@peterxiaoyang/superspec 0.1.5 → 0.1.7

package/dist/src/evidence.js

@@ -4,6 +4,7 @@ import { CLAIM_ADJUDICATION_DECISIONS, EVIDENCE_KINDS, EVIDENCE_STATUSES, FINAL_
 import { normalize_gate } from "./openspec.js";
 import { superspec_dir } from "./paths.js";
 import { findings_schema_reasons, review_digest_schema_reasons, standing_authorization_schema_reasons, user_decision_schema_reasons, } from "./disclosure.js";
+import { pinned_artifact_ref_reasons as shared_pinned_artifact_ref_reasons, worker_test_run_reasons, } from "./apply_worker_chain.js";
 function file_ref_reasons(baseRoot, ev, field, code) {
     const problems = [];
     const raw = ev[field];
@@ -29,6 +30,46 @@ function file_ref_reasons(baseRoot, ev, field, code) {
     }
     return problems;
 }
+function contractField(line) {
+    const match = line.match(/^\s*-\s+`?([A-Za-z0-9_-]+)`?\s*:\s*(.*)$/);
+    if (!match)
+        return null;
+    return { key: match[1], value: match[2].trim() };
+}
+function test_contract_section_lines(changeRoot, testId) {
+    const pathValue = join(changeRoot, ".superspec", "artifacts", "test-contract.md");
+    if (!existsSync(pathValue) || !statSync(pathValue).isFile())
+        return [];
+    const lines = readFileSync(pathValue, "utf8").split(/\r?\n/);
+    const out = [];
+    let inSection = false;
+    for (const line of lines) {
+        const heading = line.match(/^###\s+(.+?)\s*$/);
+        if (heading) {
+            if (inSection)
+                break;
+            inSection = heading[1].trim() === testId;
+            continue;
+        }
+        if (inSection)
+            out.push(line);
+    }
+    return out;
+}
+function expected_failure_contract(changeRoot, testId) {
+    const fields = new Map();
+    for (const line of test_contract_section_lines(changeRoot, testId)) {
+        const field = contractField(line);
+        if (!field)
+            continue;
+        const values = fields.get(field.key) ?? [];
+        values.push(field.value);
+        fields.set(field.key, values);
+    }
+    const signature = (fields.get("expected_failure_signature") ?? [])[0];
+    const classifier = (fields.get("expected_failure_classifier") ?? [])[0];
+    return { signature, classifier };
+}
 function pinned_ref_list_reasons(ev, field, baseRoot, staleCode, opts = {}) {
     const problems = [];
     const raw = ev[field];
@@ -94,6 +135,30 @@ function pinned_ref_reasons(ev, field, baseRoot, staleCode) {
     }
     return problems;
 }
+function string_list_field_reasons(ev, field, code, opts = {}) {
+    const raw = ev[field];
+    if (!Array.isArray(raw) || (!opts.allowEmpty && raw.length === 0) || !raw.every((item) => typeof item === "string" && item.length > 0)) {
+        return [reason(code, `${ev._path}: ${field} must be a non-empty string list`)];
+    }
+    return [];
+}
+function fingerprint_field_reasons(ev, field, code) {
+    const raw = ev[field];
+    if (typeof raw === "string") {
+        return raw.startsWith("sha256:") ? [] : [reason(code, `${ev._path}: ${field} must be a sha256 fingerprint`)];
+    }
+    if (isObject(raw) && typeof raw.fingerprint_digest === "string" && raw.fingerprint_digest.startsWith("sha256:"))
+        return [];
+    return [reason(code, `${ev._path}: ${field} must be a sha256 fingerprint or fingerprint object`)];
+}
+function pinned_artifact_ref_item_reasons(refItem, field, changeRoot, expected = {}) {
+    return shared_pinned_artifact_ref_reasons(changeRoot, refItem, field, {
+        kind: expected.kind,
+        role: expected.role,
+        taskId: expected.task_id,
+        chainId: expected.chain_id,
+    });
+}
 export function role_target_ref_reasons(ev, targetRoot) {
     return pinned_ref_reasons(ev, "target_refs", targetRoot, "stale_review");
 }
@@ -328,6 +393,26 @@ function test_run_reasons(ev, changeRoot) {
     if (typeof ev.result_summary !== "string" || !ev.result_summary.trim()) {
         problems.push(reason("test_run_summary_missing", `${ev._path}: test_run requires non-empty result_summary`));
     }
+    const runnerOrigin = ev.runner_origin;
+    const executorWorkerRun = ev.apply_execution_chain === "executor_worker";
+    if (runnerOrigin !== undefined && runnerOrigin !== "main-thread" && runnerOrigin !== "test-runner") {
+        problems.push(reason("test_run_runner_origin_invalid", `${ev._path}: runner_origin must be main-thread or test-runner`));
+    }
+    if (runnerOrigin === "test-runner" && (typeof ev.phase !== "string" || !ev.phase)) {
+        problems.push(reason("test_run_runner_origin_invalid", `${ev._path}: runner_origin=test-runner requires phase`));
+    }
+    if (runnerOrigin === "test-runner" && ev.gate === "task_complete" && ev.semantic_status === "expected_success" && !executorWorkerRun) {
+        problems.push(reason("test_run_runner_origin_invalid", `${ev._path}: test-runner GREEN evidence must belong to apply_execution_chain=executor_worker`));
+    }
+    if (executorWorkerRun && runnerOrigin !== "test-runner") {
+        problems.push(reason("test_run_runner_origin_invalid", `${ev._path}: apply_execution_chain=executor_worker requires runner_origin=test-runner`));
+    }
+    if (executorWorkerRun && (typeof ev.apply_worker_chain_id !== "string" || !ev.apply_worker_chain_id)) {
+        problems.push(reason("test_run_worker_ref_missing", `${ev._path}: apply_execution_chain=executor_worker requires apply_worker_chain_id`));
+    }
+    if (runnerOrigin === "test-runner" || executorWorkerRun) {
+        problems.push(...worker_test_run_reasons(changeRoot, ev, typeof ev.task_id === "string" ? ev.task_id : "", executorWorkerRun && typeof ev.apply_worker_chain_id === "string" ? ev.apply_worker_chain_id : null));
+    }
     if (logTexts.length > 0) {
         const claimed = [
             ...(typeof ev.test_id === "string" && ev.test_id.trim() ? [ev.test_id.trim()] : []),
@@ -339,6 +424,71 @@ function test_run_reasons(ev, changeRoot) {
             }
         }
     }
+    if (ev.semantic_status === "expected_failure" && typeof ev.test_id === "string" && ev.test_id.trim()) {
+        const expected = expected_failure_contract(changeRoot, ev.test_id.trim());
+        if (expected.signature) {
+            if (ev.expected_failure_signature !== expected.signature) {
+                problems.push(reason("test_run_wrong_failure_reason", `${ev._path}: RED evidence expected_failure_signature must match test contract for ${ev.test_id}`, [ev.test_id]));
+            }
+            if (!logTexts.some((text) => text.includes(String(expected.signature)))) {
+                problems.push(reason("test_run_wrong_failure_reason", `${ev._path}: RED raw_log_refs do not contain expected_failure_signature for ${ev.test_id}`, [ev.test_id]));
+            }
+        }
+        if (expected.classifier && ev.expected_failure_classifier !== expected.classifier) {
+            problems.push(reason("test_run_wrong_failure_reason", `${ev._path}: RED evidence expected_failure_classifier must match test contract for ${ev.test_id}`, [ev.test_id]));
+        }
+    }
+    return problems;
+}
+function apply_worker_chain_reasons(ev, changeRoot) {
+    const problems = [];
+    const state = String(ev.chain_state ?? "");
+    if (!["active", "closed", "abandoned"].includes(state)) {
+        problems.push(reason("apply_worker_chain_invalid", `${ev._path}: apply_worker_chain chain_state must be active, closed, or abandoned`));
+    }
+    for (const field of ["task_id", "apply_worker_chain_id"]) {
+        if (typeof ev[field] !== "string" || !ev[field])
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: apply_worker_chain requires ${field}`));
+    }
+    if (state === "active") {
+        problems.push(...fingerprint_field_reasons(ev, "executor_packet_fingerprint", "apply_worker_chain_invalid"));
+        problems.push(...fingerprint_field_reasons(ev, "source_implementation_fingerprint", "apply_worker_chain_invalid"));
+        problems.push(...string_list_field_reasons(ev, "declared_task_write_scope", "apply_worker_chain_invalid"));
+        problems.push(...string_list_field_reasons(ev, "pre_edit_evidence_refs", "apply_worker_chain_invalid"));
+    }
+    if (state === "closed") {
+        const taskId = typeof ev.task_id === "string" ? ev.task_id : undefined;
+        const chainId = typeof ev.apply_worker_chain_id === "string" ? ev.apply_worker_chain_id : undefined;
+        const refProblems = [
+            ...pinned_artifact_ref_item_reasons(ev.executor_report_ref, "executor_report_ref", changeRoot, { kind: "worker_report", role: "executor", task_id: taskId, chain_id: chainId }),
+            ...pinned_artifact_ref_item_reasons(ev.task_code_review_report_ref, "task_code_review_report_ref", changeRoot, { kind: "worker_report", role: "code-reviewer", task_id: taskId, chain_id: chainId }),
+            ...pinned_artifact_ref_item_reasons(ev.verifier_report_ref, "verifier_report_ref", changeRoot, { kind: "worker_report", role: "verifier", task_id: taskId, chain_id: chainId }),
+        ];
+        problems.push(...refProblems);
+        if (refProblems.length > 0)
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: closed apply_worker_chain report refs must be pinned same-chain worker reports`));
+        if (!isObject(ev.green_test_run_evidence_ref) && typeof ev.green_test_run_evidence_ref !== "string") {
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: closed apply_worker_chain requires green_test_run_evidence_ref`));
+        }
+        problems.push(...fingerprint_field_reasons(ev, "observed_freshness_fingerprint", "apply_worker_chain_invalid"));
+    }
+    if (state === "abandoned") {
+        const taskId = typeof ev.task_id === "string" ? ev.task_id : undefined;
+        const chainId = typeof ev.apply_worker_chain_id === "string" ? ev.apply_worker_chain_id : undefined;
+        if ("restored_implementation_fingerprint" in ev) {
+            problems.push(...fingerprint_field_reasons(ev, "restored_implementation_fingerprint", "apply_worker_chain_invalid"));
+        }
+        if (!("restored_implementation_fingerprint" in ev) && !("serial_takeover_baseline_ref" in ev)) {
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: abandoned apply_worker_chain requires restored_implementation_fingerprint or serial_takeover_baseline_ref`));
+        }
+        if ("serial_takeover_baseline_ref" in ev) {
+            const baselineProblems = pinned_artifact_ref_item_reasons(ev.serial_takeover_baseline_ref, "serial_takeover_baseline_ref", changeRoot, { kind: "status_report", role: "verifier", task_id: taskId, chain_id: chainId });
+            problems.push(...baselineProblems);
+            if (baselineProblems.length > 0)
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: abandoned apply_worker_chain serial_takeover_baseline_ref must be a pinned same-chain status_report`));
+            problems.push(...string_list_field_reasons(ev, "successor_green_evidence_refs", "apply_worker_chain_invalid"));
+        }
+    }
     return problems;
 }
 export function validate_evidence_schema(ev, change, changeRoot, repoRoot) {
@@ -359,6 +509,8 @@ export function validate_evidence_schema(ev, change, changeRoot, repoRoot) {
         problems.push(...human_confirmation_reasons(ev));
     if (ev.kind === "test_run")
         problems.push(...test_run_reasons(ev, changeRoot));
+    if (ev.kind === "apply_worker_chain")
+        problems.push(...apply_worker_chain_reasons(ev, changeRoot));
     // DISC Phase 1: disclosure evidence kinds and reviewer findings[] are schema-checked fail-closed.
     if (ev.kind === "main_review_digest")
         problems.push(...review_digest_schema_reasons(ev));

package/dist/src/gates.d.ts

@@ -10,6 +10,7 @@ export declare function check_artifact(change: string, status: JsonMap, changeRo
 export declare function check_task_reopen(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[], taskId: string): Decision;
 export declare function check_apply_ready(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[]): Decision;
 export declare function check_task_edit(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[], taskId: string): Decision;
+export declare function apply_worker_chain_lifecycle_reasons(repoRoot: string, changeRoot: string, evidences: JsonMap[], taskId: string): Reason[];
 export declare function check_task_complete(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[], taskId: string): Decision;
 export declare function check_review_ready(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[]): Decision;
 export declare function check_review_complete(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[]): Decision;

package/dist/src/gates.js

@@ -8,6 +8,8 @@ import { evidence_test_id_reasons, declared_test_evidence_reasons, parse_spec_sc
 import { duplicate_evidence_id_reasons, dangling_evidence_ref_reasons, final_verification_evidences, live_task_reopens, live_task_reopen_resolutions, live_pass, live_user_confirmations, pass_task_reopens, supersede_reasons, unresolved_live_task_reopens, validate_evidence_schema, verify_reference_reasons, } from "./evidence.js";
 import { review_disclosure_reasons } from "./disclosure.js";
 import { archive_manifest_path } from "./archive.js";
+import { fingerprint_matches, } from "./apply_worker_chain.js";
+import { apply_worker_chain_lifecycle_reasons as shared_apply_worker_chain_lifecycle_reasons, apply_worker_chain_lifecycle_state, serial_completion_green, } from "./apply_worker_chain_lifecycle.js";
 function action_list(...items) {
     return [...new Set(items.filter((item) => typeof item === "string" && item.length > 0))];
 }
@@ -1144,6 +1146,9 @@ export function check_task_edit(change, status, changeRoot, evidences, taskId) {
     }
     return allow(change, gate, { task_id: taskId });
 }
+export function apply_worker_chain_lifecycle_reasons(repoRoot, changeRoot, evidences, taskId) {
+    return shared_apply_worker_chain_lifecycle_reasons(repoRoot, changeRoot, evidences, taskId);
+}
 export function check_task_complete(change, status, changeRoot, evidences, taskId) {
     const gate = "task_complete";
     const reasons = [];
@@ -1158,6 +1163,8 @@ export function check_task_complete(change, status, changeRoot, evidences, taskI
     const task = parse_tasks(changeRoot)[taskId];
     if (!task)
         return block(change, gate, [reason("unknown_task", `task ${taskId} not found`)], { task_id: taskId });
+    const workerChainState = apply_worker_chain_lifecycle_state(get_repo_root(status), changeRoot, evidences, taskId);
+    reasons.push(...workerChainState.completionReasons);
     const reopenHistory = task_reopen_history(evidences, taskId);
     if (task.checked && reopenHistory.pass.length > 1) {
         reasons.push(reason("reopen_lifecycle_exhausted", `task ${taskId} has multiple task_reopen histories in this change; v1 allows at most one`, [taskId]));
@@ -1177,9 +1184,22 @@ export function check_task_complete(change, status, changeRoot, evidences, taskI
     if (!TDD_MODES.has(tddMode))
         reasons.push(reason("invalid_tdd_mode", `task ${taskId}: tdd_mode=${repr(tddMode)}`));
     if (tddRequired) {
-        const green = task_test_evidence(evidences, taskId, "expected_success", "task_complete");
+        const allGreen = task_test_evidence(evidences, taskId, "expected_success", "task_complete");
+        const green = workerChainState.validClosedGreenEvidenceIds.size > 0
+            ? allGreen.filter((ev) => (ev.apply_execution_chain === "executor_worker"
+                && workerChainState.validClosedChainIds.has(String(ev.apply_worker_chain_id ?? ""))
+                && workerChainState.validClosedGreenEvidenceIds.has(String(ev.evidence_id ?? ""))))
+            : workerChainState.takeoverBaselines.length > 0
+                ? allGreen.filter((ev) => serial_completion_green(ev) && workerChainState.takeoverBaselines.some((baseline) => (baseline.successorGreenRefs.includes(String(ev.evidence_id ?? ""))
+                    && fingerprint_matches(ev.implementation_fingerprint, baseline.fingerprint))))
+                : allGreen.filter(serial_completion_green);
         if (green.length === 0)
             reasons.push(reason("missing_green_evidence", `task ${taskId} requires GREEN evidence (expected_success) before completion`));
+        if (workerChainState.validClosedGreenEvidenceIds.size === 0 && workerChainState.takeoverBaselines.length > 0) {
+            if (green.length === 0) {
+                reasons.push(reason("apply_worker_chain_takeover_green_mismatch", `task ${taskId} requires declared successor serial GREEN evidence after takeover baseline with matching implementation fingerprint`));
+            }
+        }
         const declared = new Set(splitList(attrs.test_refs ?? ""));
         const declaredInvariants = new Set(splitList(attrs.invariant_refs ?? ""));
         if (declared.size === 0)

package/dist/src/install_engine.d.ts

@@ -16,6 +16,11 @@ export type ManifestFileEntry = {
     managed: boolean;
     preexisting: boolean;
 };
+export type ManifestConfigPatchEntry = {
+    path: string;
+    retainedOnUninstall: boolean;
+    managed: boolean;
+};
 export type EngineAction = {
     action: string;
     status: "ok" | "created" | "updated" | "skipped" | "removed" | "would_remove" | "failed";
@@ -27,6 +32,8 @@ export type EngineResult = {
     problems: string[];
     manifest: JsonMap | null;
 };
+export declare const CODEX_NATIVE_AGENT_MAX_THREADS = 12;
+export declare const CODEX_NATIVE_AGENT_MAX_DEPTH = 1;
 export declare function load_install_map(packageRoot?: string): {
     mappings: InstallMapping[];
     problems: string[];
@@ -39,6 +46,16 @@ export declare function read_install_manifest(repoRoot: string, opts?: {
     problems: string[];
 };
 export declare function install_manifest_rel(scope?: InstallScope): string;
+export declare function codex_config_rel(scope?: InstallScope): string;
+export declare function merge_codex_config(text: string, opts?: {
+    force?: boolean;
+}): string;
+export declare function ensure_codex_config(repoRoot: string, scope?: InstallScope, opts?: {
+    force?: boolean;
+}): {
+    action: EngineAction;
+    problems: string[];
+};
 export declare function install_workflow(repoRoot: string, opts?: {
     force?: boolean;
     packageRoot?: string;

package/dist/src/install_engine.js

@@ -21,6 +21,14 @@ export const PACKAGE_ROOT = find_package_root(import.meta.url);
 export const PROJECT_INSTALL_MANIFEST_REL = join(".codex", "superspec", "install-manifest.json");
 export const USER_INSTALL_MANIFEST_REL = join("superspec", "install-manifest.json");
 export const INSTALL_MANIFEST_REL = PROJECT_INSTALL_MANIFEST_REL;
+export const CODEX_NATIVE_AGENT_MAX_THREADS = 12;
+export const CODEX_NATIVE_AGENT_MAX_DEPTH = 1;
+const CODEX_CONFIG_ENTRIES = [
+    { table: "features", key: "multi_agent", value: "true" },
+    { table: "features", key: "child_agents_md", value: "true" },
+    { table: "agents", key: "max_threads", value: String(CODEX_NATIVE_AGENT_MAX_THREADS) },
+    { table: "agents", key: "max_depth", value: String(CODEX_NATIVE_AGENT_MAX_DEPTH) },
+];
 function package_version(packageRoot) {
     try {
         const pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
@@ -78,6 +86,15 @@ export function manifest_shape_problems(manifest) {
         problems.push("createdDirs malformed");
     if (!Array.isArray(manifest.dataGlobs) || manifest.dataGlobs.some((item) => typeof item !== "string" || !item))
         problems.push("dataGlobs malformed");
+    if (manifest.configPatch !== undefined) {
+        if (!isObject(manifest.configPatch)
+            || typeof manifest.configPatch.path !== "string"
+            || !manifest.configPatch.path
+            || manifest.configPatch.retainedOnUninstall !== true
+            || manifest.configPatch.managed !== false) {
+            problems.push("configPatch malformed");
+        }
+    }
     if (!Array.isArray(manifest.files)) {
         problems.push("files missing");
     }
@@ -128,6 +145,101 @@ function scoped_mappings(mappings, scope) {
         return scoped === null ? [] : [scoped];
     });
 }
+export function codex_config_rel(scope = "project") {
+    return scope === "user" ? "config.toml" : join(".codex", "config.toml");
+}
+function table_header_name(line) {
+    const match = /^\s*\[([A-Za-z0-9_.-]+)\]\s*(?:#.*)?$/u.exec(line);
+    return match?.[1] ?? null;
+}
+function is_any_table_header(line) {
+    return /^\s*\[[^\]]+\]\s*(?:#.*)?$/u.test(line);
+}
+function escape_regexp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function split_toml_lines(text) {
+    if (!text)
+        return [];
+    const lines = text.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
+    if (lines[lines.length - 1] === "")
+        lines.pop();
+    return lines;
+}
+function ensure_toml_key(lines, table, key, value, overwriteExisting) {
+    let start = -1;
+    let end = lines.length;
+    for (let idx = 0; idx < lines.length; idx += 1) {
+        if (table_header_name(lines[idx]) !== table)
+            continue;
+        start = idx;
+        end = lines.length;
+        for (let next = idx + 1; next < lines.length; next += 1) {
+            if (!is_any_table_header(lines[next]))
+                continue;
+            end = next;
+            break;
+        }
+        break;
+    }
+    if (start === -1) {
+        if (lines.length > 0 && lines[lines.length - 1].trim() !== "")
+            lines.push("");
+        lines.push(`[${table}]`, `${key} = ${value}`);
+        return true;
+    }
+    const keyRe = new RegExp(`^\\s*${escape_regexp(key)}\\s*=`, "u");
+    const desired = `${key} = ${value}`;
+    for (let idx = start + 1; idx < end; idx += 1) {
+        if (!keyRe.test(lines[idx]))
+            continue;
+        if (lines[idx] === desired)
+            return false;
+        if (!overwriteExisting)
+            return false;
+        lines[idx] = desired;
+        return true;
+    }
+    let insertAt = end;
+    while (insertAt > start + 1 && lines[insertAt - 1].trim() === "")
+        insertAt -= 1;
+    lines.splice(insertAt, 0, desired);
+    return true;
+}
+export function merge_codex_config(text, opts = {}) {
+    const lines = split_toml_lines(text);
+    for (const entry of CODEX_CONFIG_ENTRIES) {
+        ensure_toml_key(lines, entry.table, entry.key, entry.value, opts.force === true);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function ensure_codex_config(repoRoot, scope = "project", opts = {}) {
+    const rel = codex_config_rel(scope);
+    const configPath = join(repoRoot, rel);
+    const existed = existsSync(configPath);
+    try {
+        const before = existed ? readFileSync(configPath, "utf8") : "";
+        const after = merge_codex_config(before, opts);
+        if (after === before)
+            return { action: { action: `configure ${rel}`, status: "ok" }, problems: [] };
+        mkdirSync(dirname(configPath), { recursive: true });
+        writeFileSync(configPath, after, "utf8");
+        return {
+            action: {
+                action: `configure ${rel}`,
+                status: existed ? "updated" : "created",
+                detail: `Codex native subagent concurrency set to ${CODEX_NATIVE_AGENT_MAX_THREADS}`,
+            },
+            problems: [],
+        };
+    }
+    catch (err) {
+        return {
+            action: { action: `configure ${rel}`, status: "failed" },
+            problems: [`Codex config update failed: ${err.message}`],
+        };
+    }
+}
 function write_install_manifest(repoRoot, packageRoot, files, createdDirs, scope) {
     const manifest = {
         superspecVersion: package_version(packageRoot),
@@ -138,6 +250,11 @@ function write_install_manifest(repoRoot, packageRoot, files, createdDirs, scope
         files,
         createdDirs: [...new Set(createdDirs)].sort(),
         dataGlobs: ["**/.superspec"],
+        configPatch: {
+            path: codex_config_rel(scope),
+            retainedOnUninstall: true,
+            managed: false,
+        },
     };
     const manifestPath = join(repoRoot, install_manifest_rel(scope));
     mkdirSync(dirname(manifestPath), { recursive: true });
@@ -212,8 +329,11 @@ export function install_workflow(repoRoot, opts = {}) {
             actions.push({ action: `install ${mapping.target}`, status: "skipped", detail: "pre-existing file with different content kept; rerun with --force to overwrite (backs up *.bak)" });
         }
     }
+    const configResult = ensure_codex_config(repoRoot, scope, { force: opts.force === true });
+    actions.push(configResult.action);
+    problems.push(...configResult.problems);
     const manifest = write_install_manifest(repoRoot, packageRoot, files, createdDirs, scope);
-    return { actions, problems: [], manifest };
+    return { actions, problems, manifest };
 }
 export function update_workflow(repoRoot, opts = {}) {
     const packageRoot = opts.packageRoot ?? PACKAGE_ROOT;
@@ -287,8 +407,11 @@ export function update_workflow(repoRoot, opts = {}) {
             actions.push({ action: `update ${prev.path}`, status: "skipped", detail: "no longer shipped but user-modified; kept" });
         }
     }
+    const configResult = ensure_codex_config(repoRoot, scope);
+    actions.push(configResult.action);
+    problems.push(...configResult.problems);
     const manifest = write_install_manifest(repoRoot, packageRoot, files, createdDirs, scope);
-    return { actions, problems: [], manifest };
+    return { actions, problems, manifest };
 }
 function remove_empty_created_dirs(repoRoot, createdDirs, actions) {
     const byDepth = [...new Set(createdDirs)].sort((a, b) => b.split("/").length - a.split("/").length);

package/dist/src/packet_measure.js

@@ -49,9 +49,11 @@ const REPRESENTATIVE_SCENARIOS = [
     },
     {
         name: "apply_ready",
-        description: "Post-bridge runtime surface for apply orchestration before task execution.",
+        description: "Post-bridge runtime surface for apply orchestration and bounded executor handoff.",
         files: [
             ".codex/skills/superspec-apply/SKILL.md",
+            ".codex/prompts/executor.md",
+            ".codex/agents/executor.toml",
         ],
     },
     {
@@ -99,9 +101,11 @@ const REPRESENTATIVE_SCENARIOS = [
     },
     {
         name: "task_reopen_to_resolved",
-        description: "Post-bridge runtime surface for reopened apply work from revert through successor completion.",
+        description: "Post-bridge runtime surface for reopened apply work from revert through successor executor completion.",
         files: [
             ".codex/skills/superspec-apply/SKILL.md",
+            ".codex/prompts/executor.md",
+            ".codex/agents/executor.toml",
         ],
     },
     {
@@ -159,10 +163,28 @@ const LEDGER_BLOCK_SAMPLES = [
 ];
 function ensureReadableTextFile(repoRoot, relPath) {
     const absPath = join(repoRoot, relPath);
-    if (!existsSync(absPath) || !statSync(absPath).isFile()) {
-        throw new GuardError(`packet_measure_missing_file: ${relPath}`);
+    if (existsSync(absPath) && statSync(absPath).isFile()) {
+        return readFileSync(absPath, "utf8");
     }
-    return readFileSync(absPath, "utf8");
+    const skillMatch = /^\.codex\/skills\/([^/]+)\/SKILL\.md$/u.exec(relPath);
+    if (skillMatch) {
+        const fallback = join(repoRoot, "templates", "workflow", "skills", skillMatch[1], "SKILL.md");
+        if (existsSync(fallback) && statSync(fallback).isFile())
+            return readFileSync(fallback, "utf8");
+    }
+    const promptMatch = /^\.codex\/prompts\/([^/]+)\.md$/u.exec(relPath);
+    if (promptMatch) {
+        const fallback = join(repoRoot, "templates", "workflow", "prompts", `${promptMatch[1]}.md`);
+        if (existsSync(fallback) && statSync(fallback).isFile())
+            return readFileSync(fallback, "utf8");
+    }
+    const agentMatch = /^\.codex\/agents\/([^/]+)\.toml$/u.exec(relPath);
+    if (agentMatch) {
+        const fallback = join(repoRoot, "adapters", "codex", "agents", `${agentMatch[1]}.toml`);
+        if (existsSync(fallback) && statSync(fallback).isFile())
+            return readFileSync(fallback, "utf8");
+    }
+    throw new GuardError(`packet_measure_missing_file: ${relPath}`);
 }
 function dedupePaths(paths) {
     return [...new Set(paths)].sort();