agent-bios 0.14.0 → 0.16.0

package/DEPENDENCIES.md

@@ -8,12 +8,12 @@ Korean: [`ko/DEPENDENCIES.md`](ko/DEPENDENCIES.md). Dates = verification time; u
 
 | Tool | Required by | Required capability | Verified |
 | --- | --- | --- | --- |
-| `codex` (codex-cli) | `wrappers/codex-run.sh`, `wrappers/codex-helm.sh`, `launch/agent-launch.py`; guide "Codex direct-drive" + "Session relocation" bindings | existing `codex exec` contract plus `agents.<name>.description/config_file` config projection; final output on stdout and progress on stderr; honors `CODEX_HOME`; `codex resume` cwd-filtered | 0.144.1 · 2026-07-13 |
+| `codex` (codex-cli) | `compose/corpus_session.py`, `launch/agent-launch.py`, `wrappers/codex-run.sh`, `wrappers/codex-helm.sh`; guide "Codex direct-drive" + "Session relocation" bindings | per-call `-c`; cwd-aware `app-server --stdio` `config/read`; durable `thread/start`, `thread/inject_items`, and `thread/read`; `codex resume`; existing `codex exec` and agent-config projection. The corpus session tests exercise config preservation and durable thread identity without a model turn | 0.153.4 · 2026-09-07 |
 | `bash` | `install.sh`, `*/*.sh` | POSIX + arrays; runs on macOS system bash | 3.2.57 · 2026-07 |
-| `python3` | `session-cost.py`, `launch/agent-launch.py` | stdlib for every direct / non-TTY / numbered path; Python 3.11+ (`tomllib`). The interactive preflight additionally needs `textual` (next row) | 3.14.5 · 2026-07-13 |
-| `textual` (managed venv) | `launch/agent-launch.py` interactive preflight; provisioned by `launch/provision-venv.sh` | Textual TUI framework in `~/.local/share/agent-launch/venv` (override `AGENT_LAUNCH_VENV`); the launcher re-execs into it on the interactive TTY path only. Absent/broken venv, non-TTY, or `TERM` `dumb`/unset falls back to numbered prompts and never blocks | 8.2.8 · py 3.14.5 · 2026-07-13 |
+| `python3` | `compose/corpus.py`, `compose/corpus_install.py`, `compose/corpus_session.py`, `compose/corpus_store.py`, `session-cost.py`, `launch/agent-launch.py` | Python 3.11+ stdlib (`tomllib`) owns every machine/non-TTY path, private file transaction, catalog/store operation, session journal, and numbered fallback. Textual is imported only for the interactive clients | 3.14.5 · 2026-09-07 |
+| `textual` (managed venv) | `launch/agent-launch.py` preflight and `compose/corpus_ui.py` Corpus Studio; provisioner is `launch/provision-venv.sh` | Textual runtime in `~/.local/share/agent-launch/venv` (override `AGENT_LAUNCH_VENV`); each interactive client re-execs into it only on its TTY path. The private installer does not currently run the provisioner, so a fresh machine without that runtime uses numbered UI. Corpus Studio uses `Tree`, `MarkdownViewer(open_links=False)`, `TextArea(language="markdown")`, and `Select`; its numbered editor uses `$VISUAL`/`$EDITOR` when set | 8.2.8 · py 3.14.5 · 2026-09-07 |
 | `jsonschema` (system python) | `learn/check-learning.py` (learning record gate; chained from `gates/check-parity.sh`) | JSON Schema Draft 2020-12 validator executing `learn/learning.schema.json` as the SSOT | 4.26.0 · 2026-07-20 |
-| `zsh` | `launch/agent-launch.zsh` | functions, TTY tests, argument-preserving dispatch | 5.9 · 2026-07-13 |
+| `zsh` | `launch/agent-launch.zsh` | legacy compatibility/regression path only: shell functions, TTY tests, argument-preserving dispatch. The private default does not install shell interception | 5.9 · 2026-07-13 |
 | `git` | scripts, workflow (`origin/<base>..HEAD`, worktrees) | modern git; worktree support | 2.50.1 · 2026-07 |
 | coreutils (`mktemp`, `cp`) | `codex-run.sh` hermetic home; `codex-helm.sh` managed home | BSD or GNU | 2026-07 |
 
@@ -21,8 +21,23 @@ Korean: [`ko/DEPENDENCIES.md`](ko/DEPENDENCIES.md). Dates = verification time; u
 
 | CLI | Role | Required capability | Version owner |
 | --- | --- | --- | --- |
-| Claude Code | primary host; loads `CLAUDE.md` + `guides/`; `agent-launch` backend | `--model`; effort `low/medium/high/xhigh/max`; `--agents` JSON with per-agent `model`/`effort`; `--append-system-prompt`; `--mcp-config`; permission modes `acceptEdits/auto/bypassPermissions/manual/dontAsk/plan` | Environment Binding (v2.1.220 — the version whose behaviour is verified here) |
-| Codex CLI | mirror host; loads `AGENTS.md` + `guides/`; worker/reviewer runtime | see codex row above | Environment Binding + this file |
+| Claude Code | primary host and `agent-launch` backend; native global/project loading remains native | `--model`; effort `low/medium/high/xhigh/max`; `--agents`; per-call `--append-system-prompt`; `--session-id` and `--resume`; `--mcp-config`; `--plugin-dir`; permission modes `acceptEdits/auto/bypassPermissions/manual/dontAsk/plan`. Default-off `--corpus-native` validates and supplies per-item plugin roots for installed corpus carriers; automatic SessionStart execution is observed. Authenticated corpus-agent execution and post-fix authenticated resume remain unverified | Environment Binding; installed CLI 2.1.263 checked 2026-09-08 |
+| Codex CLI | mirror host and worker/reviewer runtime; native global/project loading remains native | private corpus composition preserves cwd-aware effective developer instructions, injects the selected snapshot per call, and pins the host id after `thread/start` + `thread/inject_items` + `thread/read`; see codex row above | Environment Binding + this file |
+
+Optional user-global instruction exclusion in `compose/corpus_session.py` requires
+Claude Code 2.1.263 or newer. Its native `claudeMdExcludes` setting is supplied once
+through `--settings`; native configuration arrays union/deduplicate, but repeated
+CLI `--settings` options replace one another, so the adapter refuses that collision.
+Actual include/exclude/resume startup preserved project instruction sources and
+omitted the global root/imports/user rules on 2026-09-08. Codex 0.153.4 has no
+equivalent supported native control; exclusion is refused without changing its
+execution sandbox or configuration home.
+
+Claude Haiku 4.5 calls omit `--effort` and the native agent `effort` field.
+The SWEEP-main route requires `--restricted`, `--tools`, `--strict-mcp-config`
+and `--mcp-config`; installed Claude Code 2.1.263 accepts these parser options.
+Its projection uses Read/Glob/Grep and an empty MCP configuration, with no child
+delegation. This is a parser/projection check, not a new model-generation receipt.
 
 ## LLM models & providers — owned by `Environment Binding`
 
@@ -31,17 +46,21 @@ Concrete role-slot→model bindings live only in each guide's `Environment Bindi
 - Providers: **Anthropic** (Claude — Fable/Opus/Sonnet/Haiku), **OpenAI** (GPT / Codex).
 - Auth: Anthropic via Claude Code login; OpenAI via ChatGPT subscription or API key (`$CODEX_HOME/auth.json`).
 
-## Deployed Codex assets
+## Private corpus assets
 
-- **Codex custom agents** (`codex/agents/*.toml`) — installed role templates for `frontier`, `workhorse`, `sweep`, and `reviewer`; optional at runtime, but part of the Restore contract and activated by `wrappers/codex-helm.sh` when Codex subagent fan-out is explicitly authorized.
+- **Claude native corpus plugins** — default-off per-session `--corpus-native` builds one namespaced plugin root per installed hook/agent CorpusRef, validates it with `claude plugin validate`, and passes roots by `--plugin-dir`. Agent frontmatter stays authored; corpus-agent names are plugin-qualified rather than launcher tier names. Arbitrary prose cannot become executable because carrier provenance and hook `event`/`matcher` are structural requirements.
+- **Codex custom agents** (`codex/agents/*.toml`) — role-template sources stored in the immutable private release. The default installer does not register templates in the native host home.
+- **Corpus management bootstrap** (`compose/bootstrap/SKILL.md`) — copied into every activated immutable snapshot and named by exact private path in startup text. This is private procedure access, not a claim of native skill registration.
 
 ## Referenced / optional — not required by the core repo
 
+- **Slide-writing static HTML/PDF companion** — the primary slide-writing guide needs no renderer. Its explicit static HTML/PDF job path uses Python 3.11+ standard libraries for preparation, binding checks, and result acceptance. Rendering additionally requires an explicit Node executable, Playwright module file, `pdf-lib` resolvable beside that module, and a Chromium-family browser executable. These are job-side dependencies, not installed by corpus delivery. Verified on 2026-09-09: Node 24.19.0, Playwright 1.62.1, pdf-lib 1.17.1, Chromium-family browser 152.0.7977.83. The companion runbook owns invocation and supported-format limits.
+
 - **Deep review** — no separate tool on either side. The Codex-seat deep reviewer (`codex-exec`) is the `codex` CLI's own non-interactive exec mode: `codex exec -s read-only -m gpt-5.6-sol -c model_reasoning_effort="ultra"`, self-contained packet on stdin (`-s read-only`, `-c model_reasoning_effort` and `-c service_tier` verified against installed codex-cli 0.146.0; `-c service_tier="fast"` is the explicit faster, shallower opt-in; `-s read-only` enforces the promised sandbox — ambient `~/.codex` config stays inherited, so the route is read-only but not hermetic). The Claude-seat deep reviewer (**ultracode**) is the `claude` backend itself run headless with the keyword `ultracode` in the prompt — that keyword is what opens the Workflow tool for the turn (`workflowKeywordTriggerEnabled`, default true, read in the installed 2.1.220 bundle). Personal or third-party reviewers register in the user-owned `review-methods.local.toml`, never in the shipped config.
 - **Cross-family review reviewers** — with `review_family=cross` (default), each main routes review to the opposite family. A Claude main dispatches gpt review via `$CODEX_HOME/bin/codex-run --profile hermetic` (and `codex-helm --mode review` for review fan-out) plus the deep `codex exec` pass above; a Codex main dispatches Claude review via the `claude` CLI (`claude -p --permission-mode plan` for native, and, for the workflow-orchestration route, the same `claude` CLI headless with the keyword `ultracode` in the prompt — the keyword trigger is what the injected contract names, so this is the mechanism to follow). The reviewer command, resolved path, and opposite-family tier bindings are named in the launch contract; an absent or unauthenticated route degrades to same-family native (PROPOSED). `review_family=same` restores same-family review.
 - **codex-plugin-cc** (1.0.6; re-evaluated 2026-07-16) — spawns `codex app-server` with inherited env and no `--ignore-user-config`/`--profile`, so every run reads the real `~/.codex` (config.toml, auth, its MCP servers); it has no per-invocation hermetic reach, which is what makes it unfit as a **review** route: the reviewer would inherit the same config and AGENTS.md as the main, undercutting the independent lens `review_family=cross` exists to provide. The model *is* selectable (`--model`/`--effort`); what is dated is the bundled `gpt-5-4-prompting` skill, so passing a current model does not resolve it. **Not adopted**; `wrappers/codex-run.sh` is preferred for controlled reach. It does not touch Claude Code's `/code-review` (no `code-review.md`; it adds namespaced `/codex:*`), so it never made that route cross-family. Capability we lack and may still want independently: its opt-in `Stop` hook review gate.
 - **MCP servers** (clickhouse, node_repl, …) — environment-specific; referenced by Environment Binding, not a core dependency. The launcher registers a stdio MCP server only for a user-registered capability whose offer declares the `mcp-stdio-v1` adapter; no shipped review method is MCP-backed.
-- **spreadsheet-processing** (skill) — referenced by the global spreadsheet rule; present in the author's Claude Code and Codex environments. If absent, the rule's inline fallback (plain tools/code + real Excel-engine validation) applies.
+- **spreadsheet-processing** (skill) — referenced by the always-surface spreadsheet rule in an activated selection; present in the author's Claude Code and Codex environments. If absent, the rule's inline fallback (plain tools/code + real Excel-engine validation) applies.
 
 ## Untracked — dependencies, but excluded by design
 
@@ -59,18 +78,20 @@ printf '%s\n' "$codex_help" | grep -Eq '(^|[[:space:]])-c([,[:space:]]|$)' || {
 printf '%s\n' "$codex_help" | grep -Eq '(^|[[:space:]])-C([,[:space:]]|$)' || { echo "missing codex flag: -C"; exit 1; }
 printf '%s\n' "$codex_help" | grep -Eq '(^|[[:space:]])-p([,[:space:]]|$)' || { echo "missing codex flag: -p"; exit 1; }
 printf '%s\n' "$codex_help" | grep -Eq '(^|[[:space:]])-s([,[:space:]]|$)' || { echo "missing codex flag: -s"; exit 1; }
-claude --version; claude --help | grep -E -- '--model|--effort|--agents|--append-system-prompt|--mcp-config'
+claude --version; claude --help | grep -E -- '--model|--effort|--agents|--append-system-prompt|--session-id|--resume|--mcp-config'
 bash --version | head -1; zsh --version; python3 --version; git --version
 AGENT_LAUNCH_VENV="${AGENT_LAUNCH_VENV:-$HOME/.local/share/agent-launch/venv}" bash launch/provision-venv.sh
 "${AGENT_LAUNCH_VENV:-$HOME/.local/share/agent-launch/venv}/bin/python" -c 'import textual, sys; print("textual", textual.__version__, "py", sys.version.split()[0])'
+python3 -m py_compile compose/corpus.py compose/corpus_catalog.py compose/corpus_install.py compose/corpus_session.py compose/corpus_store.py
+"${AGENT_LAUNCH_VENV:-$HOME/.local/share/agent-launch/venv}/bin/python" -m unittest discover -s compose -p 'test_corpus*.py'
 bash -n wrappers/codex-run.sh wrappers/codex-helm.sh gates/check-parity.sh launch/check-prompting-targets.sh launch/provision-venv.sh install.sh
 zsh -n launch/agent-launch.zsh
 python3 -c 'compile(open("launch/agent-launch.py").read(), "launch/agent-launch.py", "exec")'
 ./gates/check-parity.sh
 ./launch/check-prompting-targets.sh
 python3 - <<'PY'
-import os, pathlib, tomllib
-roots = [pathlib.Path("codex/agents"), pathlib.Path(os.environ.get("CODEX_HOME", pathlib.Path.home() / ".codex")) / "agents"]
+import pathlib, tomllib
+roots = [pathlib.Path("codex/agents")]
 required = {"frontier.toml", "workhorse.toml", "sweep.toml", "reviewer.toml"}
 for root in roots:
     missing = required - {path.name for path in root.glob("*.toml")}
@@ -80,6 +101,8 @@ for root in roots:
     print(f"agent TOML ok: {root}")
 PY
 wrappers/codex-helm.sh --dry-run --mode review "probe"
+agent-bios verify
+agent-bios corpus status --json
 ```
 
 ## Ownership

package/README.md

@@ -1,6 +1,8 @@
 # agent-bios
 
-Single source of truth for the global instructions and scoped guides that drive multiple LLM CLI agents (Claude Code, Codex CLI) under one working discipline. Edit once; it applies to every agent in every environment.
+Single source of truth for the instructions and scoped guides that an explicit
+agent-bios launch supplies to Claude Code or Codex. Edit once; the private corpus
+compiler projects the selected content for each activated session.
 
 A deployable instruction corpus for coding agents, plus the CLI that
 installs, verifies, and evolves it. The npm package ships the corpus; `install.sh` is both the
@@ -10,39 +12,49 @@ Korean reference: [`ko/`](ko/) mirrors every doc below — reference only, never
 
 ## Model
 
-Two layers:
+Two authored layers:
 
-- **Global instructions** — `claude/CLAUDE.md` ↔ `codex/AGENTS.md` (mutual mirrors). Loaded every session. Hold only always-on invariants, decision principles, and guide pointers. Admission rule: a rule earns global placement only if it must work **even when the agent fails to recognize the situation** — a rule whose failure mode is recognition failure dies behind a pointer.
-- **Scoped guides** — `claude/guides/`, `codex/guides/`. Loaded when a global pointer fires. All procedures, tables, numbers, and environment-specific content live here.
+- **Always-in-an-activated-session instructions** — `claude/CLAUDE.md` is the English canonical and `codex/AGENTS.md` its generated host projection. They hold compact invariants, decision principles, and guide pointers. A clean private install does not copy either file into a host's global discovery path; `compose/corpus_catalog.py` inventories their registered items and compiles the selected rules into an immutable session snapshot.
+- **Scoped guides** — `claude/guides/`, with generated Codex mirrors. The snapshot compiler copies selected guides to private generation-qualified paths and emits their router. Procedures, tables, numbers, and environment-specific content live here.
 
 ## Principles
 
+The `slide-writing` guide is selected through `office-work` and
+`visualization-docs`. Its primary guide supplies the semantic criteria for every
+slide or presentation task. Its companion runbook and scripts are used only for
+an explicitly applicable static HTML/PDF job: preparation derives a job-local
+criteria copy and `ORACLE.json`, then freezes them with the job inputs and runtime
+version. Jobs stay outside immutable corpus snapshots; preparation and result
+acceptance need Python, while rendering uses the optional dependencies listed in
+`DEPENDENCIES.md`. Native presentation formats remain the user's choice; the
+supplied renderer's mechanical checks apply only to its static HTML/PDF path.
+
 - **Rule bodies never name concrete models or tools** — only role slots and tiers. Bindings live in each guide's `Environment Binding` (dated; expire ~8 weeks or on a newer model). New model → update that row + date; leave rules alone. Declared exceptions: sections whose subject is a concrete tool surface (the cli guide's Codex direct-drive section) and optional-capability names inventoried in `DEPENDENCIES.md` (e.g. the `spreadsheet-processing` skill) — the Adopting checklist below covers swapping both.
 - **The Codex tree is generated, not mirrored by hand** — `gates/emit-mirrors.py` projects `claude/` → `codex/` and `ko/claude/` → `ko/codex/`, differing only in title and config-home variable (`$CLAUDE_CONFIG_DIR` ↔ `$CODEX_HOME`), plus one declared Codex-only standing-dispatch authorization required by Codex's trigger contract, inserted at a pinned position. It owns the projection rule; `gates/check-parity.sh` runs its `--check` and adds pointer resolvability, frontmatter, shared anchor phrases on the global↔guide restatement pairs that remain, and Codex role-binding / wrapper-default projections. Parity enforces content synchronization only; it does not guarantee both harnesses respond to the same wording with the same strength.
-- **The global is a per-session token budget** — it is re-sent every session and to every subagent, and each added bullet dilutes every other rule. A new global bullet must name the bullet it displaces (or why none does); procedures, tables, numbers, and worked examples belong in guides.
-- **Deploying is not loading** — file presence cannot detect a declined import approval or a broken entry import line, so `onboard` ends with an activation canary and `verify` checks the entry import line. A corpus that landed but is not read has changed nothing.
-- **Every span we write into a file we do not own has a remover** — the Codex config block, the settings hook registrations, the `AGENTS.md` central region and the zsh hook line each sit in a span identifiable as ours (a marker pair, a tagged line, or a manifest name), and `uninstall` removes exactly those and nothing around them. The entry `CLAUDE.md`/`AGENTS.md` are seeded once and then yours: the corpus is assembled under `central/` and the entry file only imports it, so your own additions are never mixed with ours and never removed with them. `uninstall` is a security operation — everything of ours goes, and what it took leaves as one archive you can hand off or delete.
-- **Metadata selects, observation authorizes** — a record of what was promoted can propose an irreversible act but never authorize one; it has never seen the machine it will run on. Clearing a user's personal copy of a promoted learning asks the deployed corpus whether the replacement is really there, excludes the copy being deleted from that evidence, and keeps the copy on any uncertainty: a kept duplicate is redundant, a wrong removal is data loss.
-- **The deployment outlives the act that made it** — a command's success says nothing about which version landed; a cached package can serve the previous one at exit 0. So the deployed state carries its own version marker and `status` reads that marker rather than the source it was launched from. With no marker the answer is `unknown`, never a guess.
+- **The always surface is a per-activated-session token budget** — every selected rule is supplied to that session and can be inherited by its children, so each added bullet dilutes the rest. A new always rule must name the bullet it displaces (or why none does); procedures, tables, numbers, and worked examples belong in guides.
+- **Installation is storage, not activation** — `install` and `onboard` copy a validated immutable release into agent-bios-owned state and record a baseline plus selection. `verify` proves those stored bytes, the catalog, the baseline, and the owned launcher projection; it deliberately reports activation as unverified. Only a configured `agent-launch` resolves a snapshot and calls a host adapter.
+- **The default installer leaves native host state alone** — it does not seed global `AGENTS.md`/`CLAUDE.md`, host skill/agent directories, hook settings, or shell interception. Existing installations keep their old global projection until `agent-bios migrate` previews and, with explicit apply confirmation, removes only proven legacy-owned material. `AGENT_BIOS_LEGACY_INSTALL=1` exists only for compatibility and migration regression coverage.
+- **Source, snapshot, and session have separate lifetimes** — `CorpusStore` revision-checks private authoring, compiles content-addressed snapshots, and preserves prior snapshots. `corpus_session.py` records a host-observed session id before a pin counts as resumable; reset and later edits affect future snapshots, not an existing pin.
+- **Learning evidence stays immutable** — capture events are host-qualified private JSONL records. A local edit is an overlay for later snapshots; promotion suppresses only an exact source revision when its replacement is proven in that snapshot. Local reset, removal, or migration makes no claim that an uploaded record was deleted.
 - **`Evidence Base` (per guide) is the single owner of numbers.** Measure with `session-cost.py` (`agent-bios cost` on an installed package).
-- **English is canonical and installed; Korean (`ko/`) is reference only.** The harness loads only fixed-name English files; the installer deploys English only.
+- **English is canonical and shipped; Korean (`ko/`) is reference only.** The private catalog and snapshot compiler consume the fixed-name English sources.
 
 ## Layout
 
 | Path | Role |
 | --- | --- |
-| `claude/CLAUDE.md`, `codex/AGENTS.md` | global instructions (en) — installed & loaded |
-| `claude/guides/*.md`, `codex/guides/*.md` | scoped guides (en) — installed |
-| `codex/agents/*.toml` | Codex custom subagent role templates — installed |
+| `claude/CLAUDE.md`, `codex/AGENTS.md` | canonical and generated always-surface sources (en); shipped privately and selected into activated snapshots, never installed into native global files by default |
+| `claude/guides/*.md`, `codex/guides/*.md` | scoped-guide sources copied to immutable private snapshots when selected |
+| `codex/agents/*.toml` | Codex role-template sources retained in the private release; agent-item activation remains separately evidenced |
 | `ko/**` | Korean mirror of every doc above + this README + DEPENDENCIES (reference only) |
-| `launch/` | launch profile, preflight TUI, zero-argument shell interception (reasserted at `preexec`: a terminal that redefines `claude` at its prompt hook is redefined back before the command runs — one that redefines it in a later `preexec`, or through an alias for the command already parsed, is recorded, not fought), the managed Textual venv, and the prompting-target check that guards the profile's model bindings |
-| `compose/` | corpus classification and per-selection assembly — domain manifest and its gate, assembler, package identity, hook registration, activation canary, deployed-corpus state |
+| `launch/` | launch profile and preflight TUI; `agent-launch.py` resolves a private snapshot for configured sessions, keeps Software Engineer / Vanilla bare, and routes resume through the recorded pin. The old shell interception remains only on the legacy compatibility path |
+| `compose/` | corpus authority and clients: `corpus_catalog.py` inventory/compiler, `corpus_store.py` baseline/overlay/plan/snapshot store, `corpus.py` + `corpus_ui.py` machine/numbered/rich clients, `corpus_install.py` private install and migration, `corpus_session.py` host delivery and pins, and the immutable private management bootstrap |
 | `learn/` | the collection loop — capture, record schema and its validator, curation intake, promotion manifest, redistribution, and the secret-redaction floor |
 | `session-distill/` | the heavy curator pipeline that mines many sessions into corpus-grade items |
-| `wrappers/` | internal Codex wrappers, deployed to `$CODEX_HOME/bin/` |
+| `wrappers/` | internal host/review adapters carried by the private release; the default install does not populate native host bin directories |
 | `gates/` | author-side verification (mirror generation, parity, lexicon, payload, assembler scenarios) — reachable only from a repo checkout, and `check-package.sh` fails if any of it enters the npm payload |
 | `ontology/` | what a change obliges elsewhere — entities, obligation edges, and the service's routes, held against real source by `check-ontology.py`. `instances/graph.json` is canonical; `LEXICON.md`, the RDF views, the HTML map, and the competency/extension docs are generated from it |
-| `install.sh`, `session-cost.py` | the CLI and the cost meter — the two things you run directly (`agent-bios` and `agent-bios cost` once installed) |
+| `install.sh`, `session-cost.py` | the `agent-bios` command dispatcher/private installer entry and the cost meter |
 | `decisions/` | the decision record for developing this repo — what was decided and which alternative it closed; author-side, never shipped |
 | `packages/` | authored corpus packages, organized by package identity rather than by concept home |
 | `.githooks/` | the pre-commit hook that runs the gates against the index, enabled per clone with `core.hooksPath` |
@@ -79,35 +91,336 @@ tree.
 3. `./gates/check-parity.sh` must pass.
 4. Commit, then deploy: `agent-bios install` (or `agent-bios update` from a clone).
 
-## Install (deploy)
+## Install and activate
 
-The `agent-bios` CLI deploys this SSOT into your environment by copy — idempotent, backed up before overwrite, then verified. It ships as the npm package `agent-bios`; package and command are the same name. The `$HOME` deployment is always the explicit `install` command, never a postinstall side effect.
+The npm package and command are both named `agent-bios`. Installation is always
+explicit—never a package-manager postinstall side effect—and the default path stores
+an immutable release and baseline under agent-bios-owned state. It installs the
+`agent-launch` entrypoint and its own profile/catalog files, but does not change native
+Claude/Codex globals, discovery directories, settings, hooks, or shell command
+resolution.
 
 ```bash
 npm install -g agent-bios
-agent-bios install     # deploy, back up replaced files, then verify
-agent-bios onboard     # pick domain packages, install, activation canary
-agent-bios verify      # re-check the deployed state matches the source
-agent-bios status      # show what is installed and where
+agent-bios install     # store an immutable private release and baseline
+agent-bios onboard --domains builder-base,multi-agent-orchestration
+agent-bios verify      # verify stored bytes/catalog/baseline; not host activation
+agent-bios status      # show the private release, baseline, conflicts, and evidence state
+agent-bios corpus      # rich Corpus Studio in a TTY; list in a non-TTY
+agent-bios reset       # preview reset; keep sources, snapshots, and pins
+agent-bios reset --apply --yes --expected-revision REV # use the revision returned by preview
+agent-bios migrate     # preview legacy global cleanup; --apply --yes performs it
 agent-bios update      # git pull + reinstall (clone), or print the npm update line
-agent-bios uninstall   # remove deployed files and the zsh hook
+agent-bios uninstall   # remove owned runtime entries; retain user corpus and pinned sessions
+```
+
+From a clone, `bash install.sh install` is the same default path. The release lives
+under `~/.local/share/agent-bios/runtime/releases/`; baseline tuples and transaction
+journals live under that runtime root, immutable snapshots and pins under
+`~/.local/share/agent-bios/sessions/`, and user packages, overlays, tombstones,
+learnings, history, and trash under `~/.config/agent-bios/corpus/`. The corresponding
+`AGENT_BIOS_STATE_DIR` and `AGENT_BIOS_CORPUS_DIR` environment variables relocate
+those private roots; `AGENT_LAUNCH_VENV` relocates the optional Textual runtime.
+The owned `agent-launch` entrypoint exports `AGENT_BIOS_PRIVATE_CORPUS=1` and the
+immutable `AGENT_BIOS_PACKAGE_ROOT`; the launcher also recognizes the private install
+record when the explicit marker is absent. These select the private runtime and do not
+claim that any host session has loaded a snapshot.
+
+`install`, `onboard`, `reset`, `migrate`, and `uninstall` expose dry-run or preview
+paths appropriate to their mutations. A pre-existing owned launcher/profile path whose
+bytes no longer match the recorded copy is reported as an owned-path conflict rather than
+overwritten. `migrate` is the separate recovery-backed operation for a legacy global
+installation: preview is the default, applying requires `--apply --yes`, ambiguous
+ownership refuses the apply, and later private operations do not fall through to a
+global writer. Setting `AGENT_BIOS_LEGACY_INSTALL=1` selects the old deployer only for
+compatibility and migration regression work; it is not the user default.
+
+The legacy compatibility deployer preserves guide paths named only by a previous
+manifest when the current source no longer establishes their ownership. It names
+these remnants for manual inspection and leaves them out of the new ownership
+manifest, so later uninstall does not claim them. Current source-owned members
+retain normal backup and selection cleanup; private snapshot installation uses its
+own authoritative inventory.
+
+After updating a legacy global installation, run `agent-bios migrate` before the
+first private `install`. Its preview identifies exact managed regions, legacy
+manifest paths and learning sources. `agent-bios migrate --apply --yes` backs up
+the originals, transfers and verifies learning records, retires the legacy paths,
+then installs the private release. A central-only Codex file and the unmodified
+empty Claude learning seed do not require a learning JSONL file; actual learning
+content without its source still requires attention.
+
+An interrupted migration is visible in `status` and blocks configuration readers
+and unrelated writes. Re-run `agent-bios migrate --apply --yes` to resume its
+pinned release and recorded path versions. A completed private installation is
+not repeated, and later cleanup cannot delete its replacement launcher/profile.
+Intervening edits are preserved and reported instead of overwritten. Older
+incomplete journals without replay evidence require reconciliation from their
+backups rather than a guessed replay. Existing private-session replay retains the
+previous confirmed release until migration completes.
+
+Before applying or resuming, stop the old global collectors that can still append a native
+learning JSONL or rewrite its native prose/entry file. The migration checks the
+recorded native state immediately before commit, but no filesystem check can make
+a noncooperating writer atomic after that final observation. If it reports a
+changed native target, preserve only the affected paths and restore only those
+paths to the journal's recorded `after` state before resuming the old migration.
+Do not replace a whole native directory or edit the journal.
+
+For a validated late-input recovery, set `JOURNAL` to the one `NEEDS_RECOVERY`
+migration journal and pass only the specific changed JSONL, prose, or entry paths
+that its error named. This makes a new durable copy under that journal's existing
+`backup_root`, verifies the copy, and then restores a changed target from its
+recorded `after` bytes/existence/mode or an input-only path to its recorded
+unchanged existence. It rejects a path absent from the journal, symlinks, and
+non-regular files before writing any backup. New private journals retain exact
+bytes for input-only native files, so the command can restore an originally
+present input while preserving its current mode (or using `0600` if it is
+absent). Historic digest-only journals still need an external byte-identical
+backup; the command refuses to invent their missing bytes.
+
+```sh
+JOURNAL="${AGENT_BIOS_STATE_DIR:-$HOME/.local/share/agent-bios}/runtime/migrations/<migration-id>/journal.json"
+python3 - "$JOURNAL" \
+  "$HOME/.codex/personal/learnings.jsonl" <<'PY'
+import base64, hashlib, json, os, sys, tempfile
+from pathlib import Path
+
+journal = Path(sys.argv[1])
+data = json.loads(journal.read_text(encoding="utf-8"))
+backup_root = Path(data.get("backup_root", ""))
+if data.get("kind") != "migrate" or data.get("state") != "NEEDS_RECOVERY" or backup_root != journal.parent / "backup":
+    raise SystemExit("expected one validated NEEDS_RECOVERY migration journal")
+targets = {Path(entry["path"]): entry for entry in data["paths"]}
+inputs = {Path(path): version for path, version in data["inputs"].items()}
+selected = [Path(value).expanduser() for value in sys.argv[2:]]
+unknown = [str(path) for path in selected if path not in targets and path not in inputs]
+if not selected or unknown:
+    raise SystemExit("name one or more exact journal paths; unknown: " + ", ".join(unknown))
+
+planned = []
+for path in selected:
+    entry = targets.get(path)
+    version = entry["after"] if entry is not None else inputs[path]
+    if path.is_symlink() or (path.exists() and not path.is_file()):
+        raise SystemExit(f"refusing unsafe native path: {path}")
+    root = next((parent for parent in (path.parent, *path.parents)
+                 if parent.name in {".claude", ".codex"}), None)
+    if root is None or root.is_symlink():
+        raise SystemExit(f"recovery supports an exact Claude/Codex native path, not: {path}")
+    current = root
+    for part in path.relative_to(root).parts:
+        current /= part
+        if current.is_symlink():
+            raise SystemExit(f"refusing symlink ancestor: {current}")
+    planned.append((path, entry, version))
+
+if backup_root.is_symlink() or (backup_root.exists() and not backup_root.is_dir()):
+    raise SystemExit(f"refusing unsafe recovery root: {backup_root}")
+backup_root.mkdir(parents=True, exist_ok=True, mode=0o700)
+recovery = Path(tempfile.mkdtemp(prefix="recovery-before-resume-", dir=backup_root)) / "files"
+for path, entry, version in planned:
+    if path.exists():
+        saved = recovery / str(path).lstrip("/")
+        saved.parent.mkdir(parents=True, exist_ok=True)
+        before = path.read_bytes()
+        saved.write_bytes(before)
+        saved.chmod(path.stat().st_mode & 0o777)
+        if saved.read_bytes() != before:
+            raise SystemExit(f"backup did not verify: {saved}")
+    if not version["exists"]:
+        path.unlink(missing_ok=True)
+        continue
+    encoded = version.get("bytes_b64")
+    if not isinstance(encoded, str):
+        raise SystemExit(f"journal records only a digest for existing input; restore it from an exact external backup: {path}")
+    body = base64.b64decode(encoded.encode("ascii"), validate=True)
+    if hashlib.sha256(body).hexdigest() != version["sha256"]:
+        raise SystemExit(f"journal after bytes are invalid: {path}")
+    descriptor, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+    try:
+        with os.fdopen(descriptor, "wb") as output:
+            output.write(body)
+            output.flush()
+            os.fsync(output.fileno())
+        mode = entry["mode"] if entry is not None else (path.stat().st_mode & 0o777 if path.exists() else 0o600)
+        os.chmod(temporary, mode)
+        os.replace(temporary, path)
+    finally:
+        Path(temporary).unlink(missing_ok=True)
+print(recovery)
+PY
+```
+
+Resume the old journal with `agent-bios migrate --apply --yes`. After it commits,
+restore only the preserved late record (`B`) from the printed recovery directory
+to its original native path, then run a fresh `agent-bios migrate` preview and
+`agent-bios migrate --apply --yes`. The new migration imports `B` through the
+normal learning-id deduplication path. Leave every other recovery copy in place
+as evidence; it is not an instruction to restore all saved native files.
+
+```sh
+RECOVERY_BACKUP='<the directory printed above>'
+B="$HOME/.codex/personal/learnings.jsonl"  # the one path you deliberately preserved
+cp "$RECOVERY_BACKUP/${B#/}" "$B"
+agent-bios migrate
+agent-bios migrate --apply --yes
 ```
 
-From a git clone, run `./install.sh install` directly (the same CLI). `install` respects `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `AGENT_LAUNCH_VENV`, and `ZDOTDIR`; `--dry-run` prints actions without changing anything. Deploy to **every active environment in one sitting** — a partial deploy leaves a shared global pointing at a guide some environment lacks; globals are English only. Replaced files are backed up under `~/.local/share/agent-bios/backups/<timestamp>/`, and the installed set is recorded in a manifest that `uninstall` consumes. Those copies are **a manual escape hatch, not a restore mechanism**: nothing reads them back, so recovering from one means copying files yourself. The supported paths are the ones `agent-bios help` prints — a clone rolls corpus content back to a registered version, an npm install rolls the whole package back by version — and `uninstall` emits one archive of everything it removed. The backups exist for the case those three do not cover: the exact bytes that were on disk before a particular install. The published npm package ships only the deploy set (never `settings.json`, `config.toml`, `ko/`, or `benchmarks/`).
+Corpus Studio and the machine CLI are views over the same `CorpusStore`. The CLI
+provides `list`, `search`, `show`, `history`, `status`, and `snapshot`; mutations are
+semantic JSON passed to `plan`, followed by `apply PLAN --expected-revision REV`.
+Implemented operations are create, update (including consumption surface), remove,
+installed-item restore, personal-item recover, selection, reset, and rollback. Stable
+`CorpusRef` identities survive those changes. The current `ContentRef` hashes the
+baseline, resolved selection, authoring/item/learning/promotion digests, catalog and
+store implementation digests, and management bootstrap. There is not yet a standalone undo command,
+arbitrary package authoring/import, automatic semantic conflict resolution, or verified
+native skill-menu registration; those design stages must not be inferred from the
+library UI.
 
-In a TTY, zero-argument `codex` or `claude` opens the launch preflight. Every arrow-key TUI selection screen keeps the complete current setup in a fixed top panel, followed by the highlighted option's description and then the option list. Move with Up/Down, select with Enter, use Esc to return to the previous menu, and use `q` to cancel; Esc at the mode root also cancels. Each tier's model is chosen from the host's configured catalog, or via **Other** to type any model id the backend accepts; that text input preserves values that start with `q`, so Esc or Ctrl-C cancels immediately there, while submitting `q` cancels after Enter. The Textual preflight reflows to the terminal size, so there is no fixed minimum geometry. The root menu picks a mode — **Software Engineer** (repo-scoped work that defers to the project's own AGENTS.md/CLAUDE.md: **Vanilla**, the bare CLI with no launch contract, tier bindings, or applied permissions, plus **Custom**; SE-specific review defaults arrive later), **Builder** (the tier presets: Balanced, Deep review, Fast batch, Solo with delegation off, plus Custom), **Session distill** — then a preset within it. Two entries below the modes act on the installation rather than the launch: **Corpus packages** opens a checklist of the optional domain packages (core + infra always install) and, on Apply, hands the exact checked set to `agent-bios onboard --domains` — the installer alone deploys, runs the activation canary, and records the outcome, which the status panel then reports, loudly when an apply failed. **Language** switches the interface text between English, 한국어, and 日本語 and persists the choice in your own `launcher.local.toml`; it changes the launcher's own screens only, since the corpus the models consume is English-unified. Select **Custom** (in Software Engineer or Builder) to open a persistent settings hub for the main tier, review setup, host policy, and each tier binding. Every edit returns to that hub; **Start with these settings** is the final launch confirmation, **Save these settings globally and start** additionally persists the setup as a named preset (with host-scoped tier overrides) in your user config for reuse elsewhere, and **Exit without launching** cancels the launch. The rich preflight runs from a managed virtualenv (`launch/provision-venv.sh`, at `~/.local/share/agent-launch/venv`) that the launcher re-execs into on the interactive path; when that venv is unavailable, or the call is non-interactive, or `TERM` is `dumb`/unset, the launcher falls back to numbered prompts, where `b` is the back command. Backend command names are resolved from the calling environment's `PATH`; shell functions are not re-entered. Codex child bindings are materialized as session-selected agent configs under the user cache, while Claude receives model and effort in `--agents` JSON when delegation is enabled. Review runs cross-family by default (`review_family`, default `cross`; `same` restores today's same-family projection): because the main's tiers are one model family, every dispatchable review route — native and the deep route — runs on the opposite family. The exception is `slash-review`, the host's own built-in review command (`/code-review` on Claude, with `ultra` for its deep multi-agent pass; `/review` on Codex): it needs no dependency and always resolves, but being the main's own command it cannot be dispatched cross-family, so under `cross` it runs as the same-family floor and its verdicts are labeled PROPOSED. A Claude main dispatches gpt/codex review (native via the `codex-run` reviewer wrapper resolved under `$CODEX_HOME/bin`, deep via plain `codex exec -m <frontier model> -c model_reasoning_effort="ultra"` with a self-contained packet on stdin — `-c service_tier="fast"` is the explicit faster, shallower opt-in); a Codex main dispatches Anthropic/Claude review (native via `claude -p --permission-mode plan`, deep via the `claude` CLI headless with the keyword `ultracode` in the prompt, which is what opens Claude Code's dynamic workflow for that turn). The concrete reviewer command, resolved absolute path, and opposite-family tier bindings are named in the injected session-start contract; cross-family reviewers are dispatched as read-only subprocesses, not CLI-native subagents, since neither CLI hosts the other family as a native subagent. When a cross-family route is unavailable at launch or unauthenticated at use time it degrades to same-family native subagent review labeled PROPOSED (family collapse) rather than blocking; a requested non-none review with no cross-family route and no same-family fallback (delegation off) stays fail-closed. A reviewer this launcher has never seen is yours to add: **Register another reviewer…** in the review editor asks for the descriptor a method needs, proves the candidate by running it through the real config reader before a byte is written, and appends it to `review-methods.local.toml` beside your config — a file the installer never deploys, verifies, or overwrites, whose entries face exactly the validation a shipped one does and whose name may not shadow a shipped method. A refusal shows the reader's own message and leaves that file byte-identical. Review setup means configured/requested; this launcher does not claim that review completed, and unavailable runtimes such as Ultrawork are not offered until integrated.
+New personal identities are allocated once in the creation plan and remain stable
+on retry; reset and history rollback do not make retired identities reusable.
+Member files are the content authority: `primary_member` identifies the main file,
+and `body` is its view or edit alias. The manager applies a body edit to that file
+for all clients. Divergent older body/member values stay visible until an explicit
+content choice reconciles them; old immutable snapshots are not rewritten.
 
-At the shell-wrapper boundary, every argument-bearing command (`codex exec ...`, `claude -p ...`) and every non-TTY invocation skips launch-profile projection and preserves caller arguments. The Claude direct path intentionally retains its wrapper default, `--dangerously-skip-permissions`. `codex --no-tui ...` / `claude --no-tui ...` explicitly take that direct path, and `AGENT_LAUNCH_TUI=0` disables zero-argument TUI interception for a process tree.
+Installation and rollback validate the target baseline and personal field/member
+changes together. Conflicts preserve the current selection rather than dropping
+items from a successful snapshot. Installation publishes a complete corpus/config
+association under the same lock used by readers. Pending publication is disclosed
+by status and prevents a new configured launch from reading mixed state; bare and
+pinned replay can use the last confirmed immutable release.
+
+Full reset returns an `expected_revision` in its preview. Pass that value with
+`--apply --yes`; a changed preview is refused. Retry the accepted revision to finish
+an interrupted reset, or review and accept a fresh revision to replace a stale
+reset intent. Later user changes and replacement credentials are not overwritten
+by the old intent. Nonsecret settings are archived; token bytes never are.
+
+Native corpus consumption is default-off. `agent-bios corpus snapshot --host claude
+--native --json` composes a preview; `agent-launch --corpus-native` opts one configured
+Claude session into selected corpus hook and agent plugins. The compiler emits one
+namespaced plugin root per stable CorpusRef and passes each root by `--plugin-dir` only
+for that session. A native hook or agent must retain an installed Claude carrier and a
+typed hook `event`/`matcher` binding; changing arbitrary prose into an `event` or
+`delegated` surface cannot create executable behavior. Corpus agents retain their
+authored frontmatter verbatim and are qualified by plugin namespace, distinct from the
+launcher's bare tier agents.
+
+Tier defaults come from the launch profile and the guides' Environment Binding
+tables. Claude Haiku 4.5 has no effort parameter: its tier entry, native agent
+definition and projected call omit it. SWEEP is one-rule-per-item read-only work.
+As a main seat it disables child delegation and requires review off (for example,
+Solo); a requested review needs a HELM or WORKHORSE main instead. Codex SWEEP mains
+use a read-only sandbox; Claude SWEEP mains use restricted Read/Glob/Grep tools
+and an empty, strict MCP configuration. Other main roles retain their selected
+policies, and explicit personal model/effort overrides remain available.
+
+The private install does not replace the `codex` or `claude` shell commands. Run
+`agent-launch` explicitly to open the preflight, or pass `--preset NAME HOST` for a
+configured non-interactive launch. Software Engineer / Vanilla structurally projects
+no agent-bios snapshot, launch contract, tier binding, or permission flag. After a
+fresh private install—or after an explicit legacy migration—the native CLI therefore
+receives no automatic agent-bios content; the user's own native global and project
+instructions still follow the host's normal loading rules. `--resume-session ID`
+loads the recorded host/session pin rather than resolving current defaults.
+
+Activated sessions include the user's global instruction documents by default.
+**Custom → My global instruction files** can exclude them, or use
+`agent-launch --preset balanced --exclude-global-instructions claude`. The CLI flag
+sets Custom's initial choice; the final visible choice is what gets saved and run.
+The choice is retained by managed resume, which cannot change it through a new flag.
+
+Exclusion currently supports Claude Code 2.1.263 and newer: a per-call
+`claudeMdExcludes` setting omits the global `CLAUDE.md`, its imports, and user
+`rules/`. Project instructions and project memory remain, as do native settings,
+authentication, tool registrations, and permissions. No global file is rewritten.
+An existing CLI `--settings` argument, ambiguous relative/empty configuration home,
+symlinks, glob characters in the configuration path, or a project/global file alias
+is refused rather than replaced or silently included. Current Codex exclusion is
+unavailable; its native loader has no selective global-document switch. Vanilla
+and ordinary CLI launches retain their native loading behavior.
+This controls automatic instruction loading, not file access or memory erasure:
+tools can still open files, and project memory or prior conversation content can
+contain instructions independently of the excluded documents.
+
+The preflight keeps the current setup above each choice, supports the configured model
+catalog and **Other**, and offers Builder presets, Software Engineer / Vanilla,
+Session distill, Custom, Language, and **Corpus Studio**. Studio is the same backend as
+`agent-bios corpus`: it searches and renders the library, edits Markdown and
+consumption surface, and requires Preview then revision-bound Apply. In environments
+without Textual, the corpus client and launcher retain numbered fallbacks; the corpus
+editor uses `$VISUAL`/`$EDITOR` when available. Interface catalogs change only human
+UI text; model-consumed corpus remains English.
+
+Every arrow-key TUI selection screen keeps the complete current setup in a fixed top
+panel, followed by the highlighted option's description and the option list. Custom
+opens a persistent settings hub for the main tier, review setup, host policy, global instruction files, and tier
+bindings. Every edit returns to that hub; **Start with these settings** is the final
+launch confirmation, while **Exit without launching** cancels it. In the numbered
+launcher fallback, `b` is the back command. These controls configure an explicit
+agent-bios launch; they do not restore global installation or shell interception.
+
+Review runs cross-family by default (`review_family`, default `cross`; `same` restores today's same-family projection): because the main's tiers are one model family, every dispatchable review route — native and the deep route — runs on the opposite family. The exception is `slash-review`, the host's own built-in review command (`/code-review` on Claude, with `ultra` for its deep multi-agent pass; `/review` on Codex): it needs no dependency and always resolves, but being the main's own command it cannot be dispatched cross-family, so under `cross` it runs as the same-family floor and its verdicts are labeled PROPOSED. A Claude main dispatches gpt/codex review (native via the `codex-run` reviewer wrapper resolved under `$CODEX_HOME/bin`, deep via plain `codex exec -m <frontier model> -c model_reasoning_effort="ultra"` with a self-contained packet on stdin — `-c service_tier="fast"` is the explicit faster, shallower opt-in); a Codex main dispatches Anthropic/Claude review (native via `claude -p --permission-mode plan`, deep via the `claude` CLI headless with the keyword `ultracode` in the prompt, which is what opens Claude Code's dynamic workflow for that turn). The concrete reviewer command, resolved absolute path, and opposite-family tier bindings are named in the injected session-start contract; cross-family reviewers are dispatched as read-only subprocesses, not CLI-native subagents, since neither CLI hosts the other family as a native subagent. When a cross-family route is unavailable at launch or unauthenticated at use time it degrades to same-family native subagent review labeled PROPOSED (family collapse) rather than blocking; a requested non-none review with no cross-family route and no same-family fallback (delegation off) stays fail-closed. A reviewer this launcher has never seen is yours to add: **Register another reviewer…** in the review editor asks for the descriptor a method needs, proves the candidate by running it through the real config reader before a byte is written, and appends it to `review-methods.local.toml` beside your config — a file the installer never deploys, verifies, or overwrites, whose entries face exactly the validation a shipped one does and whose name may not shadow a shipped method. A refusal shows the reader's own message and leaves that file byte-identical. Review setup means configured/requested; this launcher does not claim that review completed, and unavailable runtimes such as Ultrawork are not offered until integrated.
+
+On the legacy compatibility path only, shell interception preserves argument-bearing
+and non-TTY calls as direct backend invocations. The private default installs no shell
+functions; a direct `agent-launch` call is the only entry that projects a launch
+profile or corpus snapshot.
 
 Direct `agent-launch` calls still require a valid profile to resolve the backend command and its default arguments. `--preset`, `--custom`, or `--dry-run` select the configured-launch path even when non-TTY or combined with `--no-tui`; a non-TTY bare `--dry-run` deterministically uses Balanced, and a custom profile without that preset must pass `--preset NAME`. Forwarded backend arguments are appended verbatim after the projected defaults; one that would override a projected option (the seat, the contract, delegation, policy) is refused at launch so the contract keeps describing the run, and the summary discloses forwarded arguments when present. For scripted configured launches, call `$HOME/.local/bin/agent-launch --preset NAME --yes HOST -- ...` or add `$HOME/.local/bin` to `PATH`. The summary goes to stderr so backend stdout stays machine-consumable.
 
-Add `$CODEX_DIR/bin` to `PATH` or invoke the wrappers by absolute path. `codex-helm` follows the local CLI default and launches the HELM main with `--dangerously-bypass-approvals-and-sandbox`; an explicit `--sandbox MODE` disables bypass for that run regardless of flag order. `AGENTS.md` gives root/main local Codex sessions standing ordinary-subagent authorization when the delegation gates fire. A non-Ultra HELM main sets native multi-agent off by default and instructs HELM to send tiered dispatch through the internal `codex-run` adapter, where the selected model, effort, and sandbox are pinned; native multi-agent defaults on only when the HELM main itself is explicitly Ultra. FRONTIER is instructed to run as a separate `gpt-5.6-sol` root that is always read-only, at max by default, Ultra for genuinely divisible complex work, or a lower supported effort when cost or latency dominates. Because the HELM main has bypass authority and arbitrary expert `-c` by design, this dispatch route is an instruction-backed, live-E2E-verified default rather than a security boundary. Keep `codex-run` as the low-level internal adapter, not as a user-facing policy boundary. Both wrappers accept `-c key=value` as an expert override, and that override may intentionally change wrapper defaults for a single run.
+When the internal Codex wrappers are available to a configured route, `codex-helm` follows the local CLI default and launches the HELM main with `--dangerously-bypass-approvals-and-sandbox`; an explicit `--sandbox MODE` disables bypass for that run regardless of flag order. `AGENTS.md` gives root/main local Codex sessions standing ordinary-subagent authorization when the delegation gates fire. A non-Ultra HELM main sets native multi-agent off by default and instructs HELM to send tiered dispatch through the internal `codex-run` adapter, where the selected model, effort, and sandbox are pinned; native multi-agent defaults on only when the HELM main itself is explicitly Ultra. FRONTIER is instructed to run as a separate `gpt-6-astra` root that is always read-only, at max by default, Ultra for genuinely divisible complex work, or a lower supported effort when cost or latency dominates. Because the HELM main has bypass authority and arbitrary expert `-c` by design, this dispatch route is an instruction-backed, live-E2E-verified default rather than a security boundary. Keep `codex-run` as the low-level internal adapter, not as a user-facing policy boundary. Both wrappers accept `-c key=value` as an expert override, and that override may intentionally change wrapper defaults for a single run. The private installer keeps wrapper files in its immutable release rather than populating `$CODEX_HOME/bin`; a route that still names a native-home wrapper is unavailable until its adapter path is resolved.
 
-`claude-run` is the Claude-side adapter, deployed to `$CLAUDE_DIR/bin`, and it takes `--model` and `--effort` to pin the seat. Omitting either warns and dispatches anyway, matching `codex-run`: refusing outright turned "the review ran unpinned" into "the review did not run", which is the worse of the two. The honest signal is downstream instead — an unpinned dispatch can name no seat, so it emits no receipt and the method adjudicates to UNKNOWN rather than to a clean pass. Its default denies the mutating tools, which is not the OS-level sandbox its Codex twin gets — do not read the two defaults as equivalent guarantees.
+`claude-run` is the Claude-side review adapter carried by the release, and it takes `--model` and `--effort` to pin the seat. Omitting either warns and dispatches anyway, matching `codex-run`: refusing outright turned "the review ran unpinned" into "the review did not run", which is the worse of the two. The honest signal is downstream instead — an unpinned dispatch can name no seat, so it emits no receipt and the method adjudicates to UNKNOWN rather than to a clean pass. Its default denies the mutating tools, which is not the OS-level sandbox its Codex twin gets — do not read the two defaults as equivalent guarantees.
 
 **Review receipts.** A launch reports what it *projected*, because at launch no review has run — so a clean verdict without a receipt is PROPOSED, never ACHIEVED. Given `REVIEW_RECEIPT_DIR`, both adapters record what they observed of the dispatch they just performed: exit status, a hash of the packet fed in, a hash of the bytes returned, and the seat actually sent. Unset, they behave exactly as they would otherwise and write nothing. `agent-launch --fold-receipts DIR PACKET MAIN_DISPATCH_ID` folds a run into a `ReviewReceipts/v1` bundle — several passes of one method become the one record it is judged on — and `agent-launch --verify-receipts PLAN BUNDLE` adjudicates it, exiting non-zero unless every selected method verified. Adapting another tool needs no change here: call `agent-launch --emit-receipt` from your adapter and prove it conforms with `agent-launch --check-adapter SEAT -- CMD`, which is adjudicated by the same code that credits a real review. A receipt is still written by whoever ran the review, so this buys drift rather than honesty: what it stops is a reviewer that quietly never ran, returned nothing, or exited non-zero reading as a clean pass.
 
-`agent-bios verify` runs the post-deploy gate (also run at the end of `install`): every `guides/*.md` referenced by the deployed global exists in that environment's `guides/`; required agent files `frontier.toml`, `workhorse.toml`, `sweep.toml`, and `reviewer.toml` exist under `$CODEX_DIR/agents/` and parse as TOML; `frontier.toml` deliberately omits `model_reasoning_effort` for native surfaces that accept per-spawn effort; each required `codex exec --help` flag in `DEPENDENCIES.md` is present; and `$CODEX_DIR/bin/codex-helm --dry-run --mode review "probe"` succeeds as a credential-free assembly check (not a live Codex call). `install` overwrites each guide's `Environment Binding`; keep per-environment binding edits in the repo copy or an untracked file.
+`agent-bios verify` checks the recorded immutable release file-by-file, reloads a
+non-empty catalog from that release, matches the store's last successful baseline to
+the install record, and verifies the owned launcher/profile/status projections. Its
+result says `activation: unverified`: neither stored bytes nor a dry-run argv proves a
+host loaded the snapshot.
+
+Corpus selection seeds future activated sessions, not plain CLI/Vanilla. A one-off
+`--corpus-domains` selection applies only to that launch. The store composes an
+immutable `ContentRef`; Codex startup preserves the effective native developer
+instructions, injects the private corpus and dynamic launch contract, creates and
+reads back a durable host thread, then records its pin. Claude uses the per-call
+append and requested session id and records a pin only after observing that id in the
+native session log. Real-host probes cover Codex and Claude first-turn delivery,
+including corpus propagation to a launcher-generated Claude workhorse. Claude
+resume restores the pin's exact environment provenance rather than changing an unset
+config-home variable into an explicit default. Post-fix authenticated resume remains
+unverified. Snapshot pin integrity alone does
+not establish that a resumed model request succeeded.
+
+The native Claude plugin bootstrap has advertised four selected plugin roots and three
+qualified corpus agents. An edited corpus `SessionStart` hook ran once automatically
+through its generated plugin, without a manual `--settings` file. Authenticated resume
+and native corpus-agent execution remain to be verified. This remains separate
+from the earlier launcher-tier child evidence. Native skill-menu registration remains
+unverified.
+
+Pins preserve environment provenance rather than reconstructing it: the host's
+config-home variable, and `HOME` when needed for default lookup, retain their
+recorded unset, set, or explicitly empty state. A relative native home is resolved
+from the recorded canonical cwd. Pins lacking that context fail explicitly at resume;
+it is never inferred from the caller's environment.
+
+Named native Codex profiles (`--profile` / `-p`) are not supported for private
+activation by the verified 0.153.4 adapter: that host exposes profiles on runtime
+commands but not its effective-config app-server surface. The launcher refuses
+this combination before creating a session rather than substituting base settings.
+Plain CLI/Vanilla profile use is unchanged.
+
+Every activated snapshot retains the immutable private management bootstrap and puts
+its exact path in the injected startup text, so `$corpus` has private procedure access
+even without native skill discovery. Selected requested procedures are exposed the same
+way. This is not a claim that either host registered them in its native skill menu;
+native skill registration remains unverified.
 
 ## Adopting elsewhere
 
@@ -115,4 +428,6 @@ Keep the rule layers. Swap checklist: every line carrying the `(private)` privat
 
 ## Scope
 
-Only stable configuration, config-managed credentials, and global agent instructions. No runtime state, logs, sessions, caches, generated artifacts, or temp paths.
+The repository and npm package contain corpus sources and private runtime machinery,
+not a user's authoring state, learning events, snapshots, pins, activation journals,
+credentials, native settings, or generated temporary files.