@lyupro/codex-bridge 0.6.10 → 0.6.11

package/src/home/hooks/reply-identity.mjs

@@ -0,0 +1,64 @@
+/** Decides which run a dispatcher reply answers for, from the gate's receipt (Plan_63 D10; 2026-09-24 stranger-run incident). */
+import path from 'node:path';
+import { readJsonFileSync } from '../lib/json-file.mjs';
+import { normalizePath } from './live-runs.mjs';
+import { MAX_STATE_BLOCKS } from './guard-tries.mjs';
+import {
+  noReceiptReason,
+  noReceiptStop,
+  receiptConflictReason,
+  receiptConflictStop,
+  receiptMismatchReason,
+  receiptMismatchStop,
+} from './reply-verdicts.mjs';
+
+export function readReceiptEvidence(state) {
+  return {
+    receipt: typeof state?.runReceipt === 'string' && state.runReceipt.length > 0 ? state.runReceipt : null,
+    receiptConflict: typeof state?.runReceiptConflict === 'string' && state.runReceiptConflict.length > 0
+      ? state.runReceiptConflict : null,
+  };
+}
+
+export function missingIdsAlarm(agentType) {
+  return `codex-bridge: the host did not report session_id and agent_id for dispatcher ${agentType} — whose run this answer quotes cannot be checked; run codex-bridge doctor.`;
+}
+
+// Plan_63 D10: a recent stranger is never evidence for this reply; only the gate receipt is.
+// Form checks stay in the caller before this decision, preserving their softer try budget.
+export function decideReplyIdentity({ runDir, hasIds, receipt, receiptConflict, agentType }) {
+  if (hasIds && receiptConflict) {
+    return { block: {
+      reason: receiptConflictReason(receipt, receiptConflict),
+      stop: receiptConflictStop(MAX_STATE_BLOCKS, agentType, receipt, receiptConflict),
+    } };
+  }
+
+  if (!runDir) {
+    if (!(hasIds && receipt)) {
+      return { block: { reason: noReceiptReason, stop: noReceiptStop(MAX_STATE_BLOCKS, agentType) } };
+    }
+    let discoveredStatus = null;
+    try {
+      discoveredStatus = readJsonFileSync(path.join(receipt, 'status.json'));
+    } catch {
+      discoveredStatus = null;
+    }
+    return { runDir: receipt, discoveredRun: true, discoveredStatus };
+  }
+
+  if (hasIds) {
+    if (!receipt) {
+      return { block: { reason: noReceiptReason, stop: noReceiptStop(MAX_STATE_BLOCKS, agentType) } };
+    }
+    if (normalizePath(runDir) !== normalizePath(receipt)) {
+      return { block: {
+        reason: receiptMismatchReason(runDir, receipt),
+        stop: receiptMismatchStop(MAX_STATE_BLOCKS, agentType, runDir, receipt),
+      } };
+    }
+  }
+  // Review 2026-10-05_201513_plan63-r-review-20261005 and Plan_66 H2: missing ids alarm
+  // in the caller; named folders retain disk checks because host contract loss must never block work.
+  return { runDir, discoveredRun: false, discoveredStatus: null };
+}

package/src/home/hooks/reply-verdicts.mjs

@@ -39,7 +39,7 @@ export const stopText = (headline, observed, runStatus, folder) => {
     'The run will close itself: the worker outlives every caller and completes meta.json and ' +
       'status.json without the dispatcher. Wait for state to change and reread status.json — the ' +
       'verdict will be there; there is no need to ask the dispatcher again. Repeating the same ' +
-      'command with the same --order-id attaches to this run rather than starting another.',
+      'command with the same task file attaches to this run rather than starting another.',
   ].join(' ');
 };
 
@@ -62,18 +62,29 @@ export const handbackDemandReason =
   'exactly the command its refusal quotes and hand back again; the gate replaces the message with the ' +
   "runner's output.";
 
-export const noRecentRunReason =
-  'Contract violated: the response has no RUN= or ATTACH= line, and no recent run for this ' +
-  'dispatcher was found on disk. Run codex-bridge run and return its stdout verbatim; your own ' +
-  'analysis instead of Codex is prohibited in all outcomes.';
+export const noReceiptReason =
+  'Contract violated: no run receipt is recorded for this dispatcher. Run the canonical ' +
+  "codex-bridge run command and return that run's stdout verbatim; another run on disk cannot identify this run.";
 
-export const noRecentRunStop = (maxBlocks, agentType, runsDir) => stopText(
+export const noReceiptStop = (maxBlocks, agentType) =>
   `The reply guard stopped the session: the dispatcher responded ${maxBlocks} times ` +
-    'without naming a run and no recent matching run was found on disk.',
-  `No run for agent ${agentType} was found in the last 24 hours.`,
-  null,
-  runsDir,
-);
+  `without a run receipt for agent ${agentType}. The answer was not checked.`;
+
+export const receiptMismatchReason = (runDir, receipt) =>
+  `Contract violated: the response names run folder ${runDir}, but this dispatcher's run receipt ` +
+  `names ${receipt}. Run the canonical codex-bridge run command and return that run's stdout verbatim.`;
+
+export const receiptMismatchStop = (maxBlocks, agentType, runDir, receipt) =>
+  `The reply guard stopped the session: dispatcher ${agentType} returned run folder ${runDir} ` +
+  `${maxBlocks} times while its run receipt names ${receipt}. The answer was not checked.`;
+
+export const receiptConflictReason = (receipt, conflict) =>
+  `Contract violated: this dispatcher's run receipt names ${fact(receipt)}, but a contradictory ` +
+  `receipt names ${conflict}. Run the canonical codex-bridge run command and return that run's stdout verbatim.`;
+
+export const receiptConflictStop = (maxBlocks, agentType, receipt, conflict) =>
+  `The reply guard stopped the session: dispatcher ${agentType} responded ${maxBlocks} times ` +
+  `with conflicting run receipts ${fact(receipt)} and ${conflict}. The answer was not checked.`;
 
 export const omittedSiblingReason = (runDir, dir, status) =>
   `Contract violated: the response names ${runDir} but omits live run folder ${dir}; report every ` +
@@ -87,17 +98,10 @@ export const omittedSiblingStop = (maxBlocks, dir, status) => stopText(
   dir,
 );
 
-export const orderMismatchStop = (maxBlocks, mismatch, runStatus, runDir) => stopText(
-  `The reply guard stopped the session: the dispatcher returned another order's run ${maxBlocks} times.`,
-  mismatch.observed,
-  runStatus,
-  runDir,
-);
-
 export const liveRunReason =
   'Contract violated: status.json says state=running and the process is alive — the run is ' +
   'not finished, but you are already responding. The STARTED output of the starting call ' +
-  'is not a result. Repeat the identical codex-bridge run command, same --order-id, with ' +
+  'is not a result. Repeat the identical codex-bridge run command, same task file, with ' +
   'timeout 1800000: it attaches to this same run, costs no quota, and prints the verdict.';
 
 export const liveRunStop = (maxBlocks, runStatus, runDir) => stopText(
@@ -111,7 +115,7 @@ export const liveRunStop = (maxBlocks, runStatus, runDir) => stopText(
 export const deadRunReason =
   'Contract violated: status.json says state=running, but the process with this pid is dead ' +
   'and meta.json is missing — the run is abandoned. Repeat the identical codex-bridge run ' +
-  'command, same --order-id, with timeout of at least 1800000 and return its stdout verbatim.';
+  'command, same task file, with timeout of at least 1800000 and return its stdout verbatim.';
 
 export const deadRunStop = (maxBlocks, runStatus, runDir) => stopText(
   `The reply guard stopped the session: the dispatcher responded ${maxBlocks} times for a run it did not complete.`,
@@ -125,7 +129,7 @@ export const deadRunStop = (maxBlocks, runStatus, runDir) => stopText(
 
 export const abandonedRunReason =
   'Contract violated: status.json says state=abandoned — the runner died without a verdict. ' +
-  'Repeat the identical codex-bridge run command, same --order-id, with timeout of at least ' +
+  'Repeat the identical codex-bridge run command, same task file, with timeout of at least ' +
   '1800000 and return its stdout verbatim.';
 
 export const abandonedRunStop = (maxBlocks, runStatus, runDir) => stopText(
@@ -144,7 +148,7 @@ export const missingMetaReason = (runDir) =>
 
 export const missingDiscoveredMetaStop = (maxBlocks, discoveredStatus, runDir) => stopText(
   `The reply guard stopped the session: the dispatcher responded ${maxBlocks} times ` +
-    'without naming the recent run found on disk.',
+    'without naming the run its receipt names.',
   `status.json says state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}, ` +
     'but the adjacent meta.json is missing.',
   discoveredStatus,
@@ -158,8 +162,8 @@ export const statusMismatchReason = (claimed, meta, discoveredStatus, runDir) =>
   'its output verbatim without substituting your own judgment.';
 
 export const statusMismatchStop = (maxBlocks, claimed, meta, discoveredStatus, runDir) => stopText(
-  `The reply guard stopped the session: the dispatcher contradicted the recent run on disk ${maxBlocks} times.`,
-  `status.json says state=${fact(discoveredStatus.state)}, status=${fact(discoveredStatus.status)}; ` +
+  `The reply guard stopped the session: the dispatcher contradicted the run its receipt names ${maxBlocks} times.`,
+  `status.json says state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}; ` +
     `meta.json says status=${meta.status}, but the reply says ${claimed}.`,
   discoveredStatus,
   runDir,
@@ -167,12 +171,12 @@ export const statusMismatchStop = (maxBlocks, claimed, meta, discoveredStatus, r
 
 export const omittedDiscoveredRunReason = (meta, discoveredStatus, runDir) =>
   `Contract violated: the response omitted RUN=${runDir}; status.json says ` +
-  `state=${fact(discoveredStatus.state)}, status=${fact(discoveredStatus.status)}, and meta.json ` +
+  `state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}, and meta.json ` +
   `says status=${fact(meta.status)}. Return the runner stdout verbatim.`;
 
 export const omittedDiscoveredRunStop = (maxBlocks, meta, discoveredStatus, runDir) => stopText(
-  `The reply guard stopped the session: the dispatcher omitted the recent run found on disk ${maxBlocks} times.`,
-  `status.json says state=${fact(discoveredStatus.state)}, status=${fact(discoveredStatus.status)}; ` +
+  `The reply guard stopped the session: the dispatcher omitted the run its receipt names ${maxBlocks} times.`,
+  `status.json says state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}; ` +
     `meta.json says status=${fact(meta.status)}.`,
   discoveredStatus,
   runDir,

package/src/home/hooks/reply-witness.mjs

@@ -0,0 +1,48 @@
+/** decides which handback-witness observations one subagent stop produces
+ * Plan_67 D8 requires recovery evidence for each cause; D9 requires dispatcher evidence for untyped stops.
+ */
+import { recordWitnessObservations } from '../lib/handback-witness.mjs';
+
+export function untypedStopObservation({ evidence, hostVersion, agentId }) {
+  const alarm = evidence.dispatcher === true;
+  return {
+    observation: {
+      cause: 'missing-agent-type', hostVersion, agentType: null,
+      verdict: alarm ? 'violation' : 'undetermined',
+      detail: alarm ? `host omitted agent_type for agent ${agentId}; evidence: ${evidence.via}`
+        : `untyped subagent stop without dispatcher evidence (${evidence.reason})`,
+    },
+    alarm,
+  };
+}
+
+export function typedStopObservations({
+  agentType, hostVersion, agentId, hasIds, state, toolUses, unseen, transcriptComplete,
+}) {
+  const observations = hasIds ? [
+    { cause: 'missing-agent-type', hostVersion, agentType: null, verdict: 'match' },
+    { cause: 'missing-ids', hostVersion, agentType, verdict: 'match' },
+  ] : [{
+    cause: 'missing-ids', hostVersion, agentType, verdict: 'violation',
+    detail: `host omitted session_id or agent_id for ${agentType}`,
+  }];
+  if (unseen.length) {
+    observations.push({
+      cause: 'tools-outside-gate', hostVersion, agentType, verdict: 'violation',
+      detail: `${agentType} ${agentId}: ${unseen.map(({ name }) => name).join(', ')} outside the dispatcher gate`,
+    });
+  } else if (transcriptComplete === true && toolUses !== null && state && !state.corrupt && state.auditAlarmed !== true
+    && state.handback === 'delivered' && state.runnerFinal === true && !state.runReceiptConflict) {
+    // D8: denied attempts and synthetic gate FAILs (dispatcher-gate.mjs:70-92) cannot clear an audit alarm.
+    observations.push({ cause: 'tools-outside-gate', hostVersion, agentType, verdict: 'match' });
+  }
+  return observations;
+}
+
+export async function recordStopWitness({ stateDir, observations }) {
+  try {
+    await recordWitnessObservations({ stateDir, observations });
+  } catch {
+    // Plan_66 H2: witness failures never block work.
+  }
+}

package/src/home/lib/claude-layout.mjs

@@ -0,0 +1,14 @@
+/**
+ * Names where an installation puts package files under a Claude root — one spelling for the
+ * installer and the hooks, Plan_67 D10.
+ */
+import path from 'node:path';
+
+export function claudePaths(root) {
+  return {
+    agentsDir: path.join(root, 'agents', 'codex-bridge'),
+    commandsDir: path.join(root, 'commands', 'codex-bridge'),
+    legacyAgentsDir: path.join(root, 'agents', 'codex'),
+    legacyCommandsDir: path.join(root, 'commands', 'codex'),
+  };
+}

package/src/home/lib/dispatcher-call.mjs

@@ -0,0 +1,171 @@
+/**
+ * Owns the task-file-only dispatcher call and its repair instructions.
+ * Plan_63 D1/D9, OW-054: order labels in the call must never become runner flags.
+ */
+import {
+  ALL_ORDER_LABELS,
+  CONTINUATION_ORDER_INPUT,
+  ORDER_AGENTS,
+  RETRY_ORDER_INPUT,
+  orderLabelsFor,
+  renderOrderHeaderHelp,
+} from './order-schema.mjs';
+import {
+  isAbsoluteTaskFilePath,
+  isInputPlaceholder,
+} from './order-values.mjs';
+import { firstShellUnsafeSequence } from './shell-unsafe.mjs';
+
+export const TASK_FILE_INPUT = Object.freeze({
+  label: 'task file',
+  explanation: 'Absolute path to a file holding the task statement verbatim, written by the orchestrator with its file tool. The dispatcher passes the path to the runner and never creates, reads or rewrites the file: writing it from the shell reintroduces the permission prompt this file channel exists to remove. Given no path, return the refusal.',
+  example: 'C:/Users/me/AppData/Local/Temp/claude/<session>/scratchpad/task-plan-13.md',
+});
+
+export function callInputsFor(agentType) {
+  return ORDER_AGENTS.includes(agentType) ? [TASK_FILE_INPUT] : [];
+}
+
+const knownLabels = new Set(ALL_ORDER_LABELS);
+
+const freeTextReason = 'not a `label: value` line; free text belongs in the task file';
+
+function normaliseLabel(label) {
+  return label.toLowerCase().replace(/^[-*] /, '').replace(/[*`]/g, '')
+    .replace(/^_+|_+$/g, '').replace(/[-_]/g, ' ').replace(/\s+/g, ' ').trim();
+}
+
+function unsafeSequence(value) {
+  const shell = firstShellUnsafeSequence(value);
+  const other = value.match(/["\r\n]/)?.[0] ?? null;
+  if (shell === null) return other;
+  if (other === null) return shell;
+  return value.indexOf(shell) <= value.indexOf(other) ? shell : other;
+}
+
+// Review of 4ed0fd4: the command quotes the path in double quotes, where Bash still expands `$NAME`,
+// folds `\\` into `\` and lets a final `\` escape the closing quote. The gate would validate the
+// literal file while the runner opened another, so any such path is refused, not escaped.
+function shellRewrittenSequence(value) {
+  return value.match(/\$|\\\\|\\$/)?.[0] ?? null;
+}
+
+function shellRewrittenReason(label, sequence) {
+  return `label \`${label}\` contains ${JSON.stringify(sequence)}, which the shell rewrites inside double quotes; `
+    + 'write the path with forward slashes and without `$`';
+}
+
+/** Returns the accepted label values and every refusal; one reader for the gate, the command and the transcript. */
+export function parseDispatcherCall(agentType, promptText) {
+  const entries = callInputsFor(agentType);
+  const labels = new Set(entries.map((entry) => entry.label));
+  const inputs = new Map();
+  const problems = [];
+  const acceptedLines = new Map();
+
+  if (!ORDER_AGENTS.includes(agentType)) {
+    problems.push({ line: null, text: '', reason: `unknown dispatcher agent ${JSON.stringify(agentType)}` });
+    return { inputs, problems };
+  }
+
+  promptText.split(/\r?\n/).forEach((text, index) => {
+    const trimmed = text.trim();
+    if (!trimmed) return;
+    const line = index + 1;
+    const colon = trimmed.indexOf(':');
+    const label = colon === -1 ? null : trimmed.slice(0, colon);
+    const tail = colon === -1 ? '' : trimmed.slice(colon + 1);
+    const value = tail.trim();
+
+    if (labels.has(label) && !value) {
+      problems.push({ line, text, reason: `label \`${label}\` has an empty value` });
+      return;
+    }
+    if (labels.has(label) && /^[ \t]+/.test(tail)) {
+      if (inputs.has(label)) {
+        const first = acceptedLines.get(label).line;
+        problems.push({ line, text, reason: `label \`${label}\` is given twice (line ${first} and line ${line})` });
+        return;
+      }
+      inputs.set(label, value);
+      acceptedLines.set(label, { line, text });
+      return;
+    }
+
+    const normalised = label === null ? null : normaliseLabel(label);
+    let reason = freeTextReason;
+    if (labels.has(normalised)) {
+      reason = `write the label exactly as \`${normalised}:\``;
+    } else if (knownLabels.has(normalised)) {
+      reason = `label \`${normalised}\` moved to the task-file header; the call is only \`task file: <absolute path>\``;
+    }
+    problems.push({ line, text, reason });
+  });
+
+  for (const entry of entries) {
+    if (!entry.conditional && !entry.optional && !inputs.has(entry.label)) {
+      problems.push({ line: null, text: '', label: entry.label, reason: `missing required label \`${entry.label}\`` });
+    }
+  }
+  for (const [label, value] of inputs) {
+    const location = acceptedLines.get(label);
+    if (isInputPlaceholder(value, label)) {
+      problems.push({ ...location, reason: `label \`${label}\` is still a placeholder` });
+    }
+    if (label === 'task file' && !isAbsoluteTaskFilePath(value)) {
+      problems.push({ ...location, reason: 'label `task file` must be an absolute path' });
+    }
+    const sequence = unsafeSequence(value);
+    if (sequence !== null) {
+      const reason = `label \`${label}\` contains ${JSON.stringify(sequence)}; put free text in the task file`;
+      problems.push({ ...location, reason });
+    } else {
+      const expanding = shellRewrittenSequence(value);
+      if (expanding !== null) problems.push({ ...location, reason: shellRewrittenReason(label, expanding) });
+    }
+  }
+  return { inputs, problems };
+}
+
+/** Names each refused line and the agent's header template, so one free refusal carries its own repair. */
+export function renderCallRefusal(agentType, problems) {
+  const lines = ['Order gate denied the Agent call: the call text must be only `label: value` lines.'];
+  const entries = callInputsFor(agentType);
+  for (const { line, text, reason, label } of problems) {
+    const entry = line === null && reason === `missing required label \`${label}\``
+      ? entries.find((entry) => entry.label === label) : undefined;
+    const detail = entry ? ` — ${entry.explanation} Example: \`${entry.label}: ${entry.example}\`.` : '';
+    lines.push(line === null ? `- ${reason}${detail}` : `- line ${line}: \`${text}\` — ${reason}`);
+  }
+  lines.push('The call is only `task file: <absolute path>`.',
+    'The order goes in the header at the top of that file:',
+    ...renderOrderHeaderHelp(agentType).split('\n'), 'Free text belongs in the task file.');
+  return lines.join('\n');
+}
+
+function headerInputsFor(agentType) {
+  const entries = orderLabelsFor(agentType);
+  return [
+    ...entries.filter(({ required }) => required),
+    ...entries.filter(({ conditional }) => conditional),
+    ...entries.filter(({ optional }) => optional),
+  ];
+}
+
+function conditionFor(entry) {
+  return [CONTINUATION_ORDER_INPUT, RETRY_ORDER_INPUT]
+    .find(({ label }) => label === entry.label)?.conditional;
+}
+
+/** Keeps the caller's short prompt aligned with the header registry, including grant conditions. */
+export function renderRequiredInputSummary(agentType) {
+  if (!ORDER_AGENTS.includes(agentType)) return '';
+  const entries = headerInputsFor(agentType);
+  const required = entries.filter(({ required }) => required).map(({ label }) => `\`${label}\``);
+  const conditional = entries.filter(({ conditional }) => conditional)
+    .map((entry) => `\`${entry.label}\` (${conditionFor(entry)})`);
+  const optional = entries.filter(({ optional }) => optional).map(({ label }) => `\`${label}\``);
+  return `The call is only \`task file\` (an absolute path). The task-file header requires ${required.join(', ')}; `
+    + `conditional labels: ${conditional.join(', ')}; optional labels: ${optional.join(', ')}. `
+    + 'Free text belongs in the task file.';
+}

package/src/home/lib/dispatcher-command.mjs

@@ -1,78 +1,40 @@
 /** Owns the canonical dispatcher command because the 2026-09-23 TradeForge and 2026-09-24 local incidents let haiku ignore its prompt and register two paid runs for one order id. */
 import { CLI_NAMES } from './cli-names.mjs';
-import {
-  extractValue,
-  isAbsoluteTaskFilePath,
-  isInputPlaceholder,
-  parseGrant,
-  REQUIRED_INPUTS,
-} from './required-inputs.mjs';
-import { firstShellUnsafeSequence } from './shell-unsafe.mjs';
+import { parseDispatcherCall } from './dispatcher-call.mjs';
+import { ORDER_AGENTS } from './order-schema.mjs';
 
 function refusal(reason) {
   return { refusal: `Refused: ${reason}.` };
 }
 
-function unsafeValueReason(value, label) {
-  const sequence = firstShellUnsafeSequence(value);
-  if (sequence !== null) return `input "${label}" contains unsafe shell sequence ${JSON.stringify(sequence)}`;
-  if (value.includes('"') || value.includes('\r') || value.includes('\n')) {
-    return `input "${label}" contains a double quote or line break`;
-  }
-  return null;
+function assembleRunCommand(agentType, taskFile) {
+  const tokens = [CLI_NAMES[0], 'run', '--agent', agentType, '--task-file', `"${taskFile}"`];
+  return tokens.join(' ');
 }
 
-function quote(value) {
-  return `"${value}"`;
+/** Plan_63 D11: prompt templates and the gate must use the same command assembler. */
+export function renderRunCommandTemplate(agentType) {
+  if (typeof agentType !== 'string' || !ORDER_AGENTS.includes(agentType)) {
+    throw new Error(`unknown dispatcher agent ${JSON.stringify(agentType)}`);
+  }
+  return assembleRunCommand(agentType, '<task-file path from the orchestrator>');
 }
 
 /** Builds the only permitted run command directly from the immutable order transcript. */
 export function canonicalRunCommand(agentType, promptText) {
-  if (typeof agentType !== 'string' || !Object.prototype.hasOwnProperty.call(REQUIRED_INPUTS, agentType)) {
+  if (typeof agentType !== 'string' || !ORDER_AGENTS.includes(agentType)) {
     return refusal(`unknown dispatcher agent ${JSON.stringify(agentType)}`);
   }
   if (typeof promptText !== 'string') return refusal('prompt text is missing or is not text');
 
-  const inputs = new Map();
-  for (const entry of REQUIRED_INPUTS[agentType]) {
-    if (entry.conditional) continue;
-    const value = extractValue(promptText, entry.label);
-    if (isInputPlaceholder(value, entry.label)) {
-      return refusal(`required input "${entry.label}" is missing or is a placeholder`);
-    }
-    const unsafe = unsafeValueReason(value, entry.label);
-    if (unsafe) return refusal(unsafe);
-    if (entry.label === 'task file' && !isAbsoluteTaskFilePath(value)) {
-      return refusal('input "task file" must be an absolute path');
-    }
-    inputs.set(entry.label, value);
+  // Plan_63 D9, OW-054: the call cannot switch continuation or bypass order ownership.
+  const { inputs, problems } = parseDispatcherCall(agentType, promptText);
+  if (problems.length) {
+    const reasons = problems.map(({ line, reason }) => line === null ? reason : `line ${line}: ${reason}`);
+    return refusal(`the call text must be only label: value lines: ${reasons.join('; ')}`);
   }
 
-  // The continuation grant never reaches the command line (`--continue` is bare), so its free-text
-  // reason is not screened: the live grant "…five risks; advise settles them" would have been refused.
-  const optionalLabels = ['repository', 'scope new', 'slug', 'effort'];
-  for (const label of optionalLabels) {
-    const value = extractValue(promptText, label);
-    if (value === null) continue;
-    const unsafe = unsafeValueReason(value, label);
-    if (unsafe) return refusal(unsafe);
-    inputs.set(label, value);
-  }
-
-  const tokens = [CLI_NAMES[0], 'run', '--agent', agentType, '--repo', quote(inputs.get('repository') || '.')];
-  if (agentType === 'codex-advisor') tokens.push('--phase', quote(inputs.get('phase')));
-  if (agentType === 'codex-build') {
-    tokens.push('--scope', quote(inputs.get('scope')));
-    if (inputs.get('scope new')) tokens.push('--scope-new', quote(inputs.get('scope new')));
-  }
-  if (inputs.get('slug')) tokens.push('--slug', quote(inputs.get('slug')));
-  tokens.push('--order-id', quote(inputs.get('order id')));
-  tokens.push('--task-file', quote(inputs.get('task file')));
-  if (inputs.get('effort')) tokens.push('--effort', quote(inputs.get('effort')));
-  // Plan_75 D1, TradeForge capacity incident: forward either grant; the runner owns conflicting-grant refusal.
-  const grant = parseGrant(promptText);
-  if (grant?.kind || grant?.error) tokens.push('--continue');
-  return { command: tokens.join(' ') };
+  return { command: assembleRunCommand(agentType, inputs.get('task file')) };
 }
 
 /** Compares the proposed command as text, allowing whitespace only around its boundary. */

package/src/home/lib/dispatcher-gate.mjs

@@ -70,6 +70,10 @@ export function decidePreToolUse({ payload, order, state }) {
 
   if (toolName === HANDBACK_TOOL) {
     if (order?.refusal) return allow(`FAIL — dispatcher gate: ${order.refusal}`);
+    if (typeof state?.runReceiptConflict === 'string' && state.runReceiptConflict.length > 0) {
+      return allow('FAIL — dispatcher gate: the runner reported two different run folders for one dispatcher: ' +
+        `${state.runReceipt} and ${state.runReceiptConflict}; the answer is not delivered.`);
+    }
     if (typeof state?.runnerOutput === 'string' && state.runnerOutput.length > 0) {
       if (state.runnerFinal) return allow(state.runnerOutput);
       return deny('the run has started without a verdict; repeat the exact command to attach and wait.', order);

package/src/home/lib/dispatcher-model.mjs

@@ -0,0 +1,112 @@
+/** records which model family each dispatcher type actually ran on, against the installed contract
+ * Plan_67 D4 observes every assistant model at stop; D5 compares families; D10 does not infer host precedence.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { readDispatcherPin } from './dispatcher-pin.mjs';
+import { parseJsonText } from './json-file.mjs';
+import { compareModelFamilies } from './model-family.mjs';
+import { normalizeLedger, readLedgerFile, recordObservation } from './observation-ledger.mjs';
+
+export const DISPATCHER_MODEL_FILE = 'dispatcher-model.json';
+
+export function transcriptModels(transcriptPath) {
+  let source;
+  try {
+    source = fs.readFileSync(transcriptPath, 'utf8');
+  } catch {
+    return null;
+  }
+  const models = [];
+  let complete = true;
+  for (const line of source.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    let record;
+    try {
+      record = parseJsonText(transcriptPath, line);
+    } catch {
+      complete = false;
+      continue;
+    }
+    if (record?.type !== 'assistant' && record?.message?.role !== 'assistant') continue;
+    if (typeof record.message?.model === 'string') models.push(record.message.model);
+  }
+  return { models, complete };
+}
+
+export function modelObservation({ agentType, hostVersion, pin, models, complete = true }) {
+  const comparison = compareModelFamilies({ pinFamily: pin.family, modelIds: models ?? [] });
+  const { parsed, unparsed } = comparison;
+  // Plan_67 D8: a partial transcript cannot establish recovery, but can still prove a violation.
+  const incompleteMatch = comparison.verdict === 'match' && complete !== true;
+  const verdict = incompleteMatch ? 'undetermined' : comparison.verdict;
+  const data = {
+    hostVersion: hostVersion ?? null, agentType, pinFamily: pin.family,
+    parsed, unparsed, comparison: 'installed-contract',
+    ...(pin.family === null ? { pinReasons: pin.reasons } : {}),
+    ...(incompleteMatch ? { complete: false } : {}),
+  };
+  const detail = verdict === 'violation'
+    ? `${agentType} ran on ${parsed.join(', ')} while the installed contract pins ${pin.family}`
+    : verdict === 'match'
+      ? `${agentType} ran on ${parsed.join(', ')} matching the installed contract pin ${pin.family}`
+      : incompleteMatch
+        ? `${agentType} model comparison is undetermined: the transcript has unreadable records`
+        : `${agentType} model comparison against the installed contract is undetermined`;
+  return { key: `${hostVersion || 'unknown'}|${agentType}`, verdict, detail, data };
+}
+
+function normalizeDispatcherModel(parsed) {
+  const ledger = normalizeLedger(parsed);
+  if (!ledger) return null;
+  for (const entry of Object.values(ledger.entries)) {
+    for (const observation of [entry.lastObservation, entry.lastViolation, entry.lastMatch, ...entry.history]) {
+      if (observation === null) continue;
+      const data = observation.data;
+      if (!data || Object.getPrototypeOf(data) !== Object.prototype
+        || !(data.hostVersion === null || typeof data.hostVersion === 'string')
+        || typeof data.agentType !== 'string' || data.agentType.length === 0) return null;
+    }
+  }
+  return ledger;
+}
+
+export function readDispatcherModel({ stateDir }) {
+  return readLedgerFile(path.join(stateDir, DISPATCHER_MODEL_FILE), { normalize: normalizeDispatcherModel });
+}
+
+export async function recordDispatcherModel({ stateDir, observation, now = new Date().toISOString() }) {
+  return recordObservation({
+    stateDir, id: 'dispatcher-model', file: path.join(stateDir, DISPATCHER_MODEL_FILE),
+    observation: { ...observation, at: now },
+  });
+}
+
+export function modelLatch({ ledger, agentType }) {
+  let violation = null;
+  let matchSeq = 0;
+  // D8: seq, rather than timestamps or host versions, decides recovery across hosts of this type.
+  for (const entry of Object.values(ledger?.entries ?? {})) {
+    if (entry.lastViolation?.data?.agentType === agentType
+      && entry.lastViolation.seq > (violation?.seq ?? 0)) violation = entry.lastViolation;
+    if (entry.lastMatch?.data?.agentType === agentType) matchSeq = Math.max(matchSeq, entry.lastMatch.seq);
+  }
+  return { active: violation !== null && violation.seq > matchSeq, violation };
+}
+
+export async function observeDispatcherModelStop({ brandRoot, stateDir, input, hostVersion }) {
+  const transcript = transcriptModels(input.agent_transcript_path);
+  const observation = modelObservation({
+    agentType: input.agent_type, hostVersion,
+    pin: readDispatcherPin({ brandRoot, agentType: input.agent_type }),
+    models: transcript?.models ?? null, complete: transcript?.complete === true,
+  });
+  try {
+    await recordDispatcherModel({ stateDir, observation });
+  } catch {
+    // D4: a diagnostic write failure must not block the stop or hide an observed quota violation.
+  }
+  return observation.verdict === 'violation'
+    ? `codex-bridge: dispatcher ${input.agent_type} ran on ${observation.data.parsed.join(', ')} while the installed contract pins ${observation.data.pinFamily} — Claude quota was spent on it; run codex-bridge doctor.`
+    : null;
+}