@lyupro/codex-bridge 0.6.11 → 0.6.14

package/CHANGELOG.md

@@ -4,6 +4,145 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.14] - 2026-10-11
+
+### Added
+
+- Install and update place an always-loaded delegation core in the Claude Code host's
+  `rules/codex-bridge/core.md`: under `~/.claude/` for user scope or `<project>/.claude/` for
+  project scope. It has no `paths` frontmatter and stays within 2,400 characters, so the short
+  contract reaches every session without loading all the detailed guidance. This is separate
+  from the Codex execpolicy file. Uninstall removes package or recorded core bytes and the empty
+  package subfolder; edited or unknown files and links are kept and named, and the host's own
+  `rules/` folder stays.
+- The `doctor` row `claudeRules` checks the installed core against the package: missing or
+  differing bytes are `fail`, with `codex-bridge update --force` as the remedy; before installation
+  it is `warn`. A deleted or edited core previously left the installation looking healthy.
+- An observing `InstructionsLoaded` hook records session-start core paths and hashes in
+  `<home>/state/load-witness.json` without blocking host actions. The `doctor` rows
+  `claudeRulesLoad:<host version>` require the latest load at this owner's exact core path to
+  match the package hash, using the version from that same session's transcript. Missing, stale,
+  unreadable or oversized evidence is `warn`, never proof of a load failure; open a new Claude
+  Code session and rerun `doctor`. A newer differing or oversized load cannot be cleared by an
+  older match, and core reads are bounded to 7,200 bytes plus one overflow byte.
+- Each run row in `codex-bridge projects <project> --json` includes `path`, the absolute run
+  folder, so orchestrators can find earlier artifacts and write an `advice:` address without
+  deriving the run store from the package's installation directory.
+- Maintainers prove before a release, with
+  `npm run release-check:rules-load-claude -- --model <model>`, that both `claude` on `PATH` and
+  the VS Code extension's binary load a real project install's core. The script lives in the
+  repository and is not part of the npm package. Each target gets an isolated throwaway project; its exact core path, frozen hash and session host
+  version must match, and the check guards the operator's installation and cleans up its trees.
+  Attempts are saved to `docs/audits/release-checks/rules-load-claude.json` by default. Exit 0
+  means both targets verified, 1 means a failure, and 2 means inconclusive without a failure;
+  missing evidence blocks the release, and an oversized core fails it. The check does not start
+  Codex, because the earlier manual check raised a UAC prompt while trying to measure Claude.
+- `doctor` probes `sandbox:read-only` and `sandbox:workspace-write` sequentially before an
+  order first discovers a dead Codex sandbox: `ok` means alive, `fail` means dead with exit 1,
+  and inconclusive or unsupported checks are `warn`. Both a dead-sandbox row and an order's
+  pre-start refusal print the diagnosis from Codex's sandbox log and `setup_error.json`, because
+  the TradeForge refusal said only "setup refresh had errors" while the log named a locked
+  runtime file. Only lines attributed to the probe justify a repair signature for a locked
+  runtime file or corrupt deny-read state; other evidence stays raw with "No verified repair
+  signature". Unreadable logs do not change the verdict, and the package does not repair the host.
+
+- `codex-bridge guidance [<topic>]` prints the package's detailed rules for one topic; without a
+  topic it lists `order`, `advisor`, `budget`, `records` and `concurrency`. The rules core sends
+  the orchestrator here before it writes a task file and tells it to stop and show the output if
+  the command fails, so orchestrator prompts need no change. Text comes from the installed home
+  rather than the clone, because the seeded-config incident exposed that difference; unknown
+  topics or extra arguments exit 2, and an unreadable topic exits 1 and names `codex-bridge update`.
+
+### Changed
+
+- **Breaking for orchestrator prompts:** `UNAVAILABLE` now means a measured sign-out, not a
+  missing `codex` on `PATH`. A lookup miss is checked again after about a second; a second miss
+  is a free pre-start refusal starting "Codex CLI readiness unconfirmed", with exit 1 and no
+  run folder. Migration cost: replace the missing-CLI skip rule with checks of `codex --version`
+  for up to about two minutes, then repeat the same order exactly once if it answers. Otherwise,
+  or if that repeat gets the same refusal, hand the order to the next executor and name the
+  handoff in the summary; no second repeat. An npm update briefly rewrote the Codex shim and
+  caused an orchestrator to drop the bridge for the whole session.
+
+### Fixed
+
+- **Breaking for operators:** update refuses an unrecorded file at a newly planned path instead
+  of silently overwriting operator text, including the host rules core. The refusal names the
+  `unowned` path. Migration cost: review that file and use `--force` only if replacement is
+  intended; identical bytes are adopted without it. The existing migration for the package's
+  Codex rules file remains available to records from before rules were recorded.
+- Sandbox checks are bounded, and an inconclusive read-only check skips the workspace-write
+  check so a timed-out setup cannot race another probe. `codex --version` is also bounded.
+  Diagnosis reads only regular files in a real `.sandbox` folder, rejecting linked folders,
+  linked logs and special files that could redirect evidence or hang before a probe starts.
+
+## [0.6.13] - 2026-10-08
+
+### Added
+
+- `codex-bridge runs move [--dry-run]` moves run records from `~/.claude/codex-runs/` to
+  `~/.lyupro/.codex-bridge/runs/`. It refuses while a run is live, copies every record, verifies
+  each file by SHA-256, imports the old repository's `codex-runs` git history, and writes
+  `state/runs-root.json` last. Only this command writes the move record. It offers to remove the
+  old folder only when every file in it has an identical copy in the new store. Like
+  `uninstall --purge --dry-run`, a dry run names every refusal and still shows the counts, since
+  some project is nearly always running when the operator plans the move.
+- A finished run autocommits its own folder and the project marker when the git repository top
+  is the run store or package home. It never commits into a foreign repository such as
+  `~/.claude`, and a commit failure does not change the run verdict. On 2026-10-07 run records
+  left thousands of uncommitted files in that foreign repository; a session-close gate listed
+  each one.
+- Paths under a retired run root are refused before anything is opened or created, including
+  `advice:`, `codex-bridge read`, `stop`, and a stale `CODEX_RUNS_ROOT` in the launcher. The refusal
+  names the equivalent new path; nothing is remapped and no quota is spent.
+- The `repository:` task header must name an existing absolute directory without any path
+  segment ending in a dot or space.
+
+### Changed
+
+- The default run root is now `~/.lyupro/.codex-bridge/runs/` after a move or on a fresh install
+  where `~/.claude/codex-runs/` does not exist. A trimmed, non-empty `CODEX_RUNS_ROOT` takes
+  precedence; otherwise an existing old folder remains the root while the move is pending.
+- The `doctor` `runsRoot` line shows the selected root, its source, and warnings for a pending
+  move, an old folder still present, or a root inside a foreign git repository. `.git` is not
+  counted as a project.
+- Run records are user data. Uninstall and `--purge` preserve the package home's `runs/` folder
+  and the old `~/.claude/codex-runs/` folder.
+
+## [0.6.12] - 2026-10-07
+
+### Added
+
+- `codex-bridge inventory confirm [--scope user|project] [--host <path>] [--dry-run]` lets the
+  operator declare that the recorded hosts are all the hosts using this home. An old installation
+  record migrated to format 2 without a terminal stays `inventory: incomplete`: later updates do
+  not ask again, and since 0.6.11 every dispatcher model observation leaves the pin undetermined.
+  The package cannot prove that no unrecorded host uses the home; only the operator can.
+  The command shows the home, recorded host roots and Codex rules registry hints, marking missing
+  folders because the registry can retain deleted scratchpads. Enroll an unlisted host with
+  `codex-bridge install --host "<path>"` before confirming. A terminal "yes" changes only
+  `inventory` to `complete` and removes `legacy`; owners, fingerprints and every other field are
+  left as read. This permits ordinary shared-image cleanup when the last recorded host uninstalls;
+  it does not record a model match or clear a violation. No, EOF or a non-TTY exits 1 without changes;
+  Ctrl+C exits 130; a valid dry run shows the declaration without writing and exits 0. Confirmation
+  and an already-complete inventory without `legacy` exit 0. The `doctor` owner rows and the
+  incomplete-inventory pin reason now name this command.
+
+### Changed
+
+- `doctor` judges handback witness and dispatcher model state for every host whose dispatchers
+  ran in the last 24 hours. On 2026-10-07 two VS Code windows ran 2.1.291 and 2.1.292: an observation
+  on the non-newest host appeared only as history, and a model violation there would have printed
+  `ok`. Active witness violations identify their host with `host <version>:`, and each active
+  host's model entries have their own rows with that prefix. A model `fail` on any active host
+  reaches exit code 1. Older unresolved entries remain in one history sentence, without active
+  warning rows. The newest-host selector still serves contracts, `otherHost:*` and install.
+
+### Fixed
+
+- Dispatcher model rows no longer print a doubled period after a pin reason: the live `doctor`
+  output had added its own period to a reason that already ended with one.
+
 ## [0.6.11] - 2026-10-07
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # codex-bridge
 
-**Delegate implementation, reconnaissance, review and design advice from Claude Code to Codex — seven host guards, zero runtime dependencies, zero build steps.**
+**Delegate implementation, reconnaissance, review and design advice from Claude Code to Codex — eight host guards, zero runtime dependencies, zero build steps.**
 
 [![npm version](https://img.shields.io/npm/v/@lyupro/codex-bridge)](https://www.npmjs.com/package/@lyupro/codex-bridge)
 [![Node.js](https://img.shields.io/node/v/@lyupro/codex-bridge)](https://www.npmjs.com/package/@lyupro/codex-bridge)
@@ -32,8 +32,8 @@ Use `--scope project` to install the Claude Code-facing files under `<repo>/.cla
 
 Installation has two roots:
 
-- `~/.lyupro/.codex-bridge/` contains package runtime files, guards, configuration, conventions, and the installation record.
-- The selected Claude Code root (`~/.claude/` or `<repo>/.claude/`) contains the four agents (`codex-scout`, `codex-build`, `codex-review`, `codex-advisor`), two slash commands, merged hook registrations in `settings.json`, and run artifacts under `codex-runs/`.
+- `~/.lyupro/.codex-bridge/` contains package runtime files, guards, configuration, conventions, the installation record, and run records under `runs/` as user data.
+- The selected Claude Code root (`~/.claude/` or `<repo>/.claude/`) contains the four agents (`codex-scout`, `codex-build`, `codex-review`, `codex-advisor`), two slash commands, and merged hook registrations in `settings.json`. Before the move, existing run records remain in `~/.claude/codex-runs/`.
 
 The repository's `src/home/` directory is the literal image copied into the branded root: its
 `hooks/`, `lib/`, `config.json`, and `conventions.md` paths are the host paths without remapping.
@@ -43,7 +43,7 @@ Before every `settings.json` write, the existing file is backed up. Existing set
 
 If a global install and a clone coexist, you have two package copies. `codex-bridge update`, `codexb update`, and the clone entry point copy files from whichever copy launched the command; using the wrong one can replace a newer host installation with older files.
 
-`codex-runs/` contains operator data. Uninstall never removes it.
+Run records in `~/.lyupro/.codex-bridge/runs/` (or `~/.claude/codex-runs/` before the move) are user data. Uninstall, including `--purge`, never removes either folder.
 
 ## Requirements
 
@@ -57,12 +57,12 @@ If a global install and a clone coexist, you have two package copies. `codex-bri
 - **Invalid work is rejected before quota is spent.** Scope, order, retry, branch, and continuation checks run before a run folder is created.
 - **Verdicts come from artifacts.** CLI events, git state, and the declared report decide the result, not model claims about itself.
 - **Identical retries attach safely.** Repeating the same command joins the active run instead of starting another one.
-- **7 host guards enforce the boundary.** `reply-guard`, `order-gate`, `worktree-lock`, `prune-guard`, and `stop-guard` cover replies, orders, edits, deletion, and stopping; `worktree-witness` stands behind the lock and names a write that reached the tree anyway; `dispatcher-gate` lets a dispatcher run only the one runner command of its order and hands its caller the runner's own words.
+- **8 host guards enforce and witness the boundary.** `reply-guard`, `order-gate`, `worktree-lock`, `prune-guard`, and `stop-guard` cover replies, orders, edits, deletion, and stopping; `worktree-witness` stands behind the lock and names a write that reached the tree anyway; `dispatcher-gate` lets a dispatcher run only the one runner command of its order and hands its caller the runner's own words; `load-witness` only observes — it records that the host loaded the package's rules core, the one proof `doctor` accepts that the rules are in context.
 - **Installation is identifiable and reversible.** Writes to `settings.json` are merged and backed up; uninstall removes recorded package files only.
 - **Every run leaves an audit folder.** The verbatim task, scope, before/after git state, events, report, verdict, and reason remain together.
 - **Zero runtime dependencies and zero build steps.** The package is plain `.mjs` on the Node.js standard library.
 
-The current suite contains **3199 automated tests: 3198 passing and 1 skipped**.
+The current suite contains **3654 automated tests: 3651 passing and 3 skipped**.
 
 ## Verify
 
@@ -87,13 +87,13 @@ Output on a healthy host (trimmed):
 [ok] conventions: ~/.lyupro/.codex-bridge/conventions.md (found)
 [ok] codex: codex-cli 0.146.1
 [ok] node: 24.18.0 (requires >=24)
-[ok] runsRoot: ~/.claude/codex-runs
+[ok] runsRoot: ~/.lyupro/.codex-bridge/runs (default)
 [ok] liveRuns: 0 runs working right now
 ```
 
 `doctor` reports the selected host, package source, installed files and guards, Codex availability, retention policy, permissions, live runs, and the current repository's run folder. It judges contracts against the newest host version observed in a session transcript, not `claude` on `PATH`: on 2026-09-25 the VS Code extension ran sessions on 2.1.282 while `PATH` resolved to 2.1.281, and the extension's `CLAUDE_CODE_EXECPATH` and `CLAUDE_AGENT_SDK_VERSION` were inherited by every descendant `claude`. The transcript entry's `version` identifies the host. The dispatcher gate records it once per session in `state/host-observations.json` (sessions kept 7 days, hosts 30); `doctor` and `install` judge the newest observed host. `doctor` prints `sessionHost` and one `otherHost:<version>` line for each other observed version, with `ok`, `warn` and a probe command, or `fail` with exit 1. If no session has been observed, they say so instead of using `PATH`. Refusal and dispatcher contract records keep one verdict per host version, so a measurement of version V applies to every host of version V; older single-version records count only for their recorded version.
 
-`doctor` also reports `handbackWitness`, `dispatcherModel:<type>` rows, and the four dispatcher contract lines (`dispatcherContract:agentIdentity`, `dispatcherContract:shellStdout`, `dispatcherContract:shellFailure`, and `dispatcherContract:agentTranscript`): verified contracts are `ok`, unknown, unprobed, or stale contracts are `warn`, and a measured change is `fail` with exit 1. The witness warns only for unresolved causes on the current observed session host; later disproving evidence clears the warning while retaining history. Intercepted handbacks are not recovery evidence, and old untyped alarms without dispatcher evidence remain unverified history. A stop missing `agent_type` alarms only with dispatcher evidence for that stop. Dispatcher model rows compare transcript-observed families with the installed contract: a latest violation is `fail` with exit 1, uncertainty is `warn`, and a match, including recovery, is `ok`; no observations is also `ok`. Other hosts and recovered incidents are history, not permanent warnings. See [Response guard](docs/overview.md#response-guard) for the evidence rules. The `agents` line is a read, not a file count: each installed definition is parsed and its `name` checked against the dispatcher it claims to be, because a definition the host cannot read is a dispatcher that does not exist while every other line still says `[ok]`. Content that drifts from the packaged definition is a failure, not a warning: `doctor` exits 1 and names `codex-bridge update --force`, because a host running someone else's agent files may be calling the runner in a form no permission rule matches.
+`doctor` also reports `handbackWitness`, `dispatcherModel:<type>` rows, and the four dispatcher contract lines (`dispatcherContract:agentIdentity`, `dispatcherContract:shellStdout`, `dispatcherContract:shellFailure`, and `dispatcherContract:agentTranscript`): verified contracts are `ok`, unknown, unprobed, or stale contracts are `warn`, and a measured change is `fail` with exit 1. Witness and model checks cover every host whose dispatchers ran in the last 24 hours; two VS Code windows on 2.1.291 and 2.1.292 on 2026-10-07 showed why the newest host alone could hide an active host's violation in history. The witness warns for unresolved causes on any active host; later disproving evidence clears the warning while retaining history. Intercepted handbacks are not recovery evidence, and old untyped alarms without dispatcher evidence remain unverified history. A stop missing `agent_type` alarms only with dispatcher evidence for that stop. Each active host's model entries have their own rows prefixed `host <version>:`, comparing transcript-observed families with the installed contract: a latest violation on any active host is `fail` with exit 1, uncertainty is `warn`, and a match, including recovery, is `ok`; no model entries for active hosts is also `ok`. Hosts outside the 24-hour window and recovered incidents remain history, not permanent warnings. Contracts, `otherHost:*` and install still use the newest observed host selector. See [Response guard](docs/overview.md#response-guard) for the evidence rules. The `agents` line is a read, not a file count: each installed definition is parsed and its `name` checked against the dispatcher it claims to be, because a definition the host cannot read is a dispatcher that does not exist while every other line still says `[ok]`. Content that drifts from the packaged definition is a failure, not a warning: `doctor` exits 1 and names `codex-bridge update --force`, because a host running someone else's agent files may be calling the runner in a form no permission rule matches.
 
 If a session answers `Agent type 'codex-build' not found`, a run can still be started without the dispatcher — the agent is a wrapper that types one command:
 
@@ -140,10 +140,13 @@ Transport files from runs at least **30 days** old are pruned automatically when
 | `install [--scope user\|project] [--host <path>] [--dry-run] [--force]` | Install into a Claude Code host. |
 | `update [--scope user\|project] [--host <path>] [--dry-run] [--force]` | Refresh a recorded installation. |
 | `permissions [add\|remove] [--scope user\|project] [--host <path>]` | Inspect or manage optional shell rules. |
-| `uninstall [--scope user\|project] [--host <path>] [--dry-run] [--purge]` | Remove recorded package files while preserving run artifacts; `--purge` also deletes your data and the home after one preflight and two consents (see [Uninstall and purge](docs/overview.md#uninstall-and-purge)). |
+| `uninstall [--scope user\|project] [--host <path>] [--dry-run] [--purge]` | Remove recorded package files while preserving run artifacts; `--purge` also deletes other operator data after one preflight and two consents, preserving `runs/` and its containing home (see [Uninstall and purge](docs/overview.md#uninstall-and-purge)). |
+| `inventory confirm [--scope user\|project] [--host <path>] [--dry-run]` | Confirm in a terminal that the recorded hosts are all the hosts using this home; until then the dispatcher model pin stays undetermined and `doctor` names this command. Changes only the inventory mark of the installation record. |
+| `runs move [--dry-run]` | Copy every run record from `~/.claude/codex-runs/` into `~/.lyupro/.codex-bridge/runs/`, verify each file by SHA-256, import the old repository's `codex-runs` git history, and write the move record last. Refused while a run is live (`--dry-run` names the refusal and still previews); offers to remove the old folder only when every file has an identical copy in the new store. |
 | `doctor [--scope user\|project] [--host <path>] [--probe-contract] [--probe-executable <path>]` | Diagnose the selected host and Codex connection, including the handback witness and four dispatcher contract lines. `--probe-contract` targets the newest observed host, accepting `CLAUDE_CODE_EXECPATH` or `claude` on `PATH` only when each reports that version with `--version`; use `--probe-executable <path>` to name an executable (`--host` selects the Claude Code configuration). The probe prints its target and records nothing if the completed host run reports another transcript version. |
 | `run --agent <type> --task-file "<abs path>" [--no-wait]` | Start or attach to a delegated run through the permission-stable package command. The task-file header carries the whole order; its body carries the statement, scout questions and verification command. Its path must be absolute and use forward slashes; `$`, doubled backslashes and a final backslash are refused. Every other runner flag is a free refusal; stdin is not an input channel. |
 | `model [list\|set\|unset\|speed]` | Show the model, effort, pinned speed tier and provenance of each role, with the config path; `model list` prints the live catalogue from Codex, hidden models included and marked; `model set <role> <model> [effort]` checks the pair and any retained speed tier against that model's catalogue entry, and `model unset <role>` removes the profile. `model speed <role> <tier>` previews a live accelerated tier and its quoted cost description; repeat with trailing `confirm` to pin it. `model speed <role> unset` removes only speed, without confirmation. The profile is machine-wide, shared by every project on this machine. |
+| `guidance [<topic>]` | Print the package's detailed rules for one topic from the installed home; without a topic, list the topics. The always-loaded rules core routes the orchestrator here. |
 | `projects [<name>] [--json]` | List projects or runs in the run store. |
 | `prune <project> [<run>] [--purge] [--older-than <age>] [-f] [--json]`<br>`prune --all-projects [--older-than <age>] [-f] [--json]` | Plan or perform operator-confirmed cleanup, for one project or across the whole run store. |
 | `unlock [<project>\|--all]`<br>`unlock --lifecycle [--clear]` | Close records whose runner is gone, or show who holds the lock that serializes install, update and uninstall of this home; `--clear` removes that lock only when it is a file left by a holder proven dead (macOS; Windows and Linux locks are released by the kernel). |

package/cli/active-hosts.mjs

@@ -0,0 +1,44 @@
+/** Names the hosts whose dispatchers ran in the last 24 hours, the hosts whose witness and model state is active;
+ * Plan_67 D12: concurrent VS Code hosts 2.1.291 and 2.1.292 on 2026-10-07 must both be judged, regardless of session liveness.
+ */
+export const ACTIVE_HOST_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+export function activeHostVersions({ observations, witnessRecord, modelRecord, now = new Date() }) {
+  const currentTime = new Date(now).getTime();
+  const activity = new Map();
+  function recordActivity(version, at) {
+    if (typeof version !== 'string' || !version || version === 'unknown') return;
+    if (typeof at !== 'string'
+      || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(at)) return;
+    const time = Date.parse(at);
+    const date = Date.parse(`${at.slice(0, 10)}T00:00:00Z`);
+    if (!Number.isFinite(time) || !Number.isFinite(date)
+      || new Date(date).toISOString().slice(0, 10) !== at.slice(0, 10)) return;
+    // Plan_67 R2: future evidence must not hide a valid past source for the same host.
+    if (time > currentTime) return;
+    if (!activity.has(version) || time > activity.get(version)) activity.set(version, time);
+  }
+  function ledgerActivity(ledger) {
+    if (!ledger || ledger.corrupt) return;
+    for (const entry of Object.values(ledger.entries || {})) {
+      if (!entry || entry.corrupt || entry.lastObservation?.corrupt) continue;
+      const observation = entry.lastObservation;
+      recordActivity(observation?.data?.hostVersion, observation?.at);
+    }
+  }
+  if (observations && !observations.corrupt) {
+    for (const [version, host] of Object.entries(observations.hosts || {})) {
+      if (host && !host.corrupt) recordActivity(version, host.lastSeen);
+    }
+    for (const session of Object.values(observations.sessions || {})) {
+      if (session && !session.corrupt) recordActivity(session.version, session.at);
+    }
+  }
+  if (witnessRecord && !witnessRecord.corrupt) {
+    for (const [version, at] of Object.entries(witnessRecord.intercepted || {})) recordActivity(version, at);
+    ledgerActivity(witnessRecord.ledger);
+  }
+  ledgerActivity(modelRecord);
+  return [...activity].filter(([, at]) => currentTime - at >= 0 && currentTime - at <= ACTIVE_HOST_WINDOW_MS)
+    .sort((a, b) => b[1] - a[1]).map(([version]) => version);
+}

package/cli/command-registry.mjs

@@ -4,16 +4,21 @@
  * dispatch and usage had separate sources. One registry keeps invocation and help together.
  */
 import { diagnose, renderDoctor } from './doctor.mjs';
+import { sandboxChecks } from './doctor-sandbox.mjs';
 import { probeContract } from './probe-contract.mjs';
 import { resolveProbeTarget } from './probe-target.mjs';
 import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import { hook } from './hook.mjs';
+import { guidance } from './guidance.mjs';
 import { resolveHost } from './hosts.mjs';
 import { install } from './install.mjs';
+import { inventoryConfirm } from './inventory-confirm.mjs';
 import { model } from './model.mjs';
 import { projects } from './projects.mjs';
 import { read } from './read.mjs';
 import { runCodex } from './run-launcher.mjs';
+import { runsMove } from './runs-move.mjs';
+import { removeOldStore } from './runs-move-remove.mjs';
 import { permissions } from './permissions.mjs';
 import { prune } from './prune.mjs';
 import { stop } from './stop.mjs';
@@ -26,6 +31,7 @@ export function commandOptions(command, argv) {
   const options = {};
   const booleanFlags = command === 'install' || command === 'update' ? new Set(['--dry-run', '--force'])
     : command === 'uninstall' ? new Set(['--dry-run', '--purge'])
+      : command === 'inventory' || command === 'runs' ? new Set(['--dry-run'])
       : command === 'doctor' ? new Set(['--probe-contract']) : new Set();
   const flagNames = new Map([
     ['--dry-run', 'dryRun'],
@@ -39,6 +45,7 @@ export function commandOptions(command, argv) {
       options[flagNames.get(arg)] = true;
       continue;
     }
+    if (command === 'runs') throw new Error(`unknown runs option "${arg}"`);
     if (arg !== '--scope' && arg !== '--host' && !(command === 'doctor' && arg === '--probe-executable')) throw new Error(`unknown ${command} option "${arg}"`);
     const value = argv[index + 1];
     if (!value || value.startsWith('-')) throw new Error(`${arg} requires a value`);
@@ -122,6 +129,44 @@ export const COMMANDS = [
       return result.exitCode;
     },
   },
+  {
+    name: 'inventory',
+    summary: 'Confirm that the recorded hosts are all the hosts using this home',
+    usage: ['codex-bridge inventory confirm [--scope user|project] [--host <path>] [--dry-run]'],
+    section: 'public',
+    async handler(argv, io) {
+      if (argv[0] !== 'confirm') throw new Error(`unknown inventory action "${argv[0] ?? ''}"`);
+      const options = commandOptions('inventory', argv.slice(1));
+      const host = resolveHost(options);
+      const result = await inventoryConfirm({ host, dryRun: options.dryRun });
+      io.log(result.output);
+      return result.exitCode;
+    },
+  },
+  {
+    name: 'runs',
+    summary: 'Move run records into the package home (Plan_77)',
+    usage: ['codex-bridge runs move [--dry-run]'],
+    section: 'public',
+    actions: {
+      move: {
+        summary: 'Move run records into the package home (Plan_77)',
+        usage: ['codex-bridge runs move [--dry-run]'],
+      },
+    },
+    async handler(argv, io) {
+      if (argv[0] !== 'move') throw new Error(`unknown runs action "${argv[0] ?? ''}"`);
+      const options = commandOptions('runs', argv.slice(1));
+      const result = runsMove({ dryRun: options.dryRun });
+      io.log(result.output);
+      if (result.exitCode === 0 && result.oldStore) {
+        const removal = await removeOldStore({ from: result.oldStore, to: result.homeRoot });
+        io.log(removal.output);
+        return removal.exitCode;
+      }
+      return result.exitCode;
+    },
+  },
   {
     name: 'doctor',
     summary: 'Diagnose the selected Claude Code host (--probe-contract measures on a live host)',
@@ -144,7 +189,7 @@ export const COMMANDS = [
           io.log(`probe: ${name} ${verdict.result} — ${verdict.detail}`);
         }
       }
-      const result = await diagnose({ host });
+      const result = await diagnose({ host, sandbox: sandboxChecks });
       io.log(renderDoctor(result));
       // An inconclusive probe wrote nothing and measured nothing; exiting 0 would let a failed
       // measurement pass silently in a script (Plan_52 D26).
@@ -232,6 +277,18 @@ export const COMMANDS = [
       return result.exitCode;
     },
   },
+  {
+    name: 'guidance',
+    summary: "Print the package's detailed rules for one topic",
+    usage: ['codex-bridge guidance [<topic>]'],
+    section: 'public',
+    async handler(argv, io) {
+      const result = guidance(argv);
+      if (result.exitCode === 2) io.error(result.output);
+      else io.log(result.output);
+      return result.exitCode;
+    },
+  },
   {
     name: 'read',
     summary: "Render a run's structured event stream",

package/cli/dispatcher-model-check.mjs

@@ -1,4 +1,4 @@
-/** turns the dispatcher-model ledger into doctor rows; Plan_67 D4/D8 and D8 clarification 2026-10-07. */
+/** turns the dispatcher-model ledger into doctor rows; Plan_67 D4/D8/D12 judge every recently active host. */
 import path from 'node:path';
 import { DISPATCHER_MODEL_FILE } from '../src/home/lib/dispatcher-model.mjs';
 import { entryState } from '../src/home/lib/observation-ledger.mjs';
@@ -12,48 +12,50 @@ function entryCheck(entry) {
   const observation = entry.lastObservation;
   const { data, verdict, at } = observation;
   const key = `dispatcherModel:${data.agentType}`;
+  const prefix = `host ${data.hostVersion}: `;
   const state = entryState(entry);
   // D4: only the latest confirmed violation fails; D8 keeps uncertainty from erasing history.
   if (verdict === 'violation') {
-    return check(key, 'fail', `${observationSummary(observation)}; Claude quota was spent on this dispatcher; see Plan_67.`);
+    return check(key, 'fail', `${prefix}${observationSummary(observation)}; Claude quota was spent on this dispatcher; see Plan_67.`);
   }
   if (verdict === 'undetermined') {
     const reason = data.pinReasons?.length
-      ? data.pinReasons.join('; ') : 'no model family could be read from the transcript';
+      // Reasons are sentences ending in a period; the row adds its own (live doctor printed "record..").
+      ? data.pinReasons.map((text) => text.replace(/\.$/, '')).join('; ') : 'no model family could be read from the transcript';
     const unresolved = state === 'violation'
       ? `; earlier violation (${observationSummary(entry.lastViolation)}) is not yet disproved` : '';
-    return check(key, 'warn', `${data.agentType}: model observation undetermined at ${at}: ${reason}${unresolved}.`);
+    return check(key, 'warn', `${prefix}${data.agentType}: model observation undetermined at ${at}: ${reason}${unresolved}.`);
   }
   const history = state === 'recovered'
     ? `; recovered from earlier violation (${observationSummary(entry.lastViolation)})` : '';
-  return check(key, 'ok', `${observationSummary(observation)}; matches the installed contract${history}.`);
+  return check(key, 'ok', `${prefix}${observationSummary(observation)}; matches the installed contract${history}.`);
 }
 
-export function dispatcherModelChecks({ record, hostVersion, stateDir }) {
+export function dispatcherModelChecks({ record, activeHosts, stateDir }) {
   if (record?.corrupt) {
     return [check('dispatcherModel', 'warn',
       `The dispatcher model record is unreadable; delete ${path.join(stateDir, DISPATCHER_MODEL_FILE)} to reset it.`)];
   }
   const entries = Object.values(record?.entries || {});
-  const current = entries.filter((entry) => entry.lastObservation.data.hostVersion === hostVersion);
+  const current = entries.filter((entry) => activeHosts.includes(entry.lastObservation.data.hostVersion));
   const rows = current.map(entryCheck);
   if (!rows.length) {
-    rows.push(check('dispatcherModel', 'ok', 'Not observed yet — recorded when a dispatcher stops on this host.'));
+    rows.push(check('dispatcherModel', 'ok', 'Not observed in the last 24 hours — recorded when a dispatcher stops.'));
   }
   const hosts = new Map();
   for (const entry of entries) {
     const version = entry.lastObservation.data.hostVersion;
-    if (version === hostVersion) continue;
+    if (activeHosts.includes(version)) continue;
     const counts = hosts.get(version) || { entries: 0, violations: 0 };
     counts.entries += 1;
     if (entryState(entry) === 'violation') counts.violations += 1;
     hosts.set(version, counts);
   }
-  // D8: other hosts are one history sentence, never additional active warning rows.
+  // D12: inactive hosts are one history sentence, never additional active warning rows.
   if (hosts.size) {
     const history = [...hosts].map(([version, counts]) =>
       `${version ?? 'unknown host'}: ${counts.entries} entries, ${counts.violations} unresolved violations`);
-    rows[0].value += ` History on other hosts (historical, not current): ${history.join('; ')}.`;
+    rows[0].value += ` History on hosts without dispatcher activity in the last 24 hours (historical, not current): ${history.join('; ')}.`;
   }
   return rows;
-}
+}