@lyupro/codex-bridge 0.6.10 → 0.6.11

package/src/agents/codex-scout.md

@@ -15,136 +15,17 @@ ChatGPT subscription. All heavy work (reading files, reasoning, generating the r
 on the Codex side. Every extra line you send to chat costs Claude tokens. Therefore: do not read
 files, do not run grep, do not retell the report, and do not reason about the task.
 
-## Required dispatcher inputs
-
-{{CODEX_REQUIRED_INPUTS}}
-
-## What you receive as input
-
-- The task statement (what to find out / what to diagnose / what to review).
-- The path to a task file containing that statement verbatim. The orchestrator supplies this path;
-  pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the
-  flag exists to remove. Given no path, start the runner without the flag and return its refusal.
-- The path to the repository. If none is given, work in the current working directory.
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts.
-- Optional: `effort: <none|low|medium|high|xhigh|max>` — Codex reasoning depth.
-- Optional: `slug: <short-name>` for the run folder; by default, the slug is taken from the order
-  id.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`. Never invent a value, never edit one, never reuse an order id from
-  another order — the runner chains runs by that label, and a made-up label is how a repeat run
-  hides. If the orchestrator did not give a required input, do not guess — start the runner without
-  its flag and return the runner's refusal verbatim.
-- The sub-questions are NOT yours to pass. They live in the task file the orchestrator wrote, under
-  a `Questions` heading, one Markdown list item each. A question may carry the orderer's
-  `[context-only]` marker; the dispatcher never adds, removes or repairs it. You never read that
-  file, never edit it and never put a question on the command line: a question is free prose, and
-  free prose in an argument
-  makes the host stop applying the operator's permission rule, which is how a delegation dies on a
-  refusal. If the file holds no question, start the runner anyway and return its refusal verbatim.
-- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
-  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
-  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
-  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
-  and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal
-and asks the operator to make it permanent. On 2026-08-15 an order in another repository did all
-three in sequence and ended by telling its operator to grant a rule on `run-codex.mjs`.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-scout --repo "<repository-path or .>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
+{{CODEX_DISPATCHER_PROTOCOL}}
+
+## Role notes
 
-Nothing else goes on that line. The sub-questions travel inside the task file; a `--question` flag
-is for a human calling the runner by hand, never for you.
-
-Add `--effort "<value>"` only when the orchestrator named a depth, and only with one of
-`none|low|medium|high|xhigh|max`. Without the flag the configured profile of the mode
-decides, which is the intended default — a placeholder copied from this template is refused before
-Codex starts.
-
-If the orchestrator's call carries a line beginning with `continue:` or `retry:`, add the bare
-`--continue` flag even when its run name or reason looks malformed. Do not inspect, repair, or
-swallow the line;
-the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
-present in the command.
-No value
-is passed to it: the runner accepts only `1/true/yes/0/false/no`, while a placeholder string left in
-the
-command from this template is an argument error, and the run will not start. If it was not given,
-the flag
-must not be present in the command at all.
-
-The call does not wait. It starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get the verdict, run the **identical command a second time** — same `--order-id`,
-same `--slug`, same flags. That second call does not start a second run and costs no quota: it
-attaches to the run already in flight, prints `ATTACH=<path> order-id=<id> started=<time>`, blocks
-until the verdict exists and prints it.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
-remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
-attaching call `timeout: 1800000` (30 minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it turns a repeat into a second paid run.
-On 2026-08-03 one order became six runs exactly this way, and four of them were never accounted for
-at all.
-
-The runner does the rest: creates the run folder, `task.md` (the verbatim task + instructions for
-Codex),
-the response schema, the synchronous Codex run in a read-only sandbox, `meta.json`, artifact status,
-and ready-made response lines.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it.
-Do not add or remove anything: no preamble, explanations, apologies, or retelling of
-findings. The report is in the file; the orchestrator will read it if needed.
-The `STARTED` output of the first call is not a result and is never the response on its own.
-
-The only allowed final response is this exact stdout. Wording such as "the run has started,
-waiting for completion," "I will wait for a notification," or "Monitor started in the background" is
-prohibited in any
-form: the subagent ceases to exist immediately after responding, nobody can wait, and the
-orchestrator gets
-a promise instead of a result. This is the same failure as in codex-build: the dispatcher gives
-such a response while a run is live, it is left without an owner, and this can only be discovered by
-checking
-`status.json` manually.
-Inventing any outcome the runner did not print is equally prohibited. On 2026-08-13 a dispatcher said
-`FAIL — could not get the Codex run result because of an architectural environment limitation` while
-that run's `status.json` already said `state=finished`, `status=OK`.
+The sub-questions are NOT yours to pass. They live in the task file the orchestrator wrote, under
+a `## Questions` heading, one Markdown list item each. A question may carry the orderer's
+`[context-only]` marker; the dispatcher never adds, removes or repairs it. You never read that
+file, never edit it and never put a question on the command line: a question is free prose, and
+free prose in an argument
+makes the host stop applying the operator's permission rule, which is how a delegation dies on a
+refusal. If the file holds no question, start the runner anyway and return its refusal verbatim.
 
 ## What you return
 
@@ -198,7 +79,7 @@ The run folder contains `status.json` (`running` / `finished` / `failed` / `aban
 runner pid.
 An abandoned run is not a reason to start over yourself: the orchestrator decides whether to repeat
 it, and
-without the `--continue` it issued, the runner will reject that repeat run itself. Only a run still
+without the orchestrator's `continue:` or `retry:` grant in the task-file header, the runner will reject that repeat run itself. Only a run still
 alive is attached to; a run that already has a verdict sends your repeat into that same refusal,
 which is the runner telling you the answer is on disk already.
 

package/src/home/hooks/dispatcher-gate.mjs

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import { AGENTS } from '../lib/agents.mjs';
 import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { sameCommand } from '../lib/dispatcher-command.mjs';
+import { bindReceipt, runnerReceipt } from '../lib/dispatcher-order.mjs';
 import { parseJsonText } from '../lib/json-file.mjs';
 import {
   decidePreToolUse,
@@ -17,7 +18,7 @@ import {
   readDispatcherState,
   updateDispatcherState,
 } from '../lib/dispatcher-state.mjs';
-import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { recordInterceptedAttempt, witnessHostVersion } from '../lib/handback-witness.mjs';
 import { observeSessionHost } from '../lib/host-observations.mjs';
 
 function emit(decision, toolInput) {
@@ -81,6 +82,7 @@ async function main() {
         const next = {
           ...(current.corrupt ? {} : current),
           ...(decision.stateUpdate || {}),
+          agentType: payload.agent_type,
         };
         if (toolUseId) {
           const seenToolUseIds = Array.isArray(next.seenToolUseIds) ? next.seenToolUseIds : [];
@@ -97,9 +99,8 @@ async function main() {
 
     if (payload.tool_name === HANDBACK_TOOL) {
       try {
-        await recordHandbackWitness({
+        await recordInterceptedAttempt({
           stateDir: BRAND_STATE_DIR,
-          kind: 'seen',
           hostVersion: await witnessHostVersion(payload),
         });
       } catch {}
@@ -119,12 +120,16 @@ async function main() {
       if (!order.command || !sameCommand(payload.tool_input?.command, order.command)) return;
       const result = runnerOutput(payload);
       if (!result) return;
-      await updateDispatcherState(ids, (current) => ({
-        ...(current.corrupt ? {} : current),
-        runnerOutput: result.output,
-        runnerFinal: isFinalOutput(result.output),
-        runnerExitCode: result.exitCode,
-      }));
+      await updateDispatcherState(ids, (current) => {
+        const base = current.corrupt ? {} : current;
+        return {
+          ...base,
+          ...bindReceipt(base, runnerReceipt(result.output)),
+          runnerOutput: result.output,
+          runnerFinal: isFinalOutput(result.output),
+          runnerExitCode: result.exitCode,
+        };
+      });
     } catch {}
   }
 }

package/src/home/hooks/live-runs.mjs

@@ -18,8 +18,6 @@ import { readJsonFileSync } from '../lib/json-file.mjs';
 import { runLiveness } from '../lib/meta/run-liveness.mjs';
 import { IDENTITY_ALIVE } from '../lib/process-identity.mjs';
 
-export const RECENT_RUN_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-
 /**
  * Match the package's repository comparison without resolving symlinks: Windows realpath adds
  * `\\?\\` and UNC spellings, turning equal paths into unequal ones. A null result is uncertainty,
@@ -98,45 +96,6 @@ export function liveRuns(runsDir, options = {}) {
   return result;
 }
 
-/**
- * Find runs recent enough to explain the current dispatcher reply, including completed runs.
- * The 24-hour window covers long and overnight dispatches without letting old project history
- * explain a new reply. This closes the August 13 incident where a fabricated FAIL hid a
- * finished/OK run simply by omitting its folder. Null means the disk could not be trusted.
- */
-export function recentRuns(runsDir, options = {}) {
-  if (typeof runsDir !== 'string' || !runsDir.trim()) return null;
-  const now = options.now ?? Date.now();
-  const maxAgeMs = options.maxAgeMs ?? RECENT_RUN_MAX_AGE_MS;
-  let entries;
-  try {
-    entries = fs.readdirSync(runsDir, { withFileTypes: true });
-  } catch (err) {
-    return err.code === 'ENOENT' ? [] : null;
-  }
-
-  const result = [];
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dir = path.join(runsDir, entry.name);
-    const statusPath = path.join(dir, 'status.json');
-    if (!fs.existsSync(statusPath)) continue;
-    let status;
-    try {
-      status = readJsonFileSync(statusPath);
-    } catch {
-      return null;
-    }
-    if (!status || typeof status !== 'object' || Array.isArray(status)) return null;
-    if (options.agent && status.agent !== options.agent) continue;
-    if (options.orderId && String(status.order_id ?? '').trim() !== options.orderId) continue;
-    const timestamp = Date.parse(status.finished_at || status.started_at || '');
-    if (!Number.isFinite(timestamp) || timestamp > now || now - timestamp > maxAgeMs) continue;
-    result.push({ dir, status, timestamp });
-  }
-  return result.sort((a, b) => b.timestamp - a.timestamp);
-}
-
 /** Scan every project under the configured runs root for worktree ownership. */
 export function allLiveRuns(runsRoot, options = {}) {
   if (typeof runsRoot !== 'string' || !runsRoot.trim()) return [];

package/src/home/hooks/order-gate.mjs

@@ -2,10 +2,10 @@
 /**
  * PreToolUse gate for the Codex dispatchers (codex-scout / codex-build / codex-review).
  *
- * The runner rejects a dispatcher immediately when order id (and scope for codex-build) is
- * absent, but the old requirement lived only in the prompt read by the dispatcher. The caller
- * therefore had no enforced place to provide it and codex-build died before doing work. This
- * gate checks the producer's task text while it can still be corrected.
+ * Plan_63 D9: the call carries only the task file; order id and grant come from its header.
+ * OW-054: validate the header and order before a grant can skip the order-owner diagnostic,
+ * so a `continue: none` line cannot disarm the check. The producer can still correct the order
+ * before the runner creates a run folder or spends quota.
  *
  * Input is Claude Code's hook JSON on stdin. The last payload is retained for diagnostics so a
  * future host schema change can be inspected instead of guessed at. Any uncertain shape passes
@@ -14,15 +14,14 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { modelLatch, readDispatcherModel } from '../lib/dispatcher-model.mjs';
+import { readDispatcherPin } from '../lib/dispatcher-pin.mjs';
 import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
+import { transcriptHostVersion } from '../lib/host-version.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
-import {
-  diagnoseInput,
-  extractValue,
-  missingInputs,
-  parseGrant,
-  shellUnsafeInputs,
-} from '../lib/required-inputs.mjs';
+import { parseDispatcherCall, renderCallRefusal } from '../lib/dispatcher-call.mjs';
+import { orderFromHeader, renderOrderProblems } from '../lib/order-schema.mjs';
 import { SUBAGENT_TOOLS } from '../lib/hook-definitions.mjs';
 import { taskFingerprint } from '../lib/meta/chain.mjs';
 import { conflictingOrderOwner, orderOwnerConflictText } from '../lib/runner/order-owner.mjs';
@@ -30,6 +29,7 @@ import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { parseTaskDocument } from '../lib/runner/task-file.mjs';
 import { parseTaskHeader, taskHeaderRefusal } from '../lib/task-header.mjs';
+import { envModelProblem } from '../lib/subagent-model-env.mjs';
 
 const GUARDED = new Set(Object.keys(AGENTS));
 /**
@@ -39,9 +39,14 @@ const GUARDED = new Set(Object.keys(AGENTS));
  */
 const SUBAGENT_TOOL_NAMES = new Set(SUBAGENT_TOOLS);
 
-const pass = () => process.exit(0);
+let systemMessage;
+const pass = () => {
+  if (systemMessage) process.stdout.write(JSON.stringify({ systemMessage }));
+  process.exit(0);
+};
 const deny = (reason) => {
   process.stdout.write(JSON.stringify({
+    ...(systemMessage ? { systemMessage } : {}),
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
       permissionDecision: 'deny',
@@ -65,7 +70,37 @@ if (!SUBAGENT_TOOL_NAMES.has(input.tool_name)) pass();
 
 const toolInput = input.tool_input;
 if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) pass();
-if (!GUARDED.has(toolInput.subagent_type) || typeof toolInput.prompt !== 'string') pass();
+if (!GUARDED.has(toolInput.subagent_type)) pass();
+
+// Plan_67 D6: one installed model contract; refuse even matching aliases before prompt exits.
+const agentType = toolInput.subagent_type;
+if (Object.hasOwn(toolInput, 'model')) {
+  deny(
+    "Order gate denied the Agent call because it passes `model`: a dispatcher's model is set in one place, "
+      + `its installed agent file. Call ${agentType} without model. `
+      + 'The run folder was not created; quota was not spent.',
+  );
+}
+try {
+  const hostVersion = await transcriptHostVersion(input.transcript_path).catch(() => null);
+  const pin = readDispatcherPin({ brandRoot: BRAND_HOME.root, agentType });
+  const problem = envModelProblem({ env: process.env, hostVersion, pinFamily: pin.family });
+  if (problem) deny(problem);
+} catch {
+  // D6 (b): uncertain host/env evidence is diagnostic only; the stop observer still checks it.
+}
+try {
+  const latch = modelLatch({ ledger: readDispatcherModel({ stateDir: BRAND_STATE_DIR }), agentType });
+  if (latch.active) {
+    const { data, at } = latch.violation;
+    systemMessage = `codex-bridge: the last ${agentType} ran on ${data.parsed.join(', ')} `
+      + `while the installed contract pins ${data.pinFamily} (${data.hostVersion ?? 'unknown'}, ${at}); `
+      + 'the cause is outside this call — another hook or the host; run codex-bridge doctor.';
+  }
+} catch {
+  // D4 (a): a corrupt ledger must not turn a diagnostic warning into a refusal.
+}
+if (typeof toolInput.prompt !== 'string') pass();
 
 /**
  * Plan_62 D7: with agent teams enabled, a registered dispatcher launched with `name` or `team_name`
@@ -83,28 +118,9 @@ if (teammateField) {
   );
 }
 
-const missing = missingInputs(toolInput.subagent_type, toolInput.prompt);
-const unsafe = shellUnsafeInputs(toolInput.subagent_type, toolInput.prompt);
-if (missing.length || unsafe.length) {
-  const reason = missing.length
-    ? [
-        'Order gate denied the Agent call because required dispatcher input(s) are missing or still placeholders.',
-        'Write each value in tool_input.prompt using `label: value` before launching the dispatcher:',
-        ...missing.flatMap((entry) => {
-          const lines = [`- ${entry.label}: ${entry.explanation} Example: \`${entry.example}\`.`];
-          const diagnosis = diagnoseInput(toolInput.prompt, entry.label);
-          if (diagnosis) lines.push(`  found \`${diagnosis.line}\`, ${diagnosis.reason}`);
-          return lines;
-        }),
-      ].join('\n')
-    : [
-        'Order gate denied the Agent call because labelled dispatcher input(s) contain forbidden shell sequences.',
-        'Correct each field before launching the dispatcher:',
-        ...unsafe.map(({ entry, sequence }) =>
-          `- ${entry.label}: found ${JSON.stringify(sequence)}; put free text in the task file and pass only a short command-line value.`),
-      ].join('\n');
-  deny(reason);
-}
+// Plan_76 D1: exact registry labels prevent the scope-new and repository-prose incident of 2026-10-04.
+const call = parseDispatcherCall(toolInput.subagent_type, toolInput.prompt);
+if (call.problems.length) deny(renderCallRefusal(toolInput.subagent_type, call.problems));
 
 const readStatus = (file) => {
   try {
@@ -114,11 +130,7 @@ const readStatus = (file) => {
   }
 };
 
-const orderId = extractValue(toolInput.prompt, 'order id');
-const taskFile = extractValue(toolInput.prompt, 'task file');
-// Plan_75 D1, TradeForge capacity incident: retries keep their order; the runner owns conflicting-grant refusal.
-const grant = parseGrant(toolInput.prompt);
-if (!orderId || !taskFile || grant?.kind || grant?.error) pass();
+const taskFile = call.inputs.get('task file');
 
 let rawTask;
 try {
@@ -130,6 +142,13 @@ try {
 const parsed = parseTaskHeader(rawTask);
 const headerRefusal = taskHeaderRefusal(parsed);
 if (headerRefusal) deny(headerRefusal);
+const { order, problems } = orderFromHeader(toolInput.subagent_type, parsed);
+if (problems.length) {
+  deny(`${renderOrderProblems(toolInput.subagent_type, problems)}\nThe run folder was not created; quota was not spent.`);
+}
+const orderId = order.get('order id');
+// Plan_63 D9 / OW-054: only a validated header grant reaches the runner's grant rules.
+if (parsed.grant) pass();
 let taskHash;
 try {
   taskHash = taskFingerprint(parseTaskDocument(parsed.body).task);

package/src/home/hooks/reply-guard.mjs

@@ -24,6 +24,7 @@
  * In the handback era, SubagentHandback delivers the caller-visible answer before SubagentStop.
  * Alarms name the host by its transcript version: on 2026-09-25 the SDK variable proved inherited.
  * Plan_62 makes this hook yield after delivery and audit every transcript tool call against gate receipts.
+ * Plan_63 D10 identifies this run only by the host-keyed gate's immutable runner receipt.
  *
  * Input is JSON on stdin. The fields used here (`agent_type`, `last_assistant_message`)
  * come from Claude Code; the last payload is kept in state/diagnostics/reply-guard.last.json
@@ -32,20 +33,21 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
-import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
-import { runOrderMismatch, transcriptOrderId } from '../lib/dispatcher-order.mjs';
 import { decideDispatcherStop, transcriptToolUses } from '../lib/dispatcher-stop.mjs';
+import { observeDispatcherModelStop } from '../lib/dispatcher-model.mjs';
 import { recognizeHostRefusal } from '../lib/host-refusal.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 import { readDispatcherState, updateDispatcherState } from '../lib/dispatcher-state.mjs';
-import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { witnessHostVersion } from '../lib/handback-witness.mjs';
+import { untypedStopEvidence } from '../lib/untyped-stop.mjs';
 import { runLiveness } from '../lib/meta/run-liveness.mjs';
-import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
-import { runsRoot } from '../lib/runner/runs-root.mjs';
-import { liveRuns, normalizePath, recentRuns } from './live-runs.mjs';
+import { liveRuns, normalizePath } from './live-runs.mjs';
 import { FORM, MAX_STATE_BLOCKS, STATE, takeTry } from './guard-tries.mjs';
 import { parseReply } from './reply-parser.mjs';
+import { recordStopWitness, typedStopObservations, untypedStopObservation } from './reply-witness.mjs';
+import { decideReplyIdentity, missingIdsAlarm, readReceiptEvidence } from './reply-identity.mjs';
 import {
   abandonedRunReason,
   abandonedRunStop,
@@ -58,14 +60,11 @@ import {
   missingHostOrderIdReason,
   missingMetaReason,
   missingRunReason,
-  noRecentRunReason,
-  noRecentRunStop,
   nonexistentRunReason,
   omittedDiscoveredRunReason,
   omittedDiscoveredRunStop,
   omittedSiblingReason,
   omittedSiblingStop,
-  orderMismatchStop,
   statusMismatchReason,
   statusMismatchStop,
 } from './reply-verdicts.mjs';
@@ -114,20 +113,24 @@ try {
 
 recordHookDiagnostic('reply-guard', input);
 
-// A host that stops sending agent_type would let every dispatcher past the gate and this
-// audit without a word (Plan_66 D2 (c)); say so instead of passing silently.
+// Plan_67 D9: only evidence bound to this stop can identify an untyped dispatcher.
 if (typeof input.agent_id === 'string' && input.agent_id.length > 0
   && !(typeof input.agent_type === 'string' && input.agent_type.length > 0)) {
+  let evidence;
   try {
-    await recordHandbackWitness({
-      stateDir: BRAND_STATE_DIR,
-      kind: 'alarm',
-      hostVersion: await witnessHostVersion(input),
-      detail: `host omitted agent_type for agent ${input.agent_id}`,
-    });
+    const state = typeof input.session_id === 'string' && input.session_id.length > 0
+      ? readDispatcherState({ stateDir: BRAND_STATE_DIR, sessionId: input.session_id, agentId: input.agent_id }) : null;
+    const transcript = transcriptToolUses(input.agent_transcript_path);
+    evidence = untypedStopEvidence({ state, toolUses: transcript?.toolUses ?? null });
   } catch {
-    // Plan_66 H2: the 2026-09-17..24 handback break showed host contract loss must alarm, but never block work.
+    // An unreadable state is no evidence either way; a guard failure must never break the stop.
+    evidence = { dispatcher: false, reason: 'state-unreadable' };
   }
+  const { observation, alarm } = untypedStopObservation({
+    evidence, hostVersion: await witnessHostVersion(input), agentId: input.agent_id,
+  });
+  await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: [observation] });
+  if (!alarm) pass();
   process.stdout.write(JSON.stringify({
     systemMessage: 'codex-bridge: the host did not report agent_type for a subagent — the dispatcher gate cannot recognise dispatchers, so their answers are unchecked; run codex-bridge doctor.',
   }));
@@ -137,32 +140,40 @@ if (typeof input.agent_id === 'string' && input.agent_id.length > 0
 // business — an earlier version inferred the agent from transcript text and blocked an
 // unrelated one, which cost a re-answer for nothing.
 if (!GUARDED.has(input.agent_type)) pass();
+try {
+  dispatcherSystemMessage = await observeDispatcherModelStop({
+    brandRoot: BRAND_HOME.root, stateDir: BRAND_STATE_DIR, input, hostVersion: await witnessHostVersion(input),
+  });
+} catch { /* Plan_67 D4: model diagnostics must never block a dispatcher stop. */ }
 
 const emitStop = (payload) => {
   process.stdout.write(JSON.stringify(payload));
   process.exit(0);
 };
+const hasIds = typeof input.session_id === 'string' && input.session_id.length > 0
+  && typeof input.agent_id === 'string' && input.agent_id.length > 0;
+let receipt = null;
+let receiptConflict = null;
 try {
-  if (typeof input.session_id === 'string' && input.session_id.length > 0
-    && typeof input.agent_id === 'string' && input.agent_id.length > 0) {
+  if (hasIds) {
     const ids = {
       stateDir: BRAND_STATE_DIR,
       sessionId: input.session_id,
       agentId: input.agent_id,
     };
     const state = readDispatcherState(ids);
-    const toolUses = transcriptToolUses(input.agent_transcript_path);
+    ({ receipt, receiptConflict } = readReceiptEvidence(state));
+    const transcript = transcriptToolUses(input.agent_transcript_path);
+    const toolUses = transcript?.toolUses ?? null;
     const stop = decideDispatcherStop({ state, toolUses });
     if (stop.unseen.length) {
       const names = stop.unseen.map((toolUse) => toolUse.name).join(', ');
-      dispatcherSystemMessage = `codex-bridge: dispatcher ${input.agent_type} used ${names} outside the dispatcher gate — do not trust its answer; run codex-bridge doctor.`;
-      await recordHandbackWitness({
-        stateDir: BRAND_STATE_DIR,
-        kind: 'alarm',
-        hostVersion: await witnessHostVersion(input),
-        detail: `${input.agent_type} ${input.agent_id}: ${names} outside the dispatcher gate`,
-      });
+      dispatcherSystemMessage = [dispatcherSystemMessage, `codex-bridge: dispatcher ${input.agent_type} used ${names} outside the dispatcher gate — do not trust its answer; run codex-bridge doctor.`].filter(Boolean).join(' ');
     }
+    await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: typedStopObservations({
+      agentType: input.agent_type, agentId: input.agent_id, hostVersion: await witnessHostVersion(input),
+      hasIds, state, toolUses, unseen: stop.unseen, transcriptComplete: transcript?.complete === true,
+    }) });
     if (stop.stateUpdate) {
       await updateDispatcherState(ids, (current) => ({
         ...(current.corrupt ? {} : current),
@@ -185,6 +196,14 @@ try {
   // The handback path is fail-open; the established reply checks remain the fallback.
 }
 
+if (!hasIds) {
+  await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: typedStopObservations({
+    agentType: input.agent_type, hostVersion: await witnessHostVersion(input),
+    hasIds, state: null, toolUses: null, unseen: [], transcriptComplete: false,
+  }) });
+  dispatcherSystemMessage ||= missingIdsAlarm(input.agent_type);
+}
+
 const reply = String(input.last_assistant_message || '').trim();
 if (!reply) pass();
 const emit = (payload) => {
@@ -220,48 +239,22 @@ const blockState = (reason, stopReason) => {
 
 const { runDirs, claimed } = parseReply(reply);
 let runDir = runDirs[0] || null;
-let discoveredRun = false;
-let discoveredStatus = null;
-let searchedRunsDir = null;
 
 if (runDir && !fs.existsSync(runDir)) {
   blockForm(nonexistentRunReason);
 }
 
-const orderedOrderId = transcriptOrderId(input.agent_transcript_path);
-
 if (!runDir && !claimed) {
   // A reply that pronounces nothing cannot contradict the disk. It stays on the old, softer path:
   // three tries about the SHAPE of the answer and then through, which is what a quoted refusal
-  // needs. Only a reply that hands down a verdict earns the disk search below.
+  // needs. Only a reply that hands down a verdict earns the receipt checks below.
   blockForm(missingRunReason);
 }
 
-if (!runDir) {
-  let candidates;
-  try {
-    searchedRunsDir = resolveProjectRunsDir(runsRoot(), input.cwd, { create: false }).dir;
-    // Plan_62 r2: on 2026-09-24 the newest run of this agent type belonged to an earlier order, and the
-    // guard judged the reply against that stranger's folder. With the order id known, only its runs count.
-    candidates = recentRuns(searchedRunsDir, {
-      agent: input.agent_type,
-      ...(orderedOrderId ? { orderId: orderedOrderId } : {}),
-    });
-  } catch {
-    pass();
-  }
-  if (candidates === null) pass();
-
-  if (!candidates.length) {
-    blockState(
-      noRecentRunReason,
-      noRecentRunStop(MAX_STATE_BLOCKS, input.agent_type, searchedRunsDir),
-    );
-  }
-
-  ({ dir: runDir, status: discoveredStatus } = candidates[0]);
-  discoveredRun = true;
-}
+const identity = decideReplyIdentity({ runDir, hasIds, receipt, receiptConflict, agentType: input.agent_type });
+if (identity.block) blockState(identity.block.reason, identity.block.stop);
+const { discoveredRun, discoveredStatus } = identity;
+runDir = identity.runDir;
 
 /**
  * The dispatcher must name every WRITING run the project has live, not just the one it chose to
@@ -307,12 +300,6 @@ if (fs.existsSync(statusPath)) {
   } catch {
     runStatus = null;
   }
-  const mismatch = runOrderMismatch(orderedOrderId, runStatus, runDir);
-
-  if (mismatch) {
-    blockState(mismatch.reason, orderMismatchStop(MAX_STATE_BLOCKS, mismatch, runStatus, runDir));
-  }
-
   if (runStatus?.state === 'running') {
     // Plan_57 D5/D27: a bare pid mistook a reused foreign process for this run's worker.
     // The shared judge uses run identity and keeps unverified processes live (fail open).