@open-mercato/cli 0.9.1-develop.7464.1.9a392fca41 → 0.9.1-develop.7467.1.3b2bb92d47

package/dist/agentic/guides/modules/sync_akeneo/index.md

@@ -1,5 +1,5 @@
 # sync_akeneo — module facts (generated, do not edit)
-<!-- generated from @open-mercato/sync-akeneo 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/sync-akeneo 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/sync-akeneo/src/modules/sync_akeneo
 
 ## Sections

package/dist/agentic/guides/modules/sync_excel/index.md

@@ -1,5 +1,5 @@
 # sync_excel — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/sync_excel
 
 ## Sections

package/dist/agentic/guides/modules/system_status_overlays/index.md

@@ -1,5 +1,5 @@
 # system_status_overlays — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/enterprise/src/modules/system_status_overlays
 
 ## Sections

package/dist/agentic/guides/modules/telemetry/index.md

@@ -1,5 +1,5 @@
 # telemetry — module facts (generated, do not edit)
-<!-- generated from @open-mercato/telemetry 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/telemetry 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/telemetry/src/modules/telemetry
 
 ## Sections

package/dist/agentic/guides/modules/tillio/index.md

@@ -1,5 +1,5 @@
 # tillio — module facts (generated, do not edit)
-<!-- generated from @open-mercato/tillio 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/tillio 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/tillio/src/modules/tillio
 
 ## Sections

package/dist/agentic/guides/modules/translations/index.md

@@ -1,5 +1,5 @@
 # translations — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/translations
 
 ## Sections

package/dist/agentic/guides/modules/warranty_claims/index.md

@@ -1,5 +1,5 @@
 # warranty_claims — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/warranty_claims
 
 ## Sections

package/dist/agentic/guides/modules/webhooks/index.md

@@ -1,5 +1,5 @@
 # webhooks — module facts (generated, do not edit)
-<!-- generated from @open-mercato/webhooks 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/webhooks 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/webhooks/src/modules/webhooks
 
 ## Sections

package/dist/agentic/guides/modules/wms/index.md

@@ -1,5 +1,5 @@
 # wms — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/wms
 
 ## Sections

package/dist/agentic/guides/modules/workflows/index.md

@@ -1,5 +1,5 @@
 # workflows — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.9.1-develop.7464.1.9a392fca41; core 0.9.1-develop.7464.1.9a392fca41 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.9.1-develop.7467.1.3b2bb92d47; core 0.9.1-develop.7467.1.3b2bb92d47 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/workflows
 
 ## Sections

package/dist/agentic/guides/reference-module-facts.json

@@ -1185,7 +1185,7 @@
     "facts": {
       "title": "Example Module",
       "description": "Demonstrates pages, APIs, entities and DI.",
-      "coreVersion": "0.9.1-develop.7464.1.9a392fca41",
+      "coreVersion": "0.9.1-develop.7467.1.3b2bb92d47",
       "sourcePackage": null,
       "sourceVersion": null,
       "sourceRoot": "src/modules/example",

package/dist/agentic/guides/upstream/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.9.1-develop.7464.1.9a392fca41",
+  "generator": "@open-mercato/cli@0.9.1-develop.7467.1.3b2bb92d47",
   "files": {
     "AGENTS.md": "9fdaca247f55c64f5966cc103265cfb03233e0532f58f14aff538ae18aa3555d",
     "BACKWARD_COMPATIBILITY.md": "4ed6dfe6a79217d169748d52b92856516ed7fadff0f785c6d4b1913555e2e933"

package/dist/agentic/shared/AGENTS.md.template

@@ -68,6 +68,7 @@ Match every work-unit row; OPEN its skill before selection.
 
 | Route | Work unit | Skill/context |
 |---|---|---|
+| `architecture` | Scaffold a module starter, publish, or link an app module | `.ai/guides/module-tool.md`; implementation also loads `om-module-scaffold` |
 | `architecture` | Explain/choose module, UMES, package, eject | architecture; `om-help` for an unresolved or comparative choice across these mechanisms |
 | `module-data` | Business slice or multi-seam domain/API/command fix | MUST load `om-module-scaffold` + its exact `.ai/skills/om-module-scaffold/references/business-one-shot-blueprints.md` key, which resolves units inside the slice, not ownership — an ownership/capability outline adds `architecture` |
 | `spec-pr` | Spec/plan | Axis 3; phases+integration coverage (`integration-coverage`); no domain routes |

package/dist/agentic/shared/ai/harness/README.md

@@ -1,9 +1,11 @@
 # Agent harness evaluations
 
-`cases.json` is the 238-case standalone-app contract. Run `yarn harness:validate --all` for the deterministic gate. Live routing uses a fresh read-only process per case:
+`cases.json` is the 239-case standalone-app contract. Run `yarn harness:validate --all` for the deterministic gate. Live routing uses a fresh read-only process per case:
 
 `OMH-238` routes Customers calendar add/remove/patch requests to `.ai/guides/customers-calendar.md`, exact installed Customers definitions, and the bounded canonical `umes.customers.calendar-event-types` example. It preserves historical records, generic shared components, and warnings when optional staff/resources integrations are unavailable.
 
+`OMH-239` routes custom-module initialization, packaging, preview, publication, authentication, and continued-development questions to `.ai/guides/module-tool.md`.
+
 UMES routing is fact-first. The additive and unified-override audit evaluations, plus their targeted cases, resolve exact/pattern hosts, outgoing contributions, correlation provenance, round-trip groups, framework-owned targets, and override domain/key/mode from the generated module sheets and `.ai/guides/framework-extension-points.md` before bounded installed source. The repository UMES umbrella spec may appear as optional source-checkout provenance; it is never required in a standalone scaffold.
 
 ```text
@@ -20,7 +22,7 @@ yarn harness:release --runner codex --prepare-targets /absolute/empty-release-ta
 yarn harness:release --runner codex --portability-runner claude --prepare-targets /absolute/empty-release-targets --acknowledge-writes
 ```
 
-The primary runner owns all 238 routing cases, all 49 writable cases, and all generative-judge runs. No per-case fallback or mixed primary ownership is allowed. Omitting `--portability-runner` is valid and the sanitized report records `portabilityRunner: null`; explicitly requesting an unavailable or failing secondary runner fails that extended run.
+The primary runner owns all 239 routing cases, all 49 writable cases, and all generative-judge runs. No per-case fallback or mixed primary ownership is allowed. Omitting `--portability-runner` is valid and the sanitized report records `portabilityRunner: null`; explicitly requesting an unavailable or failing secondary runner fails that extended run.
 
 Writable evaluation is intentionally opt-in. The expanded catalog has a 49-case writable release target, but only cases registered in `release-matrix.json` and backed by controller-owned fixtures and oracles are executable. Copy or create a fresh standalone app for one registered case, then seed only that case and mark the target disposable:
 

package/dist/agentic/shared/ai/harness/RELEASE.md

@@ -6,7 +6,7 @@ Run the complete per-release gate from a generated standalone app with one comma
 yarn harness:release --runner codex --prepare-targets /absolute/empty-release-targets --acknowledge-writes
 ```
 
-Choose exactly one blocking primary runner with `--runner codex` or `--runner claude`. That runner owns the complete 238-case routing gate and every writable/review lane. To add cross-model portability evidence, explicitly pass the other runner as `--portability-runner claude` or `--portability-runner codex`; it runs only the exact 49-case representative read-only set. The two runners must differ. Omitting the portability option is valid and is recorded as `portabilityRunner: null`; no secondary result is claimed. There is no per-case fallback or mixed primary ownership. Once requested, a portability failure or unavailable runner fails that extended release run.
+Choose exactly one blocking primary runner with `--runner codex` or `--runner claude`. That runner owns the complete 239-case routing gate and every writable/review lane. To add cross-model portability evidence, explicitly pass the other runner as `--portability-runner claude` or `--portability-runner codex`; it runs only the exact 49-case representative read-only set. The two runners must differ. Omitting the portability option is valid and is recorded as `portabilityRunner: null`; no secondary result is claimed. There is no per-case fallback or mixed primary ownership. Once requested, a portability failure or unavailable runner fails that extended release run.
 
 `--prepare-targets` accepts only an absolute, new or empty regular directory outside the controller app. The controller must be a sanitized fresh scaffold: automatic preparation fails before copying when it finds `.env`, `.env.*` (except `.env.example`, `.env.sample`, and `.env.template`), credential files, or private-key files. Never use a configured development or production app as the controller. It copies the fresh scaffold once per catalog case whose `evaluationKind` is `implementation` or `regression`, while excluding `.git`, `node_modules`, build/cache/coverage output, `.ai/harness/results`, `.ai/reports`, and `.ai/framework-context`. Each target receives a guarded link to the controller's installed dependency tree. The OS sandbox resolves that link as read-only during both the writable model run and the target command gate. The release gate also hashes every dependency entry and regular-file body once before execution and once after the complete suite, and fails if any nested content or metadata changed. A generated `release-targets.json` records the local mapping.
 
@@ -34,17 +34,17 @@ For externally prepared apps, `--writable-targets /absolute/release-targets.json
 }
 ```
 
-The current catalog contains 238 cases, including 49 writable implementation/regression cases (20.6%). The command still derives all counts and case IDs from `cases.json`, `validators.json`, and `release-matrix.json`; those figures are documented release facts, not runner constants. The matrix keeps both supported runner model selectors, an exact all-case primary profile, an exact 49-case portability profile, and runner-neutral writable assignments. Run `yarn install-skills` first so the pinned external `om-code-review` skill and ownership evidence are present; the reusable local `om-judge-agent-session` skill ships with the scaffold. Before running a model or writing a fixture, the release command requires complete deterministic, primary live-routing, writable, trusted-oracle, target, generated-test, and generative-judge coverage. Every one of the 49 writable cases must have a judge assignment composing both skills. Missing business fixtures or release-matrix entries fail preflight and are listed by exact case ID in the report.
+The current catalog contains 239 cases, including 49 writable implementation/regression cases (20.5%). The command still derives all counts and case IDs from `cases.json`, `validators.json`, and `release-matrix.json`; those figures are documented release facts, not runner constants. The matrix keeps both supported runner model selectors, an exact all-case primary profile, an exact 49-case portability profile, and runner-neutral writable assignments. Run `yarn install-skills` first so the pinned external `om-code-review` skill and ownership evidence are present; the reusable local `om-judge-agent-session` skill ships with the scaffold. Before running a model or writing a fixture, the release command requires complete deterministic, primary live-routing, writable, trusted-oracle, target, generated-test, and generative-judge coverage. Every one of the 49 writable cases must have a judge assignment composing both skills. Missing business fixtures or release-matrix entries fail preflight and are listed by exact case ID in the report.
 
 ## PR #4529 remediation evidence
 
-The PR's focused remediation evidence is not a release-certification substitute. Fresh emitted controllers pass deterministic 192/192, and the field-tested OMH-188–192 generative cohort passes on default Codex, Claude Sonnet, and high-effort gpt-5.4-mini. Fresh OMH-185 writable attempts fixed concrete organization-scope, command-object, module-activation, command-snapshot, schema, custom-field, UI, and Jest guidance defects at their routed owners without relaxing trusted oracles. The final attempt reached the case's fixed 600-second ceiling and is excluded from pass evidence. Issue #4670 now owns the complete selected-primary 238-case routing and 49-case writable/generated-test/review certification, prioritizing the generative cohort and recording unavailable Claude lanes without fallback or mixed-runner ownership.
+The PR's focused remediation evidence is not a release-certification substitute. Fresh emitted controllers pass deterministic 192/192, and the field-tested OMH-188–192 generative cohort passes on default Codex, Claude Sonnet, and high-effort gpt-5.4-mini. Fresh OMH-185 writable attempts fixed concrete organization-scope, command-object, module-activation, command-snapshot, schema, custom-field, UI, and Jest guidance defects at their routed owners without relaxing trusted oracles. The final attempt reached the case's fixed 600-second ceiling and is excluded from pass evidence. Issue #4670 now owns the complete selected-primary 239-case routing and 49-case writable/generated-test/review certification, prioritizing the generative cohort and recording unavailable Claude lanes without fallback or mixed-runner ownership.
 
 After preflight it runs, in order:
 
 1. deterministic validation for the complete catalog;
 2. the release matrix's fixed `yarn generate`, `yarn typecheck`, `yarn lint`, and `yarn build` foundation;
-3. the selected primary runner across all 238 live-routing cases, followed by the optional distinct portability runner across the exact 49-case read-only sample when requested;
+3. the selected primary runner across all 239 live-routing cases, followed by the optional distinct portability runner across the exact 49-case read-only sample when requested;
 4. fixture preparation and the selected primary runner for every writable case, including the controller-owned AST/behavior oracles and target typecheck;
 5. `yarn generate`, `yarn typecheck`, `yarn lint`, and `yarn build` in every writable target, after its trusted oracles;
 6. real generated-code execution for OMH-163 and OMH-192 through fixed Jest, OMH-164 through API-only Playwright, and OMH-165 through real-browser Playwright; and

package/dist/agentic/shared/ai/harness/cases.json

@@ -520,7 +520,7 @@
     ],
     "maxContextFiles": 8,
     "maxInitialContextBytes": 65536,
-    "maxTotalContextBytes": 98304,
+    "maxTotalContextBytes": 114688,
     "relatedCases": [
       "OMH-008"
     ]
@@ -1736,7 +1736,7 @@
     ],
     "maxContextFiles": 6,
     "maxInitialContextBytes": 65536,
-    "maxTotalContextBytes": 98304,
+    "maxTotalContextBytes": 102400,
     "relatedCases": [
       "OMH-023"
     ]
@@ -2431,7 +2431,7 @@
     ],
     "maxContextFiles": 6,
     "maxInitialContextBytes": 49152,
-    "maxTotalContextBytes": 98304,
+    "maxTotalContextBytes": 114688,
     "relatedCases": [
       "OMH-031"
     ]
@@ -4553,7 +4553,7 @@
     ],
     "maxContextFiles": 5,
     "maxInitialContextBytes": 40960,
-    "maxTotalContextBytes": 98304,
+    "maxTotalContextBytes": 106496,
     "relatedCases": [
       "OMH-058"
     ],
@@ -5144,7 +5144,7 @@
     ],
     "maxContextFiles": 8,
     "maxInitialContextBytes": 65536,
-    "maxTotalContextBytes": 98304,
+    "maxTotalContextBytes": 114688,
     "relatedCases": [
       "OMH-065"
     ]
@@ -21687,5 +21687,79 @@
         ".ai/guides/customers-calendar.md"
       ]
     }
+  },
+  {
+    "id": "OMH-239",
+    "title": "Create or publish one custom module and continue development in the same standalone app",
+    "family": "architecture",
+    "mode": "analysis",
+    "evaluationKind": "routing",
+    "risk": "medium",
+    "prompt": "I am already inside a create-mercato-app Cloud sandbox. Explain the supported npx tool commands to start a new visits module, or package an existing visits module, then publish it to npm and a dedicated GitHub repository. Include a local preview before remote publication and explain how to keep developing in this same app after publication, including the optional repository link and its portability. Distinguish npm login, environment token and trusted publishing requirements. Prepare the workflow only; do not publish or create remote resources.",
+    "tags": [
+      "architecture",
+      "module-package",
+      "publication",
+      "source-link",
+      "auth"
+    ],
+    "owner": {
+      "kind": "guide",
+      "path": ".ai/guides/module-tool.md",
+      "ruleIds": [
+        "BC-01",
+        "BC-04"
+      ]
+    },
+    "expectedRouter": {
+      "required": [
+        "architecture"
+      ],
+      "allowedExtra": []
+    },
+    "requiredSkills": [],
+    "context": {
+      "required": [
+        "AGENTS.md",
+        ".ai/guides/module-tool.md"
+      ],
+      "allowedExtra": [
+        ".ai/guides/architecture.md"
+      ],
+      "forbidden": [
+        ".env*",
+        ".git/**",
+        "node_modules/**"
+      ]
+    },
+    "requiredDecisions": [
+      "module-tool-init-or-existing",
+      "dry-run-before-publication",
+      "fresh-consumer-third-party",
+      "app-source-preserved",
+      "optional-repository-source-link",
+      "npm-auth-mode-boundaries"
+    ],
+    "forbiddenPatterns": [
+      "(?:print|display|commit).{0,30}(?:NPM_TOKEN|NODE_AUTH_TOKEN|raw token)",
+      "(?:edit|patch).{0,30}(?:node_modules|generated registr)"
+    ],
+    "validators": [
+      "catalog.schema",
+      "owner.reference",
+      "skills.reference",
+      "router.contract",
+      "context.budget",
+      "context.forbidden",
+      "patterns.forbidden"
+    ],
+    "maxContextFiles": 3,
+    "maxInitialContextBytes": 32768,
+    "maxTotalContextBytes": 32768,
+    "relatedCases": [
+      "OMH-002",
+      "OMH-046",
+      "OMH-161"
+    ]
   }
 ]

package/dist/agentic/shared/ai/harness/cases.schema.json

@@ -3,8 +3,8 @@
   "$id": "https://open-mercato.dev/schemas/standalone-harness-cases.schema.json",
   "title": "Open Mercato standalone harness case catalog",
   "type": "array",
-  "minItems": 238,
-  "maxItems": 238,
+  "minItems": 239,
+  "maxItems": 239,
   "items": {
     "type": "object",
     "additionalProperties": false,
@@ -15,7 +15,7 @@
       "maxTotalContextBytes", "relatedCases"
     ],
     "properties": {
-      "id": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[0-8])$" },
+      "id": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[0-9])$" },
       "title": { "type": "string", "minLength": 12, "maxLength": 180 },
       "family": { "enum": ["architecture", "module", "umes", "integration", "ai-workflow", "bugfix", "business", "testing"] },
       "mode": { "enum": ["analysis", "one-shot", "spec", "bugfix", "review"] },
@@ -168,7 +168,7 @@
       "maxInitialContextBytes": { "type": "integer", "minimum": 4096, "maximum": 98304 },
       "maxTotalContextBytes": { "type": "integer", "minimum": 8192, "maximum": 1048576 },
       "timeoutMs": { "type": "integer", "minimum": 1000, "maximum": 600000 },
-      "relatedCases": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[0-8])$" } },
+      "relatedCases": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[0-9])$" } },
       "source": {
         "type": "object",
         "additionalProperties": false,

package/dist/agentic/shared/ai/harness/validators.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "catalog": {
-    "expectedCaseCount": 238,
+    "expectedCaseCount": 239,
     "maxContextFiles": 16,
     "maxInitialContextBytes": 98304,
     "maxTotalContextBytes": 1048576,

package/dist/agentic/shared/ai/skills/om-module-scaffold/SKILL.md

@@ -12,6 +12,8 @@ Create the smallest working vertical slice under `src/modules/<id>/`. START at [
 - A domain brief; infer names conservatively and ask only when a choice changes public behavior or scope.
 - Optional requested phases. Without phases, deliver the complete slice needed by the brief.
 
+With terminal access, initialize a new app module with `npx create-mercato-module init <module_id>` before implementing the slice; skip `init` for existing modules. Without process execution, report that capability gap instead of claiming initialization or bypassing the tool. For publication or continued development in a dedicated repository, follow `.ai/guides/module-tool.md`.
+
 ## Workflow
 
 Route before reading: every specialist step below is conditional. Decide from the brief and the blueprint route key first, include each applicable route in the assembled route, and only then read that route's guide or skill. Never probe a specialist guide and discard its route. In particular, do not open the extension or framework-context skill as a precaution: select UMES only for an injected, overridden, enriched, or intercepted installed surface, and select framework context only after naming an unresolved exact-version detail. For an architecture-only plan, the root router's `architecture` + `module-data` exception wins: use the blueprint to name likely UI/workflow surfaces without loading their implementation guides or skills.

package/dist/agentic/shared/scripts/evaluate-agent-harness.mjs

@@ -2906,13 +2906,79 @@ function buildRunnerInvocation({ runner, root, schemaPath, outputPath, model, re
   return { command: 'claude', args }
 }
 
-function runAgentOnce({ runner, root, schemaPath, prompt, timeout, model, reasoningEffort, writable, allowedReads = [], allowedWrites = [], immutableRoots = [], validateResponse = validateRoutingResponse }) {
+export function codexOutputSchema(schema) {
+  if (!isPlainObject(schema)) return schema
+  const strict = { ...schema }
+  delete strict.uniqueItems
+  if (schema.$defs) strict.$defs = Object.fromEntries(Object.entries(schema.$defs).map(([key, child]) => [key, codexOutputSchema(child)]))
+  if (schema.items) strict.items = codexOutputSchema(schema.items)
+  for (const keyword of ['anyOf', 'oneOf', 'allOf']) {
+    if (Array.isArray(schema[keyword])) strict[keyword] = schema[keyword].map(codexOutputSchema)
+  }
+  if (schema.properties) {
+    const required = new Set(schema.required ?? [])
+    strict.properties = Object.fromEntries(Object.entries(schema.properties).map(([key, child]) => {
+      const converted = codexOutputSchema(child)
+      return [key, required.has(key) ? converted : { anyOf: [converted, { type: 'null' }] }]
+    }))
+    strict.required = Object.keys(schema.properties)
+  }
+  return strict
+}
+
+function acceptsCanonicalNull(schema, rootSchema) {
+  if (schema.$ref) {
+    const resolved = resolveJsonSchemaReference(rootSchema, schema.$ref)
+    return resolved ? acceptsCanonicalNull(resolved, rootSchema) : false
+  }
+  if (schema.anyOf && !schema.anyOf.some((child) => acceptsCanonicalNull(child, rootSchema))) return false
+  if (schema.oneOf && schema.oneOf.filter((child) => acceptsCanonicalNull(child, rootSchema)).length !== 1) return false
+  return validateJsonSchema(null, schema, '$', rootSchema).length === 0
+}
+
+export function normalizeCodexOutput(value, schema, rootSchema = schema) {
+  if (schema.$ref) {
+    const resolved = resolveJsonSchemaReference(rootSchema, schema.$ref)
+    return resolved ? normalizeCodexOutput(value, resolved, rootSchema) : value
+  }
+  if (Array.isArray(value) && schema.items) return value.map((item) => normalizeCodexOutput(item, schema.items, rootSchema))
+  if (!isPlainObject(value) || !schema.properties) return value
+  const normalized = { ...value }
+  const required = new Set(schema.required ?? [])
+  for (const [key, child] of Object.entries(schema.properties)) {
+    if (!Object.hasOwn(value, key)) continue
+    const nullable = acceptsCanonicalNull(child, rootSchema)
+    if (value[key] === null && !required.has(key) && !nullable) delete normalized[key]
+    else normalized[key] = normalizeCodexOutput(value[key], child, rootSchema)
+  }
+  return normalized
+}
+
+export function codexOutputPrompt(prompt, schema) {
+  const optionalFields = Object.keys(schema.properties ?? {}).filter((key) => !(schema.required ?? []).includes(key))
+  if (!optionalFields.length) return prompt
+  return `${prompt}\n\nCodex wire format: nullable fields encode optional output. Use null for fields that the instructions omit or do not request; never invent optional content merely because the wire schema requires its key.`
+}
+
+export function routingResponseSchemaForCase(schema, caseRecord) {
+  if (isSpecRoutingCase(caseRecord) || !schema.properties?.specRouting) return schema
+  const properties = { ...schema.properties }
+  delete properties.specRouting
+  return {
+    ...schema,
+    properties,
+    required: (schema.required ?? []).filter((key) => key !== 'specRouting'),
+  }
+}
+
+function runAgentOnce({ runner, root, schemaPath, responseSchema, prompt, timeout, model, reasoningEffort, writable, allowedReads = [], allowedWrites = [], immutableRoots = [], validateResponse = validateRoutingResponse }) {
   const canonicalRoot = fs.realpathSync(root)
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'om-harness-result-'))
   const outputPath = path.join(tempDir, 'structured.json')
   const isolatedSchemaPath = path.join(tempDir, 'output.schema.json')
-  fs.copyFileSync(schemaPath, isolatedSchemaPath, fs.constants.COPYFILE_EXCL)
-  fs.chmodSync(isolatedSchemaPath, 0o600)
+  const canonicalSchema = responseSchema ?? readJson(schemaPath)
+  const transportSchema = runner === 'codex' ? codexOutputSchema(canonicalSchema) : canonicalSchema
+  fs.writeFileSync(isolatedSchemaPath, `${JSON.stringify(transportSchema)}\n`, { flag: 'wx', mode: 0o600 })
   const invocation = buildRunnerInvocation({ runner, root: canonicalRoot, schemaPath: isolatedSchemaPath, outputPath, model, reasoningEffort, writable, allowedReads, allowedWrites, immutableRoots })
   const runnerEnv = narrowRunnerEnv(runner)
   if (runner === 'codex') {
@@ -2966,7 +3032,7 @@ function runAgentOnce({ runner, root, schemaPath, prompt, timeout, model, reason
     })
     const processResult = spawnSync(contained.command, contained.args, {
       cwd: contained.cwd,
-      input: prompt,
+      input: runner === 'codex' ? codexOutputPrompt(prompt, canonicalSchema) : prompt,
       encoding: 'utf8',
       timeout,
       maxBuffer: 8 * 1024 * 1024,
@@ -2979,8 +3045,9 @@ function runAgentOnce({ runner, root, schemaPath, prompt, timeout, model, reason
     if (processResult.error) return { kind: 'environment-failure', durationMs, exitStatus: processResult.status, error: processResult.error.message, stdout: processResult.stdout ?? '' }
     if (processResult.status !== 0) return { kind: 'process-failure', durationMs, exitStatus: processResult.status, error: processFailureDiagnostic(runner, processResult), stdout: processResult.stdout ?? '' }
     try {
-      const rawResponse = extractJsonCandidate(processResult.stdout ?? '', outputPath, runner)
-      const schemaErrors = [...validateResponse(rawResponse), ...validateJsonSchema(rawResponse, readJson(schemaPath))]
+      const transportResponse = extractJsonCandidate(processResult.stdout ?? '', outputPath, runner)
+      const rawResponse = runner === 'codex' ? normalizeCodexOutput(transportResponse, canonicalSchema) : transportResponse
+      const schemaErrors = [...validateResponse(rawResponse), ...validateJsonSchema(rawResponse, canonicalSchema)]
       if (schemaErrors.length) return { kind: 'invalid-structured-output', durationMs, exitStatus: processResult.status, error: schemaErrors.join('; '), stdout: processResult.stdout ?? '' }
       const response = rawResponse
       for (const key of ['selectedRouter', 'selectedSkills', 'selectedContext', 'decisions', 'violations']) {
@@ -3668,6 +3735,7 @@ export function resolveLiveCaseTimeout(options, model, caseTimeout = 0) {
 
 function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, harnessDir, resultSchema }) {
   const schemaPath = path.join(harnessDir, 'routing-response.schema.json')
+  const routingResponseSchema = readJson(schemaPath)
   const version = runnerVersion(options.runner, root)
   const model = options.model ?? releaseMatrix.routing.runners[options.runner].modelSelector
   const writableRoot = options.writableRoot ? path.resolve(options.writableRoot) : undefined
@@ -3710,8 +3778,9 @@ function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, h
       // fail-closed tool server, so a declared example root can never be written.
       const immutableRoots = immutableExampleRoots(evaluationCase)
       const timeout = resolveLiveCaseTimeout(options, model, caseRecord.timeoutMs ?? 0)
+      const responseSchema = routingResponseSchemaForCase(routingResponseSchema, evaluationCase)
       const executions = [runAgentOnce({
-        runner: options.runner, root: runRoot, schemaPath, prompt, timeout, model, reasoningEffort: options.reasoningEffort, writable,
+        runner: options.runner, root: runRoot, schemaPath, responseSchema, prompt, timeout, model, reasoningEffort: options.reasoningEffort, writable,
         allowedReads, allowedWrites: writable ? caseRecord.allowedWrites ?? [] : [], immutableRoots,
       })]
       let execution = executions[0]
@@ -3723,7 +3792,7 @@ function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, h
           ? `${prompt}\n\nYour previous response was not valid structured output. Return only the schema object.`
           : `${prompt}\n\nThis is retry attempt 2 after a transient provider failure. Continue with the same routing contract.`
         execution = runAgentOnce({
-          runner: options.runner, root: runRoot, schemaPath, prompt: retryPrompt, timeout, model, reasoningEffort: options.reasoningEffort, writable,
+          runner: options.runner, root: runRoot, schemaPath, responseSchema, prompt: retryPrompt, timeout, model, reasoningEffort: options.reasoningEffort, writable,
           allowedReads, allowedWrites: writable ? caseRecord.allowedWrites ?? [] : [], immutableRoots,
         })
         executions.push(execution)
@@ -3787,7 +3856,7 @@ function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, h
         const diagnostics = routingCorrectionDiagnostics(evaluated.violations)
         const retryPrompt = `${prompt}\n\nThis is correction attempt ${executions.length + 1} after the previous routing answer failed a non-safety contract. Correction kind: ${correctionKind}. Evaluator diagnostics: ${JSON.stringify(diagnostics)}. These diagnostics identify only the failing contract categories; derive every answer from emitted instructions. Start the routing audit again by calling harness.read with {"path":"AGENTS.md"}; never call read_mcp_resource or any resource API. Re-evaluate every additive Axis 1 route, Axis 2 work-unit skill, module fact, and required decision while opening only the smallest task-matching initial context. Build selectedContext from every successful read in this correction attempt: add every opened routed guide's route and every opened skill's ID, or avoid opening it. Never reuse or prune the previous answer. Re-check the context budget, then return only the schema object.`
         execution = runAgentOnce({
-          runner: options.runner, root: runRoot, schemaPath, prompt: retryPrompt, timeout, model, reasoningEffort: options.reasoningEffort, writable,
+          runner: options.runner, root: runRoot, schemaPath, responseSchema, prompt: retryPrompt, timeout, model, reasoningEffort: options.reasoningEffort, writable,
           allowedReads, allowedWrites: [], immutableRoots,
         })
         executions.push(execution)

package/dist/agentic/shared/scripts/execution-sandbox.mjs

@@ -69,16 +69,17 @@ export function collapseReadOnlyRoots(values) {
 
 export function linuxMergedUsrSymlinkArgs() {
   const aliases = [
-    ['/bin', 'usr/bin'],
-    ['/sbin', 'usr/sbin'],
-    ['/lib', 'usr/lib'],
-    ['/lib64', 'usr/lib64'],
+    ['/bin', ['usr/bin']],
+    ['/sbin', ['usr/sbin', 'usr/bin']],
+    ['/lib', ['usr/lib']],
+    ['/lib64', ['usr/lib64', 'usr/lib']],
   ]
-  return aliases.flatMap(([alias, expected]) => {
+  return aliases.flatMap(([alias, targets]) => {
     try {
       const stat = fs.lstatSync(alias)
-      return stat.isSymbolicLink() && fs.readlinkSync(alias) === expected
-        ? ['--symlink', expected, alias]
+      const target = stat.isSymbolicLink() ? fs.readlinkSync(alias) : null
+      return targets.includes(target)
+        ? ['--symlink', target, alias]
         : []
     } catch { return [] }
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.9.1-develop.7464.1.9a392fca41",
+  "version": "0.9.1-develop.7467.1.3b2bb92d47",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.9.1-develop.7464.1.9a392fca41",
-    "@open-mercato/queue": "0.9.1-develop.7464.1.9a392fca41",
-    "@open-mercato/shared": "0.9.1-develop.7464.1.9a392fca41",
-    "@open-mercato/telemetry": "0.9.1-develop.7464.1.9a392fca41",
+    "@open-mercato/events": "0.9.1-develop.7467.1.3b2bb92d47",
+    "@open-mercato/queue": "0.9.1-develop.7467.1.3b2bb92d47",
+    "@open-mercato/shared": "0.9.1-develop.7467.1.3b2bb92d47",
+    "@open-mercato/telemetry": "0.9.1-develop.7467.1.3b2bb92d47",
     "cross-spawn": "^7.0.6",
     "pg": "8.23.0",
     "semver": "^7.8.5",
@@ -74,10 +74,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.9.1-develop.7464.1.9a392fca41"
+    "@open-mercato/shared": "0.9.1-develop.7467.1.3b2bb92d47"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.9.1-develop.7464.1.9a392fca41",
+    "@open-mercato/shared": "0.9.1-develop.7467.1.3b2bb92d47",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"