ceo-orchestration 1.0.0

package/.claude/plans/PLAN-142/architect/round-1/consensus.md

@@ -0,0 +1,95 @@
+---
+plan: PLAN-142
+round: 1
+rounds_synthesized: [round-1]
+agents_considered: [vp-engineering, security-engineer, devops-engineer]
+decisions_revised_in_plan:
+  - "§1 — re-diagnosed around the LIVE rail check_pair_rail.py:_invoke_codex_review (not make_invoke_command)"
+  - "§2 — kernel scope expanded from 2 to 4 paths"
+  - "§3 — added security + correctness ACs (redaction ordering, forged-verdict, model-id, JSONL contract, substrate-watch, per-call-site stdin)"
+synthesized_at: 2026-06-19
+synthesized_by: CEO
+verdict_label: NOT-design-coherent (REJECT + 2 ADJUST; fundamental scope defect)
+---
+
+> Synthesis consumed anonymized critiques (Critic-A/B/C). Map in
+> `anonymization-map.md`. Verdicts: one REJECT, two ADJUST.
+
+## Consensus findings (2+ critics flagged)
+
+- **C1 — CRITICAL (Critic-A, B, C — unanimous).** The plan fixes the WRONG
+  file. The settings.json:201-wired pair-rail is `check_pair_rail.py`, whose
+  `_invoke_codex_review` (L407) hand-rolls `codex exec --read-only -` (pipes
+  `input=prompt`, no `--json`, returns raw stdout) and never calls
+  `make_invoke_command`. **CEO re-validated hands-on:** `codex exec --read-only -`
+  → exit 2 `unexpected argument '--read-only'` on 0.139. So the live rail is
+  broken by the SAME flag-drift class, and the plan's make_invoke_command +
+  codex_invoke.py fixes are dead code for it. `check_pair_rail.py` is itself a
+  kernel path (_KERNEL_PATHS:170). → §1 + §2 + §3.
+- **C2 — HIGH (A, B, C).** Kernel scope undercounted. `codex-cli-pin.txt`
+  (>=0.128,<0.131) + `codex-cli-binary-sha256.txt` are stale vs the 0.139 binary
+  AND are themselves kernel paths (199-200), feeding release.yml step 15. The
+  real ceremony touches ~4 kernel files, not 2; ADR-111 may require a corpus
+  re-run. → §2.
+- **C3 — HIGH/MEDIUM (A, B, C).** Silent model coercion: `invoke_codex` defaults
+  `gpt-5.5`, absent from `_VALID_MODELS`, coerced to `gpt-5-codex` — the reviewer
+  S120 explicitly DEMOTED. The live rail has silently run the weaker model with
+  no audit signal. → §3 (make coercion loud + reconcile).
+- **C4 — MEDIUM (A, C).** JSONL parse contract under-specified — 'extract+join'
+  reproduces 'Extra data line 2'. Contract: per-line try/except, take the LAST
+  agent_message (not join), ignore reasoning items, degrade to ADVISORY on
+  truncated/zero-message. → §3 (unit ACs).
+- **C5 — MEDIUM (A, C).** OQ2 unresolved: JSONL parse bakes the event-schema
+  into a kernel file (recurring GPG tax). Prefer `-o/--output-last-message`, OR
+  isolate CLI-shape behind a non-kernel helper. → round-2 decision + §3.
+
+## Single-agent insights kept
+
+1. **Critic-A:** `parse_usage_from_codex_stdout` (codex.py:527) is a SECOND
+   whole-stdout `json.loads` — breaks identically on JSONL, silently zeroing
+   token telemetry. Route both parsers through one shared helper this ceremony.
+2. **Critic-B:** redaction MUST run on the FULL raw stdout BEFORE any JSONL
+   line-split (newline-splitting shreds a multi-line PEM, defeating single-pass
+   redaction); applies to non-redacting callers (run-promotion-gate.py) too.
+3. **Critic-B:** a verdict must come ONLY from a structured schema-validated
+   object, NEVER a free-text scan of `agent_message` — else a swapped binary
+   (T-8) forges a PASS. Fail-closed-to-ADVISORY on malformed.
+4. **Critic-B:** `check_pair_rail.py` returns raw stdout into
+   `_detect_write_shaped_patch`/`_emit_codex_review_invoked` with NO ingress
+   redaction — add it to match codex_invoke ordering.
+5. **Critic-C:** `substrate-watch.json` has no `codex_cli` component — the
+   detector meant to catch this drift is blind. Register it (non-kernel, cheap).
+6. **Critic-C:** `stdin=DEVNULL` is per-call-site: it would DISCARD the prompt on
+   the live `input=prompt`+`-` pipe path — convert that path to positional
+   `-- <prompt>` + DEVNULL.
+
+## Single-agent insights rejected / deferred
+
+- None rejected — all are valid and grounded. The R-VP-6/C5 architectural
+  decision (split CLI-shape into a non-kernel helper vs keep JSONL in-kernel) is
+  DEFERRED to round-2 as the central design choice to ratify.
+
+## Plan adjustments (index; edits live in PLAN-142.md)
+
+1. §1 Diagnosis — re-centered on the LIVE rail `check_pair_rail.py:407`
+   (`--read-only` rejected on 0.139, re-validated); make_invoke_command/
+   codex_invoke demoted to secondary (promotion-gate/debug) paths.
+2. §2 Governance — kernel scope expanded to 4 paths (check_pair_rail.py, codex.py,
+   codex-cli-pin.txt, codex-cli-binary-sha256.txt) + substrate-watch.json
+   (non-kernel); all override tokens discovered at execution.
+3. §3 ACs — added: live-rail fix + AC, redaction-before-parse, structured-only
+   verdict, loud model-id, JSONL contract, parse_usage shared helper,
+   substrate-watch codex_cli, per-call-site stdin, pin repin + corpus decision.
+4. §4 Status — stays `draft`; round-2 required to ratify the re-scoped plan +
+   the C5 altitude decision.
+
+## Round verdict
+
+**RUN-ANOTHER-ROUND.** Round 1 surfaced a fundamental scope/diagnosis defect
+(C1, unanimous, CEO-re-validated). The CEO re-scopes PLAN-142 per the
+adjustments above; round-2 ratifies the re-scoped plan (does the live-rail fix
+hold? is the C5 altitude decision sound? is the 4-kernel-path ceremony correctly
+budgeted?). The plan does NOT move to `reviewed` until round-2 returns
+design-coherent. Per DEBATE-SCHEMA §13: even a clean round-2 only satisfies V0 —
+shipping still needs the verification cascade (V1 tests/CI → V2 Codex pair-rail →
+V3 Owner GPG).

package/.claude/plans/PLAN-142/architect/round-1/devops-engineer.md

@@ -0,0 +1,57 @@
+---
+round: 1
+archetype: DevOps & Platform Engineer
+skill: devops-ci-cd
+generated_at: 2026-06-19
+---
+
+## Verdict
+
+ADJUST
+
+## Summary
+
+- WHAT: migrates the Codex pair-rail adapter to codex-cli 0.139.0 via 3 validated fixes — stdin=DEVNULL (non-kernel), --color never + JSONL parse_verdict (kernel).
+- STRONG: each break reproduced hands-on (S245); correct kernel-hard-deny framing; honest that the manual workaround keeps coverage alive.
+- WEAK: fix-site enumeration INCOMPLETE — the LIVE wired rail check_pair_rail.py has its own broken `codex exec --read-only -` argv that bypasses make_invoke_command; plus a stale version/SHA pin and zero codex coverage in substrate-watch.
+
+## Risks
+
+- **R-OPS-1 — CRITICAL.** The plan fixes the non-live path. The wired hook is check_pair_rail.py (settings.json:201). _invoke_codex_review (L407) builds its OWN `[codex_bin,'exec','--read-only','-']`, pipes input=prompt, no --json, `--read-only` not `--sandbox read-only`. None of the 3 fixes reach it; codex_invoke.py is referenced only by tests/ADRs. check_pair_rail.py is ALSO a kernel path (~L170) — a second kernel edit never scoped. *Mitigation:* add _invoke_codex_review to scope; route through make_invoke_command; P0 AC that the WIRED hook returns a verdict on 0.139; re-scope §2 for BOTH kernel paths + BOTH override tokens.
+- **R-OPS-2 — HIGH.** substrate-watch.json watches only claude_code + agent_sdk_ts + agent_sdk_py — `grep codex` returns nothing. Dimension vii was structurally blind to the 0.128→0.139 jump. *Mitigation:* P1 — register a codex_cli component with a watch_for note (exec/--color/--sandbox/--json + flag removals) so the next bump is a nightly advisory.
+- **R-OPS-3 — HIGH.** Pins stale + ignored: codex-cli-pin.txt (>=0.128,<0.131) and codex-cli-binary-sha256.txt (0.130-era) vs 0.139 binary; both kernel paths feeding release.yml step 15. A release now fails the pin (or is bypassed via CEO_PAIR_RAIL_VERDICT_OPTIONAL). *Mitigation:* widen pin + refresh SHA under the same ceremony; surface whether step-15 has been silently bypassed.
+- **R-OPS-4 — MEDIUM.** Model mis-pinned at two layers: invoke_codex gpt-5.5 → coerced to gpt-5-codex (absent from _VALID_MODELS). S120 PROMOTED gpt-5.5 because gpt-5-codex missed findings → the live rail has silently run the demoted reviewer. *Mitigation:* add intended id to _VALID_MODELS; unknown-id coercion emits an audit breadcrumb / hard-fails; P1 AC argv carries the requested model.
+- **R-OPS-5 — MEDIUM.** stdin=DEVNULL is correct for codex_invoke (positional prompt) but would DISCARD the prompt on the live `input=prompt`+`-` pipe path. *Mitigation:* per-call-site remedy — DEVNULL for positional; for the pipe path keep input= (confirm 0.139 accepts it) or convert to positional `-- <prompt>` + DEVNULL; repro AC for the live path.
+- **R-OPS-6 — MEDIUM.** Test strategy (OQ4) under-specified for the live path; risk JSONL added, plain-text (which check_pair_rail uses) silently dropped. *Mitigation:* golden-file unit tests (captured 0.139 JSONL + plain-text → both yield verdict, no live binary); CEO_PAIR_RAIL_FIXTURE_RESPONSE-injected decide() test; one network-gated opt-in smoke test; name the backward-compat invariant.
+- **R-OPS-7 — LOW.** OQ2 open; --strict-json + --resume never re-validated on 0.139 (may have drifted like --no-color) → strict path silently ADVISORY. *Mitigation:* resolve OQ2; AC re-validates --strict-json + --resume on 0.139; gate behind a version check if removed.
+
+## Must-fix (blocking)
+
+1. Add check_pair_rail.py:_invoke_codex_review (L407) to scope as a third fix site + second kernel edit; P0 AC that the SETTINGS-WIRED hook returns a verdict on 0.139; one argv source of truth.
+2. Reconcile governance pins with 0.139 in the same ceremony (widen codex-cli-pin.txt + refresh codex-cli-binary-sha256.txt); both kernel paths feeding release.yml step 15.
+3. Register codex_cli in substrate-watch.json so the next drift fails loud (dimension vii is currently blind).
+4. Per-call-site stdin remedy + model-id handling (DEVNULL discards the prompt on the live pipe path; gpt-5.5/_VALID_MODELS coercion runs the weaker model silently — make it loud + add the id).
+
+## Nice-to-have (advisory)
+
+1. Make _resolve_codex_bin honor codex-cli-binary-sha256.txt at RUNTIME, not just release CI (mid-session PATH decoy uncaught today).
+2. Resolve OQ2 in the plan body (-o/--output-last-message vs JSONL + golden fixture).
+3. Re-validate --strict-json + --resume on 0.139.
+4. Update the stale check_pair_rail.py L402-406 comment ('validated 0.128.0') after migration.
+
+## Unseen by the original plan
+
+1. (biggest) make_invoke_command claimed 'single source of truth' but the live hook hand-rolls its own argv and never calls it; codex_invoke.py is not wired into settings.json.
+2. version pin + binary-sha pin already violated by 0.139 and themselves kernel paths, entangled with release.yml step 15.
+3. substrate-watch.json has no codex_cli entry — the instrument meant to catch this drift doesn't watch the component that drifted.
+4. silent model coercion gpt-5.5→gpt-5-codex (demoted reviewer) with no audit signal — pre-existing correctness defect.
+5. runtime supply-chain gap: _resolve_codex_bin doesn't verify binary SHA at invocation.
+6. per-call-site stdin semantics diverge (positional vs pipe) — one-size DEVNULL doesn't transfer.
+
+## What I would NOT change
+
+1. codex_invoke.py stdin fix in the same ceremony — harmless alone, minimizes ceremony count.
+2. honest framing that coverage isn't lost meanwhile (manual workaround) — de-escalates urgency correctly.
+3. manual `codex exec review --uncommitted` for the diff's own pass — acceptable labeled bootstrap.
+4. consciously DROPPING the hook-tests-dual-rail timeout bump — good scope hygiene.
+5. fail-open-to-ADVISORY in parse_verdict (ADR-106) — preserve through the JSONL migration.

package/.claude/plans/PLAN-142/architect/round-1/proposal.md

@@ -0,0 +1,57 @@
+---
+plan: PLAN-142
+round: 1
+created_at: 2026-06-19
+---
+
+# PLAN-142 round-1 proposal — Codex pair-rail adapter migration to codex-cli 0.139.0
+
+Full plan: `.claude/plans/PLAN-142-codex-cli-0139-adapter-migration.md`.
+
+## Thesis
+
+The automated Codex pair-rail (ADR-107) is broken against the installed
+`codex-cli 0.139.0`: `codex_invoke.py` returns `{"parse_error":"[codex] empty
+stdout"}` in 0.094s. Three independent breaks, each reproduced hands-on in S245.
+Restore the rail by migrating the adapter to the 0.139.0 surface.
+
+## Scope (3 fixes, 2 in a kernel path)
+
+1. **stdin block** (NON-kernel, `.claude/scripts/codex_invoke.py`): `codex exec`
+   blocks reading stdin even with a positional prompt; the wrapper's
+   `subprocess.run` doesn't close stdin → instant empty stdout. Fix:
+   `stdin=subprocess.DEVNULL` on both `subprocess.run` calls. Verified: same
+   argv with `</dev/null` returns exit 0 + 322 bytes.
+
+2. **`--no-color` removed** (KERNEL, `.claude/hooks/_lib/adapters/codex.py`):
+   `make_invoke_command()` emits `--no-color`; 0.139.0 rejects it
+   (`error: unexpected argument '--no-color'`, exit 2). Fix: `--color never`.
+
+3. **`--json` is a JSONL event stream** (KERNEL, same adapter): with `--json`,
+   `codex exec` prints JSONL events, not one object; `parse_verdict()` does
+   `json.loads()` on the whole stdout → `Extra data line 2`. The verdict text is
+   in the `item.completed` event with `item.type=="agent_message"` (`item.text`).
+   Fix: detect the JSONL stream, extract+join `agent_message` texts, then run the
+   existing text parser. Backward-compat for plain-text/JSON must be retained.
+
+## Key decisions
+
+- `.claude/hooks/_lib/adapters/codex.py` is an arbitration-kernel path
+  (`_KERNEL_PATHS`:155). Editing it is KERNEL-HARD-DENY: sentinel GPG (Owner
+  `.asc`) + `CEO_KERNEL_OVERRIDE=<token>` + `CEO_KERNEL_OVERRIDE_ACK=I-ACCEPT`.
+- The implementation diff's cross-model pass uses the manual
+  `codex exec review --uncommitted` (the rail reviews its own fix — bootstrap).
+- The `hook-tests-dual-rail` timeout bump (also a kernel path, `validate.yml`)
+  was consciously DROPPED — out of scope here.
+
+## Open questions for the debate
+
+- OQ1: Is `gpt-5-codex` still a valid 0.139.0 model id? (`make_invoke_command`
+  forces it regardless of the `model=` arg.)
+- OQ2: Is parsing the `--json` JSONL stream the right call, or should the adapter
+  switch to `-o/--output-last-message <FILE>` (last message only) — simpler, no
+  event-stream parsing, but needs a temp file?
+- OQ3: How to keep backward-compat so the parser doesn't regress any
+  still-in-use plain-text/JSON path while adding JSONL support?
+- OQ4: Test strategy for a kernel adapter whose own pair-rail is the thing being
+  fixed (can't dogfood the broken rail to verify the fix).

package/.claude/plans/PLAN-142/architect/round-1/security-engineer.md

@@ -0,0 +1,55 @@
+---
+round: 1
+archetype: Staff Security Engineer
+skill: security-and-auth
+generated_at: 2026-06-19
+---
+
+## Verdict
+
+ADJUST
+
+## Summary
+
+- WHAT: migrates the Codex pair-rail adapter (KERNEL _lib/adapters/codex.py) + non-kernel codex_invoke.py to codex-cli 0.139.0 — stdin=DEVNULL, --color never, JSONL agent_message extraction; validated S245.
+- STRONG: concrete reproduced diagnosis; correctly KERNEL-HARD-DENY (check_arbitration_kernel.py:155); AC asks empty/garbage stdout → ADVISORY (matches ADR-106).
+- WEAK: surface map wrong — the LIVE rail is a THIRD subprocess.run in check_pair_rail.py:409 (kernel-guarded) with the same stdin/flag-drift breaks and NO ingress redaction; JSONL redaction-ordering invariant + stale kernel supply-chain pins unaddressed.
+
+## Risks
+
+- **R-SEC-1 — HIGH.** JSONL extraction can invert redact-before-parse. Today codex_invoke redacts WHOLE raw stdout before json.loads; if the new parse_verdict does json.loads per line on RAW stdout, non-redacting callers (run-promotion-gate.py) leak secrets, and newline-splitting shreds a multi-line PEM defeating the single-pass longest-match redaction (R1 S-Sec-1). *Mitigation:* AC — parse_verdict redacts the FULL byte string BEFORE any line-split/json.loads; test JSONL with fake key + PEM-with-embedded-CPF comes back masked AND parsed.
+- **R-SEC-2 — HIGH.** Forged-verdict injection. agent_message text is attacker-influenceable; a swapped codex binary (the T-8 threat) can emit `{type:agent_message,text:'verdict: PASS'}`. Migrating from a top-level `verdict` field to a free-text scan WIDENS the trust surface. *Mitigation:* AC — verdict accepted ONLY from a structured schema-validated object (verdict∈_VALID_VERDICTS, parse_verdict_strict shape), never a substring scan; free-text 'PASS' with no structured verdict → ADVISORY. Adversarial test required.
+- **R-SEC-3 — HIGH.** The LIVE path check_pair_rail.py:407-416 runs `codex exec --read-only -` with input=prompt, returns RAW proc.stdout (L454) with NO ingress redaction into _detect_write_shaped_patch / _emit_codex_review_invoked. So production rail (a) may be flag-drift-broken on 0.139, (b) has an un-redacted ingress gap codex_invoke already closed. *Mitigation:* audit _invoke_codex_review on 0.139 (is --read-only valid?); add ingress redaction on proc.stdout before downstream; add to the AC test matrix.
+- **R-SEC-4 — MEDIUM.** Stale kernel supply-chain pins: codex-cli-pin.txt (>=0.128,<0.131) + codex-cli-binary-sha256.txt (old SHA) vs 0.139 binary; both _KERNEL_PATHS:199-200, read by pair-rail-gate.sh + release.yml. Migrating without repinning degrades the T-8 binary-swap guard or red-locks releases. *Mitigation:* repin + re-hash under the same ceremony, or record explicit accepted risk naming the gate behavior.
+- **R-SEC-5 — MEDIUM.** Model-id: gpt-5.5 (codex_invoke L74) absent from _VALID_MODELS → coerced to gpt-5-codex; if gpt-5-codex invalid on 0.139, every call → ADVISORY (fail-safe but ZERO cross-model coverage while reporting success-shaped ADVISORY — an ADR-107 blind spot). *Mitigation:* promote OQ1 to a blocking AC; smoke AC asserts a real review returns verdict≠ADVISORY-with-parse_error on a known-good fixture.
+- **R-SEC-6 — LOW.** Bootstrap self-review: the tool reviews its own adapter fix; a forged-verdict/flag-drift bug could let the broken adapter bless itself. *Mitigation:* add a HUMAN (Owner) review to the ceremony + offline fixture test of parse_verdict against captured real 0.139 JSONL; resolve OQ4.
+
+## Must-fix (blocking)
+
+1. R-SEC-1: AC — redact FULL raw stdout (single pass) BEFORE any JSONL split/json.loads; JSONL+PEM+fake-key test proving redact-first survives.
+2. R-SEC-2: AC — verdict only from a structured schema-validated object; forged free-text 'PASS' → ADVISORY; adversarial test.
+3. R-SEC-3: bring check_pair_rail.py:_invoke_codex_review into scope; verify --read-only on 0.139; add ingress redaction before downstream; or justify leaving the production gate on the legacy surface.
+4. R-SEC-5/OQ1: promote OQ1 to a blocking AC; reconcile gpt-5.5 vs _VALID_MODELS so the rail isn't a silent always-ADVISORY no-op.
+
+## Nice-to-have (advisory)
+
+1. R-SEC-4: repin codex-cli-pin.txt + re-hash binary SHA under the same ceremony, or record the deferral as accepted risk.
+2. R-SEC-6/OQ4: Owner human-review + offline fixture test so kernel-diff verification doesn't depend on the artifact under test.
+3. If OQ2 picks -o/--output-last-message, create the temp file 0600 in a private dir + unlink after read; else JSONL-on-stdin keeps secrets off disk.
+
+## Unseen by the original plan
+
+1. (biggest) the THIRD subprocess path check_pair_rail.py:409 — the path that gates L3+ edits — same flag-drift + un-redacted ingress.
+2. the two kernel supply-chain pins are stale + themselves kernel paths.
+3. parse_verdict has 3 non-test callers; only codex_invoke pre-redacts → run-promotion-gate.py becomes a new egress/forged-verdict surface.
+4. redaction-label-vs-JSON-structure: pin 'redaction replaces values inside string fields only; parse runs on redacted full stream' as an invariant.
+5. stderr handling: a 0.139 unknown-flag error on stderr+empty stdout must fail-closed-to-ADVISORY and surface the stderr head (currently ignored).
+6. no DoS/size bound on the JSONL stream — needs an explicit size/line-count cap.
+
+## What I would NOT change
+
+1. KERNEL-HARD-DENY classification + the full ceremony — verified accurate; do not downgrade.
+2. fail-open-to-ADVISORY on parse miss / empty stdout (ADR-106) — never auto-PASS.
+3. landing the non-kernel codex_invoke.py stdin fix under the same ceremony — sound.
+4. routing all argv through a single make_invoke_command source of truth.
+5. NOT bumping the hook-tests-dual-rail timeout — scoping discipline.

package/.claude/plans/PLAN-142/architect/round-1/vp-engineering.md

@@ -0,0 +1,58 @@
+---
+round: 1
+archetype: VP Engineering
+skill: architecture-decisions
+generated_at: 2026-06-19
+---
+
+## Verdict
+
+REJECT
+
+## Summary
+
+- WHAT: migrates the Codex pair-rail to codex-cli 0.139.0 via 3 fixes — stdin=DEVNULL in codex_invoke.py (non-kernel), --no-color→--color never and JSONL parsing in _lib/adapters/codex.py (kernel, HARD-DENY ceremony).
+- STRONG: diagnosis is hands-on-validated; kernel-altitude/ceremony framing is correct; parse_verdict fail-open-to-ADVISORY contract preserved.
+- WEAK (fatal): the plan fixes the WRONG file. The LIVE wired pair-rail hook is check_pair_rail.py (settings.json:201), whose _invoke_codex_review (L407) has its OWN hardcoded argv that bypasses make_invoke_command AND pipes over stdin — none of the 3 fixes restore the actual production rail.
+
+## Risks
+
+- **R-VP-1 — CRITICAL.** Plan fixes make_invoke_command + codex_invoke.py, but the LIVE pair-rail is check_pair_rail.py:407 `[codex_bin,'exec','--read-only','-']` — never calls make_invoke_command, pipes `input=prompt` over stdin `-` (the exact stdin-block), uses bare `--read-only` (legacy sibling of the removed --no-color → likely rejected too), returns raw stdout. Fixing make_invoke_command is dead code for the real rail; the plan would land a green ceremony and still leave the rail broken. *Mitigation:* add check_pair_rail.py:_invoke_codex_review (also _KERNEL_PATHS:170) as a first-class fix; route through make_invoke_command; positional prompt not stdin `-`; AC that a real pair-rail run returns a verdict.
+- **R-VP-2 — HIGH.** parse_usage_from_codex_stdout (codex.py:527) does the IDENTICAL json.loads(whole-stdout) → same 'Extra data line 2' on JSONL; token telemetry silently zeroes. *Mitigation:* shared _extract_agent_message_text helper routed through BOTH parsers in this ceremony.
+- **R-VP-3 — HIGH.** Pin-gate contradiction: codex-cli-pin.txt pins >=0.128,<0.131; binary is 0.139. Both pin files are _KERNEL_PATHS:199-200 → a THIRD/FOURTH kernel edit; ADR-111 needs a corpus re-run if catch_rate shifts >5pp. Ceremony scope undercounted. *Mitigation:* repin + refresh SHA in scope; enumerate ALL kernel paths; honor or consciously defer the corpus re-run.
+- **R-VP-4 — MEDIUM.** JSONL heuristic under-specified (multi agent_message, reasoning items, truncated streams). 'extract+join' reproduces 'Extra data line 2' one layer down. *Mitigation:* per-line try/except, take LAST agent_message (not join), ignore reasoning, degrade to ADVISORY; unit ACs for each case.
+- **R-VP-5 — MEDIUM.** OQ2 (JSONL vs -o/--output-last-message) unresolved; JSONL bakes event-schema into a KERNEL file (every schema rename = new ceremony). *Mitigation:* decide OQ2; prefer --output-last-message for least kernel churn, or isolate CLI-shape behind a non-kernel helper.
+- **R-VP-6 — MEDIUM.** Altitude: CLI surface (flags, event schema) encoded in KERNEL-HARD-DENY file; codex-cli already broke twice. Recurring GPG tax with no security value (CLI shape is not the trust boundary; verdict-validation is). *Mitigation:* split CLI-shape into a non-kernel helper; keep trust logic in kernel.
+- **R-VP-7 — LOW.** make_invoke_command coerces unknown model → gpt-5-codex (L643); invoke_codex defaults gpt-5.5 (NOT in _VALID_MODELS) → silently coerced. *Mitigation:* reconcile _VALID_MODELS + wrapper default; AC asserts the model reaching codex exec is intended.
+
+## Must-fix (blocking)
+
+1. R-VP-1: add check_pair_rail.py:_invoke_codex_review to scope; route via make_invoke_command; AC that a real run returns a verdict.
+2. R-VP-2: route parse_usage_from_codex_stdout through the same JSONL extraction in this ceremony.
+3. R-VP-3: resolve codex-cli-pin.txt contradiction; enumerate all kernel paths; honor/defer ADR-111 corpus re-run.
+4. R-VP-4: specify the JSONL parsing contract + unit ACs (multi-message, reasoning-interleaved, truncated).
+5. R-VP-5/OQ2: decide JSONL-parse vs --output-last-message; if JSONL, isolate CLI-shape behind a non-kernel helper.
+
+## Nice-to-have (advisory)
+
+1. R-VP-6: split CLI-shape out of the kernel (do it in this ceremony to avoid paying the GPG tax twice).
+2. R-VP-7/OQ1: reconcile _VALID_MODELS with the gpt-5.5 default.
+3. Freeze the S245 0.139 JSONL sample as a test fixture (answers OQ4 — can't dogfood the broken rail).
+4. Document the manual workaround as interim coverage; gate the reference-doc retirement on R-VP-1, not just parse_verdict.
+
+## Unseen by the original plan
+
+1. (highest) check_pair_rail.py:_invoke_codex_review is the real production rail with its own broken Codex call none of the 3 fixes touch — a scope/diagnosis gap, not a missing AC.
+2. parse_usage_from_codex_stdout — second whole-stdout json.loads, breaks identically.
+3. codex-cli-pin.txt vs 0.139 binary: pre-flight gate rejects 0.139 even after a perfect adapter fix.
+4. --strict-json (codex.py:661) referenced as a real flag but unverified on 0.139 — may be dead like --no-color.
+5. stdin block is a CLASS bug (every subprocess.run to codex exec), not a per-file one.
+6. No rollback/verification plan for a kernel edit that cannot be dogfooded.
+
+## What I would NOT change
+
+1. Kernel-altitude framing is correct — keep the sentinel-GPG + CEO_KERNEL_OVERRIDE ceremony.
+2. Splitting the non-kernel codex_invoke.py fix into the same commit is right.
+3. Preserving parse_verdict fail-open-to-ADVISORY (ADR-106) is correct.
+4. The conscious DROP of the hook-tests-dual-rail timeout bump is good governance hygiene.
+5. The manual `codex exec review --uncommitted` as the interim bootstrap pass is acceptable.

package/.claude/plans/PLAN-142/architect/round-2/anonymization-map.md

@@ -0,0 +1,11 @@
+---
+plan: PLAN-142
+round: 2
+labels:
+  Critic-A: vp-engineering
+  Critic-B: security-engineer
+  Critic-C: devops-engineer
+---
+
+Anonymization audit record (DEBATE-SCHEMA §13.2). Round-2 synthesis weighed
+critique CONTENT under neutral labels; identities resolve here.

package/.claude/plans/PLAN-142/architect/round-2/approved.md

@@ -0,0 +1,65 @@
+# PLAN-142 — Architect Sentinel (round 2, terminal)
+
+Authorizes the canonical + kernel edits to restore the Codex pair-rail on
+codex-cli 0.139.0 (PLAN-142, status reviewed after a 2-round debate). Four of the
+five scoped paths are arbitration-kernel (KERNEL-HARD-DENY): editing them needs,
+IN ADDITION to this Owner-signed sentinel, `CEO_KERNEL_OVERRIDE=<reason-slug>` +
+`CEO_KERNEL_OVERRIDE_ACK=I-ACCEPT` in the harness environment (set at session
+launch — the Bash tool cannot set it for the hooks). The fifth path
+(`_lib/codex_cli_shape.py`, NEW) is canonical-guarded but NOT kernel.
+
+> **Anchor note:** the anchor below is the `main` HEAD this work branched from. At
+> EXECUTION, re-anchor to the then-current HEAD (the committed reviewed plan +
+> staging) and re-run `gpg --armor --detach-sign --yes approved.md` so the `.asc`
+> matches — a rewritten approved.md invalidates the old signature.
+
+Anchor commit 22644d84b73430a69bb788f97d9fe9751ca51b45 is the execution HEAD
+(committed reviewed plan + staging, branch `plan-142-reviewed`) this sentinel was
+re-anchored to at execution (S246). It descends from the `main` HEAD
+1444caa00f072a2401b94bd1fe039b473cfcbf00 this sentinel was originally drafted
+against.
+
+<!-- BEGIN SIGNED SCOPE -->
+Approved-By: @Canhada-Labs 22644d84b73430a69bb788f97d9fe9751ca51b45
+Plans: PLAN-142
+Scope:
+  - .claude/hooks/check_pair_rail.py
+  - .claude/hooks/_lib/adapters/codex.py
+  - .claude/hooks/_lib/codex_cli_shape.py
+  - .claude/governance/codex-cli-pin.txt
+  - .claude/governance/codex-cli-binary-sha256.txt
+<!-- END SIGNED SCOPE -->
+
+Authorization: Owner-signed GPG detached signature (approved.md.asc), signer
+fingerprint D7227DFE7614477282A64BFE61C1C798ED8EE279, verified against both signer
+rails (.claude/sentinel-signers.txt + the ADR-121 YAML registry). **The .asc is
+generated at EXECUTION time, not now** — this file is committed unsigned as a
+prepared draft; the Owner signs it in the execution session.
+
+Kernel-override note: paths 1, 2, 4, 5 are in `_KERNEL_PATHS`
+(check_arbitration_kernel.py:155/170/199/200). The sentinel alone does NOT grant
+them — the harness must ALSO carry `CEO_KERNEL_OVERRIDE` + `..._ACK=I-ACCEPT`
+(a generic reason slug + the ACK; not a per-path token). That env requires a
+session relaunch. Path 3 (`_lib/codex_cli_shape.py`) is canonical-guarded only —
+this sentinel covers it.
+
+Rationale by path:
+  - check_pair_rail.py — replace the broken inline `exec --read-only -` argv with
+    a codex_cli_shape-built argv (-o tmpfile); rewrite the consume side to read +
+    redact + parse_verdict_strict; tmpfile TOCTOU hygiene; _detect_write_shaped_patch
+    demoted to secondary.
+  - _lib/adapters/codex.py — parse the -o last-message file (one redacted object,
+    structured-only); rewrite parse_usage per-line; delegate ALL CLI-shape to the
+    helper (no CLI literals left in this kernel file).
+  - _lib/codex_cli_shape.py (NEW, non-kernel) — the single argv builder + model
+    list + dead-flag migration; makes the next codex-cli bump a non-kernel edit.
+  - codex-cli-pin.txt — widen the range to admit 0.139.x.
+  - codex-cli-binary-sha256.txt — re-pin to the trusted 0.139 binary
+    (d3be844c45c4fd89392536e56e1010963f94785592596b50cd0c45bb8a341406, computed
+    S245 from `shasum -a 256 $(which codex)`; RE-VERIFY at execution).
+
+ADR-111: the 0.128→0.139 jump (+ possible reviewer-model change) is large — run
+the locked-corpus catch_rate check OR defer with a rationale naming the security
+consequence. Release-time: regenerate pair-rail-verdict-<tag>.md (recomputed
+inputs_hash, since both kernel files are in pair-rail-inputs-hash-manifest.txt) OR
+ship the first post-edit release under CEO_PAIR_RAIL_VERDICT_OPTIONAL=1 recorded.

package/.claude/plans/PLAN-142/architect/round-2/consensus.md

@@ -0,0 +1,78 @@
+---
+plan: PLAN-142
+round: 2
+rounds_synthesized: [round-1, round-2]
+agents_considered: [vp-engineering, security-engineer, devops-engineer]
+decisions_revised_in_plan:
+  - "§1 — full 0.139 dead-flag set (--no-color/--read-only/--strict-json/--resume)"
+  - "§2 — 5th entanglement: pair-rail-inputs-hash-manifest + release.yml step-15 verdict regen"
+  - "§3 — live-rail consume rewrite (parse_verdict_strict), tmpfile TOCTOU hygiene, single shape helper, grep gate, --output-schema, usage convergence"
+  - "§4 — D1..D5 ratified (output-last-message + non-kernel shape helper + secondary patch-scan + binary-SHA T-8 attribution + loud model-id)"
+synthesized_at: 2026-06-19
+synthesized_by: CEO
+verdict_label: design-coherent (round-2 3×ADJUST; all must-fixes folded)
+---
+
+> Synthesis consumed anonymized critiques (Critic-A/B/C; map in
+> `anonymization-map.md`). Round-2 verdicts: 3×ADJUST (no REJECT). All three
+> independently re-validated the re-scope + D1 against the live 0.139 binary.
+
+## Consensus findings (2+ critics flagged) — all folded into the plan
+
+- **CR1 (A,B,C).** Re-scope CORRECT + D1 SOUND, both verified on 0.139
+  (`--read-only` gone, `-o/--output-last-message` works, `--color never` valid).
+  → §1, §4 D1.
+- **CR2 (A,C).** Telemetry is a FALSE dilemma — `--json` + `-o` compose. Resolved:
+  live rail `-o`-only (drop usage, no consumer per B); promotion path keeps `--json`
+  with `parse_usage` rewritten per-line. → §3 output-contracts AC, §4 D1.
+- **CR3 (A,B,C).** Single argv builder must be the NON-kernel shape helper (not
+  make_invoke_command, which emits the rejected shape); move `_VALID_MODELS` + model
+  literals out of the kernel; grep gate proves zero CLI literals remain. → §3 helper
+  ACs + grep gate, §4 D2.
+- **CR4 (A,B,C).** Live rail has NO structured-verdict consumption today
+  (`_detect_write_shaped_patch` free-text scan); R-SEC-2 is currently VIOLATED by
+  the rail. Resolved: rail consumes the `-o` file → redact → `parse_verdict_strict`;
+  patch-scan demoted to secondary defense. → §3 consume AC, §4 D3.
+- **CR5 (A,B,C).** tmpfile threat surface — the UNTRUSTED binary is the WRITER
+  (TOCTOU/symlink). Resolved: mkdtemp 0700 + O_EXCL + symlink-refusal + finally
+  unlink; degradation matrix → ADVISORY. → §3 tmpfile-hygiene AC.
+
+## Single-agent insights kept
+
+1. **Critic-C (R-OPS-1):** inputs-hash replay manifest = 5th entanglement; release
+   step-15 blocks unless a fresh post-edit verdict file is produced. → §2.
+2. **Critic-C (R-OPS-2):** `--strict-json` + `--resume` also dead on 0.139 (verified)
+   — full dead-flag audit in the helper. → §1, §3.
+3. **Critic-B (R-SEC-3):** the binary-SHA pin (not the structured object) is the T-8
+   defense; runtime gap is accepted risk. → §3, §4 D4.
+4. **Critic-A/C (--output-schema):** CLI-enforced structured-verdict backstop. → §3 P1.
+5. **Critic-B (R-SEC-6):** offline golden-fixture test promoted P1→P0 (can't dogfood
+   the broken rail). → §3 tests.
+
+## Single-agent insights rejected / deferred
+
+- None rejected. Runtime binary-SHA enforcement (R-SEC-3 option a) DEFERRED to a
+  follow-up rather than added as a 5th kernel touch this ceremony (D4) — recorded as
+  accepted risk with the release-time SHA pin + Owner review + manual workaround as
+  interim controls.
+
+## Plan adjustments (index; edits live in PLAN-142.md)
+
+1. §1 — full 0.139 dead-flag set; live-rail consume reality (free-text scan).
+2. §2 — 5 entanglements (4 kernel paths + inputs-hash manifest/verdict regen);
+   ADR-111 deferral must name the security consequence.
+3. §3 — live-rail consume rewrite, tmpfile TOCTOU hygiene, single shape helper +
+   grep gate, redaction retarget, structured-only verdict, loud model-id, output
+   contracts converge on `-o`, --output-schema, P0 offline fixtures.
+4. §4 — D1..D5 ratified.
+
+## Round verdict
+
+**PROCEED (design-coherent).** Round-2 returned 3×ADJUST with NO REJECT and NO
+ESCALATE; every must-fix is concrete and has been folded into §3/§4 (no open design
+question remains — D1..D5 are decided). Plan moves `draft → reviewed`. Per
+DEBATE-SCHEMA §13 this certifies INTERNAL design-coherence only (V0); it does NOT
+authorize shipping — execution still runs the KERNEL-HARD-DENY ceremony, then V1
+(tests/CI) → V2 (Codex pair-rail, restored or manual + Owner review) → V3 (Owner
+GPG). A round-3 was judged unnecessary: the residual items are implementation ACs,
+not unresolved design forks.

package/.claude/plans/PLAN-142/architect/round-2/devops-engineer.md

@@ -0,0 +1,58 @@
+---
+round: 2
+archetype: DevOps & Platform Engineer
+skill: devops-ci-cd
+generated_at: 2026-06-19
+---
+
+## Verdict
+
+ADJUST
+
+## Summary
+
+- RE-SCOPE CORRECT, every substrate claim re-validated on the live 0.139 binary (/opt/homebrew/bin/codex): --read-only gone (now -s/--sandbox enum); 4 kernel paths real; pin >=0.128,<0.131 excludes 0.139; SHA pin baefc1… ≠ actual d3be84…. C1 holds.
+- D1 SOUND: `-o/--output-last-message` exists; single object avoids the JSONL 'Extra data line 2' noise. Verified `--json --color never -o <file>` all coexist → token telemetry need NOT be dropped (parallel capture is technically free).
+- FOUR gaps remain (→ ADJUST): dead-flags incomplete, --output-schema unused, inputs-hash replay manifest (5th entanglement) unaddressed, live-rail consume side unspecified.
+
+## Risks
+
+- **R-OPS-1 — HIGH.** inputs-hash replay manifest = unbudgeted 5th governance entanglement. Both edited kernel files are in pair-rail-inputs-hash-manifest.txt; release.yml step 15 (validate-pair-rail-verdict.py --recompute-inputs-hash) git-hashes every entry → editing them changes inputs_hash → the next release verdict file must be regenerated or step 15 BLOCKS. *Mitigation:* §2 obligation — fresh post-edit pair-rail-verdict-<tag>.md (codex_cli=0.139, new SHA, recomputed inputs_hash) OR first release under CEO_PAIR_RAIL_VERDICT_OPTIONAL=1 recorded; name validate-pair-rail-verdict.py + the manifest.
+- **R-OPS-2 — MEDIUM.** Dead-flag set incomplete: `--strict-json` (verified → unexpected argument) and `--resume` (now an `exec resume` SUBCOMMAND) are also dead; make_invoke_command emits both. *Mitigation:* P0 AC enumerating the full 0.139 dead-flag set; do the audit in the _lib/codex_cli_shape.py helper in one pass.
+- **R-OPS-3 — MEDIUM.** D1 leaves the secondary parse contract broken: codex_invoke.py + run-promotion-gate.py still call make_invoke_command (--json) + parse_verdict(whole stdout) → still 'Extra data line 2'. *Mitigation:* both contracts converge on `-o tmpfile`; AC — run-promotion-gate.py returns a parsed verdict on 0.139.
+- **R-OPS-4 — MEDIUM.** Live-rail downstream consume unspecified: decide() uses _detect_write_shaped_patch (free-text), not parse_verdict. *Mitigation:* AC — _invoke_codex_review returns the parsed structured verdict; decide() routes through the whitelist; specify _detect_write_shaped_patch fate.
+- **R-OPS-5 — LOW.** tmpfile leaks on timeout/crash if unlink is 'after read'. *Mitigation:* try/finally unlink on timeout + exception paths.
+- **R-OPS-6 — LOW.** substrate-watch codex_cli registration needs a real watch_for note (exec flag surface) to catch the next drift. *Mitigation:* specify watch_for content; refresh SHA pin in the same edit.
+- **R-OPS-7 — LOW.** ADR-111 defer across a 9-minor + model jump must name WHY catch_rate is assumed stable. *Mitigation:* defer rationale addresses the gpt-5.5 vs gpt-5-codex model-behavior change.
+
+## Must-fix (blocking)
+
+1. R-OPS-1: add the inputs-hash replay manifest + validate-pair-rail-verdict.py to the §2 release.yml step-15 set; a fresh post-edit verdict file or recorded bypass is required.
+2. R-OPS-2: enumerate the FULL 0.139 dead-flag set (--no-color→--color never, --strict-json gone, --resume→subcommand) in the shape helper, one ceremony.
+3. R-OPS-3: converge BOTH output contracts on `-o tmpfile`; AC that run-promotion-gate.py returns a parsed verdict on 0.139.
+4. R-OPS-4: specify the live-rail consume contract (decide() routes the structured verdict through the whitelist; _detect_write_shaped_patch retained-as-advisory or removed).
+
+## Nice-to-have (advisory)
+
+1. Adopt --output-schema <FILE> (CLI-enforces R-SEC-2 structured-only — stronger than a prompt instruction).
+2. Record that --json + -o coexist (token telemetry parallel-capture is free); or drop with that fact stated.
+3. Runtime binary-SHA check in _resolve_codex_bin (mid-session PATH-decoy window).
+4. tmpfile cleanup in try/finally (timeout/exception paths).
+
+## Unseen by the original plan
+
+1. (highest) pair-rail-inputs-hash-manifest.txt replay binding — editing both kernel files invalidates the next release's inputs_hash; release.yml:536-544 blocks unless a fresh verdict file is produced.
+2. --strict-json + --resume dead on 0.139; make_invoke_command emits both.
+3. --output-schema exists — CLI-native R-SEC-2 enforcement, unmentioned.
+4. D1's -o migration doesn't propagate to the --json-consuming secondary parsers — divergent contracts.
+5. live-rail downstream is _detect_write_shaped_patch (free-text), not parse_verdict.
+6. model coercion happens in make_invoke_command:643 regardless of wrapper default — fix must touch _VALID_MODELS.
+
+## What I would NOT change
+
+1. Re-scope pivot to check_pair_rail.py:_invoke_codex_review — C1 real, keep.
+2. D1 (--output-last-message over JSONL) — verified, single object, lowest churn; keep.
+3. CLI-shape in _lib/codex_cli_shape.py, trust logic in kernel — correct; do it THIS ceremony.
+4. 4-kernel-path enumeration — accurate as far as it goes (R-OPS-1 adds the manifest/verdict coupling).
+5. egress redaction already correct at the live rail (L383, fail-CLOSED ADR-114) — scope only the ingress gap.
+6. manual workaround + Owner human review as interim bootstrap — sound.

package/.claude/plans/PLAN-142/architect/round-2/security-engineer.md

@@ -0,0 +1,56 @@
+---
+round: 2
+archetype: Staff Security Engineer
+skill: security-and-auth
+generated_at: 2026-06-19
+---
+
+## Verdict
+
+ADJUST
+
+## Summary
+
+- RE-SCOPE CORRECT (grounded): live rail = check_pair_rail.py:407 `exec --read-only -`; 0.139 help has no --read-only → exit 2 on every L2+ edit. 4 kernel paths + pin gap verified on disk.
+- D1 premise REAL: `-o/--output-last-message` exists; one structured object is sound + lower churn.
+- CORE ADJUST: the live rail does NOT use parse_verdict/_VALID_VERDICTS — it free-text-scans raw stdout via _detect_write_shaped_patch → binary block/accept. The R-SEC-1/R-SEC-2 ACs target codex.py parsers that have ZERO live callers. And verdict-forgery defense is the binary-SHA pin, NOT the structured object.
+
+## Risks
+
+- **R-SEC-1 — HIGH.** Redaction-before-parse AC lands on the wrong surface (codex.py, non-live). With D1 the ingress is a FILE read in check_pair_rail.py. *Mitigation:* retarget — read file → single-pass redact → THEN json.loads/detect; PEM-in-summary golden test.
+- **R-SEC-2 — HIGH.** 'Structured-only verdict' AC doesn't wire into the live rail (which uses _detect_write_shaped_patch, never reads a verdict field). *Mitigation:* D1 must state the live rail json.loads (post-redaction) + routes through parse_verdict_strict (verdict∈_VALID_VERDICTS, fail-CLOSED-to-ADVISORY); decide _detect_write_shaped_patch's fate; adversarial free-text-'PASS' → ADVISORY test.
+- **R-SEC-3 — HIGH.** Forged-verdict mis-attributed: a swapped binary (T-8) owns 100% of the -o file → structured {verdict:PASS} is no harder to forge than free text. The real defense is codex-cli-binary-sha256.txt, enforced only at release-time (not runtime in _resolve_codex_bin). *Mitigation:* add a runtime SHA check (possible 5th kernel touch) OR state in writing the structured object is NOT the T-8 defense + record the runtime gap as accepted risk.
+- **R-SEC-4 — MEDIUM.** tmpfile = new vector: the UNTRUSTED binary WRITES the file we read → symlink/TOCTOU. *Mitigation:* tempfile.mkdtemp(0o700); rail creates file O_CREAT|O_EXCL|0o600 + absolute path; refuse symlink/non-regular/not-owned; redact-then-read; finally unlink + rmdir; test symlink-refusal + unlink-on-timeout.
+- **R-SEC-5 — MEDIUM.** Dropping --json drops parse_usage telemetry — but it has ZERO live-rail callers, so live blast radius is NIL. *Mitigation:* consciously DROP usage on the live rail; keep --json only on the non-kernel promotion path; do NOT add a parallel --json to check_pair_rail.py.
+- **R-SEC-6 — MEDIUM.** Bootstrap self-review gap persists. *Mitigation:* promote the offline golden-fixture test (captured 0.139 file → redact → parse_verdict_strict) to P0; keep Owner human review.
+- **R-SEC-7 — LOW.** ADR-111 deferral must name the SECURITY consequence (reduced detection sensitivity), not just process.
+
+## Must-fix (blocking)
+
+1. R-SEC-1/2: D1/§3 must state check_pair_rail reads the file → single-pass redact → json.loads + schema-validate verdict∈_VALID_VERDICTS via parse_verdict_strict (fail-CLOSED-to-ADVISORY) → decide _detect_write_shaped_patch's fate. The current ACs bind only codex.py (dead for the rail).
+2. R-SEC-1/3: retarget the redaction AC to the live-rail file-read site; PEM-with-CPF golden test (masked AND parseable).
+3. R-SEC-4: binding tmpfile-hygiene P0 AC (mkdtemp 0700, O_EXCL, symlink-refusal, finally unlink+rmdir; test symlink + unlink-on-timeout).
+4. R-SEC-3: state the binary-SHA pin (release-time) is the T-8 defense, NOT the structured object; add runtime SHA check or record the mid-session PATH-decoy gap as accepted risk.
+
+## Nice-to-have (advisory)
+
+1. Promote the offline golden-fixture test P1→P0 (kernel edit can't be dogfooded + repins the T-8 SHA).
+2. DROP usage telemetry on the live rail (no consumer); keep --json only on the non-kernel path.
+3. ADR-111 deferral rationale names the security consequence.
+4. Confirm the structured-verdict review prompt is egress-redacted + instructs 'emit ONLY the JSON object as the last message'.
+
+## Unseen by the original plan
+
+1. (biggest) the live rail's 'verdict' is _detect_write_shaped_patch (free-text) → binary block/accept; parse_verdict/_VALID_VERDICTS have NO live caller. The structured-only security argument aims at code the rail doesn't run.
+2. parse_usage has zero live-rail callers — the telemetry worry is a near-no-op for the rail.
+3. under T-8, the untrusted binary WRITES the -o file → symlink/TOCTOU surface the stdin design didn't have.
+4. runtime binary-SHA gap: _resolve_codex_bin doesn't hash at invocation; repinning the SHA doesn't close the mid-session decoy vector.
+
+## What I would NOT change
+
+1. The re-scope (live rail = check_pair_rail.py, --read-only rejected, 4 kernel paths, pin gap) — verified; don't re-open.
+2. D1 (--output-last-message over JSONL) — right altitude; keep with hardening.
+3. CLI-shape in a non-kernel helper, trust logic in the kernel — correct separation.
+4. fail-open-to-ADVISORY (ADR-106) + fail-CLOSED outgoing redaction (ADR-114) — both preserved.
+5. Owner human review + manual workaround as interim bootstrap — sound.
+6. 4-path KERNEL ceremony + ADR-111 obligation as explicit budget — correct.