@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/check-typing-call-fence.ts

@@ -0,0 +1,296 @@
+/**
+ * check-typing-call-fence — the boundary nobody has broken yet, kept by NAME.
+ *
+ * THE RULE: this product composes ARGUMENTS and LETTERS, never keystrokes. It is written in two
+ * places already — `docs/herdr-launch-rail.md` §3 ("키 입력(`agent prompt`): 터미널 입력이다") and
+ * `pi-extensions/lib/herdr-fresh-call.ts:28` — and until now nothing but prose held it.
+ *
+ * WHY A GATE FOR A RULE NOBODY BROKE `[외부 관측 2026-09-17 19:35]`. An outside reader measured the
+ * tree and found the law perfectly kept and nothing keeping it: zero typing calls across
+ * `pi-extensions/`, and zero checks and zero mutants that would notice one arriving. Gates here grow
+ * on top of incidents, and this boundary was named and refused at DESIGN time, so it never produced
+ * the failure that would have produced a test. A rule kept since day one is the most defenceless
+ * kind: the green that covers it means only "nobody has broken it yet".
+ *
+ * WHAT A TYPING CALL IS. Anything that reaches a sibling by writing into the place a HUMAN types:
+ * tmux `send-keys` / `paste-buffer` / `load-buffer`, and herdr's PTY verbs — `agent.prompt`,
+ * `agent.send_keys`, `pane.send_text`, `pane.input.set`. `[측정 2026-09-18, herdr @ 7505c08]` those
+ * herdr verbs are not an API delivery with an acknowledgement: `src/app/api/agents.rs:195` hands the
+ * text to `encode_api_submission_parts`, `src/app/api_helpers.rs:25-32` wraps it in bracketed paste,
+ * and the bytes go to the child pane's PTY followed 300 ms later by an encoded Enter. What is
+ * acknowledged is that input was written — herdr's own help says it "does not track turns". That is
+ * exactly what Hard Rule 16 keeps out of delivery evidence.
+ *
+ * SCOPE. The production surfaces `pi-extensions/` and `mcp/`, tracked files only (so the gitignored
+ * `mcp/entwurf-bridge/dist/` build output is not scanned twice as its own source). This gate lives
+ * in `scripts/`, which is NOT in scope — a gate that scanned itself could only be made green by
+ * deleting the names it exists to forbid.
+ *
+ * COMMENTS ARE EXEMPT, AND THAT IS LOAD-BEARING. The sentence stating the rule contains the very
+ * names the rule forbids. A scanner that read prose would be red on the rule itself, and the
+ * cheapest way to green would be deleting the sentence — the gate would eat its own law. So every
+ * file is reduced to CODE (string literals kept, comments blanked) before the names are looked for.
+ *
+ *   TYPEFENCE-PRODUCTION-CLEAN  no production module under pi-extensions/ or mcp/ carries a typing
+ *                               call in code. A module that acquires one is refused by name.
+ *
+ * The three assertions before it are this gate's own oracle: the detector is proven to SEE each
+ * forbidden name in planted code, proven NOT to see it in prose, and the scanned inventory is
+ * measured rather than assumed — without those, "zero hits" and "looked at nothing" read the same.
+ *
+ * WHAT THIS GATE DOES NOT CATCH, NAMED RATHER THAN IMPLIED (sol D3, 2026-09-18). It reads SPELLINGS.
+ * A typing call assembled at runtime — `["send", "keys"].join("-")`, a template with the verb in a
+ * variable, an RPC method built from parts — passes it, and no wording of this scanner would change
+ * that without becoming a dataflow analysis.
+ *
+ * That limit is accepted rather than closed, and the reason is what this gate is FOR. It is a
+ * tripwire for the slip: a module that reaches for the vendor's typing verb because the argv route
+ * looked harder that afternoon, written the ordinary way, spelled out. It is not a defence against
+ * somebody deliberately hiding one, and a gate that claimed to be would be the more dangerous
+ * object — the claim above therefore says CARRIES a typing call spelled out, not "composes" one.
+ * The defence against deliberate evasion is review, and the rule it enforces is in
+ * `docs/herdr-launch-rail.md` §3 where a human reads it.
+ */
+
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+let passed = 0;
+function ok(label: string, cond: boolean, detail = ""): void {
+	assert.ok(cond, detail ? `${label}\n${detail}` : label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+/** Each forbidden name, with the surface it belongs to. A pattern matches CODE only. */
+const TYPING_CALLS: readonly { readonly name: string; readonly pattern: RegExp; readonly surface: string }[] = [
+	{ name: "send-keys", pattern: /send-keys/, surface: "tmux / herdr CLI" },
+	{ name: "send_keys", pattern: /send_keys/, surface: "herdr agent.send_keys" },
+	{ name: "paste-buffer", pattern: /paste-buffer/, surface: "tmux" },
+	{ name: "load-buffer", pattern: /load-buffer/, surface: "tmux (feeds paste-buffer)" },
+	{ name: "send-text / send_text", pattern: /send[-_]text/, surface: "herdr pane.send_text" },
+	{ name: '"agent.prompt"', pattern: /["'`]agent\.prompt["'`]/, surface: "herdr JSON-RPC method" },
+	{ name: '"pane.input.set"', pattern: /["'`]pane\.input\.set["'`]/, surface: "herdr JSON-RPC method" },
+	{ name: '"agent","prompt"', pattern: /["'`]agent["'`]\s*,\s*["'`]prompt["'`]/, surface: "herdr CLI argv" },
+];
+
+type Flavor = "c" | "shell";
+
+/**
+ * Blank every comment, keep every code byte — including string literals, because a typing call
+ * spelled as a string IS the call. Offsets are preserved so a hit still reports its own line.
+ */
+function codeOnly(src: string, flavor: Flavor): string {
+	const out = src.split("");
+	let state: "code" | "line" | "block" | "sq" | "dq" | "tpl" = "code";
+	let i = 0;
+	while (i < src.length) {
+		const c = src[i];
+		const n = src[i + 1];
+		if (state === "code") {
+			if (flavor === "c" && c === "/" && n === "/") {
+				state = "line";
+				out[i] = " ";
+				out[i + 1] = " ";
+				i += 2;
+				continue;
+			}
+			if (flavor === "c" && c === "/" && n === "*") {
+				state = "block";
+				out[i] = " ";
+				out[i + 1] = " ";
+				i += 2;
+				continue;
+			}
+			// POSIX: `#` opens a comment only at the start of a word, so `${VAR#prefix}` is code.
+			if (flavor === "shell" && c === "#" && (i === 0 || /\s/.test(src[i - 1]))) {
+				state = "line";
+				out[i] = " ";
+				i += 1;
+				continue;
+			}
+			if (c === "'") state = "sq";
+			else if (c === '"') state = "dq";
+			else if (c === "`" && flavor === "c") state = "tpl";
+			i += 1;
+			continue;
+		}
+		if (state === "line") {
+			if (c === "\n") state = "code";
+			else out[i] = " ";
+			i += 1;
+			continue;
+		}
+		if (state === "block") {
+			if (c === "*" && n === "/") {
+				out[i] = " ";
+				out[i + 1] = " ";
+				state = "code";
+				i += 2;
+				continue;
+			}
+			if (c !== "\n") out[i] = " ";
+			i += 1;
+			continue;
+		}
+		// inside a string literal: bytes are kept, escapes consume the next byte
+		if (c === "\\") {
+			i += 2;
+			continue;
+		}
+		if ((state === "sq" && c === "'") || (state === "dq" && c === '"') || (state === "tpl" && c === "`")) {
+			state = "code";
+		}
+		i += 1;
+	}
+	return out.join("");
+}
+
+type Hit = { readonly file: string; readonly line: number; readonly name: string; readonly text: string };
+
+function scan(rel: string, src: string, flavor: Flavor): Hit[] {
+	const code = codeOnly(src, flavor);
+	const rawLines = src.split("\n");
+	const hits: Hit[] = [];
+	code.split("\n").forEach((codeLine, idx) => {
+		for (const call of TYPING_CALLS) {
+			if (call.pattern.test(codeLine)) {
+				hits.push({ file: rel, line: idx + 1, name: call.name, text: rawLines[idx].trim() });
+			}
+		}
+	});
+	return hits;
+}
+
+const flavorOf = (rel: string): Flavor => (rel.endsWith(".sh") ? "shell" : "c");
+
+// ── 1. the detector sees a planted typing call in code ──────────────────────
+{
+	const plantedTs = [
+		'const argv = ["send-keys", "-t", pane, text];',
+		'await run(["paste-buffer", "-t", pane]);',
+		'await run(["load-buffer", "-b", buf]);',
+		'const m = "agent.send_keys";',
+		'const t = "pane.send_text";',
+		'const p = "agent.prompt";',
+		'const i = "pane.input.set";',
+		'const cli = ["agent", "prompt", target, text];',
+	].join("\n");
+	const found = new Set(scan("fixture.ts", plantedTs, "c").map((h) => h.name));
+	ok(
+		`the detector names all ${TYPING_CALLS.length} typing calls planted in code (a green scan means it looked, not that it is blind)`,
+		found.size === TYPING_CALLS.length,
+		`missed: ${TYPING_CALLS.map((c) => c.name)
+			.filter((n) => !found.has(n))
+			.join(", ")}`,
+	);
+	ok(
+		"the shell flavor sees a typing call too — a launcher script is production surface",
+		scan("fixture.sh", 'tmux send-keys -t "$PANE" "$TEXT"\n', "shell").length === 1,
+	);
+	ok(
+		"a `${VAR#prefix}` expansion does not blind the shell scan for the rest of its line",
+		scan("fixture.sh", 'name="${PANE#%}"; tmux send-keys -t "$name" x\n', "shell").length === 1,
+	);
+}
+
+// ── 2. prose is exempt — the rule's own sentence must survive its own gate ──
+{
+	const prose = [
+		"// keystrokes (`agent prompt`) are terminal input, which this product does not use to launch.",
+		"/* tmux send-keys and paste-buffer are the shape this fence refuses. */",
+		'const real = "fine";',
+	].join("\n");
+	ok(
+		"a typing call NAMED in a comment is not a violation — otherwise the cheapest green would be deleting the sentence that states the rule",
+		scan("fixture.ts", prose, "c").length === 0,
+	);
+	ok(
+		"the same exemption in shell comments",
+		scan("fixture.sh", "# tmux send-keys is refused here\nexec node x.js\n", "shell").length === 0,
+	);
+	// The live sentence, read from the rail itself rather than quoted here: if it is ever reworded
+	// the exemption must be re-proved against what the file ACTUALLY says. Only the sentence is
+	// scanned — whether the module as a whole is clean is the LAW's claim below, not this one's.
+	const railLine = fs
+		.readFileSync(path.join(REPO, "pi-extensions/lib/herdr-fresh-call.ts"), "utf8")
+		.split("\n")
+		.find((l) => l.includes("keystrokes (`agent prompt`)"));
+	ok(
+		"the launch rail's own written rule names `agent prompt` and is exempt as the prose it is",
+		railLine !== undefined && scan("rail-rule", railLine, "c").length === 0,
+	);
+}
+
+// ── 3. the scanned inventory is MEASURED, never assumed ─────────────────────
+//
+// SCOPE grew on 2026-09-18 (sol D3 / glm #4). `plugins/herdr/` and the four `scripts/herdr-*.mjs`
+// runtime scripts are the code that actually drives the herdr CLI, and they sat OUTSIDE the law
+// that exists because of that CLI. They are clean today — this gate is what keeps them so.
+//
+// AND THE LISTING IS NOT `--cached` ALONE. A brand-new production module is untracked until it is
+// staged, so a fence that read only the index would look at everything except the file most likely
+// to be carrying the mistake. `--others --exclude-standard` adds exactly the untracked files git
+// would offer to add, which leaves the gitignored build output (`mcp/entwurf-bridge/dist/`) out
+// for the reason it always was: it is this source, compiled, and scanning it twice proves nothing.
+const SCOPE = ["pi-extensions", "mcp", "plugins/herdr"] as const;
+const files = [
+	...execFileSync(
+		"git",
+		["ls-files", "--cached", "--others", "--exclude-standard", "--", ...SCOPE.map((s) => `${s}/*`)],
+		{
+			cwd: REPO,
+			encoding: "utf8",
+		},
+	)
+		.split("\n")
+		.filter(Boolean),
+	// The herdr runtime scripts live in `scripts/`, which is NOT in scope as a whole — this gate
+	// is in there, and a gate that scanned itself could only be made green by deleting the names
+	// it exists to forbid. So they are named, one glob, by what they are.
+	...execFileSync("git", ["ls-files", "--cached", "--others", "--exclude-standard", "--", "scripts/herdr-*.mjs"], {
+		cwd: REPO,
+		encoding: "utf8",
+	})
+		.split("\n")
+		.filter(Boolean),
+]
+	.filter((f) => /\.(ts|js|mjs|cjs|sh)$/.test(f))
+	.filter((f) => fs.existsSync(path.join(REPO, f)));
+
+{
+	const required = [
+		"pi-extensions/lib/herdr-fresh-call.ts",
+		"pi-extensions/lib/mux-fresh-call.ts",
+		"pi-extensions/lib/fresh-call-composition.ts",
+		"pi-extensions/entwurf-control.ts",
+		"mcp/entwurf-bridge/src/index.ts",
+		// The two surfaces that drive the vendor CLI this law is about — named, so widening the
+		// scope cannot quietly narrow again.
+		"plugins/herdr/lib/build.mjs",
+		"scripts/herdr-runtime.mjs",
+	];
+	const missing = required.filter((r) => !files.includes(r));
+	ok(
+		`scope is non-vacuous: ${files.length} tracked production sources under ${SCOPE.join(" + ")}, both launch rails and the MCP bridge among them`,
+		files.length >= 50 && missing.length === 0,
+		missing.length ? `not scanned: ${missing.join(", ")}` : `only ${files.length} files matched`,
+	);
+}
+
+// ── 4. THE LAW ──────────────────────────────────────────────────────────────
+{
+	const hits = files.flatMap((rel) => scan(rel, fs.readFileSync(path.join(REPO, rel), "utf8"), flavorOf(rel)));
+	ok(
+		`[QK:TYPEFENCE-PRODUCTION-CLEAN] none of the ${files.length} production sources CARRIES a typing call spelled out — this rail builds arguments and letters, and a module that acquires one of these names in code is refused by name`,
+		hits.length === 0,
+		hits.map((h) => `${h.file}:${h.line} carries ${h.name} — ${h.text}`).join("\n"),
+	);
+}
+
+console.log(`\ncheck-typing-call-fence: ${passed} assertions passed over ${files.length} production sources`);

package/scripts/codex-birth-doctor.sh

@@ -7,18 +7,32 @@
 #   RUNTIME     is there a node the launcher can exec, and a Codex CLI at all?
 #   UNIT        are the declaration, launcher and closure present, ours by digest, and
 #               owned/permissioned so that nobody else could have written them?
+#   FOREIGN     what ELSE declares a SessionStart hook in that file — reported, never judged.
 #   TRUST       has the VENDOR recorded the operator's one-time decision for this exact
 #               declaration identity?
 #
+# WHAT THE UNIT AXIS CERTIFIES ABOUT hooks.json, AND WHAT IT STOPPED CERTIFYING (#117). Not the
+# file. entwurf owns ONE `SessionStart` group in a file it SHARES — Herdr's official Codex
+# integration appends its own, and the vendor runs both, because `[source]`
+# hooks/src/engine/discovery.rs:664-665 keys trust by `<path>:<event>:<group_idx>:<handler_idx>`.
+# So this doctor selects entwurf's group by its launcher command, checks its SHAPE and its
+# NORMALIZED digest (key order and indentation blind — measured: Herdr re-serializes the whole
+# document), and reports every other group as FOREIGN without ever certifying or editing it.
+#
 # WHAT THE TRUST AXIS IS, EXACTLY. It reads `$CODEX_HOME/config.toml` and looks for the
-# vendor's own receipt at the fixed key `<hooks.json>:session_start:0:0`, whose value must
-# be a `trusted_hash` of the shape `sha256:<64 hex>`. That is ALL it claims: a vendor trust
+# vendor's own receipt at `<hooks.json>:session_start:<our group>:<our handler>`, whose value
+# must be a `trusted_hash` of the shape `sha256:<64 hex>`. That is ALL it claims: a vendor trust
 # receipt is present for the declaration identity this unit publishes. It does NOT compute
 # what that hash should be, does not compare it to anything of ours, and therefore never
 # says the approval is cryptographically valid — the vendor hashes a normalized identity of
 # its own (`[source]` hooks/src/engine/discovery.rs:775-792) and recomputing it here would
 # be entwurf asserting authority over somebody else's security decision.
 #
+# AND IT IS READ AT THE INDEX OUR DECLARATION WAS JUST MEASURED AT, never at a constant. The old
+# spelling `…:session_start:0:0` was true only while entwurf was alone in the file; with a
+# neighbour at index 0 it reads THEIR receipt and reports it as ours — a green for a hook the
+# vendor has never been asked to run.
+#
 # WHAT THIS DOCTOR NEVER DOES. It does not write, pre-seed or repair `[hooks.state]`, and it
 # never launches Codex. A missing receipt is not something to fix from here: the operator
 # opens a visible Codex, answers the vendor's prompt once, and comes back.
@@ -49,7 +63,13 @@ HELPER_DIR="$UNIT_ROOT/helper"
 LAUNCHER_NAME="codex-birth-launch.sh"
 LAUNCHER="$HELPER_DIR/$LAUNCHER_NAME"
 STATE_FILE="$UNIT_ROOT/install-state.json"
+REPO_DIR="$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+DECLARATION_LIB="$REPO_DIR/pi-extensions/lib/codex-declaration.js"
 ME="$(id -u)"
+# Filled by the UNIT axis and read by the TRUST axis: the position our declaration was actually
+# found at. Empty means the UNIT axis could not locate it, and TRUST says so rather than guessing.
+DECL_GROUP_INDEX=""
+DECL_HANDLER_INDEX=""
 
 RED=0
 section() { printf '\n── %s %s\n' "$1" "─────────────────────────────────────────"; }
@@ -105,9 +125,25 @@ judge_parent() { # $1 = dir, $2 = label
 section "UNIT (the bytes this unit publishes, and whether they are still ours)"
 judge_parent "$PACKAGE_STATE_ROOT" "the package state root"
 judge_parent "$UNIT_ROOT" "the unit root"
+FOREIGN_LINES=""
+FOREIGN_SCANNED=0
+ORPHAN_DECLARATION=0
+if [ ! -e "$STATE_FILE" ] && [ ! -L "$STATE_FILE" ] && [ -f "$HOOKS_FILE" ] && [ -n "$NODE_BIN" ] && [ -f "$DECLARATION_LIB" ]; then
+  # A hooks.json with NO entwurf state is the ordinary shape on a host where only somebody else
+  # declares hooks — it is not evidence of anything of ours. What IS evidence is a group
+  # commanding OUR launcher with no receipt behind it, so that is the only thing asked about.
+  "$NODE_BIN" -e '
+    const fs = require("node:fs");
+    const [, lib, hooksFile, launcher] = process.argv;
+    import(lib).then((m) => {
+      const sel = m.selectEntwurfDeclaration(JSON.parse(fs.readFileSync(hooksFile, "utf8")), launcher);
+      process.exit(sel.ok || sel.code === "declaration-duplicated" ? 0 : 1);
+    }).catch(() => process.exit(1));
+  ' "$DECLARATION_LIB" "$HOOKS_FILE" "$LAUNCHER" >/dev/null 2>&1 && ORPHAN_DECLARATION=1
+fi
 if [ ! -e "$STATE_FILE" ] && [ ! -L "$STATE_FILE" ]; then
-  if [ -e "$HOOKS_FILE" ] || [ -e "$HELPER_DIR" ]; then
-    bad "no ownership state at $STATE_FILE, yet $HOOKS_FILE or $HELPER_DIR exists — those bytes are not provably ours and the inverse will refuse them. Inspect them."
+  if [ "$ORPHAN_DECLARATION" = "1" ] || [ -e "$HELPER_DIR" ]; then
+    bad "no ownership state at $STATE_FILE, yet an entwurf declaration or helper closure is present — those bytes are not provably ours and the inverse will refuse them. Inspect them."
   else
     # NOT an informational note. "Nothing is installed" is the most complete way for this
     # unit to be broken: no declaration, no closure, no record will ever be minted — and a
@@ -133,15 +169,21 @@ else
   INVENTORY="$("$NODE_BIN" -e '
     const fs = require("node:fs");
     const path = require("node:path");
-    const s = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    const [, stateFile, hooksFile, helperDir, lib, launcher] = process.argv;
+    // An async main, not a top-level body: `node -e` compiles its input as a script, where a
+    // top-level `return` is a SyntaxError, and the declaration leaf is an ESM `import()`.
+    void (async function main() {
+    const s = JSON.parse(fs.readFileSync(stateFile, "utf8"));
     const out = [];
     const hex = (v) => typeof v === "string" && /^[0-9a-f]{64}$/.test(v);
-    if (s.schema !== "codex-birth-install-state/v1") out.push("BAD\tforeign state schema " + JSON.stringify(s.schema));
+    if (s.schema === "codex-birth-install-state/v1") {
+      out.push("BAD\tthe ownership state is codex-birth-install-state/v1, which recorded a digest of the WHOLE hooks.json. This unit now owns ONE declaration inside a file it shares, so that receipt claims bytes it does not own. Repair: ./run.sh install-codex-birth (it supersedes the receipt, removes nothing, and rewrites no foreign byte)");
+    } else if (s.schema !== "codex-birth-install-state/v2") {
+      out.push("BAD\tforeign state schema " + JSON.stringify(s.schema));
+    }
     if (s.status !== "installed") out.push("BAD\tthe state status is " + JSON.stringify(s.status) + ", so a previous install did not finish publishing. Repair: ./run.sh install-codex-birth");
-    if (s.hooksFile !== process.argv[2]) out.push("BAD\tthe state is bound to " + s.hooksFile + ", not the fixed path " + process.argv[2]);
-    if (s.helperDir !== process.argv[3]) out.push("BAD\tthe state is bound to helper dir " + s.helperDir + ", not the fixed path " + process.argv[3]);
-    if (!hex(s.hooksSha256)) out.push("BAD\thooksSha256 is not a digest");
-    else out.push("WANT\t" + s.hooksSha256 + "\t" + s.hooksFile + "\tthe declaration");
+    if (s.hooksFile !== hooksFile) out.push("BAD\tthe state is bound to " + s.hooksFile + ", not the fixed path " + hooksFile);
+    if (s.helperDir !== helperDir) out.push("BAD\tthe state is bound to helper dir " + s.helperDir + ", not the fixed path " + helperDir);
     const expected = [
       "codex-birth-launch.sh",
       "meta-bridge-hook-codex.ts",
@@ -168,13 +210,81 @@ else
       out.push(["WANT", f.sha256, path.join(s.helperDir, f.path), "helper member " + f.path, f.mode ?? ""].join("\t"));
     }
     out.push("INFO\tunitVersion=" + (s.unitVersion ?? "?") + " nodeBin=" + (s.nodeBin ?? "?"));
-    process.stdout.write(out.join("\n") + "\n");
-  ' "$STATE_FILE" "$HOOKS_FILE" "$HELPER_DIR" 2>&1)" || { bad "the ownership state is unreadable or malformed: $INVENTORY"; INVENTORY=""; }
+
+    // ── the DECLARATION, judged as one group inside a file this unit shares ──
+    const decl = s.declaration;
+    const declOk = decl !== null && typeof decl === "object" && !Array.isArray(decl) && decl.event === "SessionStart" && typeof decl.command === "string" && hex(decl.sha256);
+    if (!declOk && s.schema === "codex-birth-install-state/v2") out.push("BAD\tthe state records no usable declaration receipt (event/command/sha256)");
+    const emit = () => process.stdout.write(out.join("\n") + "\n");
+    if (!declOk) return emit();
+    const m = await import(lib);
+    // OWNERSHIP BEFORE CONTENT (sol B3, 2026-09-18). This doctor used to read the CONTENT of the
+    // shared file without ever asking who owned it, while the fresh-call preflight refused a foreign
+    // uid or a group-writable mode outright — so a host could be GREEN here and refuse every
+    // launch as `codex-birth-unit-missing`. One predicate now answers for all four surfaces, and
+    // it answers first: a digest measured in a file somebody else can rewrite certifies nothing.
+    const owned = m.classifyOwnedPath(m.statOwnedPath(fs, hooksFile), process.getuid());
+    if (owned === "missing") {
+      out.push("BAD\tthe declaration file is MISSING: " + hooksFile + " — no Codex thread on this host can become a citizen. Repair: ./run.sh install-codex-birth");
+      return emit();
+    }
+    if (owned !== "ok") {
+      out.push("BAD\tthe declaration file " + m.OWNED_PATH_REFUSAL[owned] + " (" + hooksFile + ") — every Codex fresh call refuses this host for the same reason, so a green here would contradict the launcher");
+      return emit();
+    }
+    let text;
+    try {
+      text = fs.readFileSync(hooksFile, "utf8");
+    } catch (err) {
+      out.push("BAD\tthe declaration file could not be read (" + hooksFile + "): " + err.message);
+      return emit();
+    }
+    let sel;
+    try {
+      sel = m.selectEntwurfDeclaration(JSON.parse(text), launcher);
+    } catch (err) {
+      out.push("BAD\t" + hooksFile + " is not readable JSON (" + err.message + ")");
+      return emit();
+    }
+    // The SCAN marker is emitted whether or not there are neighbours, because "none" and "never
+    // looked" are different facts and only one of them claims anything about a file we read.
+    for (const group of sel.foreign) {
+      out.push("FOREIGN\tSessionStart group " + group.index + ": " + (group.commands.join(" | ") || "(no handler)"));
+    }
+    out.push("FOREIGNSCAN\t" + sel.foreign.length);
+    if (!sel.ok) {
+      out.push("BAD\tentwurf\u2019s own declaration is not certifiable in " + hooksFile + " — " + sel.code + ": " + sel.detail + ". Repair: ./run.sh install-codex-birth");
+      return emit();
+    }
+    if (sel.digest !== decl.sha256) {
+      out.push("BAD\tentwurf\u2019s own declaration was EDITED after install (" + hooksFile + " group " + sel.groupIndex + ": live normalized " + sel.digest + ", recorded " + decl.sha256 + ") — the inverse will refuse to remove it");
+      return emit();
+    }
+    if (decl.command !== m.entwurfDeclarationCommand(launcher)) {
+      out.push("BAD\tthe recorded declaration command " + JSON.stringify(decl.command) + " is not the one these fixed paths produce");
+      return emit();
+    }
+    out.push("DECL\t" + sel.groupIndex + "\t" + sel.handlerIndex + "\t" + sel.digest + "\t" + sel.foreign.length);
+    return emit();
+    })().catch((err) => {
+      process.stderr.write(err && err.message ? err.message : String(err));
+      process.exit(1);
+    });
+  ' "$STATE_FILE" "$HOOKS_FILE" "$HELPER_DIR" "$DECLARATION_LIB" "$LAUNCHER" 2>&1)" || { bad "the ownership state is unreadable or malformed: $INVENTORY"; INVENTORY=""; }
 
   while IFS="$(printf '\t')" read -r kind a b c d; do
     case "$kind" in
       BAD) bad "$a" ;;
       INFO) info "$a" ;;
+      FOREIGN) FOREIGN_LINES="${FOREIGN_LINES}${a}
+" ;;
+      FOREIGNSCAN) FOREIGN_SCANNED=1 ;;
+      DECL)
+        DECL_GROUP_INDEX="$a"; DECL_HANDLER_INDEX="$b"
+        ok "entwurf's declaration is certified at $HOOKS_FILE group $a handler $b (normalized sha256 $c)"
+        info "certified by NORMALIZED digest, not by file bytes: this unit owns one SessionStart group,"
+        info "and a neighbour re-serializing that document changes every byte and nothing of ours."
+        ;;
       WANT)
         if [ -L "$b" ]; then bad "$c is a SYMLINK ($b) — this unit publishes no links."
         elif [ ! -e "$b" ]; then bad "$c is MISSING: $b"
@@ -197,11 +307,37 @@ $INVENTORY
 EOF
 fi
 
+section "FOREIGN (what else declares a SessionStart hook in that file)"
+# REPORTED, NEVER JUDGED. Another integration's declaration is not this unit's to certify, to
+# repair or to remove, and its state says nothing about whether entwurf's own hook will run —
+# `[source]` discovery.rs:664-665 trusts per declaration, so neighbours are independent. This
+# section exists so an operator can SEE them, which is the difference between coexisting and
+# not knowing.
+if [ "$FOREIGN_SCANNED" = "0" ]; then
+  # NOT "none". The UNIT axis stopped before it read that document — an absent or unreadable
+  # ownership state, a missing file — and reporting "none" here would be this doctor asserting
+  # something about the operator's file that it never looked at.
+  info "NOT READ — the UNIT axis stopped before it could look at $HOOKS_FILE, so this doctor"
+  info "knows nothing about what else declares a SessionStart hook there. Repair the UNIT axis first."
+elif [ -n "$FOREIGN_LINES" ]; then
+  printf '%s' "$FOREIGN_LINES" | while IFS= read -r line; do
+    [ -n "$line" ] && info "$line"
+  done
+  info "present-but-foreign: not certified by this unit, never overwritten, never absorbed, and"
+  info "no input to any verdict above. Their own trust receipts are their owners' business."
+else
+  info "none — entwurf is the only SessionStart declaration in $HOOKS_FILE"
+fi
+
 TRUST_REPAIR="Repair: open a visible plain Codex (no flags), answer the vendor's prompt with
            'Trust all and continue', send one first turn, then re-run this doctor."
 
 section "TRUST (the vendor's receipt for this exact declaration)"
-if [ "$UNIT_ONLY" = "1" ]; then
+if [ -z "$DECL_GROUP_INDEX" ] && [ "$UNIT_ONLY" != "1" ]; then
+  bad "the UNIT axis could not locate entwurf's declaration, so there is no index to read a vendor
+           receipt at. A receipt read at a guessed position would be somebody else's approval.
+           Repair the UNIT axis first: ./run.sh install-codex-birth"
+elif [ "$UNIT_ONLY" = "1" ]; then
   info "--unit-only: the vendor receipt was NOT read. This is a skipped axis, not a green one."
 elif [ ! -e "$CODEX_HOME/config.toml" ]; then
   bad "$CODEX_HOME/config.toml does not exist, so the vendor has recorded no trust decision for $HOOKS_FILE.
@@ -212,7 +348,11 @@ else
   # The key the vendor writes is `<declaration path>:<event>:<group>:<handler>` — measured on
   # this host after one 'Trust all'. We look for exactly ours: a receipt for a DIFFERENT
   # declaration is not this unit's approval, however valid it is for whoever owns it.
-  TRUST_KEY="$HOOKS_FILE:session_start:0:0"
+  #
+  # THE INDEX COMES FROM THE UNIT AXIS, which just measured where our declaration actually sits.
+  # Spelling it `0:0` was right only while entwurf was alone in the file: with a neighbour at
+  # index 0, that constant reads THEIR receipt and reports it as ours.
+  TRUST_KEY="$HOOKS_FILE:session_start:$DECL_GROUP_INDEX:$DECL_HANDLER_INDEX"
   # python3 + tomllib, the same reader the two config atoms already use — node has no TOML
   # parser and inventing one here would be a second opinion about the vendor's own file.
   TRUST_OUT="$(python3 -c '
@@ -242,8 +382,11 @@ sys.stdout.write("PRESENT\t" + digest)
   case "$TRUST_KIND" in
     PRESENT)
       ok "a vendor trust receipt is present for $TRUST_KEY ($TRUST_DETAIL)"
-      info "this reports that the vendor RECORDED a decision for this declaration identity — it is"
-      info "not a cryptographic validation, and this doctor never computes what that hash should be."
+      info "this reports that the vendor RECORDED a decision for this declaration identity AT THE INDEX"
+      info "entwurf's declaration was just measured at — not a cryptographic validation. This doctor"
+      info "deliberately does NOT recompute what that hash should be: the vendor hashes a normalized"
+      info "identity of its own (discovery.rs:775-792), and reimplementing it here would make entwurf a"
+      info "second opinion about somebody else's security decision, drifting with every vendor release."
       ;;
     ABSENT)
       bad "no vendor trust receipt for this declaration — $TRUST_DETAIL. Until the operator answers the