agent-embassy 1.6.1 → 1.7.1

package/dist/src/gateway/providers.js

@@ -1,13 +1,12 @@
 import path from "node:path";
-import { chmod, lstat, mkdir, mkdtemp, readdir, realpath, rmdir, } from "node:fs/promises";
 import { BridgeError } from "../errors.js";
 import { CLAUDE_PEER_COMPATIBILITY, ClaudePeerAdapter, } from "./claude-peer.js";
-import { certifiedCompatibilityVersions, compatibilityCoversWrites, compatibilityProbeNames, evaluateCompatibilityAttestation, isCompatibilityAttestation, isCompatibilityVersion, sharesCompatibilityMajor, UNKNOWN_COMPATIBILITY_VERSION, } from "./compatibility.js";
-import { CODEX_APP_SERVER_WRITABLE_VERSIONS, CodexAppServerConnector, CodexConnectorError, codexWriteProbeFailure, } from "./codex-app-server.js";
+import { CodexAppServerConnector, CodexConnectorError, } from "./codex-app-server.js";
 import { LocalCodexTransportError } from "./codex-local-transport.js";
 import { ClaudeNativeHelperSupervisor, } from "./claude-helper-supervisor.js";
 import { isDashboardLocale } from "./locale.js";
 import { composeProvenanceEnvelope } from "./provenance-envelope.js";
+import { gatewayRegistrationIngressPrefixes } from "./types.js";
 const LOCAL_HOST = "this-mac";
 const STABLE_CLAUDE_ENDPOINT_GENERATION = "claude_local_endpoint";
 const NATIVE_CLAUDE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
@@ -23,14 +22,8 @@ const DEFAULT_CODEX_CLEANUP_TIMEOUT_MS = 5_000;
 const DEFAULT_CODEX_CLEANUP_POLL_MS = 25;
 const DEFAULT_CODEX_RECOVERY_INITIAL_MS = 250;
 const DEFAULT_CODEX_RECOVERY_MAX_MS = 5_000;
+const DEFAULT_CODEX_OBSERVATION_POLL_MS = 15_000;
 const MAX_CODEX_ENDPOINT_REFRESH_CANDIDATES = 3;
-const COMPATIBILITY_PROBE_THREAD_ID = "00000000-0000-7000-8000-000000000000";
-const CODEX_WRITE_PROBE_DIRECTORY_PREFIX = ".codex-write-probe-";
-const CODEX_WRITE_PROBE_ROOT = "write-probes";
-const MAX_CODEX_WRITE_PROBE_ATTEMPTS = 16;
-const CODEX_WRITE_PROBE_TRANSIENT_ERRNOS = new Set([
-    "EAGAIN", "EIO", "EMFILE", "ENFILE",
-]);
 const CLAUDE_CLEAN_PREWRITE_RETRY_CODES = new Set([
     "CLAUDE_PEER_TARGET_UNKNOWN",
     "CLAUDE_PEER_TARGET_STALE",
@@ -86,105 +79,6 @@ function claudeCleanPrewriteResult(error) {
                         : "CLAUDE_DISPATCH_PREWRITE_FAILED",
     };
 }
-function passedProbe(name) {
-    return { name, outcome: "pass" };
-}
-function failedProbe(name, safeErrorCode) {
-    return { name, outcome: "fail", safeErrorCode };
-}
-function systemErrorCode(error) {
-    return typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        typeof error.code === "string"
-        ? error.code
-        : undefined;
-}
-function transientCodexWriteProbeError(error) {
-    return CODEX_WRITE_PROBE_TRANSIENT_ERRNOS.has(systemErrorCode(error) ?? "");
-}
-function safeCodexWriteProbeFilesystemFailure(error) {
-    return (transientCodexWriteProbeError(error) ||
-        systemErrorCode(error) === "ENOTEMPTY" ||
-        (error instanceof BridgeError &&
-            error.code === "CODEX_WRITE_PROBE_THREAD_SETUP_FAILED"));
-}
-async function attestCodexWriteProbeDirectory(directory) {
-    try {
-        const resolved = path.resolve(directory);
-        const [metadata, canonical, entries] = await Promise.all([
-            lstat(resolved, { bigint: true }),
-            realpath(resolved),
-            readdir(resolved),
-        ]);
-        const uid = process.getuid?.();
-        if (uid === undefined ||
-            !metadata.isDirectory() ||
-            canonical !== resolved ||
-            metadata.uid !== BigInt(uid) ||
-            (metadata.mode & 511n) !== 448n) {
-            throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The disposable Codex probe directory crossed its ownership, mode, or canonical-path boundary.");
-        }
-        if (entries.length !== 0) {
-            throw new BridgeError("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED", "The disposable Codex probe directory was not empty.");
-        }
-        return {
-            dev: metadata.dev,
-            ino: metadata.ino,
-            mode: metadata.mode & 511n,
-            mtimeNs: metadata.mtimeNs,
-            uid: metadata.uid,
-        };
-    }
-    catch (error) {
-        if (error instanceof BridgeError)
-            throw error;
-        if (transientCodexWriteProbeError(error)) {
-            throw new BridgeError("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED", "A transient filesystem error prevented disposable probe attestation.");
-        }
-        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The disposable Codex probe directory could not be attested safely.");
-    }
-}
-async function attestCodexWriteProbeRoot(root) {
-    try {
-        const resolved = path.resolve(root);
-        const [metadata, canonical] = await Promise.all([
-            lstat(resolved, { bigint: true }),
-            realpath(resolved),
-        ]);
-        const uid = process.getuid?.();
-        if (uid === undefined ||
-            !metadata.isDirectory() ||
-            canonical !== resolved ||
-            metadata.uid !== BigInt(uid) ||
-            (metadata.mode & 511n) !== 448n) {
-            throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "A controller-owned Codex probe root changed outside its exact owned-directory boundary.");
-        }
-        return {
-            dev: metadata.dev,
-            ino: metadata.ino,
-            mode: metadata.mode & 511n,
-            uid: metadata.uid,
-        };
-    }
-    catch (error) {
-        if (error instanceof BridgeError)
-            throw error;
-        if (transientCodexWriteProbeError(error)) {
-            return null;
-        }
-        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "A controller-owned Codex probe root could not be attested.");
-    }
-}
-function sameCodexWriteProbeDirectory(before, after) {
-    return sameCodexWriteProbeRoot(before, after) && before.mtimeNs === after.mtimeNs;
-}
-function sameCodexWriteProbeRoot(before, after) {
-    return (before.dev === after.dev &&
-        before.ino === after.ino &&
-        before.mode === after.mode &&
-        before.uid === after.uid);
-}
 function exactLocalHost(hostId) {
     if ((hostId ?? LOCAL_HOST) !== LOCAL_HOST) {
         throw new BridgeError("GATEWAY_REMOTE_PROVIDER_DISABLED", "This provider is restricted to the exact local host boundary.");
@@ -226,18 +120,6 @@ function invokeCallback(operation) {
     }
 }
 function validateAttestedClaudeRuntime(runtime) {
-    if (runtime.versionEvidenceFailure !== undefined) {
-        throw new BridgeError(runtime.versionEvidenceFailure, "The local Claude provider requires bounded, internally consistent runtime version evidence.");
-    }
-    const majorEvidence = runtime.claudeCodeVersion === UNKNOWN_COMPATIBILITY_VERSION
-        ? runtime.launcherVersionEvidence
-        : runtime.claudeCodeVersion;
-    if (majorEvidence === undefined ||
-        !sharesCompatibilityMajor(majorEvidence, CLAUDE_PEER_COMPATIBILITY.claudeCodeVersion)) {
-        throw new BridgeError(majorEvidence === undefined
-            ? "CLAUDE_VERSION_UNPARSEABLE"
-            : "CLAUDE_PEER_VERSION_UNSUPPORTED", "The local Claude provider requires a positively observed supported runtime major.");
-    }
     validateClaudeRuntimePathEvidence(runtime);
 }
 function validateClaudeRuntimePathEvidence(runtime) {
@@ -286,135 +168,17 @@ function isClaudeRegistryAvailabilityError(error) {
         error.code === "EPERM" ||
         error.code === "UNSAFE_PEER_DIRECTORY");
 }
-/**
- * A bounded observation-only surface for an installed provider generation
- * whose protocol cannot be used safely. It deliberately performs no provider
- * discovery, listener construction, route selection, or message write.
- */
-export class IncompatibleGatewayProvider {
-    identity;
-    protocol = "not-attested";
-    protocolVersion = "unknown";
-    version;
-    probes;
-    safeErrorCode;
-    initialized = false;
-    closed = false;
-    constructor(options) {
-        const attestation = evaluateCompatibilityAttestation({
-            surface: options.identity.provider,
-            version: options.version,
-            checkedAt: "2000-01-01T00:00:00.000Z",
-            certifiedVersions: certifiedCompatibilityVersions[options.identity.provider],
-            probes: options.probes,
-        });
-        if (attestation.tier !== "incompatible" ||
-            attestation.safeErrorCode !== options.safeErrorCode) {
-            throw new BridgeError("INCOMPATIBLE_PROVIDER_EVIDENCE_INVALID", "A disabled provider requires exact bounded incompatibility evidence.");
-        }
-        exactLocalHost(options.identity.hostId);
-        this.identity = Object.freeze({ ...options.identity });
-        this.version = options.version;
-        this.probes = Object.freeze(options.probes.map((probe) => Object.freeze({ ...probe })));
-        this.safeErrorCode = options.safeErrorCode;
-    }
-    compatibilitySurface() {
-        return { surface: this.identity.provider, version: this.version };
-    }
-    async runCompatibilityProbes() {
-        return this.probes;
-    }
-    acceptCompatibilityAttestation(attestation) {
-        if (!isCompatibilityAttestation(attestation) ||
-            attestation.surface !== this.identity.provider ||
-            attestation.version !== this.version ||
-            attestation.tier !== "incompatible" ||
-            attestation.safeErrorCode !== this.safeErrorCode ||
-            attestation.probes.length !== this.probes.length ||
-            attestation.probes.some((probe, index) => probe.name !== this.probes[index]?.name ||
-                probe.outcome !== this.probes[index]?.outcome ||
-                probe.safeErrorCode !== this.probes[index]?.safeErrorCode)) {
-            throw new BridgeError("INCOMPATIBLE_PROVIDER_ATTESTATION_MISMATCH", "The compatibility attestation does not match this disabled provider surface.");
-        }
-    }
-    async initialize(_callbacks) {
-        if (this.closed || this.initialized) {
-            throw new BridgeError("INCOMPATIBLE_PROVIDER_UNAVAILABLE", "The disabled provider surface cannot be initialized again.");
-        }
-        this.initialized = true;
-        return {
-            health: "degraded",
-            compatibility: "incompatible",
-            safeErrorCode: this.safeErrorCode,
-        };
-    }
-    async discoverClaudePeers() {
-        throw this.unavailable();
-    }
-    async selectRoute(_input) {
-        throw this.unavailable();
-    }
-    async assertWorkspaceDisjoint(_routeHandle, _stateRoot) {
-        throw this.unavailable();
-    }
-    async resolveReplyAddress(_address) {
-        throw this.unavailable();
-    }
-    async advertiseNativeCodexPeer(_input) {
-        throw this.unavailable();
-    }
-    async dispatch(_input) {
-        throw this.unavailable();
-    }
-    async releaseRoute(_routeHandle) { }
-    async close() {
-        this.closed = true;
-    }
-    unavailable() {
-        return new BridgeError(this.safeErrorCode, "This provider surface is observation-only because its compatibility boundary did not pass.");
-    }
-}
-export function createIncompatibleClaudeGatewayProvider(options) {
-    validateClaudeRuntimePathEvidence(options.runtime);
-    const [launcher, version, ...unobserved] = compatibilityProbeNames.claude;
-    return new IncompatibleGatewayProvider({
-        identity: {
-            provider: "claude",
-            hostId: LOCAL_HOST,
-            endpointGeneration: STABLE_CLAUDE_ENDPOINT_GENERATION,
-        },
-        version: options.version,
-        probes: [
-            passedProbe(launcher),
-            failedProbe(version, options.safeErrorCode),
-            ...unobserved.map((name) => failedProbe(name, options.safeErrorCode)),
-        ],
-        safeErrorCode: options.safeErrorCode,
-    });
-}
-export function createIncompatibleCodexGatewayProvider(options) {
-    const [installation, ...unobserved] = compatibilityProbeNames.codex;
-    return new IncompatibleGatewayProvider({
-        identity: options.identity,
-        version: options.version,
-        probes: [
-            passedProbe(installation),
-            ...unobserved.map((name) => failedProbe(name, options.safeErrorCode)),
-        ],
-        safeErrorCode: options.safeErrorCode,
-    });
-}
 export class LocalClaudeGatewayProvider {
     identity;
     protocol = "claude-peer";
     protocolVersion = `${CLAUDE_PEER_COMPATIBILITY.peerProtocol}`;
     peer;
-    runtimeVersion;
     maxPending;
     discoveryPollMs;
     now;
     selectedStateRoots = new Map();
     nativeHelpers;
+    nativeHelperSourceProvider;
     discovered = new Map();
     selected = new Map();
     /** Exact live same-UID sessions observed through native inbound frames. */
@@ -448,25 +212,12 @@ export class LocalClaudeGatewayProvider {
     retiredNativeCodexListener;
     /** Fences discovery callbacks and monitor restarts across listener rotation. */
     nativeCodexSuccessionFreeze;
-    /** A completed failed probe set fences every authority-bearing operation. */
-    compatibilityBlocked = false;
-    compatibilityFailureCode;
+    /** External registry trust/availability failures degrade Claude only. */
+    unavailableCode;
     initialized = false;
     closed = false;
     constructor(options) {
         validateAttestedClaudeRuntime(options.runtime);
-        const compatibilityVersion = options.compatibilityVersion ??
-            (options.runtime.claudeCodeVersion === UNKNOWN_COMPATIBILITY_VERSION
-                ? options.runtime.launcherVersionEvidence
-                : options.runtime.claudeCodeVersion);
-        if (compatibilityVersion === undefined ||
-            !isCompatibilityVersion(compatibilityVersion) ||
-            (compatibilityVersion !== options.runtime.claudeCodeVersion &&
-                !(options.runtime.claudeCodeVersion ===
-                    UNKNOWN_COMPATIBILITY_VERSION &&
-                    options.runtime.launcherVersionEvidence === compatibilityVersion))) {
-            throw new BridgeError("CLAUDE_RUNTIME_ATTESTATION_INVALID", "Claude compatibility classification requires exact bounded launcher evidence.");
-        }
         if (options.locale !== undefined && !isDashboardLocale(options.locale)) {
             throw new BridgeError("DASHBOARD_LOCALE_UNSUPPORTED", "The Claude provider notice locale is unsupported.");
         }
@@ -476,15 +227,12 @@ export class LocalClaudeGatewayProvider {
             hostId,
             endpointGeneration: STABLE_CLAUDE_ENDPOINT_GENERATION,
         };
-        this.runtimeVersion = compatibilityVersion;
         this.maxPending = positiveBounded(options.maxPendingMessages, MAX_CLAUDE_PENDING, 4_096);
         this.discoveryPollMs = positiveBounded(options.discoveryPollMs, DEFAULT_CLAUDE_DISCOVERY_POLL_MS, 30_000);
         this.now = options.now ?? Date.now;
         const protocolRuntime = {
             claudeExecutable: options.runtime.claudeExecutable,
-            claudeCodeVersion: options.runtime.claudeCodeVersion === UNKNOWN_COMPATIBILITY_VERSION
-                ? options.runtime.launcherVersionEvidence
-                : options.runtime.claudeCodeVersion,
+            claudeCodeVersion: options.runtime.claudeCodeVersion,
             sessionsDir: options.runtime.sessionsDir,
             socketDir: options.runtime.socketDir,
         };
@@ -506,60 +254,19 @@ export class LocalClaudeGatewayProvider {
                     deliveryNotices: options.deliveryNotices ?? "merged",
                     maxPendingMessages: this.maxPending,
                     maxHelpers: positiveBounded(options.nativeHelpers.maxHelpers, 256, 128),
-                    callbacks: () => this.compatibilityBlocked ? undefined : this.callbacks,
+                    callbacks: () => this.callbacks,
                     ...(options.nativeHelpers.factory === undefined
                         ? {}
                         : { factory: options.nativeHelpers.factory }),
                 });
-    }
-    compatibilitySurface() {
-        return { surface: "claude", version: this.runtimeVersion };
-    }
-    async runCompatibilityProbes() {
-        const [launcher, version, registry, socket, protocol] = compatibilityProbeNames.claude;
-        try {
-            const discovery = await this.peer.discover();
-            this.registryObservation = claudeRegistryObservation(discovery);
-            return [
-                passedProbe(launcher),
-                passedProbe(version),
-                passedProbe(registry),
-                passedProbe(socket),
-                passedProbe(protocol),
-            ];
-        }
-        catch (error) {
-            if (!isClaudeRegistryAvailabilityError(error))
-                throw error;
-            this.registryObservation = unavailableClaudeRegistryObservation();
-            // A missing or unreadable registry is provider-local incompatibility:
-            // keep the broker and the other surface alive, but fence this provider
-            // before listener construction can turn the same missing path into a
-            // broker-wide startup failure.
-            return [
-                passedProbe(launcher),
-                passedProbe(version),
-                failedProbe(registry, "CLAUDE_REGISTRY_UNAVAILABLE"),
-                failedProbe(socket, "CLAUDE_REGISTRY_UNAVAILABLE"),
-                passedProbe(protocol),
-            ];
-        }
+        this.nativeHelperSourceProvider = options.nativeHelperSourceProvider;
     }
     latestRegistryObservation() {
         return this.registryObservation;
     }
-    acceptCompatibilityAttestation(attestation) {
-        if (!isCompatibilityAttestation(attestation) ||
-            attestation.surface !== "claude" ||
-            attestation.version !== this.runtimeVersion) {
-            throw new BridgeError("CLAUDE_COMPATIBILITY_ATTESTATION_MISMATCH", "The Claude compatibility attestation does not match this runtime.");
-        }
-        this.compatibilityBlocked = attestation.tier === "incompatible";
-        this.compatibilityFailureCode = attestation.safeErrorCode;
-        if (this.compatibilityBlocked) {
-            if (this.monitorTimer !== undefined)
-                clearTimeout(this.monitorTimer);
-            this.monitorTimer = undefined;
+    activateEndpointGeneration(endpointGeneration) {
+        if (endpointGeneration !== this.identity.endpointGeneration) {
+            throw new BridgeError("CLAUDE_ENDPOINT_ACTIVATION_MISMATCH", "Only the exact current Claude endpoint generation can be activated.");
         }
     }
     async initialize(callbacks) {
@@ -570,17 +277,9 @@ export class LocalClaudeGatewayProvider {
             throw new BridgeError("CLAUDE_PROVIDER_ALREADY_INITIALIZED", "The local Claude provider can be initialized only once.");
         }
         this.callbacks = callbacks;
-        if (this.compatibilityBlocked) {
-            this.initialized = true;
-            return {
-                health: "degraded",
-                compatibility: "incompatible",
-                safeErrorCode: this.compatibilityFailureCode ?? "CLAUDE_COMPATIBILITY_CHECK_FAILED",
-            };
-        }
         if (this.nativeHelpers !== undefined) {
             this.initialized = true;
-            return { health: "healthy", compatibility: "compatible" };
+            return { health: "healthy" };
         }
         try {
             let listenerGeneration;
@@ -615,18 +314,16 @@ export class LocalClaudeGatewayProvider {
             }
             this.activeNativeCodexListener = listenerGeneration;
             this.initialized = true;
-            return { health: "healthy", compatibility: "compatible" };
+            return { health: "healthy" };
         }
         catch (error) {
             if (error instanceof BridgeError &&
                 error.code === "UNSAFE_PEER_DIRECTORY") {
-                this.compatibilityBlocked = true;
-                this.compatibilityFailureCode = "CLAUDE_REGISTRY_UNAVAILABLE";
+                this.unavailableCode = "CLAUDE_REGISTRY_UNAVAILABLE";
                 this.registryObservation = unavailableClaudeRegistryObservation();
                 this.initialized = true;
                 return {
                     health: "degraded",
-                    compatibility: "incompatible",
                     safeErrorCode: "CLAUDE_REGISTRY_UNAVAILABLE",
                 };
             }
@@ -671,12 +368,16 @@ export class LocalClaudeGatewayProvider {
         }
         return { routeHandle: resolved.targetId };
     }
-    async advertiseNativeCodexPeer(input) {
+    async advertiseNativeSourcePeer(input) {
         if (this.nativeHelpers !== undefined) {
             this.assertReady();
             await this.nativeHelpers.advertise(input);
             return;
         }
+        if (input.sourceProvider !== "codex" &&
+            input.sourceProvider !== this.nativeHelperSourceProvider) {
+            throw new BridgeError("CLAUDE_NATIVE_HELPER_UNAVAILABLE", "A non-Codex source requires a supervised native Claude helper.", true);
+        }
         const registration = this.nativeCodexRegistration(input);
         await this.serializeNativeCodexRegistration(async () => {
             this.assertReady();
@@ -763,7 +464,7 @@ export class LocalClaudeGatewayProvider {
             this.retiredNativeCodexListener !== undefined) {
             throw new BridgeError("CODEX_PEER_SUCCESSION_CAPACITY", "Only one distinct prepared or retired Codex generation is allowed.");
         }
-        const registration = this.nativeCodexRegistration(input);
+        const registration = this.nativeCodexRegistration({ ...input, sourceProvider: "codex" });
         this.nativeCodexPreparationInFlight = input.generation;
         let prepared;
         try {
@@ -1027,7 +728,7 @@ export class LocalClaudeGatewayProvider {
         }
         return purged;
     }
-    async unadvertiseNativeCodexPeer(alias) {
+    async unadvertiseNativeSourcePeer(alias) {
         if (this.nativeHelpers !== undefined) {
             await this.nativeHelpers.unadvertise(alias);
             return;
@@ -1043,7 +744,7 @@ export class LocalClaudeGatewayProvider {
             active.provisionalIngressForwarded = false;
         });
     }
-    async updateNativeCodexPeerStatus(alias, status) {
+    async updateNativeSourcePeerStatus(alias, status) {
         if (this.nativeHelpers !== undefined) {
             await this.nativeHelpers.updateStatus(alias, status);
             return;
@@ -1105,10 +806,10 @@ export class LocalClaudeGatewayProvider {
         active.inboundQuiesced = true;
     }
     async dispatch(input) {
-        if (this.compatibilityBlocked) {
+        if (this.unavailableCode !== undefined) {
             return {
                 state: "failed",
-                safeErrorCode: this.compatibilityFailureCode ?? "CLAUDE_COMPATIBILITY_CHECK_FAILED",
+                safeErrorCode: this.unavailableCode,
             };
         }
         if (this.nativeHelpers !== undefined) {
@@ -1182,7 +883,8 @@ export class LocalClaudeGatewayProvider {
                 return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
             }
         }
-        if (activeListener.registration?.alias !== input.sourceAlias) {
+        if (activeListener.registration?.alias !== input.sourceAlias ||
+            activeListener.registration.sourceProvider !== input.sourceProvider) {
             return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
         }
         if (this.activeNativeCodexListener !== activeListener ||
@@ -1201,7 +903,8 @@ export class LocalClaudeGatewayProvider {
         let content;
         try {
             content = composeProvenanceEnvelope({
-                direction: "claude",
+                sourceProvider: input.sourceProvider,
+                recipientProvider: this.identity.provider,
                 sourceAlias: input.sourceAlias,
                 targetAlias: input.targetAlias,
                 conversationId: input.conversationId,
@@ -1392,7 +1095,7 @@ export class LocalClaudeGatewayProvider {
         }
     }
     assertReady() {
-        if (!this.initialized || this.closed || this.compatibilityBlocked) {
+        if (!this.initialized || this.closed || this.unavailableCode !== undefined) {
             throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The local Claude provider is not available.", true);
         }
     }
@@ -1407,13 +1110,14 @@ export class LocalClaudeGatewayProvider {
             throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native Codex peer alias must target this host.");
         }
         const name = input.alias.slice(0, -suffix.length);
-        if (!name.startsWith("codex-") || !NATIVE_CLAUDE_NAME.test(name)) {
-            throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native Codex peer alias must start with codex-.");
+        const prefix = gatewayRegistrationIngressPrefixes[input.sourceProvider];
+        if (prefix === undefined || !name.startsWith(prefix) || !NATIVE_CLAUDE_NAME.test(name)) {
+            throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native source peer alias must use its provider prefix.");
         }
         if (!path.isAbsolute(input.cwd) || input.cwd.includes("\0")) {
             throw new BridgeError("INVALID_CODEX_PEER_CWD", "A native Codex peer requires an absolute working directory.");
         }
-        return { alias: input.alias, cwd: input.cwd, name };
+        return { alias: input.alias, sourceProvider: input.sourceProvider, cwd: input.cwd, name };
     }
     requireActiveNativeCodexListener() {
         this.assertReady();
@@ -1451,7 +1155,7 @@ export class LocalClaudeGatewayProvider {
                 await this.rejectNativeInboundReceipt(listenerGeneration, message.receiptHandle, diagnosticCode);
             }
         };
-        if (this.compatibilityBlocked ||
+        if (this.unavailableCode !== undefined ||
             this.closed ||
             listenerGeneration.listener.closed ||
             !this.ownsNativeCodexListener(listenerGeneration)) {
@@ -1801,7 +1505,6 @@ export class LocalClaudeGatewayProvider {
                 routeHandle: peer.targetId,
                 kind: "interactive",
                 state: claudeRouteState(peer),
-                compatibility: "compatible",
             };
             this.discovered.set(peer.targetId, row);
             rows.push(row);
@@ -1891,65 +1594,15 @@ export class LocalClaudeGatewayProvider {
 export function createLocalClaudeGatewayProvider(options) {
     return new LocalClaudeGatewayProvider(options);
 }
-function codexVersionFailureCode(version) {
-    if (version === UNKNOWN_COMPATIBILITY_VERSION) {
-        return "CODEX_APP_SERVER_VERSION_UNPARSEABLE";
-    }
-    if (!isCompatibilityVersion(version)) {
-        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The local Codex factory version evidence is malformed.");
-    }
-    return CODEX_APP_SERVER_WRITABLE_VERSIONS.some((certifiedVersion) => sharesCompatibilityMajor(certifiedVersion, version))
-        ? undefined
-        : "CODEX_APP_SERVER_VERSION_UNSUPPORTED";
-}
-function validateCodexFactory(factory, options = {}) {
-    const schema = factory.schemaCompatibility;
-    const write = factory.writeCompatibility;
-    const versionFailure = codexVersionFailureCode(factory.appServerVersion);
-    const certified = CODEX_APP_SERVER_WRITABLE_VERSIONS.includes(factory.appServerVersion);
-    const schemaCandidate = schema.observedSchemaCandidate === true &&
-        CODEX_APP_SERVER_WRITABLE_VERSIONS.some((version) => sharesCompatibilityMajor(version, factory.appServerVersion));
-    const unsupportedVersionInvalid = versionFailure !== undefined &&
-        (options.allowUnsupportedVersion !== true ||
-            write !== null ||
-            factory.writableReady);
-    const supportedSchemaInvalid = versionFailure === undefined &&
-        ((!certified &&
-            (!schemaCandidate || write !== null || factory.writableReady)) ||
-            schema.protocol !== "app-server-v2-stable" ||
-            schema.steering?.method !== "turn/steer" ||
-            schema.steering.requestSchema !== "expected-turn-id-text-v1" ||
-            schema.steering.deliveryBoundary !== "next-tool-call-boundary" ||
-            (write !== null &&
-                (write.appServerVersion !== schema.appServerVersion ||
-                    write.endpointGeneration !== schema.endpointGeneration ||
-                    write.protocol !== schema.protocol ||
-                    write.observedSchemaCandidate !== schema.observedSchemaCandidate ||
-                    write.steering?.method !== schema.steering.method ||
-                    write.steering.requestSchema !== schema.steering.requestSchema ||
-                    write.steering.deliveryBoundary !==
-                        schema.steering.deliveryBoundary)) ||
-            factory.writableReady !== (write !== null));
+function validateCodexFactory(factory) {
     if (factory.hostId !== LOCAL_HOST ||
         factory.protocol !== "codex-app-server" ||
         factory.protocolVersion !== factory.appServerVersion ||
-        schema.appServerVersion !== factory.appServerVersion ||
-        schema.endpointGeneration !== factory.endpointGeneration ||
-        unsupportedVersionInvalid ||
-        supportedSchemaInvalid) {
-        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The local Codex provider requires exact schema and write attestations.");
+        factory.appServerVersion.length === 0 ||
+        factory.endpointGeneration.length === 0) {
+        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The local Codex provider requires exact managed endpoint identity.");
     }
 }
-function codexFactoryWritesEnabled(factory, attestation, writeProbePassed = false) {
-    return ((attestation.tier === "certified" &&
-        CODEX_APP_SERVER_WRITABLE_VERSIONS.includes(attestation.version) &&
-        factory.writableReady &&
-        factory.writeCompatibility !== null) ||
-        (!factory.writableReady &&
-            factory.writeCompatibility === null &&
-            writeProbePassed &&
-            compatibilityCoversWrites(attestation)));
-}
 function codexRouteState(observation) {
     if (observation.connection !== "ready")
         return "stale";
@@ -1971,9 +1624,6 @@ function codexRouteSafeCode(observation) {
     if (codexRouteState(observation) === "stale") {
         return "CODEX_ROUTE_STALE";
     }
-    if (!observation.writableReady) {
-        return "CODEX_WRITES_DISABLED";
-    }
     return undefined;
 }
 export class LocalCodexGatewayProvider {
@@ -1986,6 +1636,7 @@ export class LocalCodexGatewayProvider {
     cleanupTimeoutMs;
     recoveryInitialMs;
     recoveryMaxMs;
+    observationPollMs;
     now;
     routes = new Map();
     /** Exact public alias authority retained across internal route recovery. */
@@ -1997,6 +1648,8 @@ export class LocalCodexGatewayProvider {
     routeRecoveries = new Map();
     routesRequiringRecovery = new Set();
     trackedRoutes = new Set();
+    observationTimer;
+    observationInFlight;
     retiredEndpointGeneration;
     expectsReply = new Map();
     callbackQueue = [];
@@ -2007,14 +1660,7 @@ export class LocalCodexGatewayProvider {
     endpointActivationRetry;
     endpointActivationRetryTimer;
     callbackDrainFrozen = false;
-    writeProbeObservationsByGeneration = new Map();
-    writeProbeResults = new Map();
-    writeProbeDecline;
-    writeProbeOverflow;
-    compatibilityAttested;
-    compatibilityFailureCode;
     endpointUnavailable = false;
-    pendingEndpointAttestation;
     pendingEndpointRefreshEvent;
     pendingEndpointRefreshSelectorClaimed = false;
     initialized = false;
@@ -2025,9 +1671,6 @@ export class LocalCodexGatewayProvider {
         this.factory = options.factory;
         this.refreshFactory = options.refreshFactory;
         exactLocalHost(options.factory.hostId);
-        this.compatibilityAttested =
-            options.factory.writableReady &&
-                options.factory.writeCompatibility !== null;
         this.maxCallbacks = positiveBounded(options.maxCallbackEvents, MAX_CODEX_CALLBACKS, 4_096);
         this.maxRoutes = positiveBounded(options.maxRoutes, MAX_CODEX_ROUTES, 256);
         this.maxReplyBytes = positiveBounded(options.maxReplyBytes, MAX_TRANSIENT_REPLY_BYTES, 1024 * 1024);
@@ -2041,6 +1684,7 @@ export class LocalCodexGatewayProvider {
         if (this.recoveryInitialMs > this.recoveryMaxMs) {
             throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The Codex recovery initial delay cannot exceed its capped delay.");
         }
+        this.observationPollMs = positiveBounded(options.observationPollMs, DEFAULT_CODEX_OBSERVATION_POLL_MS, 60_000);
         this.now = options.now ?? (() => new Date());
     }
     get identity() {
@@ -2056,352 +1700,39 @@ export class LocalCodexGatewayProvider {
     get protocolVersion() {
         return this.factory.protocolVersion;
     }
-    compatibilitySurface() {
-        return { surface: "codex", version: this.factory.appServerVersion };
-    }
-    acceptCompatibilityAttestation(attestation) {
-        const pending = this.pendingEndpointAttestation;
-        const pendingMatches = pending === undefined ||
-            (attestation.checkedAt === pending.checkedAt &&
-                attestation.tier === pending.tier &&
-                attestation.safeErrorCode === pending.safeErrorCode &&
-                attestation.probes.length === pending.probes.length &&
-                attestation.probes.every((probe, index) => probe.name === pending.probes[index]?.name &&
-                    probe.outcome === pending.probes[index]?.outcome &&
-                    probe.safeErrorCode === pending.probes[index]?.safeErrorCode));
-        if (!isCompatibilityAttestation(attestation) ||
-            attestation.surface !== "codex" ||
-            attestation.version !== this.factory.appServerVersion ||
-            !pendingMatches) {
-            throw new BridgeError("CODEX_COMPATIBILITY_ATTESTATION_MISMATCH", "The Codex compatibility attestation does not match this endpoint.");
-        }
-        if (attestation.tier === "incompatible") {
-            this.pendingEndpointAttestation = undefined;
-            this.pendingEndpointRefreshEvent = undefined;
-            this.pendingEndpointRefreshSelectorClaimed = false;
-            this.clearEndpointActivationRetry();
-            this.compatibilityAttested = false;
-            this.endpointUnavailable = true;
-            this.compatibilityFailureCode =
-                attestation.safeErrorCode ?? "CODEX_COMPATIBILITY_CHECK_FAILED";
-            return;
-        }
-        const writesEnabled = codexFactoryWritesEnabled(this.factory, attestation, this.latestWriteCompatibilityProbeObservation(this.factory.endpointGeneration)?.outcome === "pass");
-        const schemaObserved = attestation.tier === "schema_attested" &&
-            !this.factory.writableReady &&
-            this.factory.writeCompatibility === null;
-        if ((!writesEnabled && !schemaObserved) ||
-            (this.endpointUnavailable && pending === undefined) ||
-            !pendingMatches) {
-            throw new BridgeError("CODEX_COMPATIBILITY_ATTESTATION_MISMATCH", "The Codex compatibility attestation does not match this endpoint.");
+    activateEndpointGeneration(endpointGeneration) {
+        const event = this.pendingEndpointRefreshEvent;
+        if (event === undefined ||
+            event.current.endpointGeneration !== endpointGeneration ||
+            this.factory.endpointGeneration !== endpointGeneration) {
+            throw new BridgeError("CODEX_ENDPOINT_ACTIVATION_MISMATCH", "Only the exact pending managed Codex generation can be activated.");
         }
-        this.pendingEndpointAttestation = undefined;
         this.pendingEndpointRefreshEvent = undefined;
         this.pendingEndpointRefreshSelectorClaimed = false;
         this.clearEndpointActivationRetry();
-        this.compatibilityAttested = writesEnabled;
-        this.endpointUnavailable = !writesEnabled;
-        this.compatibilityFailureCode = undefined;
+        this.endpointUnavailable = false;
     }
     releaseEndpointRefreshSelectorClaim(endpointGeneration) {
         const event = this.pendingEndpointRefreshEvent;
-        if (event?.current.endpointGeneration === endpointGeneration &&
-            this.pendingEndpointAttestation !== undefined) {
+        if (event?.current.endpointGeneration === endpointGeneration) {
             this.pendingEndpointRefreshSelectorClaimed = false;
         }
     }
     rearmEndpointRefreshActivation(endpointGeneration) {
         const event = this.pendingEndpointRefreshEvent;
         if (event?.current.endpointGeneration === endpointGeneration &&
-            this.pendingEndpointAttestation !== undefined &&
             !this.closing &&
             !this.closed) {
             this.publishEndpointRefresh(event);
         }
     }
-    latestWriteCompatibilityProbeObservation(endpointGeneration) {
-        return (this.writeProbeObservationsByGeneration.get(endpointGeneration) ??
-            (this.writeProbeOverflow?.endpointGeneration === endpointGeneration
-                ? this.writeProbeOverflow.observation
-                : undefined) ??
-            (this.writeProbeDecline?.endpointGeneration === endpointGeneration
-                ? this.writeProbeDecline.observation
-                : undefined));
-    }
-    async runCompatibilityProbes(context) {
-        return await this.runCompatibilityProbesFor(this.factory, context === undefined
-            ? undefined
-            : {
-                stateRoot: path.resolve(context.stateRoot),
-                forbiddenCodexThreadIds: [...context.forbiddenCodexThreadIds],
-            });
-    }
-    async runCompatibilityProbesFor(factory, context) {
-        const [installation, control, initialize, threadList] = compatibilityProbeNames.codex;
-        let transport;
-        let connector;
-        let stage = "transport";
-        try {
-            transport = await factory.connectTransport();
-            stage = "initialize";
-            connector = await CodexAppServerConnector.connect({
-                compatibility: factory.schemaCompatibility,
-                ...(context === undefined
-                    ? {}
-                    : { writeCompatibilityProbe: true }),
-                writesEnabled: false,
-                route: {
-                    endpointGeneration: factory.endpointGeneration,
-                    threadId: COMPATIBILITY_PROBE_THREAD_ID,
-                },
-                transport,
-                maxReplyBytes: this.maxReplyBytes,
-                now: this.now,
-                onEvent: () => undefined,
-                onTurnResult: () => undefined,
-            });
-            stage = "thread_list";
-            await connector.observeLoadedThread(connector.guard());
-            const requiredProbes = [
-                passedProbe(installation),
-                passedProbe(control),
-                passedProbe(initialize),
-                passedProbe(threadList),
-            ];
-            if (context === undefined)
-                return requiredProbes;
-            const result = await this.runCodexWriteProbe(factory, connector, context);
-            return result.outcome === "pass"
-                ? [...requiredProbes, passedProbe("write_attestation")]
-                : requiredProbes;
-        }
-        catch (error) {
-            if (this.isEndpointGenerationChanged(error) ||
-                (error instanceof BridgeError &&
-                    error.code === "CODEX_FACTORY_ATTESTATION_INVALID")) {
-                throw error;
-            }
-            if (stage === "transport") {
-                const availabilityFailure = error instanceof LocalCodexTransportError &&
-                    [
-                        "MANAGED_CODEX_UNAVAILABLE",
-                        "LOCAL_APP_SERVER_NOT_RUNNING",
-                        "SPAWN_FAILED",
-                        "SPAWN_TIMEOUT",
-                        "PROXY_STDERR_LIMIT",
-                        "TRANSPORT_CONNECT_FAILED",
-                    ].includes(error.code);
-                if (!availabilityFailure)
-                    throw error;
-                const installationUnavailable = error instanceof LocalCodexTransportError &&
-                    error.code === "MANAGED_CODEX_UNAVAILABLE";
-                return [
-                    installationUnavailable
-                        ? failedProbe(installation, "CODEX_INSTALLATION_INVALID")
-                        : passedProbe(installation),
-                    failedProbe(control, installationUnavailable
-                        ? "CODEX_COMPAT_PROBE_BLOCKED"
-                        : "CODEX_CONTROL_SOCKET_UNAVAILABLE"),
-                    failedProbe(initialize, "CODEX_COMPAT_PROBE_BLOCKED"),
-                    failedProbe(threadList, "CODEX_COMPAT_PROBE_BLOCKED"),
-                ];
-            }
-            return [
-                passedProbe(installation),
-                passedProbe(control),
-                stage === "initialize"
-                    ? failedProbe(initialize, "CODEX_INITIALIZE_SCHEMA_REJECTED")
-                    : passedProbe(initialize),
-                failedProbe(threadList, "CODEX_THREAD_LIST_SCHEMA_REJECTED"),
-            ];
-        }
-        finally {
-            if (connector !== undefined) {
-                await connector.close();
-            }
-            else if (transport !== undefined) {
-                await transport.close();
-            }
-        }
-    }
-    async runCodexWriteProbe(factory, connector, context) {
-        const key = `${factory.appServerVersion}\0${factory.endpointGeneration}`;
-        const cached = this.writeProbeResults.get(key);
-        if (cached !== undefined)
-            return await cached;
-        if (this.writeProbeOverflow?.key === key) {
-            if (this.writeProbeResults.size >= MAX_CODEX_WRITE_PROBE_ATTEMPTS) {
-                return this.writeProbeOverflow.observation;
-            }
-            this.writeProbeOverflow = undefined;
-        }
-        if (this.writeProbeResults.size >= MAX_CODEX_WRITE_PROBE_ATTEMPTS) {
-            const observation = Object.freeze(codexWriteProbeFailure("CODEX_WRITE_PROBE_CAPACITY_EXHAUSTED"));
-            this.writeProbeOverflow = Object.freeze({
-                endpointGeneration: factory.endpointGeneration,
-                key,
-                observation,
-            });
-            if (this.callbacks !== undefined) {
-                invokeCallback(() => this.callbacks?.onProtocolNotice?.({
-                    code: observation.safeErrorCode,
-                }));
-            }
-            return observation;
-        }
-        const pending = this.executeCodexWriteProbe(connector, context).then((result) => {
-            const observation = Object.freeze({ ...result });
-            if (observation.outcome === "fail" &&
-                (observation.safeErrorCode ===
-                    "CODEX_WRITE_PROBE_MODEL_PIN_UNAVAILABLE" ||
-                    observation.safeErrorCode ===
-                        "CODEX_WRITE_PROBE_RATE_LIMIT_CONSTRAINED")) {
-                this.writeProbeResults.delete(key);
-                this.writeProbeDecline = Object.freeze({
-                    endpointGeneration: factory.endpointGeneration,
-                    observation,
-                });
-            }
-            else {
-                this.writeProbeObservationsByGeneration.set(factory.endpointGeneration, observation);
-            }
-            if (observation.outcome === "fail" && this.callbacks !== undefined) {
-                invokeCallback(() => this.callbacks?.onProtocolNotice?.({
-                    code: observation.safeErrorCode,
-                }));
-            }
-            return observation;
-        });
-        this.writeProbeResults.set(key, pending);
-        return await pending;
-    }
-    async executeCodexWriteProbe(connector, context) {
-        const stateRoot = path.resolve(context.stateRoot);
-        const rootBefore = await attestCodexWriteProbeRoot(stateRoot);
-        if (rootBefore === null) {
-            return codexWriteProbeFailure("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED");
-        }
-        const probeRoot = path.join(stateRoot, CODEX_WRITE_PROBE_ROOT);
-        let probeRootBefore;
-        try {
-            let created = false;
-            try {
-                await mkdir(probeRoot, { mode: 0o700 });
-                created = true;
-            }
-            catch (error) {
-                if (systemErrorCode(error) !== "EEXIST")
-                    throw error;
-            }
-            if (created)
-                await chmod(probeRoot, 0o700);
-            const evidence = await attestCodexWriteProbeRoot(probeRoot);
-            if (evidence === null) {
-                return codexWriteProbeFailure("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED");
-            }
-            probeRootBefore = evidence;
-        }
-        catch (error) {
-            if (error instanceof BridgeError &&
-                error.code === "CODEX_FACTORY_ATTESTATION_INVALID") {
-                throw error;
-            }
-            if (transientCodexWriteProbeError(error)) {
-                return codexWriteProbeFailure("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED");
-            }
-            throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The controller-owned Codex probe root could not be established safely.");
-        }
-        let cwd;
-        let before;
-        let result = codexWriteProbeFailure("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED");
-        try {
-            cwd = await mkdtemp(path.join(probeRoot, CODEX_WRITE_PROBE_DIRECTORY_PREFIX));
-            if (path.dirname(cwd) !== probeRoot) {
-                throw new Error("probe directory escaped its dedicated root");
-            }
-            await chmod(cwd, 0o700);
-            before = await attestCodexWriteProbeDirectory(cwd);
-            result = await connector.runWriteCompatibilityProbe({
-                cwd,
-                forbiddenThreadIds: [
-                    ...new Set([
-                        COMPATIBILITY_PROBE_THREAD_ID,
-                        ...context.forbiddenCodexThreadIds,
-                        ...this.trackedRoutes,
-                    ]),
-                ],
-            });
-        }
-        catch (error) {
-            if (!safeCodexWriteProbeFilesystemFailure(error)) {
-                if (error instanceof BridgeError)
-                    throw error;
-                throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The disposable Codex probe directory could not be established safely.");
-            }
-            result = codexWriteProbeFailure("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED");
-        }
-        let unchanged = false;
-        let removed = false;
-        if (cwd !== undefined && before !== undefined) {
-            try {
-                const after = await attestCodexWriteProbeDirectory(cwd);
-                unchanged = sameCodexWriteProbeDirectory(before, after);
-                await rmdir(cwd);
-                try {
-                    await lstat(cwd);
-                }
-                catch (error) {
-                    removed = systemErrorCode(error) === "ENOENT";
-                }
-            }
-            catch (error) {
-                if (!safeCodexWriteProbeFilesystemFailure(error)) {
-                    if (error instanceof BridgeError)
-                        throw error;
-                    throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The disposable Codex probe directory could not be re-attested safely.");
-                }
-                // Never remove a path after its exact ownership evidence changed.
-            }
-        }
-        if (cwd !== undefined && !removed) {
-            result = codexWriteProbeFailure("CODEX_WRITE_PROBE_CLEANUP_UNCONFIRMED", result);
-        }
-        else if (cwd !== undefined && !unchanged) {
-            result = codexWriteProbeFailure("CODEX_WRITE_PROBE_TOOL_ACTIVITY_OBSERVED", result);
-        }
-        const [probeRootAfter, rootAfter] = await Promise.all([
-            attestCodexWriteProbeRoot(probeRoot),
-            attestCodexWriteProbeRoot(stateRoot),
-        ]);
-        if (probeRootAfter === null || rootAfter === null) {
-            return codexWriteProbeFailure("CODEX_WRITE_PROBE_THREAD_SETUP_FAILED", result);
-        }
-        if (!sameCodexWriteProbeRoot(probeRootBefore, probeRootAfter) ||
-            !sameCodexWriteProbeRoot(rootBefore, rootAfter)) {
-            throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "A controller-owned Codex probe root changed while the disposable probe ran.");
-        }
-        return result;
-    }
     async initialize(callbacks) {
         if (this.closed || this.initialized) {
             throw new BridgeError("CODEX_PROVIDER_INITIALIZATION_REJECTED", "The local Codex provider cannot be initialized in this state.");
         }
         this.callbacks = callbacks;
         this.initialized = true;
-        if (this.compatibilityFailureCode !== undefined) {
-            return {
-                health: "degraded",
-                compatibility: "incompatible",
-                safeErrorCode: this.compatibilityFailureCode,
-            };
-        }
-        return !this.compatibilityAttested
-            ? {
-                health: "degraded",
-                compatibility: "compatible",
-                safeErrorCode: "CODEX_MONITOR_ONLY",
-            }
-            : { health: "healthy", compatibility: "compatible" };
+        return { health: "healthy" };
     }
     async selectRoute(input) {
         if (!this.initialized || this.closing || this.closed) {
@@ -2423,9 +1754,8 @@ export class LocalCodexGatewayProvider {
         let selectorRefreshReserved = false;
         let route;
         const stageRefreshedRoute = async (result) => {
-            if (result === undefined ||
-                result.event.outcome !== "compatible") {
-                throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex endpoint replacement was not compatibility-attested.");
+            if (result === undefined) {
+                throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex endpoint replacement could not be established.");
             }
             refreshResult = result;
             selectorRefreshReserved = this.reserveSelectorRefresh(result);
@@ -2448,7 +1778,7 @@ export class LocalCodexGatewayProvider {
             route = await stageRefreshedRoute(retainedEndpointRefresh);
         }
         else if (this.endpointUnavailable &&
-            this.pendingEndpointAttestation === undefined) {
+            this.pendingEndpointRefreshEvent === undefined) {
             route = await stageRefreshedRoute(await this.refreshEndpoint("selector"));
         }
         else {
@@ -2502,6 +1832,7 @@ export class LocalCodexGatewayProvider {
             throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task connection closed during route selection.");
         }
         this.trackedRoutes.add(input.routeHandle);
+        this.scheduleCodexObservation();
         this.routeAliases.set(input.routeHandle, input.alias);
         if (refreshResult === undefined) {
             this.queueRouteObservation(route, observation);
@@ -2566,7 +1897,6 @@ export class LocalCodexGatewayProvider {
             this.closed ||
             this.endpointUnavailable ||
             this.endpointRefresh !== undefined ||
-            !this.compatibilityAttested ||
             input.authorization !== "selected_route" ||
             !sameEndpoint(input.binding, this.identity)) {
             return { state: "failed", safeErrorCode: "CODEX_ROUTE_UNAVAILABLE" };
@@ -2580,9 +1910,6 @@ export class LocalCodexGatewayProvider {
             return { state: "failed", safeErrorCode: "CODEX_ROUTE_UNAVAILABLE" };
         }
         const guard = route.connector.guard();
-        if (!guard.writableReady) {
-            return { state: "failed", safeErrorCode: "CODEX_WRITES_DISABLED" };
-        }
         if (strictDeadline(input.deadlineAt, this.now().getTime()) === undefined) {
             return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
         }
@@ -2592,7 +1919,8 @@ export class LocalCodexGatewayProvider {
         let content;
         try {
             content = composeProvenanceEnvelope({
-                direction: "codex",
+                sourceProvider: input.sourceProvider,
+                recipientProvider: this.identity.provider,
                 sourceAlias: input.sourceAlias,
                 targetAlias: input.targetAlias,
                 conversationId: input.conversationId,
@@ -2658,6 +1986,10 @@ export class LocalCodexGatewayProvider {
             throw new BridgeError("CODEX_ENDPOINT_ACTIVATION_PENDING", "The exact Codex route still belongs to an unaccepted endpoint transition.", true);
         }
         this.trackedRoutes.delete(routeHandle);
+        if (this.trackedRoutes.size === 0 && this.observationTimer !== undefined) {
+            clearTimeout(this.observationTimer);
+            this.observationTimer = undefined;
+        }
         this.cancelRouteRecovery(routeHandle);
         const recovery = this.routeRecoveries.get(routeHandle);
         if (recovery !== undefined)
@@ -2695,6 +2027,10 @@ export class LocalCodexGatewayProvider {
         if (this.closed || this.closing)
             return;
         this.closing = true;
+        if (this.observationTimer !== undefined) {
+            clearTimeout(this.observationTimer);
+            this.observationTimer = undefined;
+        }
         for (const timer of this.routeRecoveryTimers.values())
             clearTimeout(timer);
         this.routeRecoveryTimers.clear();
@@ -2702,7 +2038,6 @@ export class LocalCodexGatewayProvider {
         this.clearEndpointActivationRetry();
         this.pendingEndpointRefreshEvent = undefined;
         this.pendingEndpointRefreshSelectorClaimed = false;
-        this.pendingEndpointAttestation = undefined;
         const refreshResult = this.endpointRefresh === undefined
             ? []
             : await Promise.allSettled([this.endpointRefresh]);
@@ -2711,6 +2046,9 @@ export class LocalCodexGatewayProvider {
         await Promise.allSettled([
             ...this.routeRecoveries.values(),
             ...this.routeCreations.values(),
+            ...(this.observationInFlight === undefined
+                ? []
+                : [this.observationInFlight]),
         ]);
         this.drainCallbackQueue();
         if (refreshResult.some((result) => result.status === "rejected") ||
@@ -2728,7 +2066,6 @@ export class LocalCodexGatewayProvider {
         this.closed = true;
         this.closing = false;
         this.callbackQueue.length = 0;
-        this.pendingEndpointAttestation = undefined;
         this.pendingEndpointRefreshEvent = undefined;
         this.pendingEndpointRefreshSelectorClaimed = false;
         this.trackedRoutes.clear();
@@ -2741,13 +2078,12 @@ export class LocalCodexGatewayProvider {
             this.closing ||
             this.closed ||
             this.endpointUnavailable ||
-            this.endpointRefresh !== undefined ||
-            !this.compatibilityAttested) {
+            this.endpointRefresh !== undefined) {
             throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
         }
     }
-    async ensureRoute(threadId, queueInitialObservation = true, allowPendingEndpointAttestation = false) {
-        if (allowPendingEndpointAttestation) {
+    async ensureRoute(threadId, queueInitialObservation = true, allowPendingEndpointActivation = false) {
+        if (allowPendingEndpointActivation) {
             if (!this.initialized || this.closing || this.closed) {
                 throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
             }
@@ -2758,7 +2094,7 @@ export class LocalCodexGatewayProvider {
         const pendingRelease = this.routeReleases.get(threadId);
         if (pendingRelease !== undefined) {
             await pendingRelease;
-            return await this.ensureRoute(threadId, queueInitialObservation, allowPendingEndpointAttestation);
+            return await this.ensureRoute(threadId, queueInitialObservation, allowPendingEndpointActivation);
         }
         const existing = this.routes.get(threadId);
         if (existing !== undefined) {
@@ -2770,7 +2106,7 @@ export class LocalCodexGatewayProvider {
             // a fresh one. The identity-checked release lets automatic recovery and
             // an explicit selector join the same cleanup safely.
             await this.releaseRouteInternal(threadId);
-            return await this.ensureRoute(threadId, queueInitialObservation, allowPendingEndpointAttestation);
+            return await this.ensureRoute(threadId, queueInitialObservation, allowPendingEndpointActivation);
         }
         const pending = this.routeCreations.get(threadId);
         if (pending !== undefined)
@@ -2780,14 +2116,12 @@ export class LocalCodexGatewayProvider {
         }
         const admittedFactory = this.factory;
         const creation = (async () => {
-            const route = await this.createRoute(threadId, admittedFactory, queueInitialObservation, this.pendingEndpointAttestation === undefined
-                ? this.compatibilityAttested
-                : codexFactoryWritesEnabled(admittedFactory, this.pendingEndpointAttestation, this.latestWriteCompatibilityProbeObservation(admittedFactory.endpointGeneration)?.outcome === "pass"));
+            const route = await this.createRoute(threadId, admittedFactory, queueInitialObservation);
             if (this.closing || this.closed) {
                 await this.closeRoute(route);
                 throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider closed during route creation.");
             }
-            if (!allowPendingEndpointAttestation &&
+            if (!allowPendingEndpointActivation &&
                 (this.endpointUnavailable ||
                     this.endpointRefresh !== undefined ||
                     admittedFactory !== this.factory ||
@@ -2806,15 +2140,14 @@ export class LocalCodexGatewayProvider {
             this.routeCreations.delete(threadId);
         }
     }
-    async createRoute(threadId, factory, queueInitialObservation, writesEnabled) {
+    async createRoute(threadId, factory, queueInitialObservation) {
         let transport;
         let connector;
         const generation = Symbol(threadId);
         try {
             transport = await factory.connectTransport();
             connector = await CodexAppServerConnector.connect({
-                compatibility: factory.writeCompatibility ?? factory.schemaCompatibility,
-                writesEnabled,
+                compatibility: { endpointGeneration: factory.endpointGeneration },
                 route: {
                     endpointGeneration: factory.endpointGeneration,
                     threadId,
@@ -2885,6 +2218,49 @@ export class LocalCodexGatewayProvider {
             this.scheduleRouteRecovery(threadId);
         }
     }
+    scheduleCodexObservation() {
+        if (this.closed ||
+            this.closing ||
+            this.trackedRoutes.size === 0 ||
+            this.observationTimer !== undefined ||
+            this.observationInFlight !== undefined) {
+            return;
+        }
+        const timer = setTimeout(() => {
+            if (this.observationTimer !== timer)
+                return;
+            this.observationTimer = undefined;
+            const observation = this.refreshCodexObservations().catch(() => {
+                // Unexpected provider-local observation failures must not kill re-arm.
+            });
+            this.observationInFlight = observation;
+            void observation.finally(() => {
+                if (this.observationInFlight === observation) {
+                    this.observationInFlight = undefined;
+                }
+                this.scheduleCodexObservation();
+            });
+        }, this.observationPollMs);
+        timer.unref();
+        this.observationTimer = timer;
+    }
+    async refreshCodexObservations() {
+        for (const [threadId, route] of [...this.routes]) {
+            if (this.closed ||
+                this.closing ||
+                !this.trackedRoutes.has(threadId) ||
+                route.connector.observation().requestInFlight) {
+                continue;
+            }
+            try {
+                await route.connector.observeLoadedThread(route.connector.guard());
+            }
+            catch {
+                // Connector events carry the provider-local failure evidence. One
+                // route's failed observation must not stop later routes or the timer.
+            }
+        }
+    }
     scheduleRouteRecovery(threadId) {
         if (this.closed ||
             this.closing ||
@@ -2919,12 +2295,11 @@ export class LocalCodexGatewayProvider {
         }
         try {
             if (this.endpointUnavailable) {
-                if (this.pendingEndpointAttestation !== undefined) {
+                if (this.pendingEndpointRefreshEvent !== undefined) {
                     throw new BridgeError("CODEX_ENDPOINT_REFRESH_PENDING", "The replacement Codex endpoint is awaiting controller activation.", true);
                 }
                 const refreshed = await this.refreshEndpoint("callback");
-                if (refreshed?.event.outcome === "compatible" &&
-                    refreshed.event.routes.some((route) => route.routeHandle === threadId)) {
+                if (refreshed?.event.routes.some((route) => route.routeHandle === threadId)) {
                     this.routesRequiringRecovery.delete(threadId);
                     this.routeRecoveryAttempts.delete(threadId);
                     return;
@@ -2954,8 +2329,7 @@ export class LocalCodexGatewayProvider {
             if (this.isEndpointGenerationChanged(error)) {
                 this.endpointUnavailable = true;
                 const refreshed = await this.refreshEndpoint("callback").catch(() => undefined);
-                if (refreshed?.event.outcome === "compatible" &&
-                    refreshed.event.routes.some((route) => route.routeHandle === threadId)) {
+                if (refreshed?.event.routes.some((route) => route.routeHandle === threadId)) {
                     this.routesRequiringRecovery.delete(threadId);
                     this.routeRecoveryAttempts.delete(threadId);
                     return;
@@ -2986,7 +2360,6 @@ export class LocalCodexGatewayProvider {
         const event = this.pendingEndpointRefreshEvent;
         if (event === undefined ||
             this.pendingEndpointRefreshSelectorClaimed ||
-            this.pendingEndpointAttestation === undefined ||
             event.current.endpointGeneration !== this.factory.endpointGeneration) {
             return undefined;
         }
@@ -3033,40 +2406,7 @@ export class LocalCodexGatewayProvider {
         try {
             const resolved = await this.resolveEndpointRefreshCandidate(refreshFactory, previousFactory, previous);
             candidate = resolved.factory;
-            const { attestation, identity: candidateIdentity } = resolved;
             await this.retireEndpointGeneration(previousFactory, previous.endpointGeneration);
-            if (attestation.tier === "incompatible") {
-                await candidate.close();
-                candidate = undefined;
-                this.compatibilityAttested = false;
-                this.pendingEndpointAttestation = undefined;
-                this.pendingEndpointRefreshEvent = undefined;
-                this.pendingEndpointRefreshSelectorClaimed = false;
-                for (const routeHandle of this.trackedRoutes) {
-                    this.routesRequiringRecovery.add(routeHandle);
-                }
-                if (this.closing || this.closed)
-                    return undefined;
-                const result = {
-                    event: {
-                        outcome: "incompatible",
-                        previous,
-                        candidate: candidateIdentity,
-                        attestation,
-                    },
-                    delivery: "callback",
-                    selectorClaimed: true,
-                    published: false,
-                };
-                result.published = true;
-                this.emitEndpointRefresh(result.event);
-                for (const routeHandle of this.routesRequiringRecovery) {
-                    if (this.trackedRoutes.has(routeHandle)) {
-                        this.scheduleRouteRecovery(routeHandle);
-                    }
-                }
-                return result;
-            }
             if (this.closing || this.closed) {
                 await candidate.close();
                 candidate = undefined;
@@ -3079,7 +2419,7 @@ export class LocalCodexGatewayProvider {
                 if (this.closing || this.closed)
                     break;
                 try {
-                    const route = await this.createRoute(routeHandle, replacementFactory, false, codexFactoryWritesEnabled(replacementFactory, attestation, this.latestWriteCompatibilityProbeObservation(replacementFactory.endpointGeneration)?.outcome === "pass"));
+                    const route = await this.createRoute(routeHandle, replacementFactory, false);
                     if (this.closing || this.closed) {
                         await this.closeRoute(route);
                         break;
@@ -3105,9 +2445,7 @@ export class LocalCodexGatewayProvider {
             this.factory = replacementFactory;
             candidate = undefined;
             this.retiredEndpointGeneration = undefined;
-            this.compatibilityAttested = false;
             this.endpointUnavailable = true;
-            this.pendingEndpointAttestation = attestation;
             for (const staged of stagedRoutes) {
                 this.routes.set(staged.routeHandle, staged.route);
                 this.routesRequiringRecovery.delete(staged.routeHandle);
@@ -3119,20 +2457,16 @@ export class LocalCodexGatewayProvider {
             }
             const result = {
                 event: {
-                    outcome: "compatible",
                     previous,
                     current: this.identity,
-                    attestation,
                     routes: refreshedRoutes,
                 },
                 delivery: this.endpointRefreshDelivery ?? "callback",
                 selectorClaimed: false,
                 published: false,
             };
-            if (result.event.outcome === "compatible") {
-                this.pendingEndpointRefreshEvent = result.event;
-                this.pendingEndpointRefreshSelectorClaimed = false;
-            }
+            this.pendingEndpointRefreshEvent = result.event;
+            this.pendingEndpointRefreshSelectorClaimed = false;
             if (result.delivery === "callback") {
                 result.selectorClaimed = true;
                 result.published = true;
@@ -3163,10 +2497,7 @@ export class LocalCodexGatewayProvider {
             let candidate;
             try {
                 candidate = await refreshFactory();
-                const versionFailure = codexVersionFailureCode(candidate.appServerVersion);
-                validateCodexFactory(candidate, {
-                    allowUnsupportedVersion: versionFailure !== undefined,
-                });
+                validateCodexFactory(candidate);
                 if (candidate.hostId !== previous.hostId ||
                     candidate.protocol !== previousFactory.protocol) {
                     throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The replacement Codex factory moved outside its pinned boundary.");
@@ -3176,41 +2507,12 @@ export class LocalCodexGatewayProvider {
                     if (candidate !== previousFactory)
                         await candidate.close();
                     candidate = undefined;
-                    if (this.endpointUnavailable &&
-                        this.compatibilityFailureCode === undefined &&
-                        !this.factory.writableReady &&
-                        this.factory.writeCompatibility === null) {
-                        throw new BridgeError("CODEX_MONITOR_ONLY", "This Codex App Server remains monitor-only until a write-attested generation is available.");
-                    }
                     if (attempt + 1 < MAX_CODEX_ENDPOINT_REFRESH_CANDIDATES) {
                         continue;
                     }
                     throw new BridgeError("CODEX_ENDPOINT_GENERATION_CHURN", "The Codex endpoint did not stabilize within its bounded refresh window.", true);
                 }
-                // Endpoint generations never inherit cached compatibility. A version
-                // outside the tested major is classified from OS-attested factory
-                // evidence alone; no connector or transport may touch that protocol.
-                const probes = versionFailure === undefined
-                    ? await this.runCompatibilityProbesFor(candidate)
-                    : compatibilityProbeNames.codex.map((name, index) => index === 0
-                        ? passedProbe(name)
-                        : failedProbe(name, versionFailure));
-                const attestation = evaluateCompatibilityAttestation({
-                    surface: "codex",
-                    version: candidate.appServerVersion,
-                    checkedAt: this.now().toISOString(),
-                    certifiedVersions: certifiedCompatibilityVersions.codex,
-                    probes,
-                });
-                return {
-                    factory: candidate,
-                    identity: {
-                        provider: "codex",
-                        hostId: previous.hostId,
-                        endpointGeneration: candidate.endpointGeneration,
-                    },
-                    attestation,
-                };
+                return { factory: candidate };
             }
             catch (error) {
                 if (candidate !== undefined && candidate !== previousFactory) {
@@ -3266,7 +2568,6 @@ export class LocalCodexGatewayProvider {
             return;
         let event = result.event;
         if (staleRouteHandle !== undefined &&
-            event.outcome === "compatible" &&
             event.routes.some((route) => route.routeHandle === staleRouteHandle)) {
             event = {
                 ...event,
@@ -3280,9 +2581,7 @@ export class LocalCodexGatewayProvider {
     }
     publishEndpointRefresh(event) {
         this.emitEndpointRefresh(event);
-        if (event.outcome === "compatible") {
-            this.armEndpointActivationRetry(event);
-        }
+        this.armEndpointActivationRetry(event);
     }
     armEndpointActivationRetry(event) {
         this.clearEndpointActivationRetry();
@@ -3295,8 +2594,7 @@ export class LocalCodexGatewayProvider {
             this.closing ||
             this.closed ||
             pending.attempt >= 3 ||
-            (pending.event.outcome === "compatible" &&
-                this.pendingEndpointAttestation === undefined)) {
+            this.pendingEndpointRefreshEvent !== pending.event) {
             this.clearEndpointActivationRetry();
             return;
         }
@@ -3308,8 +2606,7 @@ export class LocalCodexGatewayProvider {
             const current = this.endpointActivationRetry;
             if (current === undefined || current.event !== pending.event)
                 return;
-            if (current.event.outcome === "compatible" &&
-                this.pendingEndpointAttestation === undefined) {
+            if (this.pendingEndpointRefreshEvent !== current.event) {
                 this.clearEndpointActivationRetry();
                 return;
             }