agent-embassy 1.6.0 → 1.7.0

package/dist/src/gateway/service.js

@@ -1,15 +1,14 @@
 import { createHash, randomBytes } from "node:crypto";
 import { BridgeError } from "../errors.js";
 import { KeyedMutex } from "../mutex.js";
-import { certifiedCompatibilityVersions, compatibilitySurfaceDefinitions, evaluateCompatibilityAttestation, isCompatibilityAttestation, } from "./compatibility.js";
-import { createGatewayConversationId, isGatewaySnapshot, startGatewayControlServer, } from "./control.js";
+import { createGatewayConversationId, isGatewaySnapshot, startGatewayControlServer, pairParamAliases, pairParamThreadAttestation, } from "./control.js";
 import { publishGatewayDashboard } from "./dashboard.js";
 import { createDeliveryMachine, isTerminalDeliveryMachine, projectDelivery, projectDeliveryWakeups, transitionDelivery, } from "./delivery-machine.js";
 import { createCodexRegistrationSuccession, transitionCodexRegistrationSuccession, } from "./codex-registration-succession.js";
 import { createCodexRegistrationGeneration, isCodexRegistrationGeneration, } from "./codex-registration-generation.js";
 import { PROGRESS_WATCH_DEFAULT_IDLE_MS } from "./progress-watch-machine.js";
 import { GatewayStore, } from "./store.js";
-import { GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET, gatewayPublicSnapshotLimits, arePublicAvailablePeerSnapshots, projectPublicCompatibilityCheck, projectGatewayPublicSnapshot, } from "./types.js";
+import { GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET, gatewayPublicSnapshotLimits, gatewayRegistrationIngressPrefixes, arePublicAvailablePeerSnapshots, directionId, parseDirection, projectGatewayPublicSnapshot, } from "./types.js";
 const PUBLIC_ALIAS = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
 const CLAUDE_SESSION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const SAFE_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
@@ -77,39 +76,13 @@ function bindingKey(binding) {
     ].join("\0");
 }
 function endpointRefreshCallbackKey(event) {
-    const attestation = {
-        schemaVersion: event.attestation.schemaVersion,
-        surface: event.attestation.surface,
-        version: event.attestation.version,
-        tier: event.attestation.tier,
-        checkedAt: event.attestation.checkedAt,
-        probes: event.attestation.probes.map((probe) => ({
-            name: probe.name,
-            outcome: probe.outcome,
-            ...(probe.safeErrorCode === undefined
-                ? {}
-                : { safeErrorCode: probe.safeErrorCode }),
-        })),
-        ...(event.attestation.safeErrorCode === undefined
-            ? {}
-            : { safeErrorCode: event.attestation.safeErrorCode }),
-    };
-    return event.outcome === "compatible"
-        ? JSON.stringify({
-            outcome: event.outcome,
-            previous: event.previous,
-            current: event.current,
-            attestation,
-            routes: [...event.routes]
-                .map((route) => ({ ...route }))
-                .sort((left, right) => left.routeHandle.localeCompare(right.routeHandle)),
-        })
-        : JSON.stringify({
-            outcome: event.outcome,
-            previous: event.previous,
-            candidate: event.candidate,
-            attestation,
-        });
+    return JSON.stringify({
+        previous: event.previous,
+        current: event.current,
+        routes: [...event.routes]
+            .map((route) => ({ ...route }))
+            .sort((left, right) => left.routeHandle.localeCompare(right.routeHandle)),
+    });
 }
 function stableLease(provider, value) {
     return `lease_${createHash("sha256").update(provider).update("\0").update(value).digest("base64url")}`;
@@ -149,8 +122,6 @@ export class GatewayService {
     config;
     store;
     adapters;
-    compatibilityObservers;
-    compatibilitySurfaceDefinitions;
     publishDashboard;
     now;
     timers;
@@ -176,9 +147,6 @@ export class GatewayService {
     deliveryTokens = new Map();
     runtimeAlerts = [];
     activityEvents = [];
-    /** Startup probe failures that must preflight cross-provider mutations. */
-    incompatibleProviderSurfaces = new Map();
-    activeCodexIncompatibility;
     activitySequence = 0;
     detachedReceiptWrites = new Set();
     nativeIngressByConversation = new Map();
@@ -202,8 +170,6 @@ export class GatewayService {
     durablyAppliedEndpointRefreshes = new Map();
     /** Selector transitions staged until their exact registration owns a helper. */
     pendingSelectorEndpointActivations = new Map();
-    /** Last incompatible transition already projected per allowed Codex host. */
-    handledIncompatibleEndpointRefreshes = new Map();
     /** Process-local dedupe for automatic public activity rows across retries. */
     endpointRefreshActivityKeys = new Set();
     callbackWorker;
@@ -247,9 +213,6 @@ export class GatewayService {
     constructor(options) {
         this.config = options.config;
         this.adapters = [...(options.adapters ?? [])];
-        this.compatibilityObservers = [...(options.compatibilityObservers ?? [])];
-        this.compatibilitySurfaceDefinitions =
-            options.compatibilitySurfaceDefinitions ?? compatibilitySurfaceDefinitions;
         this.publishDashboard = options.publishDashboard ?? publishGatewayDashboard;
         this.now = options.now ?? (() => new Date());
         this.store =
@@ -297,28 +260,41 @@ export class GatewayService {
                 }
                 seen.add(key);
             }
-            if (this.adapters.length > 0) {
-                await this.runAutomaticCompatibilityProbesLocked();
-                assertStartActive();
-            }
             for (const adapter of this.adapters) {
                 const observation = await adapter.initialize(this.callbacksFor(adapter));
                 assertStartActive();
+                this.captureRegistryObservation(adapter, adapter.latestRegistryObservation?.());
                 await this.store.observeConnector({
                     identity: adapter.identity,
                     health: observation.health,
-                    compatibility: observation.compatibility,
                     protocol: adapter.protocol,
                     protocolVersion: adapter.protocolVersion,
                     ...(observation.safeErrorCode === undefined
                         ? {}
                         : { safeErrorCode: safeCode(observation.safeErrorCode, "ADAPTER_DEGRADED") }),
                 });
+                if (observation.ownedRoute !== undefined) {
+                    const route = observation.ownedRoute;
+                    const prefix = gatewayRegistrationIngressPrefixes[adapter.identity.provider];
+                    if (prefix === undefined || !route.alias.startsWith(prefix) ||
+                        !route.alias.endsWith(`@${adapter.identity.hostId}`) ||
+                        !PUBLIC_ALIAS.test(route.alias) || !PRIVATE_HANDLE.test(route.routeHandle) ||
+                        route.state !== "idle") {
+                        throw new BridgeError("GATEWAY_OWNED_ROUTE_INVALID", "A config-declared provider route has invalid identity evidence.");
+                    }
+                    const binding = {
+                        ...adapter.identity,
+                        routeHandle: route.routeHandle,
+                        ownerLease: stableLease(adapter.identity.provider, `${adapter.identity.hostId}\0${route.alias}`),
+                    };
+                    await this.registerOrRebind(route.alias, binding, "endpoint_reobserved", route.state, binding.ownerLease, "explicit_opt_in");
+                    this.rememberBinding(route.alias, binding, route.state);
+                    bootReactivatedIdleAliases.push(route.alias);
+                }
                 assertStartActive();
             }
             await this.recoverCodexSuccessionAfterRestartLocked();
-            bootReactivatedIdleAliases =
-                await this.reactivateRetainedCodexRoutesAfterRestartLocked();
+            bootReactivatedIdleAliases.push(...(await this.reactivateRetainedCodexRoutesAfterRestartLocked()));
             assertStartActive();
             const control = await startGatewayControlServer({
                 stateDir: this.store.rootDir,
@@ -460,7 +436,6 @@ export class GatewayService {
                 this.deliveryTrackers.clear();
                 this.deliveryTokens.clear();
                 this.runtimeAlerts.length = 0;
-                this.incompatibleProviderSurfaces.clear();
                 this.registryEvidenceByConnector.clear();
                 this.registryAdaptersWithParseableRecords.clear();
                 this.detachedReceiptWrites.clear();
@@ -476,7 +451,6 @@ export class GatewayService {
                 this.activatedEndpointRefreshes.clear();
                 this.durablyAppliedEndpointRefreshes.clear();
                 this.pendingSelectorEndpointActivations.clear();
-                this.handledIncompatibleEndpointRefreshes.clear();
                 this.endpointRefreshActivityKeys.clear();
                 this.codexOrphanCleanupPending.clear();
                 this.candidates.clear();
@@ -536,12 +510,12 @@ export class GatewayService {
             pair: async (params) => await this.exclusiveDecision(async () => this.pairRoutes(params), {
                 kind: "pairing",
                 action: "routes_paired",
-                aliases: [params.claudeAlias, params.codexAlias],
+                aliases: [...pairParamAliases(params)],
             }),
             unpair: async (params) => await this.exclusiveDecision(async () => this.unpairRoutes(params), {
                 kind: "pairing",
                 action: "routes_unpaired",
-                aliases: [params.claudeAlias, params.codexAlias],
+                aliases: [...pairParamAliases(params)],
             }),
             listSnapshot: async () => (await this.observeSnapshot()).snapshot,
             observeSnapshot: async () => await this.observeSnapshot(),
@@ -572,88 +546,6 @@ export class GatewayService {
     async snapshot() {
         return (await this.observeSnapshot()).snapshot;
     }
-    async runAutomaticCompatibilityProbesLocked() {
-        const entries = [
-            ...this.adapters.map((adapter) => {
-                if (adapter.compatibilitySurface === undefined ||
-                    adapter.runCompatibilityProbes === undefined) {
-                    throw new BridgeError("COMPAT_PROVIDER_UNAVAILABLE", "Every local provider must expose the bounded compatibility probe contract.");
-                }
-                return {
-                    observer: adapter,
-                    adapter,
-                };
-            }),
-            ...this.compatibilityObservers.map((observer) => ({ observer })),
-        ];
-        const observedEntries = entries.map((entry) => ({
-            ...entry,
-            observation: entry.observer.compatibilitySurface(),
-        }));
-        const bySurface = new Map(observedEntries.map((entry) => [entry.observation.surface, entry]));
-        if (bySurface.size !== entries.length) {
-            throw new BridgeError("COMPAT_PROVIDER_UNAVAILABLE", "Each compatibility observer must expose one distinct surface.");
-        }
-        const declared = new Set(this.compatibilitySurfaceDefinitions.map(({ surface }) => surface));
-        if ([...bySurface.keys()].some((surface) => !declared.has(surface))) {
-            throw new BridgeError("COMPAT_SURFACE_UNDECLARED", "Every compatibility observer must use a declared surface.");
-        }
-        const forbiddenCodexThreadIds = (await this.store.inspectPrivateCodexRoutes()).map((route) => route.binding.routeHandle);
-        const probeContext = {
-            stateRoot: this.store.rootDir,
-            forbiddenCodexThreadIds,
-        };
-        const attestations = [];
-        for (const definition of this.compatibilitySurfaceDefinitions) {
-            const { surface } = definition;
-            const entry = bySurface.get(surface);
-            if (entry === undefined) {
-                if (!definition.required)
-                    continue;
-                throw new BridgeError("COMPAT_PROVIDER_UNAVAILABLE", "A required compatibility surface is unavailable.");
-            }
-            const probes = entry.adapter === undefined
-                ? await entry.observer.runCompatibilityProbes()
-                : await entry.adapter.runCompatibilityProbes(probeContext);
-            if (entry.adapter !== undefined) {
-                const writeProbe = entry.adapter.latestWriteCompatibilityProbeObservation?.(entry.adapter.identity.endpointGeneration);
-                if (writeProbe?.outcome === "fail") {
-                    this.addRuntimeAlert(writeProbe.safeErrorCode, writeProbe.safeErrorCode === "CODEX_WRITE_PROBE_TOOL_ACTIVITY_OBSERVED" ||
-                        writeProbe.safeErrorCode === "CODEX_WRITE_PROBE_CLEANUP_UNCONFIRMED"
-                        ? "error"
-                        : "warning", { provider: "codex", host: entry.adapter.identity.hostId });
-                }
-                this.captureRegistryObservation(entry.adapter, entry.adapter.latestRegistryObservation?.());
-            }
-            const attestation = evaluateCompatibilityAttestation({
-                surface,
-                version: entry.observation.version,
-                checkedAt: this.now().toISOString(),
-                certifiedVersions: certifiedCompatibilityVersions[surface],
-                probes,
-            });
-            await this.store.recordCompatibilityAttestation(attestation);
-            entry.observer.acceptCompatibilityAttestation?.(attestation);
-            if (attestation.tier === "incompatible" && entry.adapter !== undefined) {
-                const code = attestation.safeErrorCode ?? "COMPATIBILITY_CHECK_FAILED";
-                this.incompatibleProviderSurfaces.set(this.providerSurfaceKey(entry.adapter.identity.provider, entry.adapter.identity.hostId), code);
-                if (surface === "codex") {
-                    this.activeCodexIncompatibility = structuredClone(attestation);
-                }
-            }
-            else if (surface === "codex" &&
-                attestation.tier === "schema_attested" &&
-                entry.adapter !== undefined) {
-                // A live but untested App Server schema is useful for observation only.
-                // Fence retained boot reactivation before it can trigger endpoint
-                // refresh churn; an explicit registration may still re-probe a later,
-                // certified generation through the provider's bounded refresh path.
-                this.incompatibleProviderSurfaces.set(this.providerSurfaceKey("codex", entry.adapter.identity.hostId), "CODEX_MONITOR_ONLY");
-            }
-            attestations.push(attestation);
-        }
-        return attestations;
-    }
     captureRegistryObservation(adapter, observation) {
         if (adapter.identity.provider !== "claude" ||
             observation === undefined ||
@@ -881,50 +773,30 @@ export class GatewayService {
                 });
             },
             onEndpointRefresh: (event) => {
+                if (!Array.isArray(event.routes))
+                    return;
+                const routeHandles = event.routes.map((route) => route.routeHandle);
                 if (!this.running ||
                     adapter.identity.provider !== "codex" ||
                     event.previous.provider !== "codex" ||
                     event.previous.hostId !== adapter.identity.hostId ||
-                    !isCompatibilityAttestation(event.attestation) ||
-                    event.attestation.surface !== "codex") {
-                    return;
-                }
-                if (event.outcome === "compatible") {
-                    const routeHandles = event.routes.map((route) => route.routeHandle);
-                    if (event.current.provider !== "codex" ||
-                        event.current.hostId !== event.previous.hostId ||
-                        event.current.endpointGeneration !==
-                            adapter.identity.endpointGeneration ||
-                        event.attestation.version !== adapter.protocolVersion ||
-                        event.attestation.tier === "incompatible" ||
-                        routeHandles.length > this.config.limits.maxRoutes ||
-                        new Set(routeHandles).size !== routeHandles.length ||
-                        routeHandles.some((routeHandle) => !PRIVATE_HANDLE.test(routeHandle))) {
-                        return;
-                    }
-                }
-                else if (event.candidate.provider !== "codex" ||
-                    event.candidate.hostId !== event.previous.hostId ||
-                    event.previous.endpointGeneration !==
+                    event.current.provider !== "codex" ||
+                    event.current.hostId !== event.previous.hostId ||
+                    event.current.endpointGeneration !==
                         adapter.identity.endpointGeneration ||
-                    event.attestation.tier !== "incompatible") {
+                    routeHandles.length > this.config.limits.maxRoutes ||
+                    new Set(routeHandles).size !== routeHandles.length ||
+                    routeHandles.some((routeHandle) => !PRIVATE_HANDLE.test(routeHandle))) {
                     return;
                 }
                 this.enqueueCallback({
                     type: "endpoint_refresh",
                     adapter,
-                    value: event.outcome === "compatible"
-                        ? {
-                            ...event,
-                            previous: { ...event.previous },
-                            current: { ...event.current },
-                            routes: event.routes.map((route) => ({ ...route })),
-                        }
-                        : {
-                            ...event,
-                            previous: { ...event.previous },
-                            candidate: { ...event.candidate },
-                        },
+                    value: {
+                        previous: { ...event.previous },
+                        current: { ...event.current },
+                        routes: event.routes.map((route) => ({ ...route })),
+                    },
                 });
             },
         };
@@ -1071,7 +943,7 @@ export class GatewayService {
                         await this.onDelivery(event.source, event.value, event.receivedAt);
                     }
                     else if (event.type === "route") {
-                        if (pendingRefresh?.outcome === "compatible" &&
+                        if (pendingRefresh !== undefined &&
                             event.source.provider === "codex" &&
                             event.source.hostId === pendingRefresh.current.hostId &&
                             event.source.endpointGeneration ===
@@ -1201,12 +1073,7 @@ export class GatewayService {
         await this.drainDetachedReceiptWritesLocked();
     }
     async failClosedEndpointRefreshConflict(boundary) {
-        const identities = [
-            boundary.value.previous,
-            ...(boundary.value.outcome === "compatible"
-                ? [boundary.value.current]
-                : []),
-        ];
+        const identities = [boundary.value.previous, boundary.value.current];
         for (const identity of identities) {
             const routes = (await this.store.inspectPrivateCodexRoutes()).filter((route) => route.binding.hostId === identity.hostId &&
                 route.binding.endpointGeneration === identity.endpointGeneration);
@@ -1308,23 +1175,6 @@ export class GatewayService {
             throw new BridgeError("PROVIDER_UNAVAILABLE", "The selected provider is unavailable.", true);
         return adapter;
     }
-    providerSurfaceKey(provider, host) {
-        return `${provider}@${host}`;
-    }
-    incompatibleProviderCode(provider, host) {
-        return this.incompatibleProviderSurfaces.get(this.providerSurfaceKey(provider, host));
-    }
-    /** Reject before either half of a cross-provider mutation can acquire state. */
-    assertCrossProviderMutationCompatible(host, options = { allowCodexRefresh: false }) {
-        const claudeCode = this.incompatibleProviderCode("claude", host);
-        if (claudeCode !== undefined) {
-            throw new BridgeError(claudeCode, "The Claude provider is observation-only until Embassy restarts with a compatible runtime.");
-        }
-        const codexCode = this.incompatibleProviderCode("codex", host);
-        if (codexCode !== undefined && !options.allowCodexRefresh) {
-            throw new BridgeError(codexCode, "The Codex provider is observation-only until a compatible endpoint is re-observed.");
-        }
-    }
     async assertClaudeWorkspaceDisjoint(adapter, routeHandle) {
         if (adapter.identity.provider !== "claude") {
             throw new BridgeError("CLAUDE_PROVIDER_MISMATCH", "The selected workspace guard does not belong to Claude.");
@@ -1382,7 +1232,6 @@ export class GatewayService {
         for (const route of retained) {
             if (!route.enabled ||
                 route.state !== "stale" ||
-                route.compatibility !== "expired" ||
                 this.pendingCodexSuccessionRecovery?.journal.new.alias === route.alias ||
                 this.codexSuccessionPoisoned.has(route.alias)) {
                 continue;
@@ -1395,13 +1244,6 @@ export class GatewayService {
                 this.addRuntimeAlert("CODEX_BOOT_REACTIVATION_SKIPPED", "warning", { provider: "codex", host: route.binding.hostId, alias: route.alias });
                 continue;
             }
-            if (this.incompatibleProviderCode("codex", route.binding.hostId) !==
-                undefined ||
-                this.incompatibleProviderCode("claude", route.binding.hostId) !==
-                    undefined) {
-                this.addRuntimeAlert("CODEX_BOOT_REACTIVATION_SKIPPED", "warning", { provider: "codex", host: route.binding.hostId, alias: route.alias });
-                continue;
-            }
             let routeSelected = false;
             let advertiseAttempted = false;
             let storeReactivated = false;
@@ -1439,19 +1281,20 @@ export class GatewayService {
                     storeReactivated =
                         afterStaging !== undefined &&
                             afterStaging.enabled &&
-                            afterStaging.compatibility === "compatible" &&
+                            afterStaging.state !== "stale" &&
                             bindingKey(afterStaging.binding) === bindingKey(binding);
                 }
                 advertiseAttempted = true;
-                const advertise = claudeAdapter.advertiseNativeCodexPeer;
+                const advertise = claudeAdapter.advertiseNativeSourcePeer;
                 if (advertise === undefined) {
                     throw new BridgeError("CODEX_BOOT_REACTIVATION_UNAVAILABLE", "The retained Codex task cannot rebuild its native advertisement.");
                 }
                 await advertise.call(claudeAdapter, {
                     alias: route.alias,
+                    sourceProvider: "codex",
                     cwd: this.nativePeerCwd,
                 });
-                await claudeAdapter.updateNativeCodexPeerStatus?.(route.alias, selected.state === "idle"
+                await claudeAdapter.updateNativeSourcePeerStatus?.(route.alias, selected.state === "idle"
                     ? "idle"
                     : selected.state === "awaiting_approval"
                         ? "waiting"
@@ -1495,7 +1338,7 @@ export class GatewayService {
                 let cleanupFailed = false;
                 if (advertiseAttempted) {
                     await claudeAdapter
-                        .unadvertiseNativeCodexPeer?.(route.alias)
+                        .unadvertiseNativeSourcePeer?.(route.alias)
                         .catch(() => {
                         cleanupFailed = true;
                     });
@@ -1627,7 +1470,7 @@ export class GatewayService {
             oldInspection.binding.ownerLease !==
                 stableLease("codex", `${lock.hostId}\0${lock.threadId}`) ||
             !oldInspection.enabled ||
-            oldInspection.compatibility !== "compatible") {
+            oldInspection.state === "stale") {
             throw new BridgeError("CODEX_SUCCESSION_OWNER_MISMATCH", "The active Codex registration is no longer exact and compatible.");
         }
         const claudeAdapter = this.adapter("claude", params.hostId);
@@ -1936,7 +1779,7 @@ export class GatewayService {
                 this.rememberBinding(effect.registration.alias, execution.newBinding, state);
                 this.codexRegistrationLocks.delete(this.successionOldRegistration(execution).alias);
                 this.codexRegistrationLocks.set(effect.registration.alias, Object.freeze({ ...effect.registration }));
-                await claudeAdapter.updateNativeCodexPeerStatus?.(effect.registration.alias, state === "idle"
+                await claudeAdapter.updateNativeSourcePeerStatus?.(effect.registration.alias, state === "idle"
                     ? "idle"
                     : state === "awaiting_approval"
                         ? "waiting"
@@ -2081,8 +1924,8 @@ export class GatewayService {
                     throw new BridgeError("CODEX_SUCCESSION_DRAIN_INCOMPLETE", "Interrupted generations cannot close before pending work and receipts are drained. Restart the gateway with embassy serve.");
                 }
                 const results = await Promise.allSettled([
-                    claudeAdapter.unadvertiseNativeCodexPeer?.(execution.oldRegistration.alias),
-                    claudeAdapter.unadvertiseNativeCodexPeer?.(execution.newRegistration.alias),
+                    claudeAdapter.unadvertiseNativeSourcePeer?.(execution.oldRegistration.alias),
+                    claudeAdapter.unadvertiseNativeSourcePeer?.(execution.newRegistration.alias),
                     codexAdapter.releaseRoute?.(execution.oldRegistration.threadId),
                     codexAdapter.releaseRoute?.(execution.newRegistration.threadId),
                 ]);
@@ -2307,9 +2150,6 @@ export class GatewayService {
         if (!params.alias.startsWith("codex-")) {
             throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "A registered Codex alias must start with codex-.");
         }
-        this.assertCrossProviderMutationCompatible(params.hostId, {
-            allowCodexRefresh: params.succeedsAlias === undefined,
-        });
         if (this.codexSuccessionPoisoned.has(params.alias) ||
             this.codexOrphanCleanupPending.has(params.alias) ||
             (params.succeedsAlias !== undefined &&
@@ -2380,7 +2220,7 @@ export class GatewayService {
             const afterRefresh = await this.store.inspectPrivateRoute(params.alias);
             const alreadyInstalledExactly = afterRefresh !== undefined &&
                 afterRefresh.enabled &&
-                afterRefresh.compatibility === "compatible" &&
+                afterRefresh.state !== "stale" &&
                 bindingKey(afterRefresh.binding) === bindingKey(binding);
             if (!alreadyInstalledExactly || !deferredEndpointRefresh) {
                 await this.registerOrRebind(params.alias, binding, "endpoint_reobserved", registered.state);
@@ -2395,15 +2235,16 @@ export class GatewayService {
         try {
             this.rememberBinding(params.alias, binding, registered.state);
             const claudeAdapter = this.adapter("claude", params.hostId);
-            const advertise = claudeAdapter.advertiseNativeCodexPeer;
+            const advertise = claudeAdapter.advertiseNativeSourcePeer;
             if (advertise !== undefined) {
                 advertiseAttempted = true;
                 await advertise.call(claudeAdapter, {
                     alias: params.alias,
+                    sourceProvider: "codex",
                     cwd: this.nativePeerCwd,
                 });
             }
-            await claudeAdapter.updateNativeCodexPeerStatus?.(params.alias, registered.state === "idle"
+            await claudeAdapter.updateNativeSourcePeerStatus?.(params.alias, registered.state === "idle"
                 ? "idle"
                 : registered.state === "awaiting_approval"
                     ? "waiting"
@@ -2425,8 +2266,7 @@ export class GatewayService {
         }
         catch (error) {
             if (routeBeforeRegistration !== undefined) {
-                if (deferredEndpointRefresh &&
-                    registered.endpointRefresh?.outcome === "compatible") {
+                if (deferredEndpointRefresh && registered.endpointRefresh !== undefined) {
                     try {
                         await this.store.markConnectorOffline(registered.endpointRefresh.current, "CODEX_ENDPOINT_ACTIVATION_FAILED", [], { preserveQueued: true });
                         this.routeStates.set(params.alias, "stale");
@@ -2508,7 +2348,7 @@ export class GatewayService {
         });
         if (advertiseAttempted) {
             await this.adapter("claude", params.hostId)
-                .unadvertiseNativeCodexPeer?.(params.alias)
+                .unadvertiseNativeSourcePeer?.(params.alias)
                 .catch(() => {
                 cleanupFailed = true;
             });
@@ -2535,7 +2375,7 @@ export class GatewayService {
         }
         this.forgetBinding(params.alias);
         await this.adapter("claude", host)
-            .unadvertiseNativeCodexPeer?.(params.alias)
+            .unadvertiseNativeSourcePeer?.(params.alias)
             .catch(() => {
             this.dashboardHealthy = false;
         });
@@ -2706,7 +2546,7 @@ export class GatewayService {
             }
             await this.requireUnchangedStaleCodexOrphan(alias, binding);
             if (nativeGeneration !== undefined) {
-                const unadvertise = claudeAdapter.unadvertiseNativeCodexPeer;
+                const unadvertise = claudeAdapter.unadvertiseNativeSourcePeer;
                 if (unadvertise === undefined) {
                     throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener cannot be removed exactly.");
                 }
@@ -2896,7 +2736,6 @@ export class GatewayService {
         for (const route of persisted) {
             if (!route.enabled ||
                 route.state !== "stale" ||
-                route.compatibility !== "expired" ||
                 !CLAUDE_SESSION_ID.test(route.binding.routeHandle) ||
                 route.binding.ownerLease !==
                     stableLease("claude", route.binding.routeHandle)) {
@@ -2920,8 +2759,7 @@ export class GatewayService {
                     alias,
                     provider: "claude",
                     host: row.adapter.identity.hostId,
-                    state: "incompatible",
-                    compatibility: "incompatible",
+                    state: "offline",
                     validated: false,
                     selected: false,
                     safeErrorCode: row.safeErrorCode,
@@ -2939,7 +2777,6 @@ export class GatewayService {
                 provider: "claude",
                 host: row.adapter.identity.hostId,
                 state: row.peer.state,
-                compatibility: row.peer.compatibility,
                 validated: true,
                 selected,
             });
@@ -2948,7 +2785,6 @@ export class GatewayService {
                 await this.store.observeRoute({
                     binding: selectedBinding,
                     state: row.peer.state,
-                    compatibility: "compatible",
                 });
             }
         }
@@ -2963,7 +2799,7 @@ export class GatewayService {
             const inspection = await this.store.inspectPrivateRoute(alias);
             if (inspection !== undefined &&
                 inspection.enabled &&
-                inspection.compatibility === "compatible") {
+                inspection.state !== "stale") {
                 await this.drainPreDeadlineDeliveryCallbacksLocked();
                 const inFlightSettlements = await this.planRouteInFlightSettlementsLocked(alias, {
                     unwrittenOutcome: "failed",
@@ -3040,7 +2876,6 @@ export class GatewayService {
         const expectedLease = stableLease("claude", candidate.routeHandle);
         if (!persisted.enabled ||
             persisted.state !== "stale" ||
-            persisted.compatibility !== "expired" ||
             persisted.binding.provider !== "claude" ||
             candidate.adapter.identity.provider !== "claude" ||
             persisted.binding.hostId !== candidate.adapter.identity.hostId ||
@@ -3106,7 +2941,6 @@ export class GatewayService {
                 binding,
                 registrationMode: "selected_live_peer",
                 state: selected.state,
-                compatibility: "compatible",
             });
             this.rememberBinding(candidate.alias, binding, selected.state);
         }
@@ -3158,7 +2992,6 @@ export class GatewayService {
                     binding,
                     registrationMode: "selected_live_peer",
                     state: selectedState,
-                    compatibility: "compatible",
                 },
                 inFlightSettlements,
             });
@@ -3231,47 +3064,83 @@ export class GatewayService {
         }
         return candidate.alias;
     }
-    assertCodexPairCaller(params) {
-        const binding = this.routeBindings.get(params.codexAlias);
+    assertPairThreadAttestation(params) {
+        const attestation = pairParamThreadAttestation(params);
+        const legacyAlias = "codexAlias" in params ? params.codexAlias : undefined;
+        if (attestation === undefined && legacyAlias === undefined)
+            return;
+        const binding = this.routeBindings.get(attestation?.alias ?? legacyAlias);
         if (binding?.provider !== "codex" ||
-            (params.codexThreadId !== undefined &&
-                binding.routeHandle !== params.codexThreadId)) {
+            (attestation !== undefined && binding.routeHandle !== attestation.threadId)) {
             throw new BridgeError("CODEX_CALLER_MISMATCH", "The inherited Codex task does not own the requested pair endpoint.");
         }
     }
     async pairRoutes(params) {
-        this.assertCodexPairCaller(params);
-        await this.selectAndPairClaude(params.claudeAlias, params.codexAlias);
+        this.assertPairThreadAttestation(params);
+        if ("claudeAlias" in params) {
+            await this.selectAndPairClaude(params.claudeAlias, params.codexAlias);
+            return;
+        }
+        await this.assertLiveConsentEndpoints(params.aliases);
+        const added = await this.store.addConsentEdge({ aliases: params.aliases });
+        if (added.created)
+            await this.changed();
+        else
+            await this.publish();
     }
     async unpairRoutes(params) {
-        this.assertCodexPairCaller(params);
-        const selected = await this.selectedClaudeRoute(params.claudeAlias);
-        await this.unpairClaudeRoute(selected, params.codexAlias);
+        this.assertPairThreadAttestation(params);
+        const aliases = pairParamAliases(params);
+        if (!("claudeAlias" in params))
+            await this.assertLiveConsentEndpoints(aliases);
+        await this.removeConsentEdge(aliases);
+    }
+    async assertLiveConsentEndpoints(aliases) {
+        const routes = await Promise.all(aliases.map((alias) => this.store.inspectPrivateRoute(alias)));
+        if (routes[0] === undefined || routes[1] === undefined) {
+            throw new BridgeError("CONSENT_EDGE_ROUTE_NOT_FOUND", "Both consent endpoints must be registered.");
+        }
+        for (const route of routes) {
+            const live = this.routeBindings.get(route.alias);
+            if (!route.enabled ||
+                route.state === "stale" ||
+                live === undefined ||
+                bindingKey(live) !== bindingKey(route.binding) ||
+                this.adapter(route.binding.provider, route.binding.hostId).identity.endpointGeneration !==
+                    route.binding.endpointGeneration) {
+                throw new BridgeError("ROUTE_UNAVAILABLE", "Both consent endpoints must be exact positively observed live routes.");
+            }
+        }
+        if (routes[0].binding.provider === routes[1].binding.provider || routes[0].binding.hostId !== routes[1].binding.hostId) {
+            throw new BridgeError("INVALID_CONSENT_EDGE", "A consent edge must connect distinct providers on the same host.");
+        }
+        return routes;
     }
-    async unpairClaudeRoute(selected, codexAlias) {
+    async removeConsentEdge(aliases) {
         await this.drainPreDeadlineDeliveryCallbacksLocked();
-        const pair = {
-            claudeAlias: selected.alias,
-            codexAlias,
-        };
-        const inFlightSettlements = await this.planPairInFlightSettlementsLocked(pair, {
+        const routes = await Promise.all(aliases.map((alias) => this.store.inspectPrivateRoute(alias)));
+        const edge = { aliases };
+        const inFlightSettlements = await this.planConsentEdgeInFlightSettlementsLocked(edge, {
             unwrittenOutcome: "cancelled",
             safeErrorCode: "PAIR_REMOVED",
         });
-        const result = await this.store.unpairRoutes({
-            ...pair,
+        const result = await this.store.removeConsentEdge({
+            ...edge,
             inFlightSettlements,
         });
         for (const settlement of result.settlements) {
             await this.applyTerminalSettlementLocked(settlement);
         }
-        this.purgePairCapabilitiesLocked(pair);
-        if (result.claudeRouteUnreferenced) {
-            const settlements = await this.store.unregisterRoute(selected.alias, selected.binding.ownerLease);
+        this.purgeConsentEdgeCapabilitiesLocked(aliases);
+        for (const alias of result.unreferencedAliases) {
+            const selected = routes.find((route) => route?.alias === alias);
+            if (selected?.binding.provider !== "claude" || selected.registrationMode !== "selected_live_peer")
+                continue;
+            const settlements = await this.store.unregisterRoute(alias, selected.binding.ownerLease);
             for (const settlement of settlements) {
                 await this.applyTerminalSettlementLocked(settlement);
             }
-            this.forgetBinding(selected.alias);
+            this.forgetBinding(alias);
             await this.adapters
                 .find((adapter) => adapter.identity.provider === "claude" &&
                 adapter.identity.hostId === selected.binding.hostId)
@@ -3279,7 +3148,7 @@ export class GatewayService {
                 .catch(() => {
                 this.dashboardHealthy = false;
             });
-            this.availablePeers = this.availablePeers.map((peer) => peer.alias === selected.alias ? { ...peer, selected: false } : peer);
+            this.availablePeers = this.availablePeers.map((peer) => peer.alias === alias ? { ...peer, selected: false } : peer);
         }
         await this.changed();
     }
@@ -3288,17 +3157,6 @@ export class GatewayService {
     }
     async selectAndPairClaude(selector, codexAlias) {
         const codexBinding = this.routeBindings.get(codexAlias);
-        const retainedCodexRoute = codexBinding?.provider === "codex"
-            ? undefined
-            : await this.store.inspectPrivateRoute(codexAlias);
-        const codexHost = codexBinding?.provider === "codex"
-            ? codexBinding.hostId
-            : retainedCodexRoute?.binding.provider === "codex"
-                ? retainedCodexRoute.binding.hostId
-                : undefined;
-        if (codexHost !== undefined) {
-            this.assertCrossProviderMutationCompatible(codexHost);
-        }
         const codexAdapter = codexBinding?.provider === "codex"
             ? this.adapters.find((adapter) => adapter.identity.provider === "codex" &&
                 adapter.identity.hostId === codexBinding.hostId)
@@ -3338,10 +3196,7 @@ export class GatewayService {
         }
         let paired;
         try {
-            paired = await this.store.pairRoutes({
-                claudeAlias: candidate.alias,
-                codexAlias,
-            });
+            paired = await this.store.addConsentEdge({ aliases: [candidate.alias, codexAlias] });
         }
         catch (error) {
             if (!alreadyLive &&
@@ -3381,7 +3236,7 @@ export class GatewayService {
     async unselectClaude(params) {
         const codexAlias = await this.inferCodexAlias(params.codexThreadId);
         const selected = await this.selectedClaudeRoute(params.alias);
-        await this.unpairClaudeRoute(selected, codexAlias);
+        await this.removeConsentEdge([selected.alias, codexAlias]);
     }
     async selectedClaudeRoute(selector) {
         const persisted = await this.store.inspectPrivateClaudeRoutes();
@@ -3393,14 +3248,13 @@ export class GatewayService {
             throw new BridgeError("PEER_NOT_FOUND", "No selected Claude session matches that selector.");
         return selected;
     }
-    async registerOrRebind(alias, binding, reason, state, currentOwnerLease = binding.ownerLease) {
+    async registerOrRebind(alias, binding, reason, state, currentOwnerLease = binding.ownerLease, registrationMode = binding.provider === "codex" ? "explicit_opt_in" : "selected_live_peer") {
         try {
             await this.store.registerRoute({
                 alias,
                 binding,
-                registrationMode: binding.provider === "codex" ? "explicit_opt_in" : "selected_live_peer",
+                registrationMode,
                 state,
-                compatibility: "compatible",
             });
         }
         catch (error) {
@@ -3470,14 +3324,12 @@ export class GatewayService {
         await this.store.observeConnector({
             identity: adapter.identity,
             health: "healthy",
-            compatibility: "compatible",
             protocol: adapter.protocol,
             protocolVersion: adapter.protocolVersion,
         });
         await this.store.observeRoute({
             binding,
             state,
-            compatibility: "compatible",
         });
         return binding;
     }
@@ -3793,8 +3645,8 @@ export class GatewayService {
             };
         });
     }
-    async planPairInFlightSettlementsLocked(pair, input) {
-        const affected = await this.store.inspectAffectedPairInFlightMessages(pair);
+    async planConsentEdgeInFlightSettlementsLocked(edge, input) {
+        const affected = await this.store.inspectAffectedConsentEdgeInFlightMessages(edge);
         const observedAt = this.now().getTime();
         return affected.map(({ messageId }) => {
             const tracker = this.deliveryTrackers.get(messageId);
@@ -3825,9 +3677,8 @@ export class GatewayService {
             };
         });
     }
-    purgePairCapabilitiesLocked(pair) {
-        const matches = (sourceAlias, targetAlias) => (sourceAlias === pair.claudeAlias && targetAlias === pair.codexAlias) ||
-            (sourceAlias === pair.codexAlias && targetAlias === pair.claudeAlias);
+    purgeConsentEdgeCapabilitiesLocked(aliases) {
+        const matches = (sourceAlias, targetAlias) => aliases.includes(sourceAlias) && aliases.includes(targetAlias);
         const conversationIds = new Set();
         for (const [conversationId, conversation] of this.conversations) {
             if (conversation.pair !== true ||
@@ -4611,12 +4462,13 @@ export class GatewayService {
      * native-ingress boundary; this preserves the exact connector generation
      * without recreating route authority or accepting a new unsolicited send.
      */
-    async enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, text) {
+    async enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, expectedTargetBinding, text) {
         const target = await this.store.resolveRoute(conversation.sourceAlias);
         if (sourceBinding.provider !== "claude" ||
-            target.provider !== "codex" ||
+            target.provider === "claude" ||
+            target.provider !== expectedTargetBinding.provider || target.ownerLease !== expectedTargetBinding.ownerLease ||
             sourceBinding.hostId !== target.hostId) {
-            throw new BridgeError("RECOVERED_REPLY_ROUTE_MISMATCH", "The retained provider reply no longer matches an exact same-host Codex target.");
+            throw new BridgeError("RECOVERED_REPLY_ROUTE_MISMATCH", "The retained provider reply no longer matches an exact same-host non-Claude target.");
         }
         const sequence = conversation.nextSequence;
         const enqueuedAt = this.now().getTime();
@@ -4647,6 +4499,7 @@ export class GatewayService {
             expectsReply: false,
             sequence,
             targetBindingKey: bindingKey(target),
+            sourceBinding: { ...sourceBinding },
             authorization: "selected_route",
             targetAlias: conversation.sourceAlias,
             deadlineAt,
@@ -4659,7 +4512,7 @@ export class GatewayService {
             deadlineAt,
         });
         await this.changed();
-        await this.setNativeCodexStatus(conversation.sourceAlias, "waiting");
+        await this.setNativeSourceStatus(conversation.sourceAlias, "waiting");
         this.scheduleDispatch(conversation.sourceAlias);
     }
     pruneTransient() {
@@ -4879,7 +4732,6 @@ export class GatewayService {
                 !dispatchable ||
                 inspection === undefined ||
                 !inspection.enabled ||
-                inspection.compatibility !== "compatible" ||
                 !storedDispatchable ||
                 bindingKey(inspection.binding) !== bindingKey(binding) ||
                 bindingKey(selectedBinding) !== bindingKey(binding)) {
@@ -4969,10 +4821,26 @@ export class GatewayService {
                     })).markerActive
                     : false;
         }
+        const sourceBinding = context.sourceBinding ??
+            (await this.store.inspectPrivateRoute(item.sourceAlias))?.binding;
+        const parsedDirection = parseDirection(item.direction);
+        if (sourceBinding === undefined ||
+            parsedDirection?.sourceProvider !== sourceBinding.provider ||
+            parsedDirection.targetProvider !== binding.provider ||
+            item.direction !== directionId(sourceBinding.provider, binding.provider)) {
+            await this.finishDelivery({
+                messageId: item.messageId,
+                state: "failed",
+                safeErrorCode: "MESSAGE_DIRECTION_BINDING_MISMATCH",
+            });
+            return;
+        }
+        context.sourceBinding ??= { ...sourceBinding };
         let result;
         try {
             result = await this.awaitDispatchWithNativeHeldLocked(tracker, this.adapter(binding.provider, binding.hostId).dispatch({
                 sourceAlias: item.sourceAlias,
+                sourceProvider: sourceBinding.provider,
                 targetAlias: item.targetAlias,
                 conversationId: context.conversationId,
                 binding,
@@ -5065,13 +4933,12 @@ export class GatewayService {
                         await this.store.observeRoute({
                             binding,
                             state: "idle",
-                            compatibility: "compatible",
                         });
                     }
                     else if (binding.provider === "codex") {
                         this.scheduleHeldRedispatch(currentTargetAlias);
                     }
-                    await this.setNativeCodexStatus(currentTargetAlias, "waiting");
+                    await this.setNativeSourceStatus(currentTargetAlias, "waiting");
                 }
             }
             else if (requeued.status === "settled") {
@@ -5282,13 +5149,12 @@ export class GatewayService {
                         .then(() => true)
                         .catch(() => false);
                     const pairStillActive = conversation.pair !== true ||
-                        (await this.store.hasPair({
-                            claudeAlias: conversation.targetAlias,
-                            codexAlias: conversation.sourceAlias,
+                        (await this.store.hasConsentEdge({
+                            aliases: [conversation.targetAlias, conversation.sourceAlias],
                         }));
                     if ((!sourceStillRoutable || !pairStillActive) &&
-                        sourceBinding?.provider === "claude") {
-                        await this.enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, replyText);
+                        sourceBinding?.provider === "claude" && context.sourceBinding !== undefined) {
+                        await this.enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, context.sourceBinding, replyText);
                     }
                     else {
                         await this.enqueue(conversation.targetAlias, conversation.sourceAlias, replyText, false, {
@@ -5381,7 +5247,7 @@ export class GatewayService {
             };
             const collision = this.routeBindings.get(event.sourceAlias);
             if (target === undefined ||
-                target.provider !== "codex" ||
+                target.provider === "claude" ||
                 target.hostId !== event.endpoint.hostId ||
                 (collision !== undefined &&
                     bindingKey(collision) !== bindingKey(sourceBinding))) {
@@ -5423,6 +5289,7 @@ export class GatewayService {
                 expectsReply: !steer,
                 sequence: 0,
                 targetBindingKey: bindingKey(target),
+                sourceBinding: { ...sourceBinding },
                 authorization: "selected_route",
                 targetAlias: event.targetAlias,
                 deadlineAt,
@@ -5448,7 +5315,7 @@ export class GatewayService {
                 deadlineAt,
             });
             await this.changed();
-            await this.setNativeCodexStatus(event.targetAlias, "waiting");
+            await this.setNativeSourceStatus(event.targetAlias, "waiting");
             // Native ingress gets one immediate dispatch opportunity. Only an
             // actual queued/waiting result earns a `held` acknowledgement; an idle
             // fast path can therefore settle with one terminal acknowledgement.
@@ -5518,7 +5385,7 @@ export class GatewayService {
             return activationDeferred;
         }
         finally {
-            if (!succeeded && event.outcome === "compatible") {
+            if (!succeeded) {
                 adapter.releaseEndpointRefreshSelectorClaim?.(event.current.endpointGeneration);
             }
             if (ownsActiveTransition &&
@@ -5537,56 +5404,29 @@ export class GatewayService {
         }
     }
     async applyCodexEndpointRefresh(adapter, event, transitionKey, options) {
+        const routeHandles = Array.isArray(event.routes)
+            ? event.routes.map((route) => route.routeHandle)
+            : [];
         if (this.closing ||
-            (event.outcome !== "compatible" && event.outcome !== "incompatible") ||
-            !isCompatibilityAttestation(event.attestation) ||
-            event.attestation.surface !== "codex" ||
             event.previous.provider !== "codex" ||
             !PRIVATE_HANDLE.test(event.previous.endpointGeneration) ||
             adapter.identity.provider !== "codex" ||
             adapter.identity.hostId !== event.previous.hostId ||
-            !this.config.allowedHosts.includes(event.previous.hostId)) {
+            !this.config.allowedHosts.includes(event.previous.hostId) ||
+            event.current.provider !== "codex" ||
+            event.current.hostId !== event.previous.hostId ||
+            !PRIVATE_HANDLE.test(event.current.endpointGeneration) ||
+            event.current.endpointGeneration === event.previous.endpointGeneration ||
+            adapter.identity.endpointGeneration !== event.current.endpointGeneration ||
+            !Array.isArray(event.routes) ||
+            event.routes.length > this.config.limits.maxRoutes ||
+            new Set(routeHandles).size !== routeHandles.length ||
+            event.routes.some((route) => !PRIVATE_HANDLE.test(route.routeHandle) ||
+                !["idle", "busy", "awaiting_approval"].includes(route.state))) {
             throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The Codex endpoint transition failed closed runtime validation.");
         }
-        if (event.outcome === "compatible") {
-            const routeHandles = Array.isArray(event.routes)
-                ? event.routes.map((route) => route.routeHandle)
-                : [];
-            if (event.current.provider !== "codex" ||
-                event.current.hostId !== event.previous.hostId ||
-                !PRIVATE_HANDLE.test(event.current.endpointGeneration) ||
-                event.current.endpointGeneration ===
-                    event.previous.endpointGeneration ||
-                adapter.identity.endpointGeneration !==
-                    event.current.endpointGeneration ||
-                event.attestation.version !== adapter.protocolVersion ||
-                event.attestation.tier === "incompatible" ||
-                !Array.isArray(event.routes) ||
-                event.routes.length > this.config.limits.maxRoutes ||
-                new Set(routeHandles).size !== routeHandles.length ||
-                event.routes.some((route) => !PRIVATE_HANDLE.test(route.routeHandle) ||
-                    !["idle", "busy", "awaiting_approval"].includes(route.state))) {
-                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The refreshed Codex provider identity changed before activation.");
-            }
-            if (this.activatedEndpointRefreshes.get(event.current.hostId) ===
-                transitionKey) {
-                return false;
-            }
-        }
-        else {
-            if (event.candidate.provider !== "codex" ||
-                event.candidate.hostId !== event.previous.hostId ||
-                !PRIVATE_HANDLE.test(event.candidate.endpointGeneration) ||
-                event.candidate.endpointGeneration ===
-                    event.previous.endpointGeneration ||
-                adapter.identity.endpointGeneration !==
-                    event.previous.endpointGeneration ||
-                event.attestation.tier !== "incompatible") {
-                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The incompatible Codex candidate no longer matches the active endpoint.");
-            }
-            if (this.handledIncompatibleEndpointRefreshes.get(event.previous.hostId) === transitionKey) {
-                return false;
-            }
+        if (this.activatedEndpointRefreshes.get(event.current.hostId) === transitionKey) {
+            return false;
         }
         let inventory = await this.store.inspectPrivateCodexRoutes();
         const previousRoutes = inventory.filter((route) => route.binding.hostId === event.previous.hostId &&
@@ -5604,11 +5444,10 @@ export class GatewayService {
             settlements = await this.store.markConnectorOffline(event.previous, "ENDPOINT_GENERATION_CHANGED", inFlightSettlements, { preserveQueued: true });
         }
         catch (error) {
-            const alreadyInvalidatedCompatibleTransition = event.outcome === "compatible" &&
-                error instanceof BridgeError &&
+            const alreadyInvalidatedTransition = error instanceof BridgeError &&
                 error.code === "CONNECTOR_NOT_FOUND" &&
-                previousRoutes.every((route) => route.state === "stale" && route.compatibility === "expired");
-            if (!alreadyInvalidatedCompatibleTransition)
+                previousRoutes.every((route) => route.state === "stale");
+            if (!alreadyInvalidatedTransition)
                 throw error;
         }
         for (const settlement of settlements) {
@@ -5617,45 +5456,9 @@ export class GatewayService {
         for (const route of previousRoutes) {
             this.routeStates.set(route.alias, "stale");
         }
-        await this.store.recordCompatibilityAttestation(event.attestation);
-        if (event.outcome === "incompatible") {
-            await this.requireEndpointRefreshUnconflicted();
-            this.activeCodexIncompatibility = structuredClone(event.attestation);
-            this.incompatibleProviderSurfaces.set(this.providerSurfaceKey("codex", event.previous.hostId), event.attestation.safeErrorCode ?? "CODEX_ENDPOINT_INCOMPATIBLE");
-            this.addRuntimeAlert(event.attestation.safeErrorCode ?? "CODEX_ENDPOINT_INCOMPATIBLE", "error", { provider: "codex", host: event.previous.hostId });
-            this.handledIncompatibleEndpointRefreshes.set(event.previous.hostId, transitionKey);
-            await this.changed();
-            return false;
-        }
-        if (event.attestation.tier === "schema_attested") {
-            // A passing untested-version schema is useful observation, but it is not
-            // durable route or write authority. Settle the provider's pending probe
-            // so a later generation can be examined, while leaving every G1 route
-            // stale and refusing selector/registration activation.
-            await this.requireEndpointRefreshUnconflicted();
-            await this.store.observeConnector({
-                identity: event.current,
-                health: "degraded",
-                compatibility: "unknown",
-                protocol: adapter.protocol,
-                protocolVersion: adapter.protocolVersion,
-                safeErrorCode: "CODEX_MONITOR_ONLY",
-            });
-            adapter.acceptCompatibilityAttestation(event.attestation);
-            this.activeCodexIncompatibility = undefined;
-            this.incompatibleProviderSurfaces.set(this.providerSurfaceKey("codex", event.current.hostId), "CODEX_MONITOR_ONLY");
-            this.handledIncompatibleEndpointRefreshes.delete(event.current.hostId);
-            await this.changed();
-            if (options.deferActivation === true ||
-                options.requiredRoute !== undefined) {
-                throw new BridgeError("CODEX_MONITOR_ONLY", "This Codex App Server passed read-only schema probes but cannot authorize a task route or message write.");
-            }
-            return false;
-        }
         await this.store.observeConnector({
             identity: event.current,
             health: "healthy",
-            compatibility: "compatible",
             protocol: adapter.protocol,
             protocolVersion: adapter.protocolVersion,
         });
@@ -5710,7 +5513,7 @@ export class GatewayService {
                         route.binding.routeHandle === expected.threadId &&
                         route.binding.ownerLease === expected.ownerLease &&
                         route.enabled &&
-                        route.compatibility === "compatible");
+                        route.state !== "stale");
                     return matches.length === 1;
                 });
                 if (committedExactly) {
@@ -5743,8 +5546,7 @@ export class GatewayService {
                     route.binding.hostId !== event.current.hostId ||
                     route.binding.endpointGeneration !==
                         event.current.endpointGeneration ||
-                    route.state !== "stale" ||
-                    route.compatibility !== "expired") {
+                    route.state !== "stale") {
                     continue;
                 }
                 await this.registerOrRebind(route.alias, route.binding, "endpoint_reobserved", state, route.binding.ownerLease);
@@ -5759,7 +5561,7 @@ export class GatewayService {
                     event.current.endpointGeneration &&
                 route.binding.routeHandle === observed.routeHandle &&
                 route.enabled &&
-                route.compatibility === "compatible");
+                route.state !== "stale");
             if (matches.length > 1) {
                 throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "A refreshed Codex task has multiple durable owners.");
             }
@@ -5799,7 +5601,7 @@ export class GatewayService {
                     event.current.endpointGeneration &&
                 route.binding.routeHandle === requiredRoute.threadId &&
                 route.enabled &&
-                route.compatibility === "compatible");
+                route.state !== "stale");
             const match = matches[0];
             if (matches.length !== 1 || match === undefined) {
                 throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The registering Codex task was not durably installed exactly.");
@@ -5853,7 +5655,7 @@ export class GatewayService {
             }
             for (const route of activatedRoutes) {
                 requireNativeContinuity(route);
-                await this.setNativeCodexStatus(route.alias, route.state === "idle"
+                await this.setNativeSourceStatus(route.alias, route.state === "idle"
                     ? "idle"
                     : route.state === "awaiting_approval"
                         ? "waiting"
@@ -5893,10 +5695,7 @@ export class GatewayService {
             for (const route of activatedRoutes) {
                 requireNativeContinuity(route);
             }
-            // Provider writes remain closed until every durable and native transition
-            // above is complete. This acknowledgement is deliberately the final
-            // fallible activation step.
-            adapter.acceptCompatibilityAttestation(event.attestation);
+            adapter.activateEndpointGeneration(event.current.endpointGeneration);
         }
         catch (error) {
             try {
@@ -5916,9 +5715,6 @@ export class GatewayService {
             ?.transitionKey === transitionKey) {
             this.pendingSelectorEndpointActivations.delete(event.current.hostId);
         }
-        this.handledIncompatibleEndpointRefreshes.delete(event.current.hostId);
-        this.activeCodexIncompatibility = undefined;
-        this.incompatibleProviderSurfaces.delete(this.providerSurfaceKey("codex", event.current.hostId));
         return false;
     }
     async onRouteState(source, event) {
@@ -5940,7 +5736,6 @@ export class GatewayService {
         await this.store.observeConnector({
             identity: source,
             health: event.state === "stale" ? "degraded" : "healthy",
-            compatibility: event.state === "stale" ? "expired" : "compatible",
             protocol: adapter.protocol,
             protocolVersion: adapter.protocolVersion,
             ...(event.safeErrorCode === undefined
@@ -5956,7 +5751,6 @@ export class GatewayService {
             await this.store.observeRoute({
                 binding,
                 state: "stale",
-                compatibility: "expired",
                 safeErrorCode: staleSafeCode,
             });
         }
@@ -5964,7 +5758,6 @@ export class GatewayService {
             await this.store.observeRoute({
                 binding,
                 state: event.state,
-                compatibility: "compatible",
                 ...(event.safeErrorCode === undefined
                     ? {}
                     : {
@@ -5974,15 +5767,15 @@ export class GatewayService {
         }
         await this.store.touchProgressWatchesForAlias(alias);
         await this.changed();
-        if (binding.provider === "codex") {
-            await this.setNativeCodexStatus(alias, event.state === "idle"
+        if (binding.provider !== "claude") {
+            await this.setNativeSourceStatus(alias, event.state === "idle"
                 ? "idle"
                 : event.state === "awaiting_approval"
                     ? "waiting"
                     : "busy");
-            if (previousState === "stale" && event.state !== "stale") {
-                adapter.rearmEndpointRefreshActivation?.(binding.endpointGeneration);
-            }
+        }
+        if (binding.provider === "codex" && previousState === "stale" && event.state !== "stale") {
+            adapter.rearmEndpointRefreshActivation?.(binding.endpointGeneration);
         }
         if (event.state === "idle" || event.state === "stale") {
             const heldTimer = this.heldRedispatchTimers.get(alias);
@@ -5993,12 +5786,12 @@ export class GatewayService {
             this.scheduleDispatch(alias);
         }
     }
-    async setNativeCodexStatus(alias, status, requireSuccess = false) {
+    async setNativeSourceStatus(alias, status, requireSuccess = false) {
         const binding = this.routeBindings.get(alias);
-        if (binding?.provider !== "codex")
+        if (binding === undefined || binding.provider === "claude")
             return;
         const adapter = this.adapter("claude", binding.hostId);
-        const update = adapter.updateNativeCodexPeerStatus;
+        const update = adapter.updateNativeSourcePeerStatus;
         if (update === undefined) {
             if (requireSuccess) {
                 throw new BridgeError("CODEX_ENDPOINT_REFRESH_NATIVE_STATUS_FAILED", "The native listener does not support refreshed Codex status activation.", true);
@@ -6097,30 +5890,6 @@ export class GatewayService {
     }
     async publicSnapshotLocked() {
         const base = await this.store.publicSnapshot();
-        const compatibilityChecks = [];
-        for (const { surface } of this.compatibilitySurfaceDefinitions) {
-            if (surface === "codex" && this.activeCodexIncompatibility !== undefined) {
-                compatibilityChecks.push(structuredClone(this.activeCodexIncompatibility));
-                continue;
-            }
-            const currentVersions = [
-                ...new Set([...this.adapters, ...this.compatibilityObservers].flatMap((observer) => {
-                    const observation = observer.compatibilitySurface?.();
-                    return observation?.surface === surface ? [observation.version] : [];
-                })),
-            ].sort((left, right) => left.localeCompare(right));
-            const currentAttestations = (await Promise.all(currentVersions.map(async (version) => await this.store.inspectCompatibilityAttestation(surface, version))))
-                .filter((attestation) => attestation !== undefined)
-                .sort((left, right) => {
-                const checkedAt = right.checkedAt.localeCompare(left.checkedAt);
-                if (checkedAt !== 0)
-                    return checkedAt;
-                return left.version.localeCompare(right.version);
-            });
-            const selected = currentAttestations[0];
-            if (selected !== undefined)
-                compatibilityChecks.push(selected);
-        }
         const peers = this.availablePeers.map((peer) => ({ ...peer }));
         if (!arePublicAvailablePeerSnapshots(peers)) {
             throw new BridgeError("INVALID_TRANSIENT_INVENTORY", "The transient peer inventory is unsafe.");
@@ -6149,11 +5918,6 @@ export class GatewayService {
         return projectGatewayPublicSnapshot({
             ...base,
             connectors: this.connectorsWithRegistry(base.connectors),
-            ...(compatibilityChecks.length === 0
-                ? {}
-                : {
-                    compatibilityChecks: compatibilityChecks.map(projectPublicCompatibilityCheck),
-                }),
             availablePeers: peers,
             activityEvents: this.activityEvents.map((event) => ({
                 ...event,