@lyupro/codex-bridge 0.6.10 → 0.6.12

package/cli/doctor-installation.mjs

@@ -1,111 +1,111 @@
-/** Reports whether what this package installed into the host still matches the package. */
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import {
-  buildInstallPlan,
-  contentFingerprint,
-  fileFingerprint,
-} from './manifest.mjs';
-import { plannedContent } from './copy.mjs';
-import { RULE_LIST_NAMES, inspectPermissions } from './permissions.mjs';
-import { readRulesRegistry } from './rules-owners.mjs';
-import { parseFrontmatter } from './frontmatter.mjs';
-import { check } from './doctor-format.mjs';
-
-export async function exists(target) {
-  try {
-    await fs.access(target);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export async function isFile(target) {
-  try {
-    return (await fs.stat(target)).isFile();
-  } catch {
-    return false;
-  }
-}
-
-export async function agentsCheck(host, record) {
-  if (!record) return check('agents', 'warn', 'Agent definitions were not checked; run codex-bridge install');
-  const plan = await buildInstallPlan(host);
-  const agents = plan.filter((item) => /[\\/]src[\\/]agents[\\/][^\\/]+\.md$/.test(item.source));
-  const mismatches = [];
-  const unreadable = [];
-  for (const item of agents) {
-    const expected = contentFingerprint(await plannedContent(item, host.brandRoot));
-    if (await fileFingerprint(item.target) !== expected) mismatches.push(path.basename(item.target));
-    const expectedName = path.basename(item.source, '.md');
-    try {
-      const frontmatter = parseFrontmatter(await fs.readFile(item.target, 'utf8'));
-      if (!frontmatter) throw new Error('frontmatter is missing');
-      if (frontmatter.name !== expectedName) {
-        throw new Error(`name is ${JSON.stringify(frontmatter.name)}, expected ${JSON.stringify(expectedName)}`);
-      }
-    } catch (err) {
-      unreadable.push(`${path.basename(item.target)} (${err.message})`);
-    }
-  }
-  // The 2026-08-10 registration failure left files present but unreadable by Claude Code. Drift was
-  // advisory until a 2026-08-16 checklist run planted the pre-Plan_41 invocation — a path instead of
-  // the package command — in an installed definition: doctor kept exit 0 while every delegation
-  // would stop on a permission prompt. A definition that is not this package's is not judged healthy.
-  if (unreadable.length) {
-    return check('agents', 'fail', `Installed agent definitions cannot be read: ${unreadable.join(', ')}; run codex-bridge update --force`);
-  }
-  return mismatches.length
-    ? check('agents', 'fail', `Installed agent definitions differ from this package: ${mismatches.join(', ')}; run codex-bridge update --force`)
-    : check('agents', 'ok', `${agents.length} installed agent definition(s) match this package`);
-}
-
-export async function conventionsCheck(host) {
-  const file = host.brandConventionsPath;
-  let content;
-  try {
-    content = await fs.readFile(file, 'utf8');
-  } catch (err) {
-    if (err.code === 'ENOENT') return check('conventions', 'ok', `${file} (not found; optional)`);
-    return check('conventions', 'fail', `cannot read ${file}: ${err.message}`);
-  }
-  return content.trim()
-    ? check('conventions', 'ok', `${file} (found)`)
-    : check('conventions', 'warn', `${file} (found but empty)`);
-}
-
-export async function rulesCheck(host, record) {
-  if (!record) return check('rules', 'warn', 'cannot check before installation');
-  if (!record.rules) {
-    return check('rules', 'warn', 'rules were not installed by this installation; install or update will add them');
-  }
-  let registry;
-  try {
-    registry = await readRulesRegistry(host);
-  } catch (err) {
-    // Keep every diagnostic visible: package removal on a broken registry left the host without its watchdog.
-    return check('rules', 'fail', err.message);
-  }
-  const ownerNote = registry?.owners.length > 1 ? `; ${registry.owners.length} owners` : '';
-  const fingerprint = await fileFingerprint(record.rules.path);
-  if (!fingerprint) return check('rules', 'fail', `${record.rules.path}${ownerNote ? ` (${registry.owners.length} owners)` : ''}`);
-  return fingerprint === record.rules.fingerprint
-    ? check('rules', 'ok', `${record.rules.path} (matches record${ownerNote})`)
-    : check('rules', 'warn', `${record.rules.path} (modified after installation${ownerNote})`);
-}
-
-export async function permissionsCheck(host) {
-  try {
-    const status = await inspectPermissions(host.settingsPath);
-    // Permission rules are an optional operator action; Plan_22 keeps their absence a warning so
-    // doctor does not turn a healthy installation red merely because hardening was not requested.
-    // The ask count is part of the line because a full set shadowed by `ask` reads as working and
-    // is not: the live run of Plan_22-1 found this line saying `installed (24/24)` over it.
-    const shadow = status.askCount ? `, ${status.askCount} shadowed by ask` : '';
-    return check('permissions', status.state === 'installed' ? 'ok' : 'warn',
-      `${status.state} (${status.present}/${status.total} own strings in ${RULE_LIST_NAMES}${shadow})`);
-  } catch (err) {
-    return check('permissions', 'warn', `cannot inspect permission rules: ${err.message}`);
-  }
-}
+/** Reports whether what this package installed into the host still matches the package. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {
+  buildInstallPlan,
+  contentFingerprint,
+  fileFingerprint,
+} from './manifest.mjs';
+import { plannedContent } from './copy.mjs';
+import { RULE_LIST_NAMES, inspectPermissions } from './permissions.mjs';
+import { readRulesRegistry } from './rules-owners.mjs';
+import { parseFrontmatter } from '../src/home/lib/frontmatter.mjs';
+import { check } from './doctor-format.mjs';
+
+export async function exists(target) {
+  try {
+    await fs.access(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function isFile(target) {
+  try {
+    return (await fs.stat(target)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+export async function agentsCheck(host, record) {
+  if (!record) return check('agents', 'warn', 'Agent definitions were not checked; run codex-bridge install');
+  const plan = await buildInstallPlan(host);
+  const agents = plan.filter((item) => /[\\/]src[\\/]agents[\\/][^\\/]+\.md$/.test(item.source));
+  const mismatches = [];
+  const unreadable = [];
+  for (const item of agents) {
+    const expected = contentFingerprint(await plannedContent(item, host.brandRoot));
+    if (await fileFingerprint(item.target) !== expected) mismatches.push(path.basename(item.target));
+    const expectedName = path.basename(item.source, '.md');
+    try {
+      const frontmatter = parseFrontmatter(await fs.readFile(item.target, 'utf8'));
+      if (!frontmatter) throw new Error('frontmatter is missing');
+      if (frontmatter.name !== expectedName) {
+        throw new Error(`name is ${JSON.stringify(frontmatter.name)}, expected ${JSON.stringify(expectedName)}`);
+      }
+    } catch (err) {
+      unreadable.push(`${path.basename(item.target)} (${err.message})`);
+    }
+  }
+  // The 2026-08-10 registration failure left files present but unreadable by Claude Code. Drift was
+  // advisory until a 2026-08-16 checklist run planted the pre-Plan_41 invocation — a path instead of
+  // the package command — in an installed definition: doctor kept exit 0 while every delegation
+  // would stop on a permission prompt. A definition that is not this package's is not judged healthy.
+  if (unreadable.length) {
+    return check('agents', 'fail', `Installed agent definitions cannot be read: ${unreadable.join(', ')}; run codex-bridge update --force`);
+  }
+  return mismatches.length
+    ? check('agents', 'fail', `Installed agent definitions differ from this package: ${mismatches.join(', ')}; run codex-bridge update --force`)
+    : check('agents', 'ok', `${agents.length} installed agent definition(s) match this package`);
+}
+
+export async function conventionsCheck(host) {
+  const file = host.brandConventionsPath;
+  let content;
+  try {
+    content = await fs.readFile(file, 'utf8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return check('conventions', 'ok', `${file} (not found; optional)`);
+    return check('conventions', 'fail', `cannot read ${file}: ${err.message}`);
+  }
+  return content.trim()
+    ? check('conventions', 'ok', `${file} (found)`)
+    : check('conventions', 'warn', `${file} (found but empty)`);
+}
+
+export async function rulesCheck(host, record) {
+  if (!record) return check('rules', 'warn', 'cannot check before installation');
+  if (!record.rules) {
+    return check('rules', 'warn', 'rules were not installed by this installation; install or update will add them');
+  }
+  let registry;
+  try {
+    registry = await readRulesRegistry(host);
+  } catch (err) {
+    // Keep every diagnostic visible: package removal on a broken registry left the host without its watchdog.
+    return check('rules', 'fail', err.message);
+  }
+  const ownerNote = registry?.owners.length > 1 ? `; ${registry.owners.length} owners` : '';
+  const fingerprint = await fileFingerprint(record.rules.path);
+  if (!fingerprint) return check('rules', 'fail', `${record.rules.path}${ownerNote ? ` (${registry.owners.length} owners)` : ''}`);
+  return fingerprint === record.rules.fingerprint
+    ? check('rules', 'ok', `${record.rules.path} (matches record${ownerNote})`)
+    : check('rules', 'warn', `${record.rules.path} (modified after installation${ownerNote})`);
+}
+
+export async function permissionsCheck(host) {
+  try {
+    const status = await inspectPermissions(host.settingsPath);
+    // Permission rules are an optional operator action; Plan_22 keeps their absence a warning so
+    // doctor does not turn a healthy installation red merely because hardening was not requested.
+    // The ask count is part of the line because a full set shadowed by `ask` reads as working and
+    // is not: the live run of Plan_22-1 found this line saying `installed (24/24)` over it.
+    const shadow = status.askCount ? `, ${status.askCount} shadowed by ask` : '';
+    return check('permissions', status.state === 'installed' ? 'ok' : 'warn',
+      `${status.state} (${status.present}/${status.total} own strings in ${RULE_LIST_NAMES}${shadow})`);
+  } catch (err) {
+    return check('permissions', 'warn', `cannot inspect permission rules: ${err.message}`);
+  }
+}

package/cli/doctor.mjs

@@ -20,12 +20,15 @@ import {
 import { hookChecks } from './doctor-hooks.mjs';
 import { contractStatus, readHostContract } from './host-contract.mjs';
 import { handbackWitnessStatus } from './handback-witness-check.mjs';
+import { dispatcherModelChecks } from './dispatcher-model-check.mjs';
 import { dispatcherContractStatus } from './dispatcher-contract.mjs';
 import { DISPATCHER_CONTRACT_FILE, readDispatcherContract } from './dispatcher-contract-record.mjs';
 import { PROBE_COMMAND } from './host-contract.mjs';
 import { readHandbackWitness } from '../src/home/lib/handback-witness.mjs';
+import { readDispatcherModel } from '../src/home/lib/dispatcher-model.mjs';
 import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import { readHostObservations } from '../src/home/lib/host-observations.mjs';
+import { activeHostVersions } from './active-hosts.mjs';
 import { otherHostCheck, sessionHostCheck, sessionHostVersions } from './session-hosts.mjs';
 import { liveRunsCheck, projectRunsCheck, retentionCheck } from './doctor-runs.mjs';
 
@@ -83,8 +86,11 @@ export async function diagnose({
   currentPackage,
   contractRecord,
   handbackWitnessRecord,
+  dispatcherModelRecord,
   dispatcherContractRecord,
   hostVersion,
+  activeHosts: injectedActiveHosts,
+  now,
   observations,
 } = {}) {
   const checks = [sourceCheck()];
@@ -147,6 +153,10 @@ export async function diagnose({
   const hostObservations = observations === undefined ? readHostObservations({ stateDir }) : observations;
   const observedVersions = sessionHostVersions(hostObservations);
   const detectedHostVersion = hostVersion === undefined ? observedVersions[0] ?? null : hostVersion;
+  const witnessRecord = handbackWitnessRecord === undefined ? readHandbackWitness({ stateDir }) : handbackWitnessRecord;
+  const modelRecord = dispatcherModelRecord === undefined ? readDispatcherModel({ stateDir }) : dispatcherModelRecord;
+  const activeHosts = injectedActiveHosts ?? (hostVersion !== undefined ? [hostVersion].filter(Boolean)
+    : activeHostVersions({ observations: hostObservations, witnessRecord, modelRecord, now }));
   checks.push(sessionHostCheck(observedVersions, hostObservations));
   const refusalRecord = contractRecord === undefined ? await readHostContract(host) : contractRecord;
   const hostContract = contractStatus({
@@ -158,11 +168,16 @@ export async function diagnose({
     : hostContract.state === 'ignored' ? 'fail' : 'warn';
   checks.push(check('hostContract', hostContractStatus, hostContract.message));
   const witness = handbackWitnessStatus({
-    record: handbackWitnessRecord === undefined ? readHandbackWitness({ stateDir }) : handbackWitnessRecord,
-    hostVersion: detectedHostVersion,
+    record: witnessRecord,
+    activeHosts,
     stateDir,
   });
-  checks.push(check('handbackWitness', ['seen', 'unobserved'].includes(witness.state) ? 'ok' : 'warn', witness.message));
+  checks.push(check('handbackWitness', ['violation', 'unreadable'].includes(witness.state) ? 'warn' : 'ok', witness.message));
+  checks.push(...dispatcherModelChecks({
+    record: modelRecord,
+    activeHosts,
+    stateDir,
+  }));
   const dispatcherRecord = dispatcherContractRecord === undefined ? readDispatcherContract({ stateDir }) : dispatcherContractRecord;
   checks.push(...dispatcherContractChecks({
     record: dispatcherRecord,
@@ -190,7 +205,7 @@ export async function diagnose({
     exitCode: !record || recordBroken || missingFiles.length || agents.status === 'fail' || rules.status === 'fail'
       || hostContractStatus === 'fail' || retention.status === 'fail' || conventions.status === 'fail'
       || projectRuns.status === 'fail'
-      || checks.some((item) => /^(hook|dispatcherContract):/.test(item.key) && item.status === 'fail')
+      || checks.some((item) => /^(hook|dispatcherContract|dispatcherModel):/.test(item.key) && item.status === 'fail')
       || checks.some((item) => item.key.startsWith('otherHost:') && item.status === 'fail') ? 1 : 0,
     checks,
     record,

package/cli/handback-witness-check.mjs

@@ -1,31 +1,41 @@
-/** Surfaces handback drift; 2026-09-25 established exact host transcript versions as identity. */
+/** Surfaces handback drift; Plan_67 D12 judges every host with recent dispatcher activity. */
 import path from 'node:path';
 import { WITNESS_FILE } from '../src/home/lib/handback-witness.mjs';
+import { entryState } from '../src/home/lib/observation-ledger.mjs';
 
-export function handbackWitnessStatus({ record, hostVersion, stateDir }) {
+export function handbackWitnessStatus({ record, activeHosts, stateDir }) {
   if (record?.corrupt) {
     return { state: 'unreadable', message: `The handback witness is unreadable; delete ${path.join(stateDir, WITNESS_FILE)} to reset it.` };
   }
-  if (record?.alarms?.length > 0) {
-    const alarm = record.alarms.at(-1);
-    return {
-      state: 'alarm',
-      message: `${record.alarms.length} dispatcher alarm(s); newest on ${alarm.hostVersion ?? 'unknown host'}: ${alarm.detail} at ${alarm.at}; do not trust a dispatcher answer from that time; see Plan_62 D15.`,
-    };
-  }
-  if (!record?.lastSeen || Object.keys(record.lastSeen).length === 0) {
-    return { state: 'unobserved', message: 'Not observed yet — a handback is seen only when a dispatcher runs in an interactive session.' };
-  }
-
-  if (record.lastSeen[hostVersion]) {
-    return { state: 'seen', message: `Handback contract last seen on host ${hostVersion} at ${record.lastSeen[hostVersion]}.` };
+  const entries = Object.values(record?.ledger?.entries || {});
+  let history = '';
+  const recovered = entries.filter((entry) => entryState(entry) === 'recovered').length;
+  const historical = entries.filter((entry) => entryState(entry) === 'violation'
+    && !activeHosts.includes(entry.lastObservation.data.hostVersion)).length;
+  const legacy = record?.legacy || [];
+  if (recovered || historical || legacy.length) {
+    const untyped = legacy.filter((entry) => entry.disposition === 'legacy-untyped-unverified').length;
+    const unclassified = legacy.filter((entry) => entry.disposition === 'unclassified').length;
+    history = ` History: ${recovered} recovered entries; ${historical} unresolved entries on hosts without dispatcher activity in the last 24 hours (history); ${untyped} older alarms without dispatcher evidence, kept for history (legacy-untyped-unverified); ${unclassified} unclassified legacy entries.`;
   }
-  const [newest, iso] = Object.entries(record.lastSeen).sort((left, right) => right[1].localeCompare(left[1]))[0];
-  if (newest) {
+  const violations = entries.filter((entry) => entryState(entry) === 'violation'
+    && activeHosts.includes(entry.lastObservation.data.hostVersion));
+  if (violations.length > 0) {
+    const details = violations.map((entry) => {
+      const { data, detail, at } = entry.lastViolation;
+      return `host ${data.hostVersion}: ${data.cause}${data.agentType ? ` / ${data.agentType}` : ''}: ${detail} at ${at}`;
+    });
     return {
-      state: 'stale',
-      message: `Handback contract last seen on host ${newest} at ${iso}, not yet on host ${hostVersion}; it is recorded the next time a dispatcher runs in an interactive session on that host.`,
+      state: 'violation',
+      message: `Dispatcher violation(s): ${details.join('; ')}; do not trust a dispatcher answer from that time; see Plan_62 D15.${history}`,
     };
   }
-  return { state: 'unobserved', message: 'Not observed yet — a handback is seen only when a dispatcher runs in an interactive session.' };
+  const intercepted = activeHosts.filter((host) => record?.intercepted?.[host])
+    .map((host) => `host ${host} at ${record.intercepted[host]}`);
+  const message = !activeHosts.length
+    ? 'No dispatcher activity in the last 24 hours.'
+    : intercepted.length
+      ? `Newest intercepted handback on ${intercepted.join('; ')}.`
+      : 'Not observed yet — a handback is seen only when a dispatcher runs in an interactive session.';
+  return { state: 'ok', message: message + history };
 }

package/cli/hosts.mjs

@@ -2,7 +2,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { resolveBrandHome } from '../src/home/lib/brand-home.mjs';
+import { resolveBrandHome } from '../src/home/lib/brand-home.mjs';
+import { claudePaths } from '../src/home/lib/claude-layout.mjs';
 
 function repositoryRoot(start) {
   let current = path.resolve(start);
@@ -14,15 +15,6 @@ function repositoryRoot(start) {
   }
 }
 
-function claudePaths(root) {
-  return {
-    agentsDir: path.join(root, 'agents', 'codex-bridge'),
-    commandsDir: path.join(root, 'commands', 'codex-bridge'),
-    legacyAgentsDir: path.join(root, 'agents', 'codex'),
-    legacyCommandsDir: path.join(root, 'commands', 'codex'),
-  };
-}
-
 export function resolveHost({
   scope = 'user',
   host,

package/cli/install-owners.mjs

@@ -11,6 +11,7 @@
  */
 import { createHash } from 'node:crypto';
 import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
 import {
   fileEntry,
   INSTALL_METHOD_COPY,
@@ -20,10 +21,6 @@ import {
 
 const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 
-export function isFormat2(parsed) {
-  return isObject(parsed) && parsed.format === 2;
-}
-
 export function imageFingerprint(image) {
   const brand = image.fingerprints?.brand;
   if (brand === undefined) return null;

package/cli/install-record.mjs

@@ -4,7 +4,8 @@ import { randomUUID } from 'node:crypto';
 import { createHomeWriter } from '../src/home/lib/home-write.mjs';
 import { readJsonFile } from '../src/home/lib/json-file.mjs';
 import { HOOK_DEFINITIONS } from '../src/home/lib/hook-definitions.mjs';
-import { isFormat2, ownerView, validateFormat2, withOwner, withoutOwner } from './install-owners.mjs';
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
+import { ownerView, validateFormat2, withOwner, withoutOwner } from './install-owners.mjs';
 
 /**
  * The record's own spelling of the field saying how the package was installed, and its one value.
@@ -306,6 +307,11 @@ async function publishInstallRecord(host, next) {
   await writer.rename('install-record', temporary, target);
 }
 
+/** Plan_67 D11 / A4: changing inventory must not rebuild owners or hide fingerprint lag. */
+export function publishInstallRecordOnly(host, next) {
+  return publishInstallRecord(host, next);
+}
+
 /**
  * Publishes the record whole through a temporary and a rename: a direct write left a half-written
  * record for every host sharing the home if the process died mid-write (advice A3, risk r3).

package/cli/inventory-confirm.mjs

@@ -0,0 +1,75 @@
+/** Lets the operator declare a shared home's installation inventory complete, the one statement the package cannot prove.
+ * Plan_67 D11, OW-047: only the operator can account for unrecorded hosts using this home.
+ */
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
+import { publishInstallRecordOnly, readInstallRecordFile } from './install-record.mjs';
+import { validateFormat2 } from './install-owners.mjs';
+import { registryHintLines } from './inventory-transition.mjs';
+import { withLifecycle } from './lifecycle-transaction.mjs';
+import { readRulesRegistry } from './rules-owners.mjs';
+import { askYesNo, isInteractive } from './terminal-question.mjs';
+
+export const INVENTORY_CONFIRM_COMMAND = 'codex-bridge inventory confirm';
+
+const question = 'Are these all the hosts using this home?';
+const updateHint = 'Run codex-bridge update to migrate the installation record.';
+
+async function confirmInRun(host, dryRun, questionOptions) {
+  let record;
+  try {
+    record = await readInstallRecordFile(host);
+    if (!isFormat2(record)) {
+      return { exitCode: 1, output: `No format-2 installation record was found. ${updateHint}` };
+    }
+    validateFormat2(record);
+  } catch (error) {
+    return { exitCode: 1, output: `Invalid installation record: ${error.message} ${updateHint}` };
+  }
+  const owners = Object.values(record.owners);
+  if (owners.length === 0) {
+    return { exitCode: 1, output: 'no recorded owners; install into each host first' };
+  }
+  if (record.inventory === 'complete' && !Object.hasOwn(record, 'legacy')) {
+    return { exitCode: 0, output: 'The inventory is already complete.' };
+  }
+
+  const screen = [
+    `Home: ${host.brandRoot}`,
+    'Recorded hosts:',
+    ...owners.map((owner) => `  ${owner.root}`),
+    ...registryHintLines(host, (await readRulesRegistry(host))?.owners ?? []),
+    "Confirming lets the last recorded host's uninstall remove the shared image. "
+      + 'A host that uses this home but is not listed must be enrolled first: '
+      + 'codex-bridge install --host "<path>".',
+  ].join('\n');
+  if (dryRun) return { exitCode: 0, output: `${screen}\nDry run: nothing changed.` };
+  const prompt = `${screen}\n${question}`;
+  if (!isInteractive(questionOptions)) {
+    return { exitCode: 1, output: `${prompt}\nRun this command in a terminal to answer.` };
+  }
+  const answer = await askYesNo(prompt, questionOptions);
+  if (answer === 'cancel') {
+    return { exitCode: 130, output: `${prompt}\nCancelled; nothing was changed.` };
+  }
+  if (answer !== 'yes') {
+    return { exitCode: 1, output: `${prompt}\nNothing changed: the inventory stays incomplete.` };
+  }
+
+  // A4 pre-mortem: the raw fields are evidence of lag, not material to regenerate on confirmation.
+  const next = { ...record, inventory: 'complete' };
+  delete next.legacy;
+  await publishInstallRecordOnly(host, next);
+  return { exitCode: 0, output: `${prompt}\nRecorded the inventory as complete.` };
+}
+
+export async function inventoryConfirm({ host, dryRun = false, ...questionOptions }) {
+  const action = (ticket) => {
+    // Plan_67 R2: a first install may create the home after the unlocked missing-home check.
+    if (!dryRun && ticket === undefined) {
+      return { exitCode: 1, output: `No format-2 installation record was found. ${updateHint}` };
+    }
+    return confirmInRun(host, dryRun, questionOptions);
+  };
+  // Plan_67 D11: dry-run only reads; a real declaration holds the lifecycle lock before reading.
+  return dryRun ? action() : withLifecycle(host, 'inventory', action);
+}

package/cli/inventory-transition.mjs

@@ -3,9 +3,10 @@
  * store nothing about a refusal.
  */
 import fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { askYesNo, isInteractive } from './terminal-question.mjs';
-import { isFormat2 } from './install-owners.mjs';
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
 import { readInstallRecordFile } from './install-record.mjs';
 import { normalizedRulesOwner, readRulesRegistry } from './rules-owners.mjs';
 
@@ -36,7 +37,8 @@ export function registryHintLines(host, candidates) {
   const otherCandidates = candidates.filter((root) => root !== owner);
   return [
     'Codex rules registry host roots are a hint only; they may be stale or belong to another home:',
-    ...(otherCandidates.length ? otherCandidates.map((root) => `  ${root}`) : ['  none found']),
+    ...(otherCandidates.length ? otherCandidates.map((root) =>
+      `  ${root}${existsSync(root) ? '' : ' (folder does not exist)'}`) : ['  none found']),
   ];
 }
 

package/cli/manifest.mjs

@@ -4,14 +4,13 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { HOOK_DEFINITIONS } from '../src/home/lib/hook-definitions.mjs';
-import {
-  renderRequiredInputSummary,
-  renderRequiredInputs,
-} from '../src/home/lib/required-inputs.mjs';
+import { renderRequiredInputSummary } from '../src/home/lib/dispatcher-call.mjs';
 import { renderNoSelfExecution } from '../src/home/lib/no-self-execution.mjs';
+import { renderDispatcherProtocol } from '../src/home/lib/dispatcher-protocol.mjs';
+import { ORDER_AGENTS } from '../src/home/lib/order-schema.mjs';
 import { renderStopSummary } from '../src/home/lib/stop-contract.mjs';
 import { readJsonFile } from '../src/home/lib/json-file.mjs';
-import { normalizeFrontmatter } from './frontmatter.mjs';
+import { normalizeFrontmatter } from '../src/home/lib/frontmatter.mjs';
 import {
   INSTALL_RECORD_NAME,
   RULES_NAME,
@@ -77,7 +76,8 @@ export function replacePlaceholders(content, installationRoot) {
   const replaced = content
     .replaceAll('{{CODEX_BRIDGE_DIR}}', posix(path.resolve(installationRoot)))
     .replaceAll('{{CODEX_REQUIRED_INPUTS_SUMMARY}}', renderRequiredInputSummary(agentType))
-    .replaceAll('{{CODEX_REQUIRED_INPUTS}}', renderRequiredInputs(agentType))
+    .replaceAll('{{CODEX_DISPATCHER_PROTOCOL}}', ORDER_AGENTS.includes(agentType)
+      ? renderDispatcherProtocol(agentType) : '{{CODEX_DISPATCHER_PROTOCOL}}')
     .replaceAll('{{CODEX_NO_SELF_EXECUTION}}', renderNoSelfExecution())
     .replaceAll('{{CODEX_STOP_SUMMARY}}', renderStopSummary());
   return normalizeFrontmatter(replaced);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.10",
-  "description": "Claude Code-to-Codex delegation with 7 guards, 2848 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.12",
+  "description": "Claude Code-to-Codex delegation with 7 guards, 3267 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",