@zalom/plastic 1.4.0 → 1.4.1

package/scripts/doctor.rb

@@ -1268,12 +1268,35 @@ class Doctor
       end
     end
 
-    checks << codex_hooks_registered_check(config)
+    hooks_check = codex_hooks_registered_check(config)
+    checks << hooks_check
+    checks << codex_hooks_implemented_check(config)
+    checks << codex_hook_trust_advisory_check if hooks_check[:status] == "pass"
     codex_config_toml_advisory_check(config).tap { |c| checks << c if c }
 
     checks
   end
 
+  # Hooks being REGISTERED (hooks.json content matches HookRegistry) is not
+  # the same as hooks being TRUSTED: Codex gates every non-managed hook
+  # command behind a human /hooks review, keyed by the command's current
+  # hash, so a release that changes a hook command re-arms the review
+  # (intent 198, Decision D2). Whether Codex persists a queryable trust
+  # record anywhere under ~/.codex is undocumented and unverified, so this
+  # can never be a real pass or fail on trust state; it is an advisory that
+  # always names the /hooks step, and it fires only once hooks are actually
+  # registered (an unregistered hook is already reported by
+  # codex_hooks_registered_check, so reminding about trust on top of that
+  # would be noise, not signal).
+  def codex_hook_trust_advisory_check
+    check(
+      category: "agent_registration", name: "codex_hooks_trust", status: "warn",
+      message: "Open Codex, run /hooks, and trust the Plastic hook definitions. " \
+               "Codex re-arms this review whenever a hook's command changes.",
+      fixable: false
+    )
+  end
+
   # Codex-specific agent presence + structural sanity: ~/.codex/agents/plastic-*.toml
   # exist and each carries the mandatory fields. No TOML parser (doctor depends on none):
   # "structural" means the mandatory keys appear as lines and the multi-line
@@ -1315,6 +1338,15 @@ class Doctor
     has_name && has_desc && !di.nil? && !balanced.nil?
   end
 
+  # Plain string extraction of the single model-selection line a generated
+  # Codex agent TOML carries (model_reasoning_effort for a tier alias, model
+  # for a literal override id; codex_model_fields never emits both). No TOML
+  # parser dependency, mirroring codex_agent_toml_well_formed? above.
+  def codex_agent_toml_model_value(content)
+    m = content.match(/^model_reasoning_effort\s*=\s*"([^"]*)"/) || content.match(/^model\s*=\s*"([^"]*)"/)
+    m && m[1]
+  end
+
   # codex_hooks_registered (intent 102, the owner-facing first-run validation
   # path, Decision 14): ~/.codex/hooks.json must carry EXACTLY the commands
   # HookRegistry.codex_hooks_json defines, mirroring the Claude
@@ -1356,6 +1388,124 @@ class Doctor
     end
   end
 
+  # codex_hooks_implemented (intent 200): codex_hooks_registered_check above proves
+  # hooks.json content matches what HookRegistry would emit; both sides of THAT
+  # comparison come from the registry, so a pass only proves the registry agrees
+  # with itself. It never looks at the actual dispatcher, so it cannot see a
+  # registered gate with no real branch there (links-gate shipped exactly this way,
+  # dead, in v1.4.0/intent 192, invisible to doctor and the suite until 198 found it
+  # by hand), or a dispatcher branch nobody registers (bash-gate's shape, intent
+  # 203, in the opposite direction). This check closes both directions at once.
+
+  # The Codex gate names HookRegistry actually registers: the six apply_patch-gated
+  # names (CODEX_PRE_HOOKS + CODEX_POST_HOOKS), the two Bash-matcher shell gates
+  # (CODEX_BASH_HOOKS), and the live-state hook names Codex inherits whole from
+  # `events` (CODEX_LIVE_STATE_EVENTS). No parsing needed: these are HookRegistry's
+  # own Ruby constants.
+  def codex_registry_gate_names
+    live_state = HookRegistry::CODEX_LIVE_STATE_EVENTS.flat_map do |event|
+      HookRegistry.events[event].flat_map { |g| g["hooks"].map { |h| h["name"] } }
+    end
+    (HookRegistry::CODEX_PRE_HOOKS + HookRegistry::CODEX_POST_HOOKS +
+     HookRegistry::CODEX_BASH_HOOKS + live_state).uniq
+  end
+
+  # Source-text extraction of scripts/codex-hook's supported gate names (D3): the
+  # dispatcher is an executable script with real top-level side effects (it reads
+  # $stdin and may exit), so it can never be required or executed to introspect it,
+  # only read as plain text, mirroring codex_agent_toml_well_formed? above. Pulls
+  # gate names from the STATE_HOOKS and SHELL_HOOKS %w[] literals, plus the `when
+  # "<name>"` labels of the top-level `case gate` statement (stopping at its
+  # trailing `else`). Line-shape dependent, not AST-safe, disclosed as such in
+  # docs; the healthy-install pass test against the REAL dispatcher is what proves
+  # this shape still holds.
+  #
+  # SELF-CHECKING: returns nil, never [], when nothing recognizable is found. A
+  # reshaped dispatcher (combined `when "a", "b"` arms, a multi-line array, a
+  # Hash-dispatch rewrite) would otherwise silently read as zero gate names, and a
+  # zero-gate dispatcher would make the diff below either flag every registered
+  # hook as "missing" or, worse, quietly under-report a real gap. A check that
+  # finds nothing and calls that healthy IS the exact disease this whole check
+  # exists to catch, one level up, so nil forces the caller (below) to fail loudly
+  # instead of reporting health it never actually verified.
+  def codex_dispatcher_gate_names(source)
+    names = []
+    %w[STATE_HOOKS SHELL_HOOKS].each do |const|
+      m = source.match(/^#{const}\s*=\s*%w\[([^\]]*)\]/)
+      names.concat(m[1].split(/\s+/)) if m
+    end
+
+    case_start = source.index(/^case gate\b/)
+    if case_start
+      case_body = source[case_start..-1]
+      else_idx = case_body.index(/^else\b/)
+      scanned = else_idx ? case_body[0...else_idx] : case_body
+      names.concat(scanned.scan(/^when\s+"([^"]+)"/).flatten)
+    end
+
+    names.uniq!
+    names.empty? ? nil : names
+  end
+
+  # The both-direction diff. Each mismatch becomes one detail line naming the
+  # hook, the direction, the harness ("Codex"), and the concrete runtime effect,
+  # never a generic "Codex hooks drift" message (D4).
+  def codex_hooks_implemented_check(config)
+    dispatcher_path = File.join(plastic_home, "scripts", "codex-hook")
+
+    unless File.exist?(dispatcher_path)
+      return check(
+        category: "agent_registration", name: "codex_hooks_implemented", status: "fail",
+        message: "scripts/codex-hook not found at #{tilde(dispatcher_path)}; cannot verify " \
+                 "the Codex hook registry and dispatcher agree",
+        fixable: true, fix_hint: "Re-run the Plastic installer with --codex"
+      )
+    end
+
+    dispatcher_names = codex_dispatcher_gate_names(File.read(dispatcher_path))
+
+    if dispatcher_names.nil?
+      return check(
+        category: "agent_registration", name: "codex_hooks_implemented", status: "fail",
+        message: "Could not read any gate names out of #{tilde(dispatcher_path)}: the " \
+                 "STATE_HOOKS/SHELL_HOOKS constants and the `case gate` statement no longer " \
+                 "match the shape this check expects, so the registry could not be checked " \
+                 "against the real dispatcher. This is exactly the silent-pass failure this " \
+                 "check exists to prevent; update codex_dispatcher_gate_names in doctor.rb " \
+                 "to the file's new shape.",
+        fixable: false
+      )
+    end
+
+    registry_names = codex_registry_gate_names
+    missing_dispatcher_branch = registry_names - dispatcher_names
+    dead_branch = dispatcher_names - registry_names
+
+    if missing_dispatcher_branch.empty? && dead_branch.empty?
+      return check(
+        category: "agent_registration", name: "codex_hooks_implemented", status: "pass",
+        message: "Every Codex-registered gate has a scripts/codex-hook branch, and every " \
+                 "dispatcher branch is registered"
+      )
+    end
+
+    details = missing_dispatcher_branch.map do |name|
+      "#{name} is registered in ~/.codex/hooks.json but scripts/codex-hook has no branch " \
+        "for it, so it always falls through to the fail-open else and always allows the write"
+    end
+    details += dead_branch.map do |name|
+      "#{name} has a branch in scripts/codex-hook but is not registered in HookRegistry for " \
+        "Codex, so it is dead code Codex never reaches"
+    end
+
+    check(
+      category: "agent_registration", name: "codex_hooks_implemented", status: "fail",
+      message: "Codex's hook registry and scripts/codex-hook disagree on #{details.size} gate(s)",
+      details: details,
+      fixable: false
+    )
+  end
+
   # config.toml advisory (intent 102, Decision 2, R2): READ ONLY. Warns on the two
   # documented footguns (hooks disabled, sandbox read-only); never writes, and
   # returns nil (no check emitted) when config.toml is absent or carries neither.
@@ -1547,6 +1697,8 @@ class Doctor
     agent_config = agents[agent_key]
     return [] unless agent_config
 
+    return check_agent_model_drift_codex(agent_config) if agent_key == "codex"
+
     agents_dir = File.join(agent_config[:dir], "agents")
     installed = Dir.glob(File.join(agents_dir, "plastic-*.md")).sort
 
@@ -1608,6 +1760,83 @@ class Doctor
     end
   end
 
+  # Codex leg of agent_model_drift (intent 198, Decision D4): the shared .md
+  # path above is structurally blind on Codex (codex agents are TOML under
+  # ~/.codex/agents/, never ~/.agents/agents/*.md), so it always passed on an
+  # empty glob without opening a single Codex file. This mirrors the same
+  # four buckets (sanctioned override, matches default, drifted,
+  # unclassified) against ~/.codex/agents/plastic-*.toml instead, reading
+  # model / model_reasoning_effort with the same plain string matching
+  # codex_agent_toml_well_formed? already uses (no TOML parser dependency).
+  # The expected value resolves through AgentModels::TIER_DEFAULTS mapped
+  # through AgentModels.effort_for, honoring the Codex-scoped
+  # agents.models.codex.<name> override precedence install_codex's own
+  # agent_model_overrides(harness: "codex") already applies.
+  # AgentModels::CONSULTATION_AGENTS need no special-case bucket here:
+  # generate_codex_agents already skips writing them for Codex entirely, so
+  # the glob below never finds them and there is nothing to classify.
+  def check_agent_model_drift_codex(agent_config)
+    agents_dir = File.join(agent_config[:home_dir], "agents")
+    installed = Dir.glob(File.join(agents_dir, "plastic-*.toml")).sort
+
+    if installed.empty?
+      return [check(
+        category: "core_files", name: "agent_model_drift", status: "pass",
+        message: "No installed plastic-* agent TOML files to check for model drift"
+      )]
+    end
+
+    global_config = load_yaml_safe(File.join(plastic_home, "config.yml")) || {}
+    overrides = AgentModels.override_map(project_config: {}, global_config: global_config, harness: "codex")
+
+    drifted = []
+    sanctioned = []
+    unclassified = []
+
+    installed.each do |path|
+      basename = File.basename(path, ".toml")
+      installed_value = codex_agent_toml_model_value(File.read(path))
+      override = overrides[basename]
+
+      if override
+        sanctioned << "#{basename}: toml=#{installed_value.inspect}, sanctioned override=#{override.inspect}"
+      elsif AgentModels::TIER_DEFAULTS.key?(basename)
+        expected_effort = AgentModels.effort_for(AgentModels::TIER_DEFAULTS[basename])
+        if installed_value != expected_effort
+          drifted << "#{basename}: toml=#{installed_value.inspect}, resolved default effort=#{expected_effort.inspect}"
+        end
+      else
+        unclassified << "#{basename}: toml=#{installed_value.inspect}, no resolved default (basename is in " \
+                         "neither AgentModels::TIER_DEFAULTS nor AgentModels::CONSULTATION_AGENTS in " \
+                         "scripts/lib/agent_models.rb; add it there, or set agents.models.codex.#{basename} " \
+                         "to sanction a model explicitly)"
+      end
+    end
+
+    if drifted.empty? && unclassified.empty?
+      message = if sanctioned.empty?
+                  "No agent-model drift (#{installed.size} installed Codex agent TOML(s) match the resolved default)"
+                else
+                  "No unsanctioned Codex agent-model drift; #{sanctioned.size} sanctioned override(s) in effect"
+                end
+      [check(
+        category: "core_files", name: "agent_model_drift", status: "pass",
+        message: message,
+        details: sanctioned
+      )]
+    else
+      parts = []
+      parts << "#{drifted.size} installed Codex agent TOML(s) have unsanctioned model drift vs the config-resolved default" if drifted.any?
+      parts << "#{unclassified.size} installed Codex agent TOML(s) have no resolved default in scripts/lib/agent_models.rb" if unclassified.any?
+      [check(
+        category: "core_files", name: "agent_model_drift", status: "warn",
+        message: parts.join("; "),
+        details: drifted + unclassified + sanctioned,
+        fixable: false
+      )]
+    end
+  end
+
   # --- Check category: manifest sync (binary core integrity) ---
 
   # Verify, for BOTH the global manifest and the agent-side manifest, that every

package/scripts/hook-lock-gate

@@ -2,7 +2,7 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 #
-# Usage: hook-lock-gate <file_path> [session_id]
+# Usage: hook-lock-gate <file_path> [session_id] [harness]
 # Fail-CLOSED PreToolUse gate (intent 96). Blocks a mutating write to an active
 # intent's lifecycle dir when THIS session holds no live lock. Project code is NOT
 # gated here (D2). Emits the PreToolUse JSON deny contract at exit 0; reserves
@@ -16,9 +16,14 @@ begin
   file_path = ARGV[0]
   exit 0 unless file_path && !file_path.empty?
   session = (ARGV[1] unless ARGV[1].to_s.empty?) || ENV["CLAUDE_CODE_SESSION_ID"]
+  # Usage: hook-lock-gate <file_path> [session_id] [harness]. Claude's own bash
+  # shim never passes a third arg, so harness falls through to Lock's default
+  # (claude, slash form); scripts/codex-hook is the only caller that passes
+  # "codex" here (intent 201 D2).
+  harness = (ARGV[2] unless ARGV[2].to_s.empty?) || "claude"
 
   bridge_data = Bridge.discover_bridge(session: session, cwd: Dir.pwd)   # nil = no bridge cache
-  reason = Bridge.lock_gate_decision(bridge_data, file_path, session: session)
+  reason = Bridge.lock_gate_decision(bridge_data, file_path, session: session, harness: harness)
   unless reason
     # Allow path: refresh the lease for the session that holds this target's
     # lock (owner or delegate). Best-effort, never blocks.
@@ -37,7 +42,7 @@ begin
       dir = Bridge.intent_dir_for(file_path)
       artifact = File.basename(file_path) if dir
       if dir && artifact
-        claim_reason = Claim.claim_gate_reason(dir, artifact, session: session)
+        claim_reason = Claim.claim_gate_reason(dir, artifact, session: session, harness: harness)
         if claim_reason
           print JSON.generate(
             "hookSpecificOutput" => {

package/scripts/install.rb

@@ -40,10 +40,26 @@ class Install < InstallerCore
     puts "\n\u{1f9e0} Plastic v#{version}\n\n"
 
     if installed? && !reinstall
-      warn "Plastic v#{installed_version} is already installed."
-      warn "  - To upgrade:        npx @zalom/plastic update"
-      warn "  - To re-sync files:  npx @zalom/plastic install --reinstall"
-      return 1
+      # `installed?` is a GLOBAL check (is Plastic core installed for ANY
+      # harness), so it cannot by itself decide whether to refuse: once any
+      # agent is present, a machine that has NEVER installed a second harness
+      # (e.g. Codex, with no ~/.agents, no ~/.codex/hooks.json) must still be
+      # able to add it. Refuse only when EVERY selected agent already has its
+      # own registration (intent 198, D7); otherwise proceed with just the
+      # unregistered ones, and report the already-registered ones without
+      # silently re-syncing them (that is what --reinstall is for).
+      new_agents = selected.reject { |key| agent_installed?(key) }
+      if new_agents.empty?
+        warn "Plastic v#{installed_version} is already installed."
+        warn "  - To upgrade:        npx @zalom/plastic update"
+        warn "  - To re-sync files:  npx @zalom/plastic install --reinstall"
+        return 1
+      end
+
+      already_registered = selected - new_agents
+      run(selected: new_agents, force: force, reinstall: reinstall, ledger_action: ledger_action, argv: argv,
+          already_registered: already_registered)
+      return 0
     end
 
     run(selected: selected, force: force, reinstall: reinstall, ledger_action: ledger_action, argv: argv)
@@ -51,7 +67,11 @@ class Install < InstallerCore
   end
 
   # Hermetic entrypoint (no prompting / no exit). Returns the per-agent results array.
-  def run(selected:, force: false, reinstall: false, ledger_action: nil, argv: ARGV, input: $stdin)
+  # `already_registered` names agents the gate above found already registered:
+  # they are reported, never re-installed, so the summary line and the Codex
+  # trust reminder only ever count agents that actually changed this run.
+  def run(selected:, force: false, reinstall: false, ledger_action: nil, argv: ARGV, input: $stdin,
+          already_registered: [])
     fresh = !installed?
     mode = fresh ? :install : :update # :update here means "re-sync, skip bootstrap"
 
@@ -60,6 +80,7 @@ class Install < InstallerCore
     apply_config_flags(argv)
 
     results = selected.map { |key| install_for_agent(key, force, argv: argv, input: input, reinstall: reinstall) }
+    results += already_registered.map { |key| already_registered_result(key) }
 
     action = ledger_action || (fresh ? "install" : "reinstall")
     ledger_append(version, action)
@@ -114,10 +135,17 @@ class Install < InstallerCore
     argv[i + 1]
   end
 
+  def already_registered_result(key)
+    config = agent_config(key)
+    { agent: config[:name], success: false, already_registered: true }
+  end
+
   def print_results(results, mode)
     puts "\n\u{2014} Results \u{2014}\n\n"
     results.each do |r|
-      if r[:success]
+      if r[:already_registered]
+        puts "  \u{2139}  #{r[:agent]}: already registered, not re-synced (use --reinstall to re-sync)"
+      elsif r[:success]
         puts "  \u{2705} #{r[:agent]}: #{r[:files]} files installed"
       else
         puts "  \u{26a0}\u{fe0f}  #{r[:agent]}: #{r[:reason]}"
@@ -132,6 +160,23 @@ class Install < InstallerCore
     puts "   Registered for: #{installed.map { |r| r[:agent] }.join(", ")}"
     puts "   Run /clear (or restart your agent) to pick up new conventions."
     puts "   Next: read docs/guides/your-first-intent-in-10-minutes.md\n\n"
+
+    print_codex_hook_trust_reminder(installed)
+  end
+
+  # Codex hooks are installed but INERT until a human reviews and trusts each
+  # hook definition via /hooks (intent 198, Decision D2); Codex keys trust to
+  # the hook's current command hash, so a future release that changes a hook
+  # command re-arms the review. Printed only when a harness that declares its
+  # own home_dir (Codex today) actually installed successfully in this run.
+  # Data-driven from `agents`, never a hardcoded harness name, mirroring the
+  # same reasoning as the D1 presence-probe fix.
+  def print_codex_hook_trust_reminder(installed)
+    codex_like = agents.select { |a| a.key?(:home_dir) }
+    return if codex_like.none? { |a| installed.any? { |r| r[:agent] == a[:name] } }
+
+    puts "   Codex: open Codex, run /hooks, and trust the Plastic hook definitions."
+    puts "   Plastic's gates will not fire until you do.\n\n"
   end
 
   def show_help

package/scripts/lib/bridge.rb

@@ -21,6 +21,16 @@ module Bridge
   # (<id>--<slug>.md) is never sentineled; it is born complete.
   PLACEHOLDER_SENTINEL = "<!-- plastic:placeholder -->"
 
+  # Single place a skill-reference string gets built (intent 201, D3): every
+  # message that used to write "/plastic-something" by hand calls this
+  # instead, so a fourth harness only teaches ITS prefix once instead of
+  # hunting the codebase for hardcoded slashes. The actual prefix table lives
+  # on Lock (see lock.rb), which bridge.rb already requires; this is a thin
+  # delegator so every call site in this file reads Bridge.skill_ref.
+  def self.skill_ref(name, harness: :claude)
+    Lock.skill_ref(name, harness: harness)
+  end
+
   # Bridge cleanup is terminal-state, not age-based (intent 80). A bridge is dead
   # weight ONLY once its intent is terminal (no longer in its store's INDEX.md
   # `## Active` block); such bridges are purged. An Active intent's bridge is kept
@@ -87,6 +97,12 @@ module Bridge
       "host" => lock_data["host"],
       "type" => lock_data["type"],
       "delegates" => Array(lock_data["delegates"]),
+      "owner_harness" => lock_data["owner_harness"],
+      "owner_agent" => lock_data["owner_agent"],
+      "owner_model" => lock_data["owner_model"],
+      "owner_thread" => lock_data["owner_thread"],
+      "run_mode" => lock_data["run_mode"],
+      "delegate_activity" => Array(lock_data["delegate_activity"]),
     }
   end
 
@@ -872,7 +888,8 @@ module Bridge
   # and arm_guided (auto: false) are thin delegators so the lock-stamp + provision
   # behaviour stays identical across both modes. Works even when no bridge exists
   # yet (mid-session intent creation).
-  def self.arm(session, intent_id:, intent_dir:, store:, name:, auto:)
+  def self.arm(session, intent_id:, intent_dir:, store:, name:, auto:, harness: nil,
+               agent: nil, model: nil, thread: nil)
     key = resolve_session(session, intent_id: intent_id, store: store)
     if blank?(session) && blank?(ENV["CLAUDE_CODE_SESSION_ID"])
       $stderr.puts "plastic: no session id available; arming with derived bridge key #{key}"
@@ -883,24 +900,29 @@ module Bridge
     # Acquire the durable delivery lock (D1/D2): session-keyed, O_EXCL, in the
     # intent dir. The bridge lock block is a cache of the file.
     intent_dir_abs = File.expand_path(intent_dir)
-    status, lock_data = Lock.acquire(intent_dir_abs, session: key)
+    status, lock_data = Lock.acquire(intent_dir_abs, session: key,
+                                     harness: harness, agent: agent,
+                                     model: model, thread: thread,
+                                     run_mode: auto ? "auto" : "guided")
     case status
     when :acquired, :owned
       data["lock"] = lock_cache(lock_data)
     when :held
       raise LockHeldError, "delivery lock for intent #{intent_id} is held by " \
-        "session #{lock_data && lock_data['owner_session']}; run /plastic-doctor " \
-        "check the lock status"
+        "session #{lock_data && lock_data['owner_session']}; run " \
+        "#{skill_ref('plastic-doctor', harness: harness)} check the lock status"
     when :stale
       raise LockHeldError, "delivery lock for intent #{intent_id} is stale " \
-        "(owner #{lock_data && lock_data['owner_session']}); run /plastic-doctor " \
-        "reclaim the lock to take it over with an audit"
+        "(owner #{lock_data && lock_data['owner_session']}); run " \
+        "#{skill_ref('plastic-doctor', harness: harness)} reclaim the lock to take it " \
+        "over with an audit"
     when :excluded
       raise LockHeldError, "a #{lock_data && lock_data['type']} lock is active on " \
-        "intent #{intent_id}; run /plastic-doctor check the lock status"
+        "intent #{intent_id}; run #{skill_ref('plastic-doctor', harness: harness)} check " \
+        "the lock status"
     when :corrupt
       raise LockHeldError, "delivery.lock for intent #{intent_id} is unreadable; " \
-        "run /plastic-doctor fix the lock"
+        "run #{skill_ref('plastic-doctor', harness: harness)} fix the lock"
     end
 
     # Provision the per-intent worktrees (mandatory code worktree for project
@@ -920,15 +942,19 @@ module Bridge
 
   # Arm auto mode for a session+intent. Works even when no bridge exists yet
   # (mid-session intent creation). Re-derives intent state, then sets build.auto.
-  def self.arm_auto(session, intent_id:, intent_dir:, store:, name:)
-    arm(session, intent_id: intent_id, intent_dir: intent_dir, store: store, name: name, auto: true)
+  def self.arm_auto(session, intent_id:, intent_dir:, store:, name:, harness: nil,
+                    agent: nil, model: nil, thread: nil)
+    arm(session, intent_id: intent_id, intent_dir: intent_dir, store: store, name: name,
+        auto: true, harness: harness, agent: agent, model: model, thread: thread)
   end
 
   # Acquire the delivery lock WITHOUT auto mode (intent 96 / Start guided branch).
   # Mirrors arm_auto's lock-stamp + worktree provision but leaves build.auto = false.
   # Same signature as arm_auto; disarm_auto (mode-agnostic) releases a guided lock.
-  def self.arm_guided(session, intent_id:, intent_dir:, store:, name:)
-    arm(session, intent_id: intent_id, intent_dir: intent_dir, store: store, name: name, auto: false)
+  def self.arm_guided(session, intent_id:, intent_dir:, store:, name:, harness: nil,
+                      agent: nil, model: nil, thread: nil)
+    arm(session, intent_id: intent_id, intent_dir: intent_dir, store: store, name: name,
+        auto: false, harness: harness, agent: agent, model: model, thread: thread)
   end
 
   # Degrade path for disarm_auto when no intent_id is given (intent 131): the
@@ -992,10 +1018,20 @@ module Bridge
   # reclaim verb (Lock.takeover). Two entry points call this: the
   # plastic-lock CLI and /plastic-intent-starting (self-healing boarding).
   def self.repair_lock(session, intent_id:, intent_dir:, store:, name:,
-                       now: Time.now, tmp: tmp_dir)
+                       now: Time.now, tmp: tmp_dir, harness: nil,
+                       agent: nil, model: nil, thread: nil, run_mode: nil,
+                       hint_harness: nil)
     key = resolve_session(session, intent_id: intent_id, store: store)
     dir = File.expand_path(intent_dir)
     actions = []
+    previous = read(key, intent_id: intent_id, tmp: tmp)
+    auto = !!(previous && previous.dig("build", "auto"))
+    derived_mode = if previous && previous.dig("build").is_a?(Hash) &&
+                      previous["build"].key?("auto")
+                     auto ? "auto" : "guided"
+                   end
+    identity = { harness: harness, agent: agent, model: model, thread: thread,
+                 run_mode: blank?(run_mode) ? derived_mode : run_mode.to_s }
 
     if Lock.corrupt?(dir)
       File.delete(Lock.path(dir))
@@ -1010,21 +1046,31 @@ module Bridge
       end
       return { "status" => "stale", "owner" => lock["owner_session"],
                "actions" => actions, "session" => key,
-               "hint" => "run /plastic-doctor reclaim the lock to take over with an audit" }
+               "hint" => "run #{skill_ref('plastic-doctor', harness: hint_harness || harness)} reclaim the " \
+                         "lock to take over with an audit" }
     end
 
     if lock
-      Lock.heartbeat(dir, session: key, now: now)
-      lock_data = Lock.read(dir)
+      if lock["owner_session"].to_s == key.to_s
+        lock_data = lock.dup
+        { "owner_harness" => harness, "owner_agent" => agent,
+          "owner_model" => model, "owner_thread" => thread,
+          "run_mode" => identity[:run_mode] }.each do |field, value|
+          lock_data[field] = value.to_s unless blank?(value)
+        end
+        Lock.write(dir, lock_data)
+        Lock.heartbeat(dir, session: key, now: now)
+      else
+        Lock.heartbeat(dir, session: key, now: now)
+        lock_data = Lock.read(dir)
+      end
       role = lock_data["owner_session"].to_s == key ? "owner" : "delegate"
       actions << "lock kept (#{role})"
     else
-      status, lock_data = Lock.acquire(dir, session: key, now: now)
+      status, lock_data = Lock.acquire(dir, session: key, now: now, **identity)
       actions << "lock #{status}"
     end
 
-    previous = read(key, intent_id: intent_id, tmp: tmp)
-    auto = !!(previous && previous.dig("build", "auto"))
     data = derive(key, intent_id: intent_id, intent_dir: dir, store: store,
                   name: name, tmp: tmp)
     data["build"]["auto"] = auto
@@ -1138,7 +1184,8 @@ module Bridge
   # target's lock names as owner or delegate (even when stale: a stale lock is
   # still its owner's until an explicit takeover).
   def self.lock_gate_decision(bridge_data, file_path, session: nil,
-                              ttl: Lock::TTL_SECONDS, now: Time.now, home: Dir.home)
+                              ttl: Lock::TTL_SECONDS, now: Time.now, home: Dir.home,
+                              harness: :claude)
     return nil if blank?(file_path)
 
     target_dir = intent_dir_for(file_path)
@@ -1166,20 +1213,23 @@ module Bridge
                "#{lock['owner_session']}. Back off; if you are the owner's " \
                "subagent, the owner must run: plastic-lock delegate " \
                "--intent-dir #{target_dir} --session <your-session-id>. " \
-               "Inspect with /plastic-doctor check the lock status"
+               "Inspect with #{skill_ref('plastic-doctor', harness: harness)} check the " \
+               "lock status"
       end
       return solo_allow(id, "stale delivery lock") if solo
       return "intent #{id} has a stale delivery lock (owner " \
-             "#{lock['owner_session']}); run /plastic-doctor reclaim the lock to " \
-             "take it over, or /plastic-doctor fix the lock"
+             "#{lock['owner_session']}); run #{skill_ref('plastic-doctor', harness: harness)} " \
+             "reclaim the lock to take it over, or " \
+             "#{skill_ref('plastic-doctor', harness: harness)} fix the lock"
     end
     if Lock.corrupt?(target_dir)
       return solo_allow(id, "unreadable delivery.lock") if solo
-      return "delivery.lock for intent #{id} is unreadable; run /plastic-doctor fix the lock"
+      return "delivery.lock for intent #{id} is unreadable; run " \
+             "#{skill_ref('plastic-doctor', harness: harness)} fix the lock"
     end
     return solo_allow(id, "no delivery lock") if solo
-    "no delivery lock held for intent #{id}; run /plastic-intent-starting " \
-      "to lock and begin"
+    "no delivery lock held for intent #{id}; run " \
+      "#{skill_ref('plastic-intent-starting', harness: harness)} to lock and begin"
   end
 
   # A session holds an intent's lock iff the durable delivery.lock in the

package/scripts/lib/hook_registry.rb

@@ -88,6 +88,26 @@ module HookRegistry
   CODEX_PRE_HOOKS  = %w[code-gate lock-gate savepoint-pre links-gate create-gate].freeze
   CODEX_POST_HOOKS = %w[gate-check].freeze
 
+  # Codex's shell-tool gate hole (intent 203): bash-gate (denies a shell write to
+  # project code before How) and retrieval-gate (advisory, never denies) both
+  # belong on the Bash matcher, and ONLY Bash: the official Codex hooks doc's
+  # PreToolUse event catalog enumerates exactly Bash, apply_patch, and MCP tool
+  # calls, and neither it nor the two prior Codex research passes (198's
+  # official-docs research, 181's deep research) documents a discrete Read,
+  # Grep, or Glob tool name (D3). So this does NOT copy Claude's four-name
+  # "Bash|Read|Grep|Glob" retrieval-gate matcher; registering a tool name Codex
+  # never reports would be dead weight that looks alive, the exact defect this
+  # intent exists to fix.
+  CODEX_BASH_HOOKS = %w[bash-gate retrieval-gate].freeze
+
+  # Live-state events registered WHOLE (intent 199), unlike CODEX_PRE_HOOKS/
+  # CODEX_POST_HOOKS above: Codex's SessionStart/UserPromptSubmit/PreCompact already
+  # match Claude's shape exactly, one matcher group each ("", no tool to collapse
+  # onto), so every hook `events` lists under these three events projects straight
+  # through with no allowlist to keep in sync. A hook added to any of them on the
+  # Claude side registers for Codex automatically.
+  CODEX_LIVE_STATE_EVENTS = %w[SessionStart UserPromptSubmit PreCompact].freeze
+
   def codex_hooks_json(dispatcher_path:)
     # name => statusMessage, straight from the single `events` source (A8): the
     # guide Part 3 hooks.json format carries a per-hook statusMessage, so emit it.
@@ -101,11 +121,21 @@ module HookRegistry
     # Preserve the order these hook names appear across the PreToolUse groups in `events`.
     pre_order = events["PreToolUse"].flat_map { |g| g["hooks"].map { |h| h["name"] } }
     pre = (pre_order & CODEX_PRE_HOOKS).map { |n| cmd.call(n) }
+    bash = (pre_order & CODEX_BASH_HOOKS).map { |n| cmd.call(n) }
     post = CODEX_POST_HOOKS.map { |n| cmd.call(n) }
-    {
-      "PreToolUse"  => [{ "matcher" => "apply_patch", "hooks" => pre }],
+
+    result = {
+      "PreToolUse"  => [
+        { "matcher" => "apply_patch", "hooks" => pre },
+        { "matcher" => "Bash", "hooks" => bash },
+      ],
       "PostToolUse" => [{ "matcher" => "apply_patch", "hooks" => post }],
     }
+    CODEX_LIVE_STATE_EVENTS.each do |event|
+      names = events[event].flat_map { |g| g["hooks"].map { |h| h["name"] } }
+      result[event] = [{ "matcher" => "", "hooks" => names.map { |n| cmd.call(n) } }]
+    end
+    result
   end
 
   # The settings.json shape merge_claude_hooks expects: single-group events map