@junghanacs/entwurf 0.21.0 → 0.23.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/codex-fresh-preflight.js

@@ -2,13 +2,21 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parse } from "smol-toml";
+import { CODEX_BIRTH_EVENT, classifyOwnedPath, entwurfDeclarationCommand, selectEntwurfDeclaration, statOwnedPath, trustReceiptKey, } from "./codex-declaration.js";
 import { checkCodexSocketFile, realCodexProtocolOpener, resolveCodexDefaultSocketPath, } from "./native-push/codex-ws-client.js";
 export const CODEX_PREFLIGHT_HINT = {
     "codex-birth-unit-missing": "the Codex SessionStart birth unit is absent, drifted from its recorded digests, or unsafely owned; run `entwurf install-codex-birth`, then `entwurf doctor-codex-birth`",
     "codex-birth-trust-missing": "the vendor has recorded no trust receipt for this birth declaration, so the hook is declared and never runs; open a visible plain Codex, answer its prompt with `Trust all and continue`, send one first turn, then `entwurf doctor-codex-birth`",
     "codex-mcp-hand-missing": "the Codex user config does not expose the managed entwurf bridge; run `entwurf install-codex-mcp`, then `entwurf doctor-codex-mcp`",
     "codex-visible-identity-missing": "Codex tui.status_line does not include thread-title; run `entwurf install-codex-statusline`, then `entwurf doctor-codex-statusline`",
-    "codex-app-server-unavailable": "the operator-owned Codex app-server default socket is absent or unsafe; start `codex app-server --listen unix://$CODEX_HOME/app-server-control/app-server-control.sock` and retry",
+    "codex-app-server-unavailable": "the operator-owned Codex app-server default socket is absent or unsafe; start it with `entwurf codex-app-server` from a detached tmux session (one that is NOT where you work), then retry",
+};
+export const CODEX_LAUNCH_CWD_PREFLIGHT_HINT = {
+    "codex-launch-cwd-undecided": "Codex has recorded NO decision for the directory this sibling would start in, so the window would open on the vendor's folder-consent screen and WAIT for a human instead of running its first turn — no rollout, no callback, and nothing to address; either launch in a directory this Codex has already been answered for, or open a plain `codex -C <dir>` there once and answer it, then retry",
+    "codex-launch-cwd-untrusted-ancestor": "this directory sits inside a project the operator marked `untrusted`, and on this rail the vendor does not offer a consent screen for that — it refuses the startup outright with `pass the repository root explicitly with --cd`, so answering a prompt at this directory would only reproduce that error; launch at that untrusted project's own root instead, or change that project's recorded decision",
+};
+export const CODEX_CALLER_PREFLIGHT_HINT = {
+    "codex-caller-title-missing": "this Codex caller's tui.terminal_title does not include thread-id, so the multiplexer reports no pane title naming this thread and there is no caller seat to open the sibling beside; run `entwurf install-codex-terminal-title`, then `entwurf doctor-codex-terminal-title` (an explicit placement.tmuxSession skips this check entirely, because it never needs the seat)",
 };
 /**
  * The unit's paths are the operator's own, derived from the SAME environment the installer
@@ -37,54 +45,69 @@ const CODEX_MCP_ENV_VARS = [
     "TMUX",
     "TMUX_PANE",
 ];
+/**
+ * ONE POLICY, FOUR SURFACES. The predicate itself lives in `codex-declaration.js` (sol B3,
+ * 2026-09-18) because the installer, the inverse and the doctor decide about the SAME shared
+ * hooks.json and used to decide differently: they checked symlink-and-regular, this checked owner
+ * and mode as well, and the doctor checked neither. That split let an install and a doctor say yes
+ * about bytes every fresh call then refused. The executable bit stays HERE — it is this rail's
+ * question about the launcher codex is going to exec, not a fact about shared ownership.
+ */
 function isSafeOwnedFile(file, expectedUid, executable = false) {
-    try {
-        const stat = fs.lstatSync(file);
-        return (stat.isFile() &&
-            !stat.isSymbolicLink() &&
-            stat.uid === expectedUid &&
-            (stat.mode & 0o022) === 0 &&
-            (!executable || (stat.mode & 0o111) !== 0));
-    }
-    catch {
+    const stat = statOwnedPath(fs, file);
+    if (classifyOwnedPath(stat, expectedUid) !== "ok")
         return false;
-    }
+    return !executable || (stat.mode & 0o111) !== 0;
 }
 function isSafeOwnedDir(dir, expectedUid) {
-    try {
-        const stat = fs.lstatSync(dir);
-        return stat.isDirectory() && !stat.isSymbolicLink() && stat.uid === expectedUid && (stat.mode & 0o022) === 0;
-    }
-    catch {
-        return false;
-    }
+    return classifyOwnedPath(statOwnedPath(fs, dir), expectedUid, { kind: "directory" }) === "ok";
 }
 /**
  * The unit's own ownership state, read as the digest inventory it is. Bytes that merely
  * EXIST prove nothing: the launcher codex is about to exec must be the one this unit
  * published, so every recorded member is compared to its recorded digest before a sibling
  * is opened. No digest is computed for the VENDOR here — that is a different axis below.
+ *
+ * WHAT THIS NO LONGER READS (#117): a WHOLE-FILE `hooksSha256`. `codex-birth-install-state/v2`
+ * records the normalized digest of entwurf's own declaration instead, because hooks.json is a
+ * file this unit SHARES — a neighbouring integration appending its own `SessionStart` group
+ * changes every byte of that file and none of our declaration's meaning. The declaration axis
+ * lives in `birthDeclaration` below, which needs the live document anyway to find where our group
+ * currently sits.
  */
-function closureDriftedFromState(paths, expectedUid) {
+function certifiedState(paths, expectedUid) {
     // The directory holding the state carries the state's authority: anyone who can write it
     // can replace the inventory every digest below is compared against.
     if (!isSafeOwnedDir(path.dirname(paths.stateFile), expectedUid))
-        return true;
+        return null;
     if (!isSafeOwnedDir(path.dirname(path.dirname(paths.stateFile)), expectedUid))
-        return true;
+        return null;
     if (!isSafeOwnedFile(paths.stateFile, expectedUid))
-        return true;
+        return null;
     let state;
     try {
         state = JSON.parse(fs.readFileSync(paths.stateFile, "utf8"));
     }
     catch {
-        return true;
+        return null;
     }
-    if (state.schema !== "codex-birth-install-state/v1" || state.status !== "installed")
-        return true;
+    // v2 ONLY, and a v1 state is refused rather than read leniently: v1 recorded a whole-file
+    // digest, so a reader that tolerated it would be certifying an authority nobody holds any
+    // more. `entwurf install-codex-birth` supersedes it — that is the one forward path.
+    if (state.schema !== "codex-birth-install-state/v2" || state.status !== "installed")
+        return null;
     if (state.hooksFile !== paths.hooksFile || state.helperDir !== paths.helperDir)
-        return true;
+        return null;
+    const declaration = state.declaration;
+    if (declaration === null || typeof declaration !== "object" || Array.isArray(declaration))
+        return null;
+    const recorded = declaration;
+    if (recorded.event !== CODEX_BIRTH_EVENT)
+        return null;
+    if (typeof recorded.command !== "string" || typeof recorded.sha256 !== "string")
+        return null;
+    if (!/^[0-9a-f]{64}$/.test(recorded.sha256))
+        return null;
     const digest = (file) => {
         try {
             return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
@@ -93,11 +116,9 @@ function closureDriftedFromState(paths, expectedUid) {
             return null;
         }
     };
-    if (typeof state.hooksSha256 !== "string" || digest(paths.hooksFile) !== state.hooksSha256)
-        return true;
     const members = state.helperFiles;
     if (!Array.isArray(members))
-        return true;
+        return null;
     // Exactly the closure the installer publishes: a short inventory would leave a member
     // nothing compares, which is the same hole as not checking digests at all.
     const named = members.map((raw) => raw?.path);
@@ -110,23 +131,37 @@ function closureDriftedFromState(paths, expectedUid) {
         "entwurf-capabilities.json",
     ];
     if (named.length !== expected.length)
-        return true;
+        return null;
     if (expected.some((name) => !named.includes(name)))
-        return true;
+        return null;
     if (named.some((name, index) => named.indexOf(name) !== index))
-        return true;
+        return null;
     for (const raw of members) {
         const member = raw;
         const rel = member.path;
         if (typeof rel !== "string" || rel.length === 0 || rel.startsWith("/") || rel.split("/").includes("..")) {
-            return true;
+            return null;
         }
         if (typeof member.sha256 !== "string" || digest(path.join(paths.helperDir, rel)) !== member.sha256)
-            return true;
+            return null;
     }
-    return false;
+    return { command: recorded.command, sha256: recorded.sha256 };
 }
-function birthMissing(paths, expectedUid) {
+/**
+ * WHERE ENTWURF'S DECLARATION CURRENTLY SITS, or nothing.
+ *
+ * `null` here means the SAME reject as before — `codex-birth-unit-missing` — but the question
+ * it answers is narrower than it used to be (#117). It no longer asks "is hooks.json exactly the
+ * file we wrote"; it asks "is entwurf's own `SessionStart` group present exactly once, shaped the
+ * way the operator approved, and still the declaration this unit recorded". A Herdr (or any
+ * other) integration declaring its own group beside ours changes neither answer.
+ *
+ * The POSITION is the return value rather than a side note because the vendor keys its trust
+ * receipt by index: a declaration that has been renumbered by a neighbour's install needs its
+ * receipt read at the new index, and reading the old one would report a NEIGHBOUR's approval as
+ * our own.
+ */
+function birthDeclaration(paths, expectedUid) {
     const launcher = path.join(paths.helperDir, "codex-birth-launch.sh");
     const directories = [
         path.dirname(paths.hooksFile),
@@ -135,9 +170,9 @@ function birthMissing(paths, expectedUid) {
         path.join(paths.helperDir, "lib", "native-push"),
     ];
     if (directories.some((dir) => !isSafeOwnedDir(dir, expectedUid)))
-        return true;
+        return null;
     if (!isSafeOwnedFile(paths.hooksFile, expectedUid))
-        return true;
+        return null;
     const closure = [
         [launcher, true],
         [path.join(paths.helperDir, "meta-bridge-hook-codex.ts"), false],
@@ -147,25 +182,28 @@ function birthMissing(paths, expectedUid) {
         [path.join(paths.helperDir, "entwurf-capabilities.json"), false],
     ];
     if (closure.some(([file, executable]) => !isSafeOwnedFile(file, expectedUid, executable)))
-        return true;
+        return null;
+    const recorded = certifiedState(paths, expectedUid);
+    if (recorded === null)
+        return null;
+    // The state's own account of what it certified must be the declaration these paths produce;
+    // a receipt bound to a different launcher is a receipt for a different unit.
+    if (recorded.command !== entwurfDeclarationCommand(launcher))
+        return null;
+    let selected;
     try {
-        const parsed = JSON.parse(fs.readFileSync(paths.hooksFile, "utf8"));
-        const events = parsed.hooks?.SessionStart;
-        if (!Array.isArray(events) || events.length !== 1)
-            return true;
-        const group = events[0];
-        if ("matcher" in group || !Array.isArray(group.hooks) || group.hooks.length !== 1)
-            return true;
-        const hook = group.hooks[0];
-        if (Object.keys(hook).sort().join(",") !== "command,timeout,type")
-            return true;
-        if (hook.type !== "command" || hook.command !== `'${launcher}'` || hook.timeout !== 30)
-            return true;
+        selected = selectEntwurfDeclaration(JSON.parse(fs.readFileSync(paths.hooksFile, "utf8")), launcher);
     }
     catch {
-        return true;
+        return null;
     }
-    return closureDriftedFromState(paths, expectedUid);
+    if (!selected.ok)
+        return null;
+    // The NORMALIZED digest, so a neighbour re-serializing the document (measured: Herdr does)
+    // cannot make our intact declaration look edited — and an edit to our own handler still can.
+    if (selected.digest !== recorded.sha256)
+        return null;
+    return { groupIndex: selected.groupIndex, handlerIndex: selected.handlerIndex };
 }
 /**
  * The vendor's own receipt for THIS declaration, read and never written. The key the vendor
@@ -173,15 +211,21 @@ function birthMissing(paths, expectedUid) {
  * `trusted_hash` of the shape `sha256:<64 hex>`. What this asserts is that a receipt EXISTS
  * for our declaration identity — never that the hash is correct, which only the vendor can
  * say, and never by launching Codex to find out.
+ *
+ * THE KEY IS MEASURED, NOT ASSUMED (#117). It used to be spelled `…:session_start:0:0`, which
+ * was true only while entwurf was the sole declaration in the file. With a neighbour at index 0
+ * that constant reads THEIR receipt and calls it ours — a false green for a hook the vendor has
+ * never been asked to run. The caller passes the key built from the position our declaration was
+ * just found at.
  */
-function trustReceiptMissing(config, hooksFile) {
+function trustReceiptMissing(config, key) {
     const hooks = config.hooks;
     if (hooks == null || typeof hooks !== "object" || Array.isArray(hooks))
         return true;
     const state = hooks.state;
     if (state == null || typeof state !== "object" || Array.isArray(state))
         return true;
-    const entry = state[`${hooksFile}:session_start:0:0`];
+    const entry = state[key];
     if (entry == null || typeof entry !== "object" || Array.isArray(entry))
         return true;
     const digest = entry.trusted_hash;
@@ -227,6 +271,192 @@ function visibleIdentityMissing(config) {
     const statusLine = tui.status_line;
     return !Array.isArray(statusLine) || !statusLine.includes("thread-title");
 }
+/** `[tui].terminal_title` membership, the exact axis `entwurf doctor-codex-terminal-title`
+ * judges. Same shape as `visibleIdentityMissing` and a DIFFERENT key: `status_line` is what a
+ * human reads inside the TUI, `terminal_title` is what the multiplexer reports back as
+ * `#{pane_title}`. Neither substitutes for the other. */
+function callerTitleMissing(config) {
+    const tui = config.tui;
+    if (tui == null || typeof tui !== "object" || Array.isArray(tui))
+        return true;
+    const terminalTitle = tui.terminal_title;
+    return !Array.isArray(terminalTitle) || !terminalTitle.includes("thread-id");
+}
+/**
+ * The CALLER-side capability, pre-mutation and synchronous.
+ *
+ * Synchronous because it reads one config file and nothing else: there is no app-server axis
+ * here and there must not be one — whether the operator's app-server is up says nothing about
+ * whether a caller's pane can be found, and asking would make a placement check fail for a
+ * delivery reason.
+ *
+ * Call it only when the anchor will actually be USED — a codex caller that named an explicit
+ * `placement` never consults the title, so refusing it for a missing `thread-id` would be a
+ * refusal for an unused capability.
+ */
+export function codexCallerFreshPreflight(env) {
+    const config = readConfig(env);
+    if (config === null || callerTitleMissing(config))
+        return "codex-caller-title-missing";
+    return null;
+}
+/**
+ * The launch directory's own capability, pre-mutation and synchronous — and DELIBERATELY NARROWER
+ * than the vendor's own decision, because the leaf that decides here reads one TOML file while the
+ * vendor asks its app-server. Read this whole comment as the scope statement it is: what follows
+ * says what this answers, and then says what it refuses to claim.
+ *
+ * WHY THE AXIS EXISTS. `[source rust-v0.153.4]` a fresh call always passes `--remote`, so the TUI
+ * resolves `AppServerTarget::Remote` and startup ALWAYS runs `check_directory_trust` on the `-C`
+ * value (`tui/src/lib.rs:1699-1725`). Nothing on that path consults the approval or sandbox policy
+ * (`tui/src/onboarding/directory_trust.rs:33-130`), which is why the
+ * `--dangerously-bypass-approvals-and-sandbox` token this argv already carries does NOT cover it:
+ * approvals and folder consent are two different gates. A directory with no recorded decision
+ * renders the consent screen and blocks, and a blocked TUI has started no turn — no rollout, no
+ * birth, no callback, and the caller waits out its whole timeout on a window that is merely
+ * waiting to be answered. `[측정 2026-09-16]` the two release-gate runs that failed launched in
+ * `…-2zznHl` and `…-kSsoAn`, neither of which had an entry; the two that passed launched in
+ * `…-db65N2` and `…-pBXxOJ`, both of which did. Unattended, the failure is silent.
+ *
+ * THE THREE VENDOR OUTCOMES THIS LEAF MODELS, in the vendor's own order
+ * (`tui/src/config_update.rs:290-371`, `ProjectTrustHost::Remote`):
+ *
+ *   1. A DIRECT decision on the exact cwd starts a turn, and BOTH recorded answers do. `trusted`
+ *      returns before any screen (`:346-354`); a saved `untrusted` is explicitly skipped for a
+ *      remote target — `if target.uses_remote_workspace() && trust_level == Some(Untrusted) {
+ *      continue; }` (`onboarding/directory_trust.rs:94-96`), and `uses_remote_workspace()` is
+ *      exactly `matches!(self, Self::Remote { .. })` (`tui/src/lib.rs:307-309`). Refusing a
+ *      deliberate `untrusted` would be entwurf inventing a policy the vendor does not have.
+ *      The key is the exact cwd — `cwd_keys = vec![cwd_key]` (`:290-296`), no root marker, no git
+ *      root, no parent, all three of which exist only on the Local host. `[측정 2026-09-16]`
+ *      `~/.codex/config.toml` carried a trusted `/tmp` and still recorded two separate
+ *      `/tmp/entwurf-codex-fresh-live-*` entries, one per run a human answered.
+ *   2. With NO direct decision, an enabled PROJECT LAYER consents on the directory's behalf
+ *      (`trust_level.is_none() && disabled_project.is_none() && project_layers.any(no
+ *      disabledReason)` → `Ok(None)`, `:346-354`). Those layers come from the app-server's
+ *      `ConfigRead { include_layers: true }` answer, which this leaf does not have. A layer that
+ *      is present but DISABLED is a fourth outcome — the vendor preserves an unknown or untrusted
+ *      project layer as disabled rather than dropping it, and that path falls through to the
+ *      screen — and this leaf cannot tell the two apart either. So wherever a layer could exist at
+ *      all it answers `null`, which folds both outcomes into "proceed".
+ *   3. With no direct decision and NO layers, a cwd inside an explicitly `untrusted` ancestor is
+ *      not a consent screen at all: the remote branch returns an ERROR
+ *      (`"remote project directory is inside an explicitly untrusted project; pass the repository
+ *      root explicitly with --cd"`, `:357-371`). That is a different failure with a different
+ *      repair, so it gets its own reason — answering `Trust` at the child would only reproduce the
+ *      same vendor error. Note the vendor's own precondition there is `project_layers.is_empty()`,
+ *      which is why this reason is only reachable after step 2 has found no layer anywhere.
+ *
+ * WHAT THIS LEAF IS FOR, AND WHAT IT IS NOT. It is NOT equivalent to the vendor's judgment and
+ * must not be described as asking "the same question": it reads the operator's own `config.toml`,
+ * while the vendor reads an EFFECTIVE config — system, managed and cloud layers merged around that
+ * user layer (`config/src/loader/mod.rs:258-290`, `:430-460`) — through its app-server.
+ *
+ * That gap is affordable because NOTHING HERE REFUSES A LAUNCH. `freshCall` prints what this leaf
+ * saw and opens the window anyway: the consent screen is self-repairing when a human is there, and
+ * one answer teaches the vendor the directory for good. The one caller that treats the answer as a
+ * precondition is `smoke-codex-fresh-live`, where nobody is at the keyboard and a named
+ * precondition is worth more than a callback timeout — that gate owns one directory, answered
+ * once.
+ *
+ * So read a non-null answer as "the vendor will probably stop here, and this is the repair", never
+ * as a verdict. Absence is not evidence either way, and every case this leaf cannot see resolves
+ * to `null`.
+ */
+export function codexLaunchCwdFreshPreflight(env, launchCwd) {
+    // THREE NON-ANSWERS, AND EVERY ONE OF THEM PROCEEDS. Each is a case where this leaf holds no
+    // evidence about what the vendor will do, and a refusal without evidence is exactly the false
+    // refusal this axis promises not to produce:
+    //
+    //   - A RELATIVE directory. It cannot match a stored key here, but the vendor does not give up
+    //     on one — it asks its app-server for a cwd and joins (`config_update.rs:203-224`), so the
+    //     joined path may well be answered. In production this branch is unreachable anyway: the
+    //     shared cwd leaf already refuses a non-absolute request as `cwd-not-absolute`, which is a
+    //     better reason than anything this axis could give.
+    //   - NO READABLE USER CONFIG. A missing `config.toml` is not "no decisions": the vendor loads
+    //     an empty user table and merges system, managed and cloud layers around it
+    //     (`config/src/loader/mod.rs:258-290`, `:430-460`, `:520-610`), any of which can carry the
+    //     decision or the layer that starts the turn.
+    //   - NO `projects` TABLE. Same reason: it says the USER layer records nothing, not that the
+    //     effective config does.
+    if (!path.isAbsolute(launchCwd))
+        return null;
+    const config = readConfig(env);
+    if (config === null)
+        return null;
+    const projects = config.projects;
+    if (projects == null || typeof projects !== "object" || Array.isArray(projects)) {
+        return null;
+    }
+    const table = projects;
+    const levelOf = (key) => {
+        const entry = table[key];
+        if (entry == null || typeof entry !== "object" || Array.isArray(entry))
+            return null;
+        const level = entry.trust_level;
+        // An unrecognised value leaves `trust_level` as `None` on the vendor side too, and `None`
+        // with no project layer is precisely the case that renders the screen.
+        return level === "trusted" || level === "untrusted" ? level : null;
+    };
+    // Outcome 1: a direct decision, either answer.
+    if (levelOf(launchCwd) !== null)
+        return null;
+    // Outcome 2: a PROJECT LAYER may consent with no entry at all, and this leaf cannot enumerate
+    // layers — they come from the app-server's `ConfigRead { include_layers: true }` answer. What
+    // it CAN decide is the negative: a `.codex` anywhere from the directory upward is the only
+    // place such a layer comes from, so when none exists the vendor's `project_layers` really is
+    // empty and the two remaining outcomes below are computable. Where one could exist, answer
+    // `null`.
+    //
+    // EXISTENCE, not ownership, and the weaker predicate is the load-bearing one. The vendor
+    // admits a layer on its own terms — an unknown or untrusted one is preserved as a DISABLED
+    // layer, not dropped — and none of that consults owner/mode/symlink safety. Asking for a
+    // safely-owned directory here would let a layer the vendor sees go unseen by this leaf, which
+    // would then synthesise an `untrusted-ancestor` refusal for a launch the vendor was going to
+    // run. That is the false refusal this axis must never produce, so the check is the widest
+    // thing that still means "a layer could live here".
+    //
+    // The operator's own CODEX HOME is excluded, and excluding it is what keeps this axis from
+    // being a no-op: `~/.codex` is an ancestor of nearly every directory anyone launches a sibling
+    // in, and it is the USER config root rather than a project layer — the vendor names those
+    // apart (`layer.name.dotCodexFolder` for a project, the home for the user layer). Counting it
+    // would answer `null` for every path under `$HOME` and the check would never fire in real use.
+    const codexHome = path.resolve(env.CODEX_HOME?.trim() || path.join(env.HOME ?? "", ".codex"));
+    for (let dir = launchCwd;;) {
+        const candidate = path.join(dir, ".codex");
+        if (candidate !== codexHome && fs.existsSync(candidate))
+            return null;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    // Outcome 3: no layer anywhere and an explicitly untrusted ancestor — the vendor's own
+    // precondition for that branch is exactly `project_layers.is_empty()`, which the loop above
+    // has now established. It is reported as its own failure because its repair is to launch at
+    // that root, never to answer a prompt at the child.
+    //
+    // The MATCH IS NOT THE VENDOR'S and is not claimed to be. The vendor compares path URIs
+    // (`LegacyAppPathString` → `PathUri::starts_with`, segment-aware, fail-closed on encoded
+    // separators); this compares plain strings on a separator boundary. Where the two could
+    // disagree — a key or a cwd that is not a plain POSIX path — this answers `undecided` rather
+    // than `untrusted-ancestor`. Be exact about what that buys: BOTH are refusals, so this is NOT
+    // the launch-permissive direction. What it weakens is the SPECIFIC-ERROR claim — the ancestor
+    // reason names another directory as the repair, and naming the wrong one is worse than saying
+    // "no decision here". Neither vendor outcome on this branch starts a turn, so the guarantee
+    // above is untouched either way.
+    const plainPosixPath = (value) => !value.includes("%") && !value.includes("\\") && !value.split("/").some((seg) => seg === "." || seg === "..");
+    if (plainPosixPath(launchCwd)) {
+        for (const key of Object.keys(table)) {
+            if (levelOf(key) !== "untrusted" || !plainPosixPath(key))
+                continue;
+            if (launchCwd === key || launchCwd.startsWith(key.endsWith("/") ? key : `${key}/`)) {
+                return "codex-launch-cwd-untrusted-ancestor";
+            }
+        }
+    }
+    return "codex-launch-cwd-undecided";
+}
 const DEFAULT_APP_SERVER_TIMEOUT_MS = 5_000;
 function withTimeout(promise, timeoutMs) {
     return new Promise((resolve, reject) => {
@@ -304,14 +534,16 @@ export async function codexFreshPreflight(env, deps = {}) {
     if (!path.isAbsolute(paths.hooksFile) || !path.isAbsolute(paths.helperDir) || !path.isAbsolute(paths.stateFile)) {
         return "codex-birth-unit-missing";
     }
-    if (birthMissing(paths, deps.operatorUid ?? process.getuid?.() ?? -1)) {
+    const declaration = birthDeclaration(paths, deps.operatorUid ?? process.getuid?.() ?? -1);
+    if (declaration === null) {
         return "codex-birth-unit-missing";
     }
     const config = readConfig(env);
     // The vendor receipt is a SEPARATE reject from our bytes: perfect bytes the vendor will
     // not run and absent bytes are two different repairs, and folding them would send the
     // operator to the installer for something only they can answer in their own Codex.
-    if (config === null || trustReceiptMissing(config, paths.hooksFile))
+    const key = trustReceiptKey(paths.hooksFile, declaration.groupIndex, declaration.handlerIndex);
+    if (config === null || trustReceiptMissing(config, key))
         return "codex-birth-trust-missing";
     if (mcpMissing(config))
         return "codex-mcp-hand-missing";

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-control-rpc.js

@@ -38,6 +38,46 @@ export function formatSenderInfoBlock(sender, wantsReply = false) {
         ...(wantsReply ? { wants_reply: true } : {}),
     })}</sender_info>`;
 }
+// ============================================================================
+// Accepted-connection disconnect policy (server half of the same wire)
+// ============================================================================
+/** The two codes that mean THE PEER WENT AWAY, and nothing else. `EPIPE` is a write to a pipe the
+ * far side already closed; `ECONNRESET` is the far side resetting it. Both describe the client, not
+ * this process's state, which is why they are absorbed rather than diagnosed. */
+const PEER_DISCONNECT_CODES = new Set(["EPIPE", "ECONNRESET"]);
+export function isPeerDisconnect(error) {
+    return typeof error.code === "string" && PEER_DISCONNECT_CODES.has(error.code);
+}
+/**
+ * Install the disconnect policy on a connection this process ACCEPTED. Must run before any data
+ * handler and before any response can be written back.
+ *
+ * `[측정 2026-09-14, .agent-reports/116-c4-live-blocker-20260914.md]` a resident pi DIED without
+ * this. A sibling's control-socket send timed out while the receiving session was mid-turn, the
+ * sender closed its end, and the server then wrote its late response to a socket whose peer was
+ * gone. That EPIPE does NOT arrive as a throw — `writeResponse`'s synchronous try/catch cannot see
+ * it — it arrives asynchronously as an `error` event, and an `error` event with no listener is an
+ * uncaught exception, so Node terminated the whole session. The citizen then simply read as `dead`
+ * and the stale socket it left behind was the only trace.
+ *
+ * A client that went away is a BOUNDED environment condition, not invalid state: Rule 15's "crash,
+ * don't warn" governs states we cannot reason about, and losing an entire resident session because
+ * someone hung up is itself the silent failure. Same policy the MCP probe already carries for an
+ * async EPIPE on a child's stdin (`scripts/probe-bridge-command.ts:88-97`).
+ *
+ * Anything that is NOT a peer hanging up is diagnosed exactly once with its code and message and
+ * then served on. Swallowing every error would hide the class this listener is not here to absorb;
+ * rethrowing from an event callback would be the crash this whole function exists to prevent.
+ *
+ * `diagnose` is injected so a gate can count diagnostics without capturing global stderr.
+ */
+export function attachAcceptedSocketDisconnectPolicy(socket, diagnose = (line) => console.error(line)) {
+    socket.on("error", (error) => {
+        if (isPeerDisconnect(error))
+            return;
+        diagnose(`[entwurf-control] control socket error (${error.code ?? "no code"}): ${error.message}`);
+    });
+}
 export function parseGetInfoResponseData(data) {
     const value = data;
     return {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-fact-provider.js

@@ -27,7 +27,7 @@
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
 import { isOutOfSocketDomainGardenIdConflict, resolveFactList, UNOBSERVED_PEER, } from "./entwurf-facts.js";
-import { observePeerFacts } from "./entwurf-peer-observe.js";
+import { makeObservePeerFacts, readHerdrPlacementIndex } from "./entwurf-peer-observe.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, } from "./meta-session.js";
 import { scanSocketProbes } from "./socket-discovery.js";
@@ -140,7 +140,11 @@ export async function listEntwurfFacts(deps) {
     //    not performed becomes `unobserved`.
     const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
     const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-    const observe = deps.observe ?? observePeerFacts;
+    // The placement owner is read EXACTLY ONCE per listing, before any row is shaped, and
+    // never again for this call. That single read is the anti-watcher rule in code: herdr
+    // publishes no "the session reference landed" event, and a retry loop around that gap
+    // is the discovery watcher `docs/mux-launch-rail.md` §7 refuses by name.
+    const observe = deps.observe ?? makeObservePeerFacts((deps.readPlacementIndex ?? readHerdrPlacementIndex)());
     let selectedObserve = observe;
     if (deps.observationLimit !== undefined) {
         if (!Number.isSafeInteger(deps.observationLimit) || deps.observationLimit < 0) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-facts.js

@@ -30,9 +30,14 @@
  * the surrounding identity facts around it.
  */
 import { factLivenessOf, isLivenessSupported } from "./entwurf-v2-contract.js";
+import { UNOBSERVED_PLACEMENT } from "./herdr-placement.js";
 /** What a caller that measured nothing must say. Explicit and greppable — a row that
  * silently defaulted to `none`/`absent` would be a fabricated fact. */
-export const UNOBSERVED_PEER = { receiver: "unobserved", transcript: "unobserved" };
+export const UNOBSERVED_PEER = {
+    receiver: "unobserved",
+    transcript: "unobserved",
+    placement: UNOBSERVED_PLACEMENT,
+};
 /**
  * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
  *
@@ -57,6 +62,7 @@ export function resolvePeerFact(identity, socket, observations = UNOBSERVED_PEER
         liveness: factLivenessOf(identity.backend, socket),
         receiver: observations.receiver,
         transcript: observations.transcript,
+        placement: observations.placement,
     };
 }
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-peer-observe.js

@@ -13,14 +13,23 @@
  * about it: no `sendable`, no `deliverable`, no transport. The listing stays a listing —
  * dispatch still computes routing at call time from the same underlying markers.
  *
+ * THE PLACEMENT AXIS IS MEASURED ONCE, NOT PER CITIZEN (#116 S1). `receiver` and
+ * `transcript` are per-citizen filesystem questions; placement is one question asked of
+ * one placement owner about every pane it has. So the herdr read happens ABOVE this
+ * module (the provider does it once) and arrives here as an already-built index. That
+ * is also the anti-watcher shape: one read per listing, no retry, no wait for a pane
+ * whose session reference has not landed yet.
+ *
  * ONE MEASUREMENT, TWO WORDS. `receiver` is derived from the SAME
  * `resolveMailboxReceiverFacts` composition the v2 dispatch seam and `entwurf_self` use.
  * The surfaces are allowed to phrase it differently — a listing wants an enum, a reject
  * wants a sentence — but they may not disagree, so the enum is a projection of that atom
  * rather than a second opinion about the same markers.
  */
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import { resolveMailboxReceiverFacts } from "./entwurf-deliverability.js";
+import { buildPlacementIndex, parseHerdrPaneList, resolvePlacement, } from "./herdr-placement.js";
 import { metaCapabilityFor, metaReceiverMarkerPath, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "./meta-session.js";
 /**
  * The mailbox receiver axis for one citizen.
@@ -60,7 +69,63 @@ function observeTranscript(identity) {
         return "absent";
     }
 }
-/** The production observer: both axes, measured for one citizen. */
+/** How long the one placement read may take before we stop waiting for it. A listing
+ * must not hang on a placement owner: the column is a convenience and `unobserved` is
+ * a complete answer. */
+const HERDR_READ_TIMEOUT_MS = 2000;
+/**
+ * Read the placement owner ONCE, or decline to.
+ *
+ * TWO ENV FACTS DECIDE, AND BOTH ARE HERDR'S OWN (measured, herdr 0.9.0). `HERDR_ENV=1`
+ * is how herdr tells a process it is running inside herdr, and `HERDR_BIN_PATH` is the
+ * invocation path herdr's own plugin contract tells callers to use. Neither is
+ * discovered: if herdr did not put them in this process's environment we are not inside
+ * herdr and we make no claim. There is no path guess, no socket scan, and no PATH
+ * lookup — this must stay as explicit as Hard Rule 6 wants configuration to be.
+ *
+ * EVERY FAILURE IS `null`, NEVER AN EMPTY INDEX. A missing binary, a timeout, a nonzero
+ * exit or a payload we cannot parse all mean nobody measured. An empty index would say
+ * something much stronger — "herdr was read and has none of your citizens" — about a
+ * read that did not happen.
+ */
+export function readHerdrPlacementIndex(env = process.env) {
+    if (env.HERDR_ENV !== "1")
+        return null;
+    const bin = env.HERDR_BIN_PATH;
+    if (typeof bin !== "string" || bin.length === 0)
+        return null;
+    let stdout;
+    try {
+        stdout = execFileSync(bin, ["pane", "list"], {
+            encoding: "utf8",
+            timeout: HERDR_READ_TIMEOUT_MS,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        // Bounded environment probe: a placement owner that did not answer is a citizen
+        // column that reads `unobserved`, not a listing that fails.
+        return null;
+    }
+    const rows = parseHerdrPaneList(stdout);
+    return rows === null ? null : buildPlacementIndex(rows);
+}
+/**
+ * Build the production observer over an already-resolved placement index.
+ *
+ * `null` means no placement owner was read on this host — every citizen then reads
+ * `unobserved`, which is the only honest answer when nobody looked. It is NOT `none`:
+ * that word is reserved for a herdr that WAS read and does not have this citizen.
+ */
+export function makeObservePeerFacts(placementIndex) {
+    return (identity) => ({
+        receiver: observeReceiver(identity),
+        transcript: observeTranscript(identity),
+        placement: resolvePlacement(placementIndex, identity),
+    });
+}
+/** The production observer with no placement owner read — the shape every caller that
+ * has not resolved an index gets, and the default on a host with no herdr. */
 export function observePeerFacts(identity) {
-    return { receiver: observeReceiver(identity), transcript: observeTranscript(identity) };
+    return makeObservePeerFacts(null)(identity);
 }