@lyupro/codex-bridge 0.6.10 → 0.6.12

package/src/home/hooks/dispatcher-gate.mjs

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import { AGENTS } from '../lib/agents.mjs';
 import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { sameCommand } from '../lib/dispatcher-command.mjs';
+import { bindReceipt, runnerReceipt } from '../lib/dispatcher-order.mjs';
 import { parseJsonText } from '../lib/json-file.mjs';
 import {
   decidePreToolUse,
@@ -17,7 +18,7 @@ import {
   readDispatcherState,
   updateDispatcherState,
 } from '../lib/dispatcher-state.mjs';
-import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { recordInterceptedAttempt, witnessHostVersion } from '../lib/handback-witness.mjs';
 import { observeSessionHost } from '../lib/host-observations.mjs';
 
 function emit(decision, toolInput) {
@@ -81,6 +82,7 @@ async function main() {
         const next = {
           ...(current.corrupt ? {} : current),
           ...(decision.stateUpdate || {}),
+          agentType: payload.agent_type,
         };
         if (toolUseId) {
           const seenToolUseIds = Array.isArray(next.seenToolUseIds) ? next.seenToolUseIds : [];
@@ -97,9 +99,8 @@ async function main() {
 
     if (payload.tool_name === HANDBACK_TOOL) {
       try {
-        await recordHandbackWitness({
+        await recordInterceptedAttempt({
           stateDir: BRAND_STATE_DIR,
-          kind: 'seen',
           hostVersion: await witnessHostVersion(payload),
         });
       } catch {}
@@ -119,12 +120,16 @@ async function main() {
       if (!order.command || !sameCommand(payload.tool_input?.command, order.command)) return;
       const result = runnerOutput(payload);
       if (!result) return;
-      await updateDispatcherState(ids, (current) => ({
-        ...(current.corrupt ? {} : current),
-        runnerOutput: result.output,
-        runnerFinal: isFinalOutput(result.output),
-        runnerExitCode: result.exitCode,
-      }));
+      await updateDispatcherState(ids, (current) => {
+        const base = current.corrupt ? {} : current;
+        return {
+          ...base,
+          ...bindReceipt(base, runnerReceipt(result.output)),
+          runnerOutput: result.output,
+          runnerFinal: isFinalOutput(result.output),
+          runnerExitCode: result.exitCode,
+        };
+      });
     } catch {}
   }
 }

package/src/home/hooks/live-runs.mjs

@@ -18,8 +18,6 @@ import { readJsonFileSync } from '../lib/json-file.mjs';
 import { runLiveness } from '../lib/meta/run-liveness.mjs';
 import { IDENTITY_ALIVE } from '../lib/process-identity.mjs';
 
-export const RECENT_RUN_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-
 /**
  * Match the package's repository comparison without resolving symlinks: Windows realpath adds
  * `\\?\\` and UNC spellings, turning equal paths into unequal ones. A null result is uncertainty,
@@ -98,45 +96,6 @@ export function liveRuns(runsDir, options = {}) {
   return result;
 }
 
-/**
- * Find runs recent enough to explain the current dispatcher reply, including completed runs.
- * The 24-hour window covers long and overnight dispatches without letting old project history
- * explain a new reply. This closes the August 13 incident where a fabricated FAIL hid a
- * finished/OK run simply by omitting its folder. Null means the disk could not be trusted.
- */
-export function recentRuns(runsDir, options = {}) {
-  if (typeof runsDir !== 'string' || !runsDir.trim()) return null;
-  const now = options.now ?? Date.now();
-  const maxAgeMs = options.maxAgeMs ?? RECENT_RUN_MAX_AGE_MS;
-  let entries;
-  try {
-    entries = fs.readdirSync(runsDir, { withFileTypes: true });
-  } catch (err) {
-    return err.code === 'ENOENT' ? [] : null;
-  }
-
-  const result = [];
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dir = path.join(runsDir, entry.name);
-    const statusPath = path.join(dir, 'status.json');
-    if (!fs.existsSync(statusPath)) continue;
-    let status;
-    try {
-      status = readJsonFileSync(statusPath);
-    } catch {
-      return null;
-    }
-    if (!status || typeof status !== 'object' || Array.isArray(status)) return null;
-    if (options.agent && status.agent !== options.agent) continue;
-    if (options.orderId && String(status.order_id ?? '').trim() !== options.orderId) continue;
-    const timestamp = Date.parse(status.finished_at || status.started_at || '');
-    if (!Number.isFinite(timestamp) || timestamp > now || now - timestamp > maxAgeMs) continue;
-    result.push({ dir, status, timestamp });
-  }
-  return result.sort((a, b) => b.timestamp - a.timestamp);
-}
-
 /** Scan every project under the configured runs root for worktree ownership. */
 export function allLiveRuns(runsRoot, options = {}) {
   if (typeof runsRoot !== 'string' || !runsRoot.trim()) return [];

package/src/home/hooks/order-gate.mjs

@@ -2,10 +2,10 @@
 /**
  * PreToolUse gate for the Codex dispatchers (codex-scout / codex-build / codex-review).
  *
- * The runner rejects a dispatcher immediately when order id (and scope for codex-build) is
- * absent, but the old requirement lived only in the prompt read by the dispatcher. The caller
- * therefore had no enforced place to provide it and codex-build died before doing work. This
- * gate checks the producer's task text while it can still be corrected.
+ * Plan_63 D9: the call carries only the task file; order id and grant come from its header.
+ * OW-054: validate the header and order before a grant can skip the order-owner diagnostic,
+ * so a `continue: none` line cannot disarm the check. The producer can still correct the order
+ * before the runner creates a run folder or spends quota.
  *
  * Input is Claude Code's hook JSON on stdin. The last payload is retained for diagnostics so a
  * future host schema change can be inspected instead of guessed at. Any uncertain shape passes
@@ -14,15 +14,14 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { modelLatch, readDispatcherModel } from '../lib/dispatcher-model.mjs';
+import { readDispatcherPin } from '../lib/dispatcher-pin.mjs';
 import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
+import { transcriptHostVersion } from '../lib/host-version.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
-import {
-  diagnoseInput,
-  extractValue,
-  missingInputs,
-  parseGrant,
-  shellUnsafeInputs,
-} from '../lib/required-inputs.mjs';
+import { parseDispatcherCall, renderCallRefusal } from '../lib/dispatcher-call.mjs';
+import { orderFromHeader, renderOrderProblems } from '../lib/order-schema.mjs';
 import { SUBAGENT_TOOLS } from '../lib/hook-definitions.mjs';
 import { taskFingerprint } from '../lib/meta/chain.mjs';
 import { conflictingOrderOwner, orderOwnerConflictText } from '../lib/runner/order-owner.mjs';
@@ -30,6 +29,7 @@ import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { parseTaskDocument } from '../lib/runner/task-file.mjs';
 import { parseTaskHeader, taskHeaderRefusal } from '../lib/task-header.mjs';
+import { envModelProblem } from '../lib/subagent-model-env.mjs';
 
 const GUARDED = new Set(Object.keys(AGENTS));
 /**
@@ -39,9 +39,14 @@ const GUARDED = new Set(Object.keys(AGENTS));
  */
 const SUBAGENT_TOOL_NAMES = new Set(SUBAGENT_TOOLS);
 
-const pass = () => process.exit(0);
+let systemMessage;
+const pass = () => {
+  if (systemMessage) process.stdout.write(JSON.stringify({ systemMessage }));
+  process.exit(0);
+};
 const deny = (reason) => {
   process.stdout.write(JSON.stringify({
+    ...(systemMessage ? { systemMessage } : {}),
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
       permissionDecision: 'deny',
@@ -65,7 +70,37 @@ if (!SUBAGENT_TOOL_NAMES.has(input.tool_name)) pass();
 
 const toolInput = input.tool_input;
 if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) pass();
-if (!GUARDED.has(toolInput.subagent_type) || typeof toolInput.prompt !== 'string') pass();
+if (!GUARDED.has(toolInput.subagent_type)) pass();
+
+// Plan_67 D6: one installed model contract; refuse even matching aliases before prompt exits.
+const agentType = toolInput.subagent_type;
+if (Object.hasOwn(toolInput, 'model')) {
+  deny(
+    "Order gate denied the Agent call because it passes `model`: a dispatcher's model is set in one place, "
+      + `its installed agent file. Call ${agentType} without model. `
+      + 'The run folder was not created; quota was not spent.',
+  );
+}
+try {
+  const hostVersion = await transcriptHostVersion(input.transcript_path).catch(() => null);
+  const pin = readDispatcherPin({ brandRoot: BRAND_HOME.root, agentType });
+  const problem = envModelProblem({ env: process.env, hostVersion, pinFamily: pin.family });
+  if (problem) deny(problem);
+} catch {
+  // D6 (b): uncertain host/env evidence is diagnostic only; the stop observer still checks it.
+}
+try {
+  const latch = modelLatch({ ledger: readDispatcherModel({ stateDir: BRAND_STATE_DIR }), agentType });
+  if (latch.active) {
+    const { data, at } = latch.violation;
+    systemMessage = `codex-bridge: the last ${agentType} ran on ${data.parsed.join(', ')} `
+      + `while the installed contract pins ${data.pinFamily} (${data.hostVersion ?? 'unknown'}, ${at}); `
+      + 'the cause is outside this call — another hook or the host; run codex-bridge doctor.';
+  }
+} catch {
+  // D4 (a): a corrupt ledger must not turn a diagnostic warning into a refusal.
+}
+if (typeof toolInput.prompt !== 'string') pass();
 
 /**
  * Plan_62 D7: with agent teams enabled, a registered dispatcher launched with `name` or `team_name`
@@ -83,28 +118,9 @@ if (teammateField) {
   );
 }
 
-const missing = missingInputs(toolInput.subagent_type, toolInput.prompt);
-const unsafe = shellUnsafeInputs(toolInput.subagent_type, toolInput.prompt);
-if (missing.length || unsafe.length) {
-  const reason = missing.length
-    ? [
-        'Order gate denied the Agent call because required dispatcher input(s) are missing or still placeholders.',
-        'Write each value in tool_input.prompt using `label: value` before launching the dispatcher:',
-        ...missing.flatMap((entry) => {
-          const lines = [`- ${entry.label}: ${entry.explanation} Example: \`${entry.example}\`.`];
-          const diagnosis = diagnoseInput(toolInput.prompt, entry.label);
-          if (diagnosis) lines.push(`  found \`${diagnosis.line}\`, ${diagnosis.reason}`);
-          return lines;
-        }),
-      ].join('\n')
-    : [
-        'Order gate denied the Agent call because labelled dispatcher input(s) contain forbidden shell sequences.',
-        'Correct each field before launching the dispatcher:',
-        ...unsafe.map(({ entry, sequence }) =>
-          `- ${entry.label}: found ${JSON.stringify(sequence)}; put free text in the task file and pass only a short command-line value.`),
-      ].join('\n');
-  deny(reason);
-}
+// Plan_76 D1: exact registry labels prevent the scope-new and repository-prose incident of 2026-10-04.
+const call = parseDispatcherCall(toolInput.subagent_type, toolInput.prompt);
+if (call.problems.length) deny(renderCallRefusal(toolInput.subagent_type, call.problems));
 
 const readStatus = (file) => {
   try {
@@ -114,11 +130,7 @@ const readStatus = (file) => {
   }
 };
 
-const orderId = extractValue(toolInput.prompt, 'order id');
-const taskFile = extractValue(toolInput.prompt, 'task file');
-// Plan_75 D1, TradeForge capacity incident: retries keep their order; the runner owns conflicting-grant refusal.
-const grant = parseGrant(toolInput.prompt);
-if (!orderId || !taskFile || grant?.kind || grant?.error) pass();
+const taskFile = call.inputs.get('task file');
 
 let rawTask;
 try {
@@ -130,6 +142,13 @@ try {
 const parsed = parseTaskHeader(rawTask);
 const headerRefusal = taskHeaderRefusal(parsed);
 if (headerRefusal) deny(headerRefusal);
+const { order, problems } = orderFromHeader(toolInput.subagent_type, parsed);
+if (problems.length) {
+  deny(`${renderOrderProblems(toolInput.subagent_type, problems)}\nThe run folder was not created; quota was not spent.`);
+}
+const orderId = order.get('order id');
+// Plan_63 D9 / OW-054: only a validated header grant reaches the runner's grant rules.
+if (parsed.grant) pass();
 let taskHash;
 try {
   taskHash = taskFingerprint(parseTaskDocument(parsed.body).task);

package/src/home/hooks/reply-guard.mjs

@@ -24,6 +24,7 @@
  * In the handback era, SubagentHandback delivers the caller-visible answer before SubagentStop.
  * Alarms name the host by its transcript version: on 2026-09-25 the SDK variable proved inherited.
  * Plan_62 makes this hook yield after delivery and audit every transcript tool call against gate receipts.
+ * Plan_63 D10 identifies this run only by the host-keyed gate's immutable runner receipt.
  *
  * Input is JSON on stdin. The fields used here (`agent_type`, `last_assistant_message`)
  * come from Claude Code; the last payload is kept in state/diagnostics/reply-guard.last.json
@@ -32,20 +33,21 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
-import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
-import { runOrderMismatch, transcriptOrderId } from '../lib/dispatcher-order.mjs';
 import { decideDispatcherStop, transcriptToolUses } from '../lib/dispatcher-stop.mjs';
+import { observeDispatcherModelStop } from '../lib/dispatcher-model.mjs';
 import { recognizeHostRefusal } from '../lib/host-refusal.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 import { readDispatcherState, updateDispatcherState } from '../lib/dispatcher-state.mjs';
-import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { witnessHostVersion } from '../lib/handback-witness.mjs';
+import { untypedStopEvidence } from '../lib/untyped-stop.mjs';
 import { runLiveness } from '../lib/meta/run-liveness.mjs';
-import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
-import { runsRoot } from '../lib/runner/runs-root.mjs';
-import { liveRuns, normalizePath, recentRuns } from './live-runs.mjs';
+import { liveRuns, normalizePath } from './live-runs.mjs';
 import { FORM, MAX_STATE_BLOCKS, STATE, takeTry } from './guard-tries.mjs';
 import { parseReply } from './reply-parser.mjs';
+import { recordStopWitness, typedStopObservations, untypedStopObservation } from './reply-witness.mjs';
+import { decideReplyIdentity, missingIdsAlarm, readReceiptEvidence } from './reply-identity.mjs';
 import {
   abandonedRunReason,
   abandonedRunStop,
@@ -58,14 +60,11 @@ import {
   missingHostOrderIdReason,
   missingMetaReason,
   missingRunReason,
-  noRecentRunReason,
-  noRecentRunStop,
   nonexistentRunReason,
   omittedDiscoveredRunReason,
   omittedDiscoveredRunStop,
   omittedSiblingReason,
   omittedSiblingStop,
-  orderMismatchStop,
   statusMismatchReason,
   statusMismatchStop,
 } from './reply-verdicts.mjs';
@@ -114,20 +113,24 @@ try {
 
 recordHookDiagnostic('reply-guard', input);
 
-// A host that stops sending agent_type would let every dispatcher past the gate and this
-// audit without a word (Plan_66 D2 (c)); say so instead of passing silently.
+// Plan_67 D9: only evidence bound to this stop can identify an untyped dispatcher.
 if (typeof input.agent_id === 'string' && input.agent_id.length > 0
   && !(typeof input.agent_type === 'string' && input.agent_type.length > 0)) {
+  let evidence;
   try {
-    await recordHandbackWitness({
-      stateDir: BRAND_STATE_DIR,
-      kind: 'alarm',
-      hostVersion: await witnessHostVersion(input),
-      detail: `host omitted agent_type for agent ${input.agent_id}`,
-    });
+    const state = typeof input.session_id === 'string' && input.session_id.length > 0
+      ? readDispatcherState({ stateDir: BRAND_STATE_DIR, sessionId: input.session_id, agentId: input.agent_id }) : null;
+    const transcript = transcriptToolUses(input.agent_transcript_path);
+    evidence = untypedStopEvidence({ state, toolUses: transcript?.toolUses ?? null });
   } catch {
-    // Plan_66 H2: the 2026-09-17..24 handback break showed host contract loss must alarm, but never block work.
+    // An unreadable state is no evidence either way; a guard failure must never break the stop.
+    evidence = { dispatcher: false, reason: 'state-unreadable' };
   }
+  const { observation, alarm } = untypedStopObservation({
+    evidence, hostVersion: await witnessHostVersion(input), agentId: input.agent_id,
+  });
+  await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: [observation] });
+  if (!alarm) pass();
   process.stdout.write(JSON.stringify({
     systemMessage: 'codex-bridge: the host did not report agent_type for a subagent — the dispatcher gate cannot recognise dispatchers, so their answers are unchecked; run codex-bridge doctor.',
   }));
@@ -137,32 +140,40 @@ if (typeof input.agent_id === 'string' && input.agent_id.length > 0
 // business — an earlier version inferred the agent from transcript text and blocked an
 // unrelated one, which cost a re-answer for nothing.
 if (!GUARDED.has(input.agent_type)) pass();
+try {
+  dispatcherSystemMessage = await observeDispatcherModelStop({
+    brandRoot: BRAND_HOME.root, stateDir: BRAND_STATE_DIR, input, hostVersion: await witnessHostVersion(input),
+  });
+} catch { /* Plan_67 D4: model diagnostics must never block a dispatcher stop. */ }
 
 const emitStop = (payload) => {
   process.stdout.write(JSON.stringify(payload));
   process.exit(0);
 };
+const hasIds = typeof input.session_id === 'string' && input.session_id.length > 0
+  && typeof input.agent_id === 'string' && input.agent_id.length > 0;
+let receipt = null;
+let receiptConflict = null;
 try {
-  if (typeof input.session_id === 'string' && input.session_id.length > 0
-    && typeof input.agent_id === 'string' && input.agent_id.length > 0) {
+  if (hasIds) {
     const ids = {
       stateDir: BRAND_STATE_DIR,
       sessionId: input.session_id,
       agentId: input.agent_id,
     };
     const state = readDispatcherState(ids);
-    const toolUses = transcriptToolUses(input.agent_transcript_path);
+    ({ receipt, receiptConflict } = readReceiptEvidence(state));
+    const transcript = transcriptToolUses(input.agent_transcript_path);
+    const toolUses = transcript?.toolUses ?? null;
     const stop = decideDispatcherStop({ state, toolUses });
     if (stop.unseen.length) {
       const names = stop.unseen.map((toolUse) => toolUse.name).join(', ');
-      dispatcherSystemMessage = `codex-bridge: dispatcher ${input.agent_type} used ${names} outside the dispatcher gate — do not trust its answer; run codex-bridge doctor.`;
-      await recordHandbackWitness({
-        stateDir: BRAND_STATE_DIR,
-        kind: 'alarm',
-        hostVersion: await witnessHostVersion(input),
-        detail: `${input.agent_type} ${input.agent_id}: ${names} outside the dispatcher gate`,
-      });
+      dispatcherSystemMessage = [dispatcherSystemMessage, `codex-bridge: dispatcher ${input.agent_type} used ${names} outside the dispatcher gate — do not trust its answer; run codex-bridge doctor.`].filter(Boolean).join(' ');
     }
+    await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: typedStopObservations({
+      agentType: input.agent_type, agentId: input.agent_id, hostVersion: await witnessHostVersion(input),
+      hasIds, state, toolUses, unseen: stop.unseen, transcriptComplete: transcript?.complete === true,
+    }) });
     if (stop.stateUpdate) {
       await updateDispatcherState(ids, (current) => ({
         ...(current.corrupt ? {} : current),
@@ -185,6 +196,14 @@ try {
   // The handback path is fail-open; the established reply checks remain the fallback.
 }
 
+if (!hasIds) {
+  await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: typedStopObservations({
+    agentType: input.agent_type, hostVersion: await witnessHostVersion(input),
+    hasIds, state: null, toolUses: null, unseen: [], transcriptComplete: false,
+  }) });
+  dispatcherSystemMessage ||= missingIdsAlarm(input.agent_type);
+}
+
 const reply = String(input.last_assistant_message || '').trim();
 if (!reply) pass();
 const emit = (payload) => {
@@ -220,48 +239,22 @@ const blockState = (reason, stopReason) => {
 
 const { runDirs, claimed } = parseReply(reply);
 let runDir = runDirs[0] || null;
-let discoveredRun = false;
-let discoveredStatus = null;
-let searchedRunsDir = null;
 
 if (runDir && !fs.existsSync(runDir)) {
   blockForm(nonexistentRunReason);
 }
 
-const orderedOrderId = transcriptOrderId(input.agent_transcript_path);
-
 if (!runDir && !claimed) {
   // A reply that pronounces nothing cannot contradict the disk. It stays on the old, softer path:
   // three tries about the SHAPE of the answer and then through, which is what a quoted refusal
-  // needs. Only a reply that hands down a verdict earns the disk search below.
+  // needs. Only a reply that hands down a verdict earns the receipt checks below.
   blockForm(missingRunReason);
 }
 
-if (!runDir) {
-  let candidates;
-  try {
-    searchedRunsDir = resolveProjectRunsDir(runsRoot(), input.cwd, { create: false }).dir;
-    // Plan_62 r2: on 2026-09-24 the newest run of this agent type belonged to an earlier order, and the
-    // guard judged the reply against that stranger's folder. With the order id known, only its runs count.
-    candidates = recentRuns(searchedRunsDir, {
-      agent: input.agent_type,
-      ...(orderedOrderId ? { orderId: orderedOrderId } : {}),
-    });
-  } catch {
-    pass();
-  }
-  if (candidates === null) pass();
-
-  if (!candidates.length) {
-    blockState(
-      noRecentRunReason,
-      noRecentRunStop(MAX_STATE_BLOCKS, input.agent_type, searchedRunsDir),
-    );
-  }
-
-  ({ dir: runDir, status: discoveredStatus } = candidates[0]);
-  discoveredRun = true;
-}
+const identity = decideReplyIdentity({ runDir, hasIds, receipt, receiptConflict, agentType: input.agent_type });
+if (identity.block) blockState(identity.block.reason, identity.block.stop);
+const { discoveredRun, discoveredStatus } = identity;
+runDir = identity.runDir;
 
 /**
  * The dispatcher must name every WRITING run the project has live, not just the one it chose to
@@ -307,12 +300,6 @@ if (fs.existsSync(statusPath)) {
   } catch {
     runStatus = null;
   }
-  const mismatch = runOrderMismatch(orderedOrderId, runStatus, runDir);
-
-  if (mismatch) {
-    blockState(mismatch.reason, orderMismatchStop(MAX_STATE_BLOCKS, mismatch, runStatus, runDir));
-  }
-
   if (runStatus?.state === 'running') {
     // Plan_57 D5/D27: a bare pid mistook a reused foreign process for this run's worker.
     // The shared judge uses run identity and keeps unverified processes live (fail open).

package/src/home/hooks/reply-identity.mjs

@@ -0,0 +1,64 @@
+/** Decides which run a dispatcher reply answers for, from the gate's receipt (Plan_63 D10; 2026-09-24 stranger-run incident). */
+import path from 'node:path';
+import { readJsonFileSync } from '../lib/json-file.mjs';
+import { normalizePath } from './live-runs.mjs';
+import { MAX_STATE_BLOCKS } from './guard-tries.mjs';
+import {
+  noReceiptReason,
+  noReceiptStop,
+  receiptConflictReason,
+  receiptConflictStop,
+  receiptMismatchReason,
+  receiptMismatchStop,
+} from './reply-verdicts.mjs';
+
+export function readReceiptEvidence(state) {
+  return {
+    receipt: typeof state?.runReceipt === 'string' && state.runReceipt.length > 0 ? state.runReceipt : null,
+    receiptConflict: typeof state?.runReceiptConflict === 'string' && state.runReceiptConflict.length > 0
+      ? state.runReceiptConflict : null,
+  };
+}
+
+export function missingIdsAlarm(agentType) {
+  return `codex-bridge: the host did not report session_id and agent_id for dispatcher ${agentType} — whose run this answer quotes cannot be checked; run codex-bridge doctor.`;
+}
+
+// Plan_63 D10: a recent stranger is never evidence for this reply; only the gate receipt is.
+// Form checks stay in the caller before this decision, preserving their softer try budget.
+export function decideReplyIdentity({ runDir, hasIds, receipt, receiptConflict, agentType }) {
+  if (hasIds && receiptConflict) {
+    return { block: {
+      reason: receiptConflictReason(receipt, receiptConflict),
+      stop: receiptConflictStop(MAX_STATE_BLOCKS, agentType, receipt, receiptConflict),
+    } };
+  }
+
+  if (!runDir) {
+    if (!(hasIds && receipt)) {
+      return { block: { reason: noReceiptReason, stop: noReceiptStop(MAX_STATE_BLOCKS, agentType) } };
+    }
+    let discoveredStatus = null;
+    try {
+      discoveredStatus = readJsonFileSync(path.join(receipt, 'status.json'));
+    } catch {
+      discoveredStatus = null;
+    }
+    return { runDir: receipt, discoveredRun: true, discoveredStatus };
+  }
+
+  if (hasIds) {
+    if (!receipt) {
+      return { block: { reason: noReceiptReason, stop: noReceiptStop(MAX_STATE_BLOCKS, agentType) } };
+    }
+    if (normalizePath(runDir) !== normalizePath(receipt)) {
+      return { block: {
+        reason: receiptMismatchReason(runDir, receipt),
+        stop: receiptMismatchStop(MAX_STATE_BLOCKS, agentType, runDir, receipt),
+      } };
+    }
+  }
+  // Review 2026-10-05_201513_plan63-r-review-20261005 and Plan_66 H2: missing ids alarm
+  // in the caller; named folders retain disk checks because host contract loss must never block work.
+  return { runDir, discoveredRun: false, discoveredStatus: null };
+}