@openrig/cli 0.6.14 → 0.7.1

package/daemon/dist/adapters/codex-runtime-adapter.js

@@ -1,8 +1,12 @@
+import { codexEnvelopeArgs } from "../domain/codex-rebuild-permissions.js";
 import { operationalLaunchArg } from "./kernel-authority.js";
 import nodePath from "node:path";
 import fs from "node:fs";
 import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { createRequire } from "node:module";
 import os from "node:os";
+import { isDeepStrictEqual } from "node:util";
 import { parse as parseToml } from "smol-toml";
 import { codexPostureArg } from "./yolo-mode.js";
 import { resolveConcreteHint } from "../domain/runtime-adapter.js";
@@ -12,13 +16,31 @@ import { assessNativeResumeProbe, buildCodexResumeCore, hasCodexUpdateHeader } f
 import { unknownDaemonSupportMessage } from "../domain/codex-daemon-support.js";
 import { CODEX_NETWORK_DEFAULT_OVERRIDE, codexNetworkDefaultArg } from "../domain/codex-network-default.js";
 import { resolveCodexGitAddDirs } from "../domain/codex-git-add-dirs.js";
-import { mergeManagedBlock } from "../domain/managed-blocks.js";
+import { isPerSeatRoleGuidance, mergeManagedBlock, perSeatRoleSkipWarning } from "../domain/managed-blocks.js";
 import { excludeNewGeneratedFiles } from "../domain/generated-file-hygiene.js";
 import { codexQueueStateRoot, codexTeamWorkspaceArg } from "../domain/codex-team-workspace.js";
 import { shellQuote } from "./shell-quote.js";
-import { runSyncSite } from "../domain/sync-site-wrap.js";
+import { execRuntimeProbe } from "./runtime-probe-exec.js";
 import { resolveReadinessTimeoutMs } from "../domain/readiness-timeout.js";
+import { CODEX_CORE_MARKETPLACE, CODEX_CORE_PLUGIN, CODEX_CORE_PLUGIN_KEY, CODEX_MARKETPLACE_MANIFEST_PATH, codexCoreMarketplaceManifest, codexCorePluginEnablement, codexReadableConfigLayers, recordedMarketplaceSource, userLayerEnablesCorePlugin, } from "../domain/codex-core-plugin-install.js";
+const defaultCodexCli = (args, env) => new Promise((resolve) => {
+    execFile("codex", args, { env, timeout: 120_000, maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => {
+        const status = error ? (typeof error.code === "number" ? error.code : null) : 0;
+        // A spawn failure (ENOENT, EACCES) has no exit code and empty output: keep its message as the reason.
+        const err = String(stderr ?? "");
+        resolve({ status, stdout: String(stdout ?? ""), stderr: err.trim() || !error ? err : error.message });
+    });
+});
+// Codex's hook trust recipe (the key and hash Codex records for a trusted hook), kept in one script.
+const codexHookTrust = createRequire(import.meta.url)("../../assets/plugins/openrig-core/hooks/scripts/codex-hook-trust.cjs");
 import { listNativeProcesses, observeCodexPaneProcess, observeCodexForkProcess, verifyPaneIdleShell } from "../domain/native-process-lineage.js";
+import { recordSeatSkillWrite, seatPluginSkillsLossNote, seatProjectionComplete, seatSkillWriteRefusal } from "../domain/seat-skill-storage.js";
+import { codexPluginContentHash, planOwnedCodexContentApproval, recordOwnedCodexApproval } from "../domain/codex-owned-plugin-trust.js";
+// The managed resume check's poll window: a quick phase, then an extended one for a slow boot.
+const RESUME_QUICK_ATTEMPTS = 6;
+const RESUME_EXTENDED_ATTEMPTS = 24;
+const RESUME_QUICK_SLEEP_MS = 200;
+const RESUME_EXTENDED_SLEEP_MS = 500;
 /**
  * Codex runtime adapter. Projects resources to .agents/ targets (preserving
  * existing Codex filesystem contract) and delivers startup files.
@@ -30,6 +52,8 @@ export class CodexRuntimeAdapter {
     fs;
     listProcesses;
     readThreadIdByPid;
+    readResumeEvidence;
+    resumeProofWindowMs;
     readinessSettings;
     sleep;
     resolveHomeDirByPid;
@@ -59,7 +83,21 @@ export class CodexRuntimeAdapter {
     // (FR-A) to write config-layer [hooks] command entries that are cwd-independent and
     // version-matched to the running daemon (NOT ${PLUGIN_ROOT}, NOT a per-cwd copy).
     activityRelayPath;
+    // The vendored openrig-core plugin directory, resolved when the install step runs (vendoring happens at startup).
+    resolveCorePluginDir;
+    // Whether a node's resolved plugin selection includes openrig-core (the test that also gives it OPENRIG_SEAT_PROJECT_DIR).
+    resolveCorePluginSelected;
+    runCodexCli;
+    // One Codex config.toml per adapter: launches, the boot step and resume all write it (and Codex's install writes it too),
+    // so each of those runs its whole setup under this one lock, one after another.
+    configLock = Promise.resolve();
+    codexSystemConfigDir;
+    /** Build the Codex launch adapter with injectable filesystem, process, and CLI seams for isolated checks. */
     constructor(deps) {
+        this.resolveCorePluginDir = deps.resolveCorePluginDir;
+        this.resolveCorePluginSelected = deps.resolveCorePluginSelected;
+        this.runCodexCli = deps.runCodexCli ?? defaultCodexCli;
+        this.codexSystemConfigDir = deps.codexSystemConfigDir ?? "/etc/codex";
         this.tmux = deps.tmux;
         this.resolveManagedConfigSettings = deps.resolveManagedConfigSettings;
         this.resolveHooksEnabled = deps.resolveHooksEnabled;
@@ -80,6 +118,18 @@ export class CodexRuntimeAdapter {
         });
         this.readThreadIdByPid = deps.readThreadIdByPid ?? ((pid, identity) => identity === undefined
             ? this.readThreadIdFromLogs(pid) : threadIdResolver.resolveForkChild(pid, identity));
+        // A just-launched resume may log only inside its start second, so this reads like a fork child's ("by-process").
+        this.readResumeEvidence = deps.readResumeEvidence ?? (deps.readThreadIdByPid
+            ? async (pid, identity) => {
+                const threadId = (await deps.readThreadIdByPid(pid, identity))?.trim();
+                return threadId ? { threadId } : { reason: "no_log_row" };
+            }
+            : async (pid, identity) => {
+                let reason;
+                const threadId = (await threadIdResolver.resolveForkChild(pid, identity, (d) => { reason = d.reason; }))?.trim();
+                return threadId ? { threadId } : { reason: reason ?? "no_log_row" };
+            });
+        this.resumeProofWindowMs = deps.resumeProofWindowMs ?? RESUME_QUICK_ATTEMPTS * RESUME_QUICK_SLEEP_MS + RESUME_EXTENDED_ATTEMPTS * RESUME_EXTENDED_SLEEP_MS;
         this.readinessSettings = deps.readinessSettings;
         this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
         this.verifyProfilePreflight = deps.verifyProfilePreflight
@@ -93,8 +143,17 @@ export class CodexRuntimeAdapter {
      * not block the launch.
      */
     async ensureManagedConfig() {
+        return this.withConfigLock(() => this.applyManagedConfig());
+    }
+    /** Run `task` after every earlier config setup on this adapter has finished, whatever its outcome. */
+    withConfigLock(task) {
+        const run = this.configLock.then(task, task);
+        this.configLock = run.catch(() => undefined);
+        return run;
+    }
+    async applyManagedConfig() {
         if (!this.resolveManagedConfigSettings)
-            return;
+            return undefined;
         try {
             const { enabled, codexVersion } = await this.resolveManagedConfigSettings();
             this.ensureCodexFeatureFlag(enabled, { codexVersion });
@@ -102,11 +161,209 @@ export class CodexRuntimeAdapter {
                 this.ensureCodexActivityHooks();
             else
                 this.removeCodexActivityHooks();
+            return { hooksEnabled: enabled };
         }
         catch (err) {
             console.error(`[openrig] runtime setup warning: ${err.message}`);
+            return undefined;
         }
     }
+    /**
+     * Boot step, run after the plugin is vendored: install openrig-core into Codex only when hooks are enabled and some
+     * Codex seat's resolved selection includes it. A daemon whose Codex seats didn't select it never installs it.
+     */
+    async ensureCodexCorePluginAtBoot(anySeatSelected) {
+        if (!anySeatSelected || !this.resolveHooksEnabled)
+            return;
+        const resolveHooksEnabled = this.resolveHooksEnabled;
+        await this.withConfigLock(async () => {
+            try {
+                if (await resolveHooksEnabled())
+                    await this.ensureCodexCorePlugin();
+            }
+            catch (err) {
+                console.error(`[openrig] runtime setup warning: ${err.message}`);
+            }
+        });
+    }
+    /**
+     * Install the vendored openrig-core plugin into Codex through Codex's own commands, so a seat that selected it gets its
+     * refocus and skills, trusting exact shipped hooks on first install and renewing proven owned content approvals. It runs only when the person's config
+     * doesn't disable the plugin (codexCorePluginEnablement), and only when the installed version differs from the vendored
+     * one. Codex owns its plugin cache; its immutable legacy trust baseline is never rewritten.
+     */
+    async ensureCodexCorePlugin() {
+        const report = (outcome, reason) => {
+            if (outcome !== "current")
+                console.error(`[openrig] codex core plugin ${outcome}: ${reason}`);
+            return { outcome, reason };
+        };
+        const pluginDir = this.resolveCorePluginDir?.();
+        if (!pluginDir)
+            return { outcome: "skipped", reason: "the openrig-core plugin isn't vendored" };
+        let version;
+        try {
+            version = JSON.parse(this.fs.readFile(nodePath.join(pluginDir, ".codex-plugin", "plugin.json"))).version;
+        }
+        catch {
+            return report("skipped", "the vendored plugin has no readable Codex manifest");
+        }
+        if (typeof version !== "string" || !/^[0-9A-Za-z._-]+$/.test(version))
+            return report("skipped", "the vendored plugin's Codex manifest has no usable version");
+        const shipped = nodePath.resolve(import.meta.dirname, "../../assets/plugins/openrig-core");
+        const ownFiles = [];
+        const collect = (dir, relative = "hooks") => {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                const child = nodePath.join(relative, entry.name);
+                if (entry.isDirectory())
+                    collect(nodePath.join(dir, entry.name), child);
+                else
+                    ownFiles.push(child);
+            }
+        };
+        collect(nodePath.join(shipped, "hooks"));
+        ownFiles.push(".codex-plugin/plugin.json");
+        const matchesShipped = (dir) => ownFiles.every(relative => {
+            try {
+                return fs.readFileSync(nodePath.join(dir, relative)).equals(fs.readFileSync(nodePath.join(shipped, relative)));
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!matchesShipped(pluginDir))
+            return report("skipped", "vendored hook files differ from this daemon's shipped plugin; existing choices are left alone");
+        // Installation retains the hook-file predicate; any approval requires the complete shipped tree.
+        const matchesShippedTree = (dir) => {
+            try {
+                return codexPluginContentHash(dir, true) === codexPluginContentHash(shipped, true);
+            }
+            catch {
+                return false;
+            }
+        };
+        const codexHome = nodePath.dirname(this.resolveCodexConfigPath());
+        const readLayers = () => codexReadableConfigLayers(codexHome, this.codexSystemConfigDir).map((layer) => {
+            if (!this.fs.exists(layer.path))
+                return { ...layer, state: "absent" };
+            try {
+                return { ...layer, state: "read", content: this.fs.readFile(layer.path) };
+            }
+            catch (error) {
+                return { ...layer, state: "unreadable", reason: error.message };
+            }
+        });
+        const layers = readLayers();
+        const enablement = codexCorePluginEnablement(layers);
+        if (enablement.decision !== "allow")
+            return report("skipped", enablement.reason);
+        const pluginsDir = nodePath.dirname(pluginDir);
+        const userLayer = layers.find((layer) => layer.name === "user config");
+        const userConfig = userLayer?.state === "read" ? userLayer.content : null;
+        const recorded = recordedMarketplaceSource(userConfig);
+        // Compared as real paths, so a marketplace recorded through a symlink to the plugins folder is the same source.
+        const canonical = (p) => { try {
+            return fs.realpathSync.native(nodePath.resolve(p));
+        }
+        catch {
+            return nodePath.resolve(p);
+        } };
+        if (recorded !== undefined && (recorded === null || canonical(recorded) !== canonical(pluginsDir))) {
+            return report("skipped", `a marketplace named ${CODEX_CORE_MARKETPLACE} is already configured with another source; it's left alone`);
+        }
+        // Current only when Codex would load it: the vendored version is in its store AND the user config still registers it
+        // (our marketplace, and an explicit enabled = true, which Codex's install writes). Codex loads only configured
+        // plugins, so a cache left behind after the entry or the marketplace was removed is installed again.
+        const cacheRoot = nodePath.join(codexHome, "plugins", "cache", CODEX_CORE_MARKETPLACE, CODEX_CORE_PLUGIN);
+        const cachedDir = nodePath.join(cacheRoot, version);
+        const cached = this.fs.exists(cachedDir);
+        // Codex's "continue without trusting" choice writes no state. An existing install/configuration may therefore be a
+        // decline even with no hooks.state entry. Absent grants still stay under native review. A proven owned grant may
+        // renew its content approval; an unrecorded skip of that exact owned upgrade cannot be distinguished from pending approval.
+        const firstInstall = !this.fs.exists(cacheRoot) && !layers.some(layer => layer.state === "read"
+            && Object.hasOwn((parseToml(layer.content).plugins ?? {}), CODEX_CORE_PLUGIN_KEY));
+        const renewContentApproval = (freshGrant = false) => {
+            const configPath = this.resolveCodexConfigPath();
+            const currentLayers = readLayers();
+            if (codexCorePluginEnablement(currentLayers).decision !== "allow")
+                return;
+            const before = this.fs.readFile(configPath);
+            const currentSource = recordedMarketplaceSource(before);
+            if (currentSource == null || canonical(currentSource) !== canonical(pluginsDir) || !userLayerEnablesCorePlugin(before))
+                return;
+            let content = before;
+            const planned = planOwnedCodexContentApproval({ configPath, content, layers: currentLayers, shipped, installed: cachedDir, freshGrant });
+            if (!planned)
+                return;
+            for (const [key, hash] of Object.entries(planned.hashes))
+                content = upsertCodexHookTrust(content, key, hash, "trusted_content_hash");
+            // The line writer must not alter examples in strings or duplicate quoted keys.
+            try {
+                const expected = parseToml(before);
+                for (const [key, hash] of Object.entries(planned.hashes))
+                    expected.hooks.state[key].trusted_content_hash = hash;
+                if (!isDeepStrictEqual(parseToml(content), expected))
+                    return;
+            }
+            catch {
+                return;
+            } // Leave native review and owner bytes intact for unsupported TOML spellings.
+            if (this.fs.readFile(configPath) !== before)
+                return; // A concurrent native choice wins.
+            if (content !== before)
+                this.fs.writeFile(configPath, content);
+            recordOwnedCodexApproval(configPath, planned.approval);
+        };
+        if (cached && recorded !== undefined && userLayerEnablesCorePlugin(userConfig)) {
+            renewContentApproval();
+            return report("current", `${CODEX_CORE_PLUGIN_KEY} ${version} is installed and registered`);
+        }
+        const manifestPath = nodePath.join(pluginsDir, CODEX_MARKETPLACE_MANIFEST_PATH);
+        const manifest = codexCoreMarketplaceManifest();
+        if (!this.fs.exists(manifestPath) || this.fs.readFile(manifestPath) !== manifest) {
+            this.fs.mkdirp(nodePath.dirname(manifestPath));
+            this.fs.writeFile(manifestPath, manifest);
+        }
+        const env = { ...process.env, CODEX_HOME: codexHome, ...(this.launchPath ? { PATH: this.launchPath } : {}) };
+        if (recorded === undefined) {
+            const added = await this.runCodexCli(["plugin", "marketplace", "add", pluginsDir], env);
+            if (added.status !== 0)
+                return report("skipped", `codex plugin marketplace add failed: ${(added.stderr || added.stdout).trim() || `exit ${added.status}`}`);
+        }
+        const installed = await this.runCodexCli(["plugin", "add", CODEX_CORE_PLUGIN_KEY], env);
+        if (installed.status !== 0)
+            return report("skipped", `codex plugin add failed: ${(installed.stderr || installed.stdout).trim() || `exit ${installed.status}`}`);
+        // First install grants declarations; Codex0.164 also requires full-bundle content approval. Existing declaration
+        // choices are never rewritten. No cache files or native baseline files are rewritten here.
+        let freshGrants = 0;
+        const grantLayers = readLayers();
+        if (firstInstall && codexCorePluginEnablement(grantLayers).decision === "allow" && matchesShippedTree(cachedDir)) {
+            let content = this.fs.readFile(this.resolveCodexConfigPath());
+            const hookManifest = JSON.parse(fs.readFileSync(nodePath.join(shipped, "hooks/codex.json"), "utf8"));
+            for (const [event, groups] of Object.entries(hookManifest.hooks)) {
+                groups.forEach((group, groupIndex) => group.hooks.forEach((handler, handlerIndex) => {
+                    const { key, hash } = codexHookTrust.computeCodexHookTrust(event, {
+                        ...handler, timeoutSec: handler.timeout, matcher: group.matcher,
+                        keySource: `${CODEX_CORE_PLUGIN_KEY}:hooks/codex.json`, groupIndex, handlerIndex,
+                    });
+                    // Any existing choice in any readable layer/profile wins; never overwrite enabled=false or an old hash.
+                    const hasChoice = (doc) => {
+                        if (!doc || typeof doc !== "object")
+                            return false;
+                        const value = doc;
+                        return Object.hasOwn(value.hooks?.state ?? {}, key) || Object.values(doc).some(hasChoice);
+                    };
+                    if (!hasChoice(parseToml(content)) && !grantLayers.some(layer => layer.state === "read" && hasChoice(parseToml(layer.content)))) {
+                        content = upsertCodexHookTrust(content, key, hash);
+                        freshGrants++;
+                    }
+                }));
+            }
+            this.fs.writeFile(this.resolveCodexConfigPath(), content);
+        }
+        renewContentApproval(freshGrants === 6);
+        return report("installed", `${CODEX_CORE_PLUGIN_KEY} ${version} through Codex's own install (${enablement.reason})`);
+    }
     /**
      * Boot step for a daemon without Codex seats: when runtime.codex.hooks_enabled is false,
      * strip OpenRig's managed hooks block, as every boot did before. Removal writes only when
@@ -247,7 +504,7 @@ export class CodexRuntimeAdapter {
     }
     async listInstalled(binding) {
         const results = [];
-        const skillsDir = nodePath.join(binding.cwd, ".agents", "skills");
+        const skillsDir = binding.seatSkillsRoot ?? nodePath.join(binding.cwd, ".agents", "skills");
         if (this.fs.exists(skillsDir) && this.fs.listFiles) {
             for (const file of this.fs.listFiles(skillsDir)) {
                 results.push({ effectiveId: file, category: "skill", installedPath: nodePath.join(skillsDir, file) });
@@ -266,7 +523,7 @@ export class CodexRuntimeAdapter {
                 continue;
             }
             try {
-                const didProject = this.projectEntry(entry, binding.cwd, warnings);
+                const didProject = this.projectEntry(entry, binding.cwd, warnings, binding.seatSkillsRoot, binding.seatSkillsRefused);
                 if (didProject) {
                     projected.push(entry.effectiveId);
                 }
@@ -293,7 +550,7 @@ export class CodexRuntimeAdapter {
         for (const file of files) {
             try {
                 const content = this.fs.readFile(file.absolutePath);
-                const hint = file.deliveryHint === "auto" ? this.detectDeliveryHint(file.path, content) : file.deliveryHint;
+                const hint = file.deliveryHint === "auto" ? this.detectDeliveryHint(file.path, content, file.orientation) : file.deliveryHint;
                 switch (hint) {
                     case "guidance_merge": {
                         const targetPath = nodePath.join(binding.cwd, "AGENTS.md");
@@ -303,9 +560,18 @@ export class CodexRuntimeAdapter {
                         break;
                     }
                     case "skill_install": {
-                        const targetDir = nodePath.join(binding.cwd, ".agents", "skills", nodePath.basename(nodePath.dirname(file.absolutePath)));
+                        const targetDir = nodePath.join(binding.seatSkillsRoot ?? nodePath.join(binding.cwd, ".agents", "skills"), nodePath.basename(nodePath.dirname(file.absolutePath)));
+                        const skillTarget = nodePath.join(targetDir, nodePath.basename(file.path));
+                        // OPR.0.7.0.13: never write through a link out of the seat's storage.
+                        const refusal = binding.seatSkillsRoot ? binding.seatSkillsRefused ?? seatSkillWriteRefusal(binding.seatSkillsRoot, skillTarget) : undefined;
+                        if (refusal) {
+                            warnings.push(`skill_install: ${refusal}`);
+                            continue;
+                        }
                         this.fs.mkdirp(targetDir);
-                        this.fs.writeFile(nodePath.join(targetDir, nodePath.basename(file.path)), content);
+                        this.fs.writeFile(skillTarget, content);
+                        if (binding.seatSkillsRoot)
+                            recordSeatSkillWrite(binding.seatSkillsRoot, skillTarget, file.absolutePath, content);
                         break;
                     }
                     case "send_text": {
@@ -339,10 +605,11 @@ export class CodexRuntimeAdapter {
             return { ok: false, error: "resumeToken and forkSource are mutually exclusive — pick one" };
         }
         const updatePrompt = { handled: false };
-        const prepared = await this.prepareLaunch(binding, opts.name);
+        // Only a launch that starts a conversation may install the core plugin; a resume never does.
+        const prepared = await this.prepareLaunch(binding, opts.name, undefined, { installCorePlugin: !opts.resumeToken });
         if (!prepared.ok)
             return prepared;
-        const { modelArg, effortArg, appliedLaunch, postureArg, queueStateDirArg, daemonArg, networkArg } = prepared;
+        const { modelArg, effortArg, appliedLaunch, postureArg, queueStateDirArg, daemonArg, networkArg, suppressAutoAddDirs } = prepared;
         // Fork branch: `codex fork <parent_thread_id>`. Captures the NEW thread id
         // post-fork. Parent thread id is NOT persisted onto the new seat record
         // (identity-honesty bedrock).
@@ -396,9 +663,9 @@ export class CodexRuntimeAdapter {
         // -s danger-full-access (overrides even a named profile); otherwise the named profile, or
         // OpenRig's explicit -s workspace-write floor flag.
         // Issue #121: only the fresh launch adds git metadata dirs; resume and fork never did.
-        const gitDirArg = opts.resumeToken
+        const gitDirArg = opts.resumeToken || binding.codexRebuildPermissions
             ? ""
-            : (await this.resolveGitAddDirs(binding.cwd)).map((dir) => ` --add-dir ${shellQuote(dir)}`).join("");
+            : suppressAutoAddDirs ? "" : (await this.resolveGitAddDirs(binding.cwd)).map((dir) => ` --add-dir ${shellQuote(dir)}`).join("");
         const cmd = opts.resumeToken
             // 0.5.2-07 A2-3: the pod-aware RESUME path threads the SPEC model too (reverted before — the
             // grounding map assumed codex parity with the claude adapter, but only fresh emitted -m).
@@ -415,7 +682,8 @@ export class CodexRuntimeAdapter {
             const verification = await this.verifyResumeLaunch(binding.tmuxSession, updatePrompt, { resumeToken: opts.resumeToken });
             if (!verification.ok)
                 return verification;
-            return { ok: true, resumeToken: opts.resumeToken, resumeType: "codex_id", appliedLaunch };
+            return { ok: true, resumeToken: opts.resumeToken, resumeType: "codex_id", appliedLaunch,
+                ...(verification.resumedProcess ? { resumedProcess: verification.resumedProcess } : {}) };
         }
         const threadId = await this.captureFreshThreadId(binding, updatePrompt);
         if (updatePrompt.failure)
@@ -430,7 +698,8 @@ export class CodexRuntimeAdapter {
     async buildResumeCommand(binding, opts) {
         if (!binding.tmuxSession)
             return { ok: false, error: "No tmux session bound — cannot build a Codex resume command" };
-        const prepared = await this.prepareLaunch(binding, opts.name, opts.running);
+        // Building a resume command (the in-place restart's) never installs the core plugin.
+        const prepared = await this.prepareLaunch(binding, opts.name, opts.running, { installCorePlugin: false });
         if (!prepared.ok)
             return prepared;
         const core = this.resumeCore(prepared, opts.resumeToken, binding);
@@ -455,21 +724,39 @@ export class CodexRuntimeAdapter {
     }
     /** Launch flags shared by fresh, fork and resume, decided once per launch. With `running`, the probed and
      *  prepared parts come from the running Codex instead, and no Codex process is started to decide them. */
-    async prepareLaunch(binding, name, running) {
-        await this.ensureManagedConfig();
+    async prepareLaunch(binding, name, running, opts) {
+        // The config write and, for a seat that selected openrig-core, its install run as one step under the config lock, so
+        // concurrent launches never interleave them. An unselected seat's launch never installs.
+        await this.withConfigLock(async () => {
+            const managed = await this.applyManagedConfig();
+            if (opts.installCorePlugin && managed?.hooksEnabled && this.resolveCorePluginSelected?.(binding.nodeId)) {
+                try {
+                    await this.ensureCodexCorePlugin();
+                }
+                catch (err) {
+                    console.error(`[openrig] runtime setup warning: ${err.message}`);
+                }
+            }
+        });
         const model = binding.model?.trim();
         const modelArg = model ? ` -m ${shellQuote(model)}` : "";
         const effort = binding.effort?.trim();
         const effortArg = effort ? ` -c ${shellQuote(`model_reasoning_effort="${effort}"`)}` : "";
         const profile = binding.codexConfigProfile?.trim();
         const profileArg = profile ? ` -p ${shellQuote(profile)}` : "";
-        const posture = codexPostureArg(profileArg, process.env, binding.launchPosture);
-        const appliedLaunch = observeCodexSandbox(posture);
+        const posture = binding.codexRebuildPermissions
+            ? profileArg + codexEnvelopeArgs(binding.codexRebuildPermissions)
+            : codexPostureArg(profileArg, process.env, binding.launchPosture);
+        const appliedLaunch = binding.codexRebuildPermissions
+            ? { runtime: "codex", axis: "sandbox", state: "observed", value: binding.codexRebuildPermissions.sandboxPolicy.type,
+                reason: "emitted_launch_arguments", ...(binding.codexRebuildPermissions.approvalPolicy === "never" ? { approvalPolicy: "never" } : {}) }
+            : observeCodexSandbox(posture);
         const postureArg = posture + operationalLaunchArg(this.runtime, binding);
         if (running) {
             // The running Codex already loaded its profile; drift in -p is the caller's to compare.
             return { ok: true, model, modelArg, effort, effortArg, profile, appliedLaunch, postureArg,
                 queueStateDirArg: running.addDirs.map((dir) => ` --add-dir ${shellQuote(dir)}`).join(""),
+                suppressAutoAddDirs: false,
                 daemonOptOut: running.daemonOptOut, daemonArg: running.daemonOptOut ? " --no-daemon" : "",
                 networkArg: running.networkOverride ? ` -c ${shellQuote(CODEX_NETWORK_DEFAULT_OVERRIDE)}` : "" };
         }
@@ -486,10 +773,15 @@ export class CodexRuntimeAdapter {
                 };
             }
         }
-        const teamWorkspaceArg = binding.teamPermissionDefault && !profile
+        // Codex rejects writable --add-dir roots under a read-only sandbox. Only
+        // suppress OpenRig's generated roots when later project layers cannot make it writable.
+        const suppressAutoAddDirs = Boolean(!binding.codexRebuildPermissions && profile
+            && posture === profileArg && this.profileRemainsReadOnly(profile, binding.cwd));
+        const teamWorkspaceArg = !binding.codexRebuildPermissions && binding.teamPermissionDefault && !profile
             && appliedLaunch.state === "observed" && appliedLaunch.value === "workspace-write"
             ? codexTeamWorkspaceArg(this.prepareTeamWorkspace, name) : "";
-        const queueStateDirArg = teamWorkspaceArg || this.buildQueueStateAddDirArg(name);
+        const queueStateDirArg = binding.codexRebuildPermissions || suppressAutoAddDirs
+            ? "" : teamWorkspaceArg || this.buildQueueStateAddDirArg(name);
         // #69: one daemon-support decision for this launch, for the Codex the seat pane runs
         // (its cwd, the launch PATH), applied to fresh, fork and resume.
         const daemonSupport = this.detectDaemonSupport ? await this.detectDaemonSupport(binding.cwd) : undefined;
@@ -499,10 +791,11 @@ export class CodexRuntimeAdapter {
         const daemonOptOut = daemonSupport?.kind === "supported";
         const daemonArg = daemonOptOut ? " --no-daemon" : "";
         // #275: on the plain floor, network access unless Codex reports an opt-out or policy.
-        const networkArg = await codexNetworkDefaultArg(this.readNetworkDefault, appliedLaunch, binding.cwd, name);
+        const networkArg = binding.codexRebuildPermissions ? ""
+            : await codexNetworkDefaultArg(this.readNetworkDefault, appliedLaunch, binding.cwd, name);
         // The launch facts keep the probed daemon choice, so a printed recovery command can repeat it; no probe, no fact.
         const launchFacts = daemonSupport ? { ...appliedLaunch, daemonOptOut } : appliedLaunch;
-        return { ok: true, model, modelArg, effort, effortArg, profile, appliedLaunch: launchFacts, postureArg, queueStateDirArg, daemonOptOut, daemonArg, networkArg };
+        return { ok: true, model, modelArg, effort, effortArg, profile, appliedLaunch: launchFacts, postureArg, queueStateDirArg, suppressAutoAddDirs, daemonOptOut, daemonArg, networkArg };
     }
     resumeCore(prepared, resumeToken, binding) {
         const { profile, queueStateDirArg, model, postureArg, networkArg, daemonOptOut, effort } = prepared;
@@ -519,6 +812,81 @@ export class CodexRuntimeAdapter {
         const root = codexQueueStateRoot(sessionName, sharedDocsRoot);
         return root ? ` --add-dir ${shellQuote(root)}` : "";
     }
+    /**
+     * Return true only when visible config proves a read-only profile within Codex's default project root.
+     * Unknown markers or unreadable layers retain the generated roots for native launch handling.
+     */
+    profileRemainsReadOnly(profile, cwd) {
+        const root = this.codexHome ?? nodePath.join(this.fs.homedir ?? os.homedir(), ".codex");
+        const path = nodePath.join(root, `${profile}.config.toml`);
+        const userPath = nodePath.join(root, "config.toml");
+        if (!this.fs.exists(path))
+            return false;
+        try {
+            const value = parseToml(this.fs.readFile(path));
+            if (value.sandbox_mode !== "read-only" || value.default_permissions !== undefined || !nodePath.isAbsolute(cwd))
+                return false;
+            // A custom marker set may change the project boundary; leave the prior
+            // generated roots in place unless this default-marker scan proves it.
+            if (value.project_root_markers !== undefined)
+                return false;
+            // Codex merges fixed system/user/legacy-managed layers before choosing
+            // project markers. Any visible override or unreadable layer keeps roots.
+            for (const fixedPath of [
+                nodePath.join(this.codexSystemConfigDir, "config.toml"),
+                userPath,
+                nodePath.join(this.codexSystemConfigDir, "managed_config.toml"),
+            ]) {
+                if (!this.fs.exists(fixedPath))
+                    continue;
+                const fixed = parseToml(this.fs.readFile(fixedPath));
+                if (fixed.default_permissions !== undefined || fixed.project_root_markers !== undefined)
+                    return false;
+            }
+            // Codex's default root is the nearest .git file or a .git directory
+            // containing HEAD. When none exists, Codex uses cwd itself.
+            let projectRoot = nodePath.normalize(cwd);
+            for (let dir = projectRoot;;) {
+                const marker = nodePath.join(dir, ".git");
+                if (this.fs.exists(marker)) {
+                    if (!this.fs.statMode)
+                        return false;
+                    const kind = this.fs.statMode(marker) & fs.constants.S_IFMT;
+                    // statMode may expose permission bits alone; that cannot prove a file.
+                    if (kind !== fs.constants.S_IFREG && kind !== fs.constants.S_IFDIR)
+                        return false;
+                    if (kind === fs.constants.S_IFREG || this.fs.exists(nodePath.join(marker, "HEAD"))) {
+                        projectRoot = dir;
+                        break;
+                    }
+                }
+                const parent = nodePath.dirname(dir);
+                if (parent === dir)
+                    break;
+                dir = parent;
+            }
+            // Trust can exclude a closer project file, leaving a writable ancestor active.
+            // Keep roots if any visible applicable ancestor could make the launch writable.
+            for (let dir = nodePath.normalize(cwd);;) {
+                const projectPath = nodePath.join(dir, ".codex", "config.toml");
+                // At the home ancestor this is the user config, which loaded before the profile.
+                if (projectPath !== userPath && this.fs.exists(projectPath)) {
+                    const project = parseToml(this.fs.readFile(projectPath));
+                    if (project.default_permissions !== undefined)
+                        return false;
+                    if (project.sandbox_mode !== undefined && project.sandbox_mode !== "read-only")
+                        return false;
+                }
+                if (dir === projectRoot)
+                    return true;
+                dir = nodePath.dirname(dir);
+            }
+        }
+        catch {
+            // Preflight owns profile errors; unreadable user or project state keeps prior roots.
+            return false;
+        }
+    }
     async captureProbeScreen(target) {
         // Current readiness belongs to the rendered screen. Scrollback may retain
         // dismissed prompts, loading headers, or refusals from earlier attempts.
@@ -645,14 +1013,14 @@ export class CodexRuntimeAdapter {
     ensureManagedBootstrap(binding) {
         this.provisionWorkspaceTrust(binding.cwd ?? null);
     }
-    projectEntry(entry, cwd, warnings) {
+    projectEntry(entry, cwd, warnings, seatSkillsRoot, seatSkillsRefused) {
         if (entry.category === "runtime_resource" && this.applyRuntimeResource(entry)) {
             return true;
         }
         if (entry.category === "guidance" && entry.mergeStrategy === "managed_block") {
             const targetPath = nodePath.join(cwd, "AGENTS.md");
             const content = this.fs.readFile(entry.absolutePath);
-            return this.mergeGuidance(targetPath, entry.effectiveId, content, warnings);
+            return this.mergeGuidance(targetPath, entry.effectiveId, content, warnings, entry.absolutePath);
         }
         // HG-1.3 plugin runtime applicability filter (per DESIGN.md §5.1):
         // - explicit pluginType="claude" → skip Codex projection
@@ -661,9 +1029,23 @@ export class CodexRuntimeAdapter {
         if (entry.category === "plugin" && !this.pluginAppliesToCodex(entry)) {
             return false;
         }
-        const targetDir = this.resolveTargetDir(entry, cwd);
+        const targetDir = this.resolveTargetDir(entry, cwd, seatSkillsRoot);
         if (!targetDir)
             return true;
+        // OPR.0.7.0.13: never write through a link out of the seat's storage.
+        // A refused seat storage refuses every skill meant for it, named; otherwise each destination is checked.
+        const refusal = seatSkillsRoot && entry.category === "skill"
+            ? seatSkillsRefused ?? seatSkillWriteRefusal(seatSkillsRoot, nodePath.join(targetDir, "SKILL.md")) : undefined;
+        if (refusal) {
+            warnings.push(`${entry.effectiveId}: ${refusal}`);
+            return false;
+        }
+        // OPR.0.7.0.13: destinations refused below (a link on the way); an entry with any is reported incomplete, not projected.
+        const notProjected = [];
+        // OPR.0.7.0.13: a skill written to the seat's own storage is recorded, so cleanup and restore know it as OpenRig's.
+        const record = seatSkillsRoot && entry.category === "skill"
+            ? (dest, src, content) => recordSeatSkillWrite(seatSkillsRoot, dest, src, content)
+            : () => { };
         this.fs.mkdirp(targetDir);
         let isDir = false;
         if (this.fs.listFiles) {
@@ -679,10 +1061,26 @@ export class CodexRuntimeAdapter {
         const createdFiles = [];
         try {
             if (isDir && this.fs.listFiles) {
+                let skippedPluginSkills = 0;
                 for (const file of this.fs.listFiles(entry.absolutePath)) {
+                    // OPR.0.7.0.13: a seat with its own storage gets a selected plugin's bundled skills there, through its loadout, so
+                    // the project's copy of the plugin leaves its skills out; its manifest, hooks and settings are copied as before.
+                    if (seatSkillsRoot && entry.category === "plugin" && file.split(/[\\/]/)[0] === "skills") {
+                        skippedPluginSkills++;
+                        continue;
+                    }
                     const src = nodePath.join(entry.absolutePath, file);
                     const dest = nodePath.join(targetDir, file);
+                    // OPR.0.7.0.13: each destination in a seat's storage is checked before it's recorded, written or re-moded, so a
+                    // helper folder or file found to be a link is not written through (the identical-content, mode-only branch included).
+                    const refusedDest = seatSkillsRoot && entry.category === "skill" ? seatSkillWriteRefusal(seatSkillsRoot, dest) : undefined;
+                    if (refusedDest) {
+                        warnings.push(`${entry.effectiveId}: ${refusedDest}`);
+                        notProjected.push(dest);
+                        continue;
+                    }
                     const content = this.fs.readFile(src);
+                    record(dest, src, content);
                     // Reconcile mode even when the content write is skipped: a byte-identical dest
                     // projected earlier may still carry the wrong (default) mode.
                     if (this.fs.exists(dest) && hashContent(content) === hashContent(this.fs.readFile(dest))) {
@@ -696,10 +1094,19 @@ export class CodexRuntimeAdapter {
                         createdFiles.push(dest);
                     this.preserveMode(src, dest);
                 }
+                const pluginLoss = seatSkillsRefused ? seatPluginSkillsLossNote(entry.effectiveId, skippedPluginSkills, seatSkillsRefused) : undefined;
+                if (pluginLoss)
+                    warnings.push(pluginLoss);
             }
             else {
-                const content = this.fs.readFile(entry.absolutePath);
                 const destFile = nodePath.join(targetDir, nodePath.basename(entry.absolutePath));
+                const refusedFile = seatSkillsRoot && entry.category === "skill" ? seatSkillWriteRefusal(seatSkillsRoot, destFile) : undefined;
+                if (refusedFile) {
+                    warnings.push(`${entry.effectiveId}: ${refusedFile}`);
+                    return false;
+                }
+                const content = this.fs.readFile(entry.absolutePath);
+                record(destFile, entry.absolutePath, content);
                 if (this.fs.exists(destFile) && hashContent(content) === hashContent(this.fs.readFile(destFile))) {
                     this.preserveMode(entry.absolutePath, destFile);
                     return true;
@@ -715,7 +1122,7 @@ export class CodexRuntimeAdapter {
             if (entry.category === "plugin")
                 warnings.push(...excludeNewGeneratedFiles(cwd, createdFiles));
         }
-        return true;
+        return seatProjectionComplete(entry.effectiveId, notProjected, warnings);
     }
     /**
      * Reapply the source file's permission bits to the projected dest. Plain
@@ -740,9 +1147,9 @@ export class CodexRuntimeAdapter {
         // auto: detect via .codex-plugin/plugin.json presence in the source tree
         return this.fs.exists(nodePath.join(entry.absolutePath, ".codex-plugin", "plugin.json"));
     }
-    resolveTargetDir(entry, cwd) {
+    resolveTargetDir(entry, cwd, seatSkillsRoot) {
         switch (entry.category) {
-            case "skill": return nodePath.join(cwd, ".agents", "skills", entry.effectiveId);
+            case "skill": return nodePath.join(seatSkillsRoot ?? nodePath.join(cwd, ".agents", "skills"), entry.effectiveId);
             case "guidance": return null; // handled via merge
             case "subagent": return nodePath.join(cwd, ".agents"); // .agents/{id}.yaml per preserved contract
             case "plugin": return nodePath.join(cwd, ".codex", "plugins", entry.effectiveId);
@@ -775,14 +1182,17 @@ export class CodexRuntimeAdapter {
      * propagate the skip signal so ProjectionResult and StartupDeliveryResult
      * report honest counts.
      */
-    mergeGuidance(targetPath, blockId, content, warnings) {
+    mergeGuidance(targetPath, blockId, content, warnings, sourcePath) {
         // Mirrors Claude Code adapter: the `rig-role` managed block collides across
         // pod-mates because the regenerator pairs (target-file × spec) without
         // seat correlation. Per-seat role content is delivered through `send_text`
         // startup instead. Refuse the merge loudly; silent skip would mask the
         // collision. See ADR-0006.
-        if (blockId === "rig-role") {
-            console.log(`[openrig] skip: effectiveId is rig-role, per-seat delivery via send_text path required (target=${targetPath})`);
+        if (isPerSeatRoleGuidance(blockId, sourcePath)) {
+            console.log(`[openrig] skip: effectiveId is ${blockId}, a seat's own role; per-seat delivery via send_text path required (target=${targetPath})`);
+            const warning = perSeatRoleSkipWarning(blockId, targetPath);
+            if (warning)
+                warnings.push(warning);
             return false;
         }
         mergeManagedBlock(this.fs, targetPath, blockId, content, {
@@ -791,8 +1201,8 @@ export class CodexRuntimeAdapter {
         });
         return true;
     }
-    detectDeliveryHint(path, content) {
-        return resolveConcreteHint(path, content);
+    detectDeliveryHint(path, content, orientation) {
+        return resolveConcreteHint(path, content, orientation);
     }
     provisionWorkspaceTrust(cwd) {
         if (!cwd)
@@ -904,11 +1314,88 @@ export class CodexRuntimeAdapter {
         }
         return undefined;
     }
+    /**
+     * #1524 (b): whether the pane's resumed Codex process is proven to hold `resumeToken`. Codex's own records for that
+     * exact process (pid and start time) must name the token, read before `deadline`, with the same process observed
+     * before and after the read, so a reused pid or a replaced pane proves nothing. A different conversation is a
+     * mismatch; anything unread is unknown, never a mismatch or a match.
+     */
+    /** #1524 (b): `work` under the resume check's deadline. It isn't started at or after the deadline, it races the
+     *  deadline, and a value that arrives at or after it is not used (null). It cancels nothing: work already started
+     *  runs to its end (an async step may go on to its next read, and synchronous work such as the default record
+     *  reader's SQLite queries can't be interrupted at all), so the check can return after the deadline. */
+    async beforeResumeDeadline(work, deadline) {
+        if (Date.now() >= deadline)
+            return null;
+        const value = await this.withinDeadline(Promise.resolve().then(work), deadline);
+        return Date.now() >= deadline ? null : value;
+    }
+    async proveResumedProcess(tmuxSession, resumeToken, deadline) {
+        if (!this.tmux.getPanePid)
+            return { kind: "unknown", reason: "the pane's process can't be read" };
+        if (Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        const input = { target: tmuxSession, tmux: this.tmux,
+            listProcesses: this.listProcesses, expectedToken: resumeToken, requireResume: true };
+        const before = await this.beforeResumeDeadline(() => observeCodexPaneProcess(input), deadline);
+        if (!before && Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        if (!before)
+            return { kind: "unknown", reason: "no single Codex process resuming this conversation was observed in the pane" };
+        if (lstartToMinTs(before.process.startedAt) === undefined) {
+            return { kind: "unknown", reason: "the resumed Codex process has no readable start time" };
+        }
+        let evidence;
+        try {
+            evidence = await this.beforeResumeDeadline(() => this.readResumeEvidence(before.process.pid, before.process.startedAt), deadline);
+        }
+        catch (err) {
+            return { kind: "unknown", reason: `Codex's records couldn't be read (${err.message})` };
+        }
+        if (!evidence)
+            return { kind: "unknown", reason: "reading Codex's records didn't finish inside the resume window", windowEnded: true };
+        const after = await this.beforeResumeDeadline(() => observeCodexPaneProcess(input), deadline);
+        if (!after && Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        if (after?.fingerprint !== before.fingerprint) {
+            return { kind: "unknown", reason: "the resumed Codex process changed during the check" };
+        }
+        if (!evidence.threadId)
+            return { kind: "unknown", reason: evidence.reason ?? "no_log_row" };
+        // A decision is only as current as its last observation: at or past the deadline it decides nothing.
+        if (Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        return evidence.threadId === resumeToken
+            ? { kind: "match", process: { pid: before.process.pid, startedAt: before.process.startedAt } }
+            : { kind: "mismatch", threadId: evidence.threadId };
+    }
     async verifyResumeLaunch(tmuxSession, updatePrompt, opts) {
-        const quickAttempts = 6;
-        const extendedAttempts = 24;
-        const quickSleepMs = 200;
-        const extendedSleepMs = 500;
+        const quickAttempts = RESUME_QUICK_ATTEMPTS;
+        const extendedAttempts = RESUME_EXTENDED_ATTEMPTS;
+        const quickSleepMs = RESUME_QUICK_SLEEP_MS;
+        const extendedSleepMs = RESUME_EXTENDED_SLEEP_MS;
+        // #1524 (b): a managed resume of a known conversation is proven from Codex's own records, inside one wall-clock
+        // deadline for the whole existing window. Why it is still unproven, for the attention text at the bound.
+        // With a conversation to prove, the deadline prevents acceptance of late wrapped poll or proof values, or of a late
+        // match or mismatch. Ordinary poll sleeps request at most the remaining time. Work already started is not cancelled,
+        // and scheduling or synchronous work can delay return. The existing update-prompt helper has its own reads,
+        // reporting and guarded one-key behaviour outside this deadline.
+        const resumeToken = opts?.resumeToken;
+        const deadline = Date.now() + this.resumeProofWindowMs;
+        let unproven = null;
+        // Ordinary poll sleeps request at most the remaining time; scheduling can delay their completion. False once no time
+        // is left.
+        const pause = async (ms) => {
+            if (!resumeToken) {
+                await this.sleep(ms);
+                return true;
+            }
+            const left = deadline - Date.now();
+            if (left <= 0)
+                return false;
+            await this.sleep(Math.min(ms, left));
+            return Date.now() < deadline;
+        };
         // OPR.0.3.3.21 (FR-2): process-alive is NOT proof of a restored
         // conversation. verifyResumeLaunch must NOT return ok:true unless the probe
         // proves `resumed`. Unresolved operator-action gates (update/trust/model)
@@ -939,8 +1426,21 @@ export class CodexRuntimeAdapter {
             if (attempt >= quickAttempts && (sawRealGate || lastUnresolved?.code !== "awaiting_runtime")) {
                 break;
             }
-            const paneCommand = await this.tmux.getPaneCommand(tmuxSession);
-            const paneContent = await this.captureProbeScreen(tmuxSession);
+            // #1524 (b): with a conversation to prove, no capture starts at or after the deadline, and one that ends after it
+            // isn't used (a capture already started isn't cancelled: its second read may still run, its value discarded).
+            let paneCommand;
+            let paneContent;
+            if (resumeToken) {
+                const captured = await this.beforeResumeDeadline(async () => ({ command: await this.tmux.getPaneCommand(tmuxSession), content: await this.captureProbeScreen(tmuxSession) }), deadline);
+                if (!captured)
+                    break;
+                paneCommand = captured.command;
+                paneContent = captured.content;
+            }
+            else {
+                paneCommand = await this.tmux.getPaneCommand(tmuxSession);
+                paneContent = await this.captureProbeScreen(tmuxSession);
+            }
             lastPaneContent = paneContent;
             let probe = assessNativeResumeProbe({
                 runtime: "codex",
@@ -976,12 +1476,35 @@ export class CodexRuntimeAdapter {
                     evidence: paneContent.split("\n").slice(-12).join("\n"),
                 };
             }
-            if (probe.status === "resumed") {
-                return {
-                    ok: true,
-                    resumeToken: opts?.resumeToken,
-                    resumeType: opts?.resumeToken ? "codex_id" : undefined,
-                };
+            if (probe.status === "resumed" && !resumeToken) {
+                return { ok: true, resumeToken: undefined, resumeType: undefined };
+            }
+            if (probe.status === "resumed" && resumeToken) {
+                const proof = await this.proveResumedProcess(tmuxSession, resumeToken, deadline);
+                if (proof.kind === "match")
+                    return { ok: true, resumeToken, resumeType: "codex_id", resumedProcess: proof.process };
+                if (proof.kind === "mismatch") {
+                    return {
+                        ok: false,
+                        error: `Codex resume opened a different conversation: the resumed process's records name ${proof.threadId}, not the requested ${resumeToken}. The session was preserved; nothing was restarted.`,
+                        recovery: "attention_required",
+                        resumeMismatch: { opened: proof.threadId },
+                        verifierInput: verifierInput(),
+                        evidence: paneContent.split("\n").slice(-12).join("\n"),
+                    };
+                }
+                // Unknown is not a failure yet: keep polling inside the window, as a boot still in progress does. The
+                // window ending says nothing new, so it doesn't replace the last reason a read gave.
+                if (!("windowEnded" in proof) || !unproven)
+                    unproven = proof.reason;
+                lastUnresolved = { status: "inconclusive", code: "awaiting_runtime", detail: `Codex resume not yet proven: ${proof.reason}.` };
+                report = { probe, paneContent };
+                if (Date.now() >= deadline)
+                    break;
+                const sleepMs = attempt < quickAttempts ? quickSleepMs : extendedSleepMs;
+                if (attempt < totalAttempts - 1 && !(await pause(sleepMs)))
+                    break;
+                continue;
             }
             report = { probe, paneContent }; // resumed returned above, so this screen is unresolved
             if (probe.code === "update_gate") {
@@ -997,8 +1520,8 @@ export class CodexRuntimeAdapter {
                     lastUnresolved = null;
                     sawRealGate = false;
                     const sleepMs = attempt < quickAttempts ? quickSleepMs : extendedSleepMs;
-                    if (attempt < totalAttempts - 1)
-                        await this.sleep(sleepMs);
+                    if (attempt < totalAttempts - 1 && !(await pause(sleepMs)))
+                        break;
                     continue;
                 }
                 lastUnresolved = probe;
@@ -1011,13 +1534,16 @@ export class CodexRuntimeAdapter {
                 }
             }
             const sleepMs = attempt < quickAttempts ? quickSleepMs : extendedSleepMs;
-            if (attempt < totalAttempts - 1)
-                await this.sleep(sleepMs);
+            if (attempt < totalAttempts - 1 && !(await pause(sleepMs)))
+                break;
         }
         // Report the newest screen observed; a resumed or booting one names no gate. The loop's own decisions above used
         // lastUnresolved. The text follows the newest screen too, so an older gate's text never stands for a newer screen.
         const shown = report && report.probe.status !== "resumed" && report.probe.code !== "awaiting_runtime" ? report : null;
-        const newestText = shown ? shown.probe.detail
+        const unprovenText = unproven && report?.probe.status === "resumed"
+            ? `Codex resume could not be proven within the resume window: ${unproven}. The session was preserved; nothing was restarted.`
+            : null;
+        const newestText = unprovenText ? unprovenText : shown ? shown.probe.detail
             : report?.probe.status === "resumed" ? "Codex resume could not be confirmed: the last screen observed looked ready, but the resume check ended before proving a restored conversation."
                 : report ? report.probe.detail
                     : lastUnresolved?.detail;
@@ -1029,6 +1555,9 @@ export class CodexRuntimeAdapter {
             // The gate on that screen, if any. A boot still in progress names no gate.
             ...(shown ? gateFields(shown.probe, shown.paneContent) : {}),
             ...(shown?.beforeInput ? { screenBeforeInput: true } : {}),
+            // With a conversation to prove and no gate on the newest screen, the end is "not proven": whatever the last frame
+            // was (a boot, a ready screen, or no capture at all before the deadline), the resumed Codex may be running.
+            ...(resumeToken && !shown ? { resumeUnproven: true } : {}),
             verifierInput: verifierInput(),
             evidence: (report?.paneContent ?? lastPaneContent).split("\n").slice(-12).join("\n"),
         };
@@ -1120,19 +1649,6 @@ function upsertCodexProjectTrust(content, projectPath) {
 //   CONFIDENCE: the HASH is fully deterministic from the open source (JSON+sha256) — HIGH.
 //   The KEY's exact key_source canonical form + the positional indices are what the VM
 //   read-back must confirm — PROVISIONAL until then.
-/** Recursively sort object keys (mirrors codex-rs fingerprint.rs `canonical_json`). */
-function canonicalizeJsonValue(value) {
-    if (Array.isArray(value))
-        return value.map(canonicalizeJsonValue);
-    if (value !== null && typeof value === "object") {
-        const src = value;
-        const out = {};
-        for (const key of Object.keys(src).sort())
-            out[key] = canonicalizeJsonValue(src[key]);
-        return out;
-    }
-    return value;
-}
 const CODEX_HOOK_EVENT_KEY_LABEL = {
     SessionStart: "session_start",
     UserPromptSubmit: "user_prompt_submit",
@@ -1149,32 +1665,20 @@ export function computeCodexHookTrust(event, input) {
     const groupIndex = input.groupIndex ?? 0;
     const handlerIndex = input.handlerIndex ?? 0;
     const key = `${input.keySource}:${label}:${groupIndex}:${handlerIndex}`;
-    // Build NormalizedHookIdentity exactly as `TomlValue::try_from` would: None fields dropped.
-    const handler = {
-        type: "command",
-        command: input.command,
-        timeout: input.timeoutSec,
-        async: false,
-    };
-    if (input.statusMessage != null)
-        handler.statusMessage = input.statusMessage;
-    const identity = { event_name: label, hooks: [handler] };
-    if (input.matcher != null)
-        identity.matcher = input.matcher;
-    const serialized = JSON.stringify(canonicalizeJsonValue(identity));
-    const hex = createHash("sha256").update(serialized, "utf8").digest("hex");
-    return { key, hash: `sha256:${hex}` };
+    // NormalizedHookIdentity exactly as `TomlValue::try_from` would build it (None fields dropped), hashed by the shared
+    // recipe in codex-hook-trust.cjs.
+    return { key, hash: codexHookTrust.codexHookHash(label, input) };
 }
 /**
  * OPR.0.4.3.33 — idempotent, non-clobbering, section-scoped writer for a single
  * `[hooks.state."<key>"] trusted_hash = "<hash>"` record. Mirrors upsertCodexProjectTrust:
  * find/create the exact table header, splice ONLY its `trusted_hash` line, leave every other
  * `[hooks.state]` / `[projects]` entry and the managed hook block byte-identical. Same key+hash
- * ⇒ no-op. Only ever called for OUR 4 authored hook keys (never a blanket/wildcard trust).
+ * ⇒ no-op. Only called for our authored inline or verified owned plugin keys (never blanket trust).
  */
-export function upsertCodexHookTrust(content, key, hash) {
+export function upsertCodexHookTrust(content, key, hash, field = "trusted_hash") {
     const header = `[hooks.state.${JSON.stringify(key)}]`;
-    const trustLine = `trusted_hash = ${JSON.stringify(hash)}`;
+    const trustLine = `${field} = ${JSON.stringify(hash)}`;
     const lines = content.length > 0 ? content.split("\n") : [];
     const headerIndex = lines.findIndex((line) => line.trim() === header);
     if (headerIndex === -1) {
@@ -1189,14 +1693,14 @@ export function upsertCodexHookTrust(content, key, hash) {
             break;
         }
     }
-    const hashIndex = lines.findIndex((line, index) => index > headerIndex && index < nextSectionIndex && line.trim().startsWith("trusted_hash"));
+    const hashIndex = lines.findIndex((line, index) => index > headerIndex && index < nextSectionIndex && line.trim().startsWith(field));
     if (hashIndex >= 0) {
         lines[hashIndex] = trustLine;
     }
     else {
         lines.splice(headerIndex + 1, 0, trustLine);
     }
-    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+    return field === "trusted_content_hash" ? lines.join("\n") : `${lines.join("\n").replace(/\n*$/, "\n")}`;
 }
 export function isCodex013xOrLater(version) {
     const match = /^(\d+)\.(\d+)/.exec(version);
@@ -1574,15 +2078,12 @@ function escapeRegExp(value) {
 }
 // Module-private (P1 pin — NEVER exported). The REAL Codex profile-LOAD probe,
 // extracted verbatim from launchHarness: dynamic imports keep it lazy for
-// production, execFn runs the real `codex -p <profile> mcp list` via execSync
-// (utf-8, piped stdio, 10s timeout). Injected as the adapter's default
-// verifyProfilePreflight; tests substitute a controlled stub.
+// production, execFn runs the real `codex -p <profile> mcp list` through
+// execRuntimeProbe (utf-8, 10s bound, off the event loop). Injected as the
+// adapter's default verifyProfilePreflight; tests substitute a controlled stub.
 async function defaultProfilePreflight(profile, selected) {
     const { verifyCodexProfileLoads } = await import("../domain/codex-profile-preflight.js");
-    const { execSync } = await import("node:child_process");
-    const execFn = async (cmd) => runSyncSite("codex.runtime.profile_preflight", () => execSync(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 10_000,
-        ...(selected ? { cwd: selected.cwd, env: { ...process.env, CODEX_HOME: selected.codexHome, ...(selected.launchPath ? { PATH: selected.launchPath } : {}) } } : {}),
-    }));
+    const execFn = (cmd) => execRuntimeProbe("codex.runtime.profile_preflight", cmd, selected ? { cwd: selected.cwd, env: { ...process.env, CODEX_HOME: selected.codexHome, ...(selected.launchPath ? { PATH: selected.launchPath } : {}) } } : {});
     return verifyCodexProfileLoads(profile, execFn, undefined, selected?.codexHome);
 }
 // Exported for unit test (B12-T): the REAL async sampling path — the anti-vacuity test drives