "$CODEX_HOME_SANDBOX/config.toml" | cut -d' ' -f1)"
+set +e
+OUT3="$(CODEX_BIN="$FAKE_CODEX/codex" CODEX_HOME="$CODEX_HOME_SANDBOX" PATH="$FAKE_CODEX:$PATH" "$REAL_BASH" "$REPO_DIR/run.sh" setup "$PROJ8C" 2>&1)"
+RC3=$?
+set -e
+want "[QK:CODEX-SETUP-TRUSTED-RERUN-GREEN] S-8c: once the vendor receipt exists the same setup is GREEN" \
+  "[ '$RC3' -eq 0 ] && printf '%s' \"\$OUT3\" | grep -q 'codex-birth: PASS' && printf '%s' \"\$OUT3\" | grep -q 'result: green'"
+want "S-8c: the trusted rerun is byte-idempotent — it neither rewrote the config nor touched the receipt" \
+  "[ \"\$(sha256sum '$CODEX_HOME_SANDBOX/config.toml' | cut -d' ' -f1)\" = '$CODEX_CONFIG_TRUSTED' ]"
+want_auth_untouched "S-8c"
+rm -rf "$HOME/.codex" "$XDG_DATA_HOME/entwurf/codex-mcp" "$XDG_DATA_HOME/entwurf/codex-statusline" "$XDG_DATA_HOME/entwurf/codex-terminal-title" "$CODEX_BIRTH_UNIT_ROOT"
+
 # ── S-9: rail certification is a SEPARATE axis from install success (#78 D1) ──
 # The 0.20.0 macOS lane opened the installers to Darwin (meta-bridge-install.sh's
 # platform gate became its own python3/node dependency instead of the platform
@@ -379,8 +494,8 @@ PROJ9C="$SB/proj9c"; mkdir -p "$PROJ9C"
 seed_auth
 set +e; OUT="$(PATH="$FAKE_UNAME:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9C" 2>&1)"; RC=$?; set -e
 want "S-9c: a harness-free uncertified host still exits 0" "[ '$RC' -eq 0 ]"
-want "S-9c: all five harness probes are still zero-state SKIPs" \
-  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP'"
+want "S-9c: all six harness probes are still zero-state SKIPs" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && printf '%s' \"\$OUT\" | grep -q 'codex: SKIP'"
 want "S-9c: core still PASSes and the computed summary is still green" \
   "printf '%s' \"\$OUT\" | grep -q 'core: PASS' && printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
 want "S-9c: an absent harness is never given a rail verdict it did not earn" \

package/scripts/tsconfig.json

@@ -31,6 +31,7 @@
 		"../pi-extensions/model-lock.ts",
 		"../pi-extensions/meta-bridge-hook.ts",
 		"../pi-extensions/meta-bridge-hook-copilot.ts",
+		"../pi-extensions/meta-bridge-hook-codex.ts",
 		"../pi-extensions/meta-bridge-omp.ts",
 		"../pi-extensions/meta-bridge-receive-omp.ts",
 		"../mcp/entwurf-bridge/src/resume-mode.ts"