@junghanacs/entwurf 0.36.0 → 0.36.1

package/scripts/mutants/codex-native.json

@@ -1014,6 +1014,58 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:CODEX-BIRTH-INVERSE-SOLE-OWNER]",
 			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-SOCKET-OWNER-HELD-INODE",
+			"title": "the named pid counts as the socket's holder for being named, so a wrapper whose subtree holds no fd on the LISTEN inode reads as owning it again",
+			"subject": "scripts/lib/codex-socket-listener.ts",
+			"find": ["\tconst holders = o.nodes.filter((node) => node.holdingFds.length > 0);"],
+			"replace": [
+				"\tconst holders = o.nodes.filter((node) => node.holdingFds.length > 0 || node.pid === o.namedPid);  // mutant: named means holding"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-SOCKET-OWNER-HELD-INODE]",
+			"signatureSource": "test/codex-socket-listener.test.ts"
+		},
+		{
+			"claim": "CODEX-SOCKET-OWNER-PID-REUSE",
+			"title": "only a vanished pid counts as moved, so a pid reused by another process between the two reads keeps the first process's ownership",
+			"subject": "scripts/lib/codex-socket-listener.ts",
+			"find": [
+				"\tconst moved = o.nodes.filter((node) => node.after?.startTime !== node.startTime || node.after?.ppid !== node.ppid);"
+			],
+			"replace": [
+				"\tconst moved = o.nodes.filter((node) => node.after === null || node.after.ppid !== node.ppid);  // mutant: reuse is not movement"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-SOCKET-OWNER-PID-REUSE]",
+			"signatureSource": "test/codex-socket-listener.test.ts"
+		},
+		{
+			"claim": "CODEX-SOCKET-OWNER-FD-REREAD",
+			"title": "the first fd read stands in for the second, so a holder that closed or handed off the LISTEN fd while another process kept the inode still reads as owning it",
+			"subject": "scripts/lib/codex-socket-listener.ts",
+			"find": ["\tconst heldAfter = listener.after?.holdingFds ?? [];"],
+			"replace": [
+				"\tconst heldAfter = listener.after?.holdingFds?.length ? listener.after.holdingFds : listener.holdingFds;  // mutant: the first read stands in"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-SOCKET-OWNER-FD-REREAD]",
+			"signatureSource": "test/codex-socket-listener.test.ts"
+		},
+		{
+			"claim": "CODEX-SOCKET-LISTEN-ROW-ONLY",
+			"title": "an accepted connection, which carries the listener's path without ACCEPTCON, is read as a second LISTEN row, so any attached client turns ownership indeterminate",
+			"subject": "scripts/lib/codex-socket-listener.ts",
+			"find": ["\t\tif ((Number.parseInt(flags ?? \"\", 16) & SO_ACCEPTCON) === 0) continue;"],
+			"replace": ["\t\t// mutant: every bound row at the path counts, listening or not"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-SOCKET-LISTEN-ROW-ONLY]",
+			"signatureSource": "test/codex-socket-listener.test.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-supply.json

@@ -8,7 +8,7 @@
 			"subject": "scripts/check-herdr-sandbox.ts",
 			"find": ["const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";"],
 			"replace": [
-				"const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";\nconst PINNED_FALLBACK = \"0.9.3\";\nvoid PINNED_FALLBACK;"
+				"const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";\nconst PINNED_FALLBACK = \"0.9.4\";\nvoid PINNED_FALLBACK;"
 			],
 			"gate": ["bash", "run.sh", "check-herdr-supply"],
 			"timeoutSeconds": 120,
@@ -19,8 +19,8 @@
 			"claim": "HSUP-DIGEST-SHAPE",
 			"title": "a pinned digest is truncated, so the check that is supposed to catch a swapped binary can no longer fail",
 			"subject": "scripts/fixtures/herdr-supply.json",
-			"find": ["\"sha256\": \"18a8dc65f1c2fa485884344356dea1cfd911c6f06cf46fa78e193f4087f4dba7\""],
-			"replace": ["\"sha256\": \"18a8dc65f1c2fa485884344356de\""],
+			"find": ["\"sha256\": \"493304fbefb0ed0ea0455f373b47f48d24e8774bc7974f4c916ad2e937675b23\""],
+			"replace": ["\"sha256\": \"493304fbefb0ed0ea0455f373b47\""],
 			"gate": ["bash", "run.sh", "check-herdr-supply"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:HSUP-DIGEST-SHAPE]",
@@ -119,14 +119,14 @@
 			"signatureSource": "scripts/check-herdr-supply.ts"
 		},
 		{
-			"claim": "HSUP-X86-UNEXECUTED",
-			"title": "the x86_64 asset is recorded as executed although no cell of this rail has ever run on it",
+			"claim": "HSUP-EXECUTION-RECEIPT-BOUND",
+			"title": "the x86_64 asset is recorded as executed with no receipt bound to this pin's version and its own full digest",
 			"subject": "scripts/fixtures/herdr-supply.json",
 			"find": ["\"executed\": false"],
 			"replace": ["\"executed\": true"],
 			"gate": ["bash", "run.sh", "check-herdr-supply"],
 			"timeoutSeconds": 120,
-			"signature": "[QK:HSUP-X86-UNEXECUTED]",
+			"signature": "[QK:HSUP-EXECUTION-RECEIPT-BOUND]",
 			"signatureSource": "scripts/check-herdr-supply.ts"
 		}
 	]

package/scripts/smoke-codex-fresh-live.ts

@@ -68,6 +68,7 @@ import {
 } from "../pi-extensions/lib/meta-session.ts";
 import { FRESH_CALL_BACKENDS } from "../pi-extensions/lib/mux-fresh-call.ts";
 import {
+	checkCodexSocketFile,
 	readCodexThread,
 	realCodexProtocolOpener,
 	resolveCodexDefaultSocketPath,
@@ -95,6 +96,12 @@ import {
 	sourceCleanupWindows,
 	validateFinalMailboxBody,
 } from "./lib/codex-fresh-source-receipts.ts";
+import {
+	describeCodexSocketOwnership,
+	judgeCodexSocketOwnership,
+	observeCodexSocketSubtree,
+	parseProcStat,
+} from "./lib/codex-socket-listener.ts";
 import { skipLive } from "./lib/live-skip.ts";
 import { parseTmuxRow, TMUX_COORDINATE_FIELDS, TMUX_COORDINATE_FORMAT } from "./lib/tmux-coordinate-row.ts";
 
@@ -697,7 +704,8 @@ async function run(): Promise<void> {
 	//                            `--cut` still refuses it as BLOCKED (MUST SKIP). Nothing is
 	//                            excused — a cut without this receipt remains impossible.
 	//   PRESENT BUT WRONG     -> FAIL, unchanged: a malformed or dead PID, a process whose
-	//                            argv is not a Codex app-server, a foreign uid, A == S. The
+	//                            argv is not a Codex app-server, a foreign uid, a subtree that
+	//                            does not hold the endpoint's LISTEN socket, A == S. The
 	//                            operator answered, and the answer is a defect.
 	// Nothing is inferred either way, and no default is invented for a value the operator
 	// did not give. The reproducible green is the invocation VERIFY and the release skill's
@@ -747,6 +755,10 @@ async function run(): Promise<void> {
 		fs.existsSync(procDir),
 		`missing ${procDir}`,
 	);
+	// Read BEFORE the uid/argv/environment checks below and handed to the socket-ownership
+	// observer, so the process those checks read and the process that owns the socket are the
+	// same one: a pid reused in between changes this start time and fails closed (#128).
+	const namedStartTime = parseProcStat(fs.readFileSync(path.join(procDir, "stat"), "utf8")).startTime;
 	const procStat = fs.statSync(procDir);
 	if (typeof process.getuid === "function") {
 		ok("the named app-server process belongs to this operator", procStat.uid === process.getuid());
@@ -774,15 +786,27 @@ async function run(): Promise<void> {
 	// cannot be borrowed into a claim about what a Codex MCP child inherits.
 	appServerEnv = { ...procEnv };
 	codexSocketPath = resolveCodexDefaultSocketPath(appServerEnv);
-	const expectedListen = `unix://${codexSocketPath}`;
-	const listensOnDefaultSocket = argv.some(
-		(arg, index) => (arg === "--listen" && argv[index + 1] === expectedListen) || arg === `--listen=${expectedListen}`,
+	// Ownership is read from the kernel, not from argv (#128). The endpoint is the one delivery
+	// itself connects to — the production classifier's verified physical socket — and the claim
+	// is that the named pid's OWN subtree holds its LISTEN inode. The argv `--listen` spelling
+	// is recorded in the receipt below and decides nothing: a wrapper whose child listens and a
+	// listener started with the vendor-default `--listen unix://` are both read as what they are.
+	const socketFile = checkCodexSocketFile(codexSocketPath);
+	ok(
+		"the default control path is a live socket or Codex's exact rendezvous alias — the endpoint delivery connects to",
+		socketFile.ok,
+		socketFile.ok ? "" : `${codexSocketPath}: ${socketFile.reason}`,
+	);
+	const socketOwnership = judgeCodexSocketOwnership(
+		observeCodexSocketSubtree(appServerPid, socketFile.connectPath, namedStartTime),
 	);
 	ok(
-		"the explicit app-server PID owns the same default UDS the fresh Codex runtime will use",
-		listensOnDefaultSocket,
-		`expected --listen ${expectedListen}; argv=${JSON.stringify(argv)}`,
+		"the explicit app-server PID's own process subtree holds the LISTEN socket at that verified endpoint",
+		socketOwnership.verdict === "owned",
+		`${describeCodexSocketOwnership(socketOwnership)}; argv=${JSON.stringify(argv)}`,
 	);
+	receipts["1a-codex-socket-ownership"] =
+		`advertised=${codexSocketPath}\nendpoint=${socketFile.connectPath}\n${describeCodexSocketOwnership(socketOwnership)}`;
 	const appServerCoordinate = inspectTmuxCoordinate("Codex app-server/MCP inherited seat", appServerEnv);
 	const fixtureCoordinate = inspectTmuxCoordinate("fixture/initial-Pi caller seat", process.env);
 	ok(

package/scripts/smoke-pi-durable-fresh-live.ts

@@ -538,9 +538,29 @@ ok(
 	fs.existsSync(liveDb),
 	liveDb,
 );
+const sqlite = await import("node:sqlite");
+// A doorbell input stays `placed` while the run that consumed it is active and turns `done` only when that run
+// ends (pi-durable's SubmissionRecord). Pi's relay can land before pd's final generation commits, so the snapshot
+// waits for THIS message's submission to settle (`done` or `unanswered`); the assertions below judge what settled.
+const msgName = /meta-mailbox → enqueued \(([^)]+)\)/.exec(piToPd.text)?.[1] ?? "";
+const doorbellRequestId = `entwurf-doorbell:${pdGid}:${msgName}`;
+if (msgName !== "") {
+	receipts["6-native-doorbell-settled"] = await until(`pd's doorbell submission to settle`, TURN_WAIT_MS, () => {
+		const live = new sqlite.DatabaseSync(liveDb, { readOnly: true });
+		try {
+			const rows = live.prepare("SELECT status, record FROM submissions").all() as Array<{
+				status: string;
+				record: string;
+			}>;
+			const hit = rows.find((r) => (JSON.parse(r.record) as { requestId?: unknown }).requestId === doorbellRequestId);
+			return hit?.status === "done" || hit?.status === "unanswered" ? hit.status : null;
+		} finally {
+			live.close();
+		}
+	});
+}
 const snapshot = path.join(receiptsDir, "pd-session.snapshot.sqlite");
 fs.mkdirSync(receiptsDir, { recursive: true });
-const sqlite = await import("node:sqlite");
 {
 	const source = new sqlite.DatabaseSync(liveDb, { readOnly: true });
 	try {
@@ -599,8 +619,7 @@ ok(
 	JSON.stringify(pdToPi),
 );
 receipts["6-pd-to-pi-settled"] = JSON.stringify(pdToPi);
-const msgName = /meta-mailbox → enqueued \(([^)]+)\)/.exec(piToPd.text)?.[1] ?? "";
-const doorbell = pdDoorbellSubmission(nativeSubmissions, rootId, `entwurf-doorbell:${pdGid}:${msgName}`);
+const doorbell = pdDoorbellSubmission(nativeSubmissions, rootId, doorbellRequestId);
 receipts["6-native-doorbell-submission"] = JSON.stringify(doorbell);
 ok(
 	"the doorbell admitted THIS message's notice to the root conversation and the submission is done",