ceo-orchestration 1.0.0

package/.claude/plans/PLAN-142/staging/codex_cli_shape.py

@@ -0,0 +1,433 @@
+# PLAN-142 STAGING DRAFT — apply to .claude/hooks/_lib/codex_cli_shape.py under the GPG ceremony; NOT YET TESTED.
+"""Single source of truth for codex-cli 0.139.0 CLI-shape (PLAN-142 D2).
+
+This NEW non-kernel module owns ALL Codex CLI-shape so that the kernel
+files (`check_pair_rail.py`, `_lib/adapters/codex.py`) keep ZERO CLI
+literals — no flag names, no model-id list, no subcommand strings. The
+kernel files DELEGATE every argv build to `build_exec_argv` here. This is
+the structural fix for the recurring GPG tax: after this module ships,
+the NEXT codex-cli bump is a NON-kernel edit (PLAN-142 §3 grep gate, D2).
+
+=== Verified 0.139.0 CLI surface (hands-on, S245) ===
+REJECTED on 0.139 (exit 2 / "unexpected argument" — NEVER emit these):
+  - ``--read-only``     (sandbox is now ``-s/--sandbox <mode>``)
+  - ``--no-color``      (color is now ``--color <never|always|auto>``)
+  - ``--strict-json``   (removed; use ``--output-schema`` to enforce shape)
+  - ``--resume <id>``   (now an ``exec resume`` SUBCOMMAND, not a flag)
+
+VALID on 0.139 (the only flags this module emits):
+  - ``exec``                         the subcommand
+  - ``-s/--sandbox <read-only|workspace-write|danger-full-access>``
+  - ``--color <never|always|auto>``  (we always pass ``never``)
+  - ``-o/--output-last-message <FILE>``  writes ONLY the final agent
+        message to <FILE> (verified: a one-line JSON object)
+  - ``--output-schema <FILE>``       JSON Schema the CLI ENFORCES at
+        generation time (makes the structured-verdict shape CLI-enforced,
+        not prompt-dependent — PLAN-142 §3 [P1], R-SEC-2 CLI-enforced)
+  - ``--json``                       JSONL event stream on stdout (usage
+        telemetry consumer ONLY — the live verdict rail does NOT use this)
+
+Verified compose: ``codex exec -o <f> --color never --sandbox read-only \
+  -- "<prompt>"`` writes ONLY the final agent message to <f>. ``-o`` and
+``--json`` COMPOSE (the promotion path adds ``--json`` for usage).
+
+=== argv ordering / two modes (PLAN-142 §4 D1) ===
+mode='verdict' (LIVE rail — check_pair_rail.py):
+    [exec, --color, never, --sandbox, <mode>, -o, <output_file>,
+     (--output-schema <schema_file>)?, --, <prompt>]
+    NO ``--json``: the live rail has no token-usage consumer; usage
+    telemetry is consciously DROPPED on the rail (R-SEC-5).
+
+mode='verdict+usage' (PROMOTION path — codex_invoke.py / run-promotion-gate.py):
+    same as 'verdict' PLUS ``--json`` so the promotion path can read
+    per-line usage events from the JSONL stdout (R-VP-A, R-OPS-3).
+
+This module is stdlib-only and NEVER shells out — it returns argv lists
+ONLY. The binary name (``codex``) is prepended by the CALLER (the rail
+resolves it via ``_resolve_codex_bin``; codex_invoke prepends ``"codex"``).
+
+# TARGET PATH (apply via Owner-signed sentinel ceremony):
+#   .claude/hooks/_lib/codex_cli_shape.py  (NON-kernel — not in _KERNEL_PATHS)
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Dict, List, Optional, Tuple
+
+# ---------------------------------------------------------------------------
+# Module identity / version
+# ---------------------------------------------------------------------------
+
+#: SemVer for the CLI-shape contract. Bump whenever the emitted flag
+#: surface changes (e.g. the NEXT codex-cli bump edits THIS module —
+#: that is the whole point of D2).
+CLI_SHAPE_VERSION: str = "0.1.0-draft"
+
+#: The codex-cli version this shape targets. Kept in sync with
+#: ``.claude/governance/codex-cli-pin.txt`` (informational; the pin file
+#: is the enforced supply-chain gate, not this constant).
+CODEX_CLI_TARGET_VERSION: str = "0.139.0"
+
+
+# ---------------------------------------------------------------------------
+# Model-id catalog (MOVED here from _lib/adapters/codex.py — PLAN-142 §3 D2)
+# ---------------------------------------------------------------------------
+#
+# This list is the SINGLE validation surface for Codex reviewer model ids.
+# After the ceremony, `_lib/adapters/codex.py` must import `_VALID_MODELS`
+# and `DEFAULT_MODEL` from here (no local copy) so the grep gate finds no
+# `gpt-5*`/`o3*`/`o4*`/`_VALID_MODELS` literal in the kernel files.
+#
+# OPEN ITEM for execution (PLAN-142 D5 / OQ1): the historical wrapper
+# default `gpt-5.5` is NOT in this catalog and was being SILENTLY coerced
+# to `gpt-5-codex` at codex.py:643. This draft does NOT add `gpt-5.5` —
+# the execution session MUST reconcile the live 0.139 model catalog and
+# pick the real default (gpt-5-codex vs gpt-5.5), then update this list +
+# DEFAULT_MODEL. Coercion is now LOUD (see `coerce_model`), never silent.
+
+#: Allowed Codex reviewer model ids. Carried over verbatim from the
+#: pre-migration `_lib/adapters/codex.py:_VALID_MODELS` (S120 demotion
+#: kept `gpt-5-codex`). DRAFT — confirm against the live 0.139 catalog.
+_VALID_MODELS: Tuple[str, ...] = (
+    "gpt-5",
+    "gpt-5-mini",
+    "gpt-5-codex",
+    "o3",
+    "o3-mini",
+    "o4-mini",
+)
+
+#: Default reviewer model when the caller passes None / "".
+#: DRAFT — confirm against the live 0.139 catalog at execution (D5).
+DEFAULT_MODEL: str = "gpt-5-codex"
+
+
+# ---------------------------------------------------------------------------
+# Sandbox modes (MOVED here from _lib/adapters/codex.py:_VALID_SANDBOX_MODES)
+# ---------------------------------------------------------------------------
+
+#: Allowed sandbox modes per codex-cli 0.139 ``-s/--sandbox`` enum.
+_VALID_SANDBOX_MODES: Tuple[str, ...] = (
+    "read-only",
+    "workspace-write",
+    "danger-full-access",
+)
+
+#: Conservative default sandbox for a read-only reviewer rail.
+DEFAULT_SANDBOX_MODE: str = "read-only"
+
+
+# ---------------------------------------------------------------------------
+# Invocation modes (PLAN-142 §4 D1 — the only two shapes we emit)
+# ---------------------------------------------------------------------------
+
+#: Live verdict rail: ``-o`` only, NO ``--json`` (no usage consumer).
+MODE_VERDICT: str = "verdict"
+
+#: Promotion path: ``-o`` PLUS ``--json`` (usage via JSONL stdout).
+MODE_VERDICT_USAGE: str = "verdict+usage"
+
+_VALID_MODES: Tuple[str, ...] = (MODE_VERDICT, MODE_VERDICT_USAGE)
+
+
+# ---------------------------------------------------------------------------
+# Verdict JSON Schema for ``--output-schema`` (PLAN-142 §3 [P1], R-SEC-2)
+# ---------------------------------------------------------------------------
+#
+# Passing this schema via ``--output-schema <FILE>`` makes the CLI ENFORCE
+# the structured-verdict shape at generation time, so the trust model is
+# CLI-enforced rather than prompt-dependent. The caller writes this object
+# to a tmpfile (json.dump) and passes that path as `schema_file`.
+#
+# The shape mirrors `_lib/adapters/codex.py:parse_verdict_strict` exactly
+# so the parser and the generator agree:
+#   { "verdict": PASS|ADVISORY|BLOCK,
+#     "findings": [ {rubric_violation_id, severity, file, line, rationale} ],
+#     "summary": "" }
+#
+# `additionalProperties` is permissive on `usage`/`model` (promotion path
+# may attach them) but the REQUIRED keys pin the verdict contract.
+
+#: The canonical verdict-object JSON Schema (Draft-07 compatible subset).
+VERDICT_OUTPUT_SCHEMA: Dict[str, object] = {
+    "type": "object",
+    "additionalProperties": True,
+    "required": ["verdict", "findings", "summary"],
+    "properties": {
+        "verdict": {
+            "type": "string",
+            "enum": ["PASS", "ADVISORY", "BLOCK"],
+        },
+        "summary": {"type": "string"},
+        "findings": {
+            "type": "array",
+            "items": {
+                "type": "object",
+                "additionalProperties": True,
+                "required": ["rubric_violation_id", "severity", "rationale"],
+                "properties": {
+                    "rubric_violation_id": {"type": "string"},
+                    "severity": {"type": "string", "enum": ["P0", "P1"]},
+                    "file": {"type": "string"},
+                    "line": {"type": "integer", "minimum": 0},
+                    "rationale": {"type": "string"},
+                },
+            },
+        },
+    },
+}
+
+
+def verdict_output_schema_json() -> str:
+    """Serialize ``VERDICT_OUTPUT_SCHEMA`` to a stable JSON string.
+
+    Helper for the caller that writes the schema to the
+    ``--output-schema`` tmpfile. Sorted keys → deterministic bytes (so a
+    fixture / inputs-hash over the schema file is stable). NEVER raises on
+    the constant above (it is pure-JSON-serializable by construction).
+    """
+    return json.dumps(VERDICT_OUTPUT_SCHEMA, sort_keys=True, ensure_ascii=False)
+
+
+# ---------------------------------------------------------------------------
+# Model / sandbox coercion — LOUD on unknown (PLAN-142 C3 / D5)
+# ---------------------------------------------------------------------------
+
+
+class UnknownCodexModel(ValueError):
+    """Raised when a caller requests a model id not in ``_VALID_MODELS``.
+
+    PLAN-142 C3 / D5: the pre-migration code SILENTLY coerced an unknown
+    model (e.g. the wrapper default ``gpt-5.5``) to ``gpt-5-codex`` at
+    ``make_invoke_command:643``, masking a real misconfiguration. The
+    migration makes this LOUD: ``build_exec_argv`` raises this so the argv
+    NEVER carries a model the caller did not intend.
+
+    Carries the requested id and the valid set for the breadcrumb. The
+    requested id is a model NAME (e.g. "gpt-5.5"), not secret-laden — safe
+    to surface in the message.
+    """
+
+    def __init__(self, requested: str, valid: Tuple[str, ...]) -> None:
+        self.requested = requested
+        self.valid = valid
+        super().__init__(
+            "[codex-cli-shape] unknown model "
+            + repr(requested)
+            + "; valid="
+            + repr(list(valid))
+            + " (PLAN-142 C3: coercion is LOUD, not silent)"
+        )
+
+
+def coerce_model(model: Optional[str]) -> str:
+    """Resolve a caller-supplied model id to a valid 0.139 model.
+
+    Contract (PLAN-142 C3 — LOUD, never silent):
+      - None / "" → ``DEFAULT_MODEL`` (an explicit, audited default).
+      - a value IN ``_VALID_MODELS`` → returned unchanged.
+      - a value NOT in ``_VALID_MODELS`` → raises ``UnknownCodexModel``.
+
+    Callers that prefer fail-open-to-default (the rail wrapper, if it
+    decides an unknown model should degrade rather than abort) MUST catch
+    ``UnknownCodexModel`` and emit an audit breadcrumb themselves — this
+    module refuses to make that policy decision silently. The default-on-
+    empty branch is the ONLY implicit substitution and it is intentional.
+
+    NEVER coerces a present-but-unknown id to the default — that was the
+    exact S120 footgun this migration removes.
+    """
+    if model is None or model == "":
+        return DEFAULT_MODEL
+    if model in _VALID_MODELS:
+        return model
+    raise UnknownCodexModel(model, _VALID_MODELS)
+
+
+def coerce_sandbox_mode(sandbox_mode: Optional[str]) -> str:
+    """Resolve a caller-supplied sandbox mode to a valid 0.139 mode.
+
+    Unlike ``coerce_model``, an unknown sandbox mode is coerced to the
+    conservative ``DEFAULT_SANDBOX_MODE`` (``read-only``) rather than
+    raised: a tighter-than-requested sandbox is fail-safe (the reviewer
+    can only ever READ less), so silent tightening here does not create
+    the masked-misconfiguration risk that the model case does. None / ""
+    also map to the conservative default.
+    """
+    if sandbox_mode in _VALID_SANDBOX_MODES:
+        return sandbox_mode  # type: ignore[return-value]  # narrowed by membership
+    return DEFAULT_SANDBOX_MODE
+
+
+# ---------------------------------------------------------------------------
+# THE single argv builder (PLAN-142 §4 D2)
+# ---------------------------------------------------------------------------
+
+
+def build_exec_argv(
+    prompt: str,
+    *,
+    mode: str,
+    model: Optional[str],
+    sandbox_mode: str,
+    output_file: str,
+    schema_file: Optional[str] = None,
+) -> List[str]:
+    """Build the codex-cli 0.139 ``exec`` argv (WITHOUT the binary name).
+
+    This is THE single argv builder for the whole framework (PLAN-142 D2).
+    `make_invoke_command`, `codex_invoke.py`, and `check_pair_rail.py` all
+    DELEGATE here so no CLI literal survives in the kernel files.
+
+    Args:
+        prompt: the (already-redacted) prompt text. Empty → ValueError
+            (an empty prompt is a caller bug, not a runtime condition).
+        mode: ``MODE_VERDICT`` (live rail — ``-o`` only) or
+            ``MODE_VERDICT_USAGE`` (promotion path — ``-o`` PLUS ``--json``).
+            Unknown mode → ValueError.
+        model: reviewer model id; resolved via ``coerce_model`` (None/""
+            → ``DEFAULT_MODEL``; present-but-unknown → ``UnknownCodexModel``).
+        sandbox_mode: one of ``_VALID_SANDBOX_MODES``; resolved via
+            ``coerce_sandbox_mode`` (unknown → conservative ``read-only``).
+        output_file: absolute path for ``-o/--output-last-message``. The
+            CLI writes ONLY the final agent message here (a JSON object).
+            The CALLER owns this tmpfile's secure lifecycle (mkdtemp 0o700,
+            O_CREAT|O_EXCL|0o600, symlink/owner refusal, finally-unlink —
+            PLAN-142 §3 R-SEC-4). Empty → ValueError.
+        schema_file: optional absolute path to a JSON Schema file for
+            ``--output-schema``. When provided, the CLI ENFORCES the
+            verdict shape at generation time (PLAN-142 §3 [P1], R-SEC-2).
+            The caller writes ``verdict_output_schema_json()`` there.
+
+    Returns:
+        argv list (WITHOUT the binary). The caller prepends the resolved
+        ``codex`` binary path before ``subprocess.run``.
+
+    Argv ordering (verified composable on 0.139):
+        exec --color never --sandbox <mode> -o <output_file>
+             [--output-schema <schema_file>] [--json] -- <prompt>
+
+    NEVER emits ``--no-color`` / ``--read-only`` / ``--strict-json`` /
+    ``--resume`` (all REJECTED or relocated on 0.139). The ``--`` sentinel
+    guards a prompt that begins with ``-``.
+
+    Raises:
+        ValueError: empty prompt, empty output_file, or unknown mode.
+        UnknownCodexModel: present-but-unknown model id (LOUD, C3).
+    """
+    if not isinstance(prompt, str) or not prompt:
+        raise ValueError("[codex-cli-shape] build_exec_argv: prompt must be non-empty str")
+    if not isinstance(output_file, str) or not output_file:
+        raise ValueError("[codex-cli-shape] build_exec_argv: output_file must be non-empty str")
+    if mode not in _VALID_MODES:
+        raise ValueError(
+            "[codex-cli-shape] build_exec_argv: unknown mode "
+            + repr(mode)
+            + "; valid="
+            + repr(list(_VALID_MODES))
+        )
+
+    resolved_model = coerce_model(model)  # LOUD on unknown (C3)
+    resolved_sandbox = coerce_sandbox_mode(sandbox_mode)
+
+    argv: List[str] = [
+        "exec",
+        "--color", "never",
+        "--sandbox", resolved_sandbox,
+        "-o", output_file,
+    ]
+
+    # The model flag. 0.139 keeps ``--model <id>`` on ``exec``; the
+    # migration carries the INTENDED model into argv (no silent default
+    # substitution — coerce_model already guaranteed validity above).
+    argv.extend(["--model", resolved_model])
+
+    # CLI-enforced verdict shape (P1). Optional — absence falls back to the
+    # prompt-requested shape + parser-side parse_verdict_strict.
+    if schema_file:
+        if not isinstance(schema_file, str):
+            raise ValueError("[codex-cli-shape] build_exec_argv: schema_file must be str or None")
+        argv.extend(["--output-schema", schema_file])
+
+    # ``--json`` ONLY on the promotion path: the live verdict rail has no
+    # token-usage consumer and consciously DROPS usage telemetry (R-SEC-5).
+    if mode == MODE_VERDICT_USAGE:
+        argv.append("--json")
+
+    # ``--`` then the prompt as the final positional (guards a leading ``-``).
+    argv.extend(["--", prompt])
+    return argv
+
+
+# ---------------------------------------------------------------------------
+# Convenience wrappers mirroring the two call sites (optional sugar)
+# ---------------------------------------------------------------------------
+
+
+def build_verdict_argv(
+    prompt: str,
+    *,
+    model: Optional[str] = None,
+    sandbox_mode: str = DEFAULT_SANDBOX_MODE,
+    output_file: str,
+    schema_file: Optional[str] = None,
+) -> List[str]:
+    """LIVE-rail shape: ``MODE_VERDICT`` (``-o`` only, NO ``--json``).
+
+    Thin sugar so ``check_pair_rail.py`` reads
+    ``build_verdict_argv(prompt, output_file=f, schema_file=s)`` with no
+    mode literal at the call site. Delegates to ``build_exec_argv``.
+    """
+    return build_exec_argv(
+        prompt,
+        mode=MODE_VERDICT,
+        model=model,
+        sandbox_mode=sandbox_mode,
+        output_file=output_file,
+        schema_file=schema_file,
+    )
+
+
+def build_verdict_usage_argv(
+    prompt: str,
+    *,
+    model: Optional[str] = None,
+    sandbox_mode: str = DEFAULT_SANDBOX_MODE,
+    output_file: str,
+    schema_file: Optional[str] = None,
+) -> List[str]:
+    """PROMOTION-path shape: ``MODE_VERDICT_USAGE`` (``-o`` PLUS ``--json``).
+
+    Thin sugar so ``codex_invoke.py`` / ``run-promotion-gate.py`` read
+    ``build_verdict_usage_argv(prompt, output_file=f)`` with no mode
+    literal. Delegates to ``build_exec_argv``.
+    """
+    return build_exec_argv(
+        prompt,
+        mode=MODE_VERDICT_USAGE,
+        model=model,
+        sandbox_mode=sandbox_mode,
+        output_file=output_file,
+        schema_file=schema_file,
+    )
+
+
+__all__ = [
+    "CLI_SHAPE_VERSION",
+    "CODEX_CLI_TARGET_VERSION",
+    "_VALID_MODELS",
+    "DEFAULT_MODEL",
+    "_VALID_SANDBOX_MODES",
+    "DEFAULT_SANDBOX_MODE",
+    "MODE_VERDICT",
+    "MODE_VERDICT_USAGE",
+    "VERDICT_OUTPUT_SCHEMA",
+    "verdict_output_schema_json",
+    "UnknownCodexModel",
+    "coerce_model",
+    "coerce_sandbox_mode",
+    "build_exec_argv",
+    "build_verdict_argv",
+    "build_verdict_usage_argv",
+]

package/.claude/plans/PLAN-142-codex-cli-0139-adapter-migration.md

@@ -0,0 +1,224 @@
+---
+id: PLAN-142
+title: Restore the Codex pair-rail on codex-cli 0.139.0 (live hook + adapter + pins + CLI-shape helper)
+status: done
+created: 2026-06-19
+reviewed_at: 2026-06-19
+executed_at: 2026-06-19
+completed_at: 2026-06-19
+created_by: "CEO (S245 — substrate-drift diagnosis surfaced during the PLAN-139 Codex pair-rail run)"
+reviewed_by: "CEO (S245 — 2-round debate: round-1 REJECT [wrong file] → re-scope → round-2 3×ADJUST, all must-fixes folded)"
+executed_by: "CEO (S246 — KERNEL ceremony: 5 scoped paths + non-kernel + 7 test files; V1 tests/gates + real smoke (D5 + strict output-schema smoke-resolved); V2 codex review 2×P2 folded; V3 Owner-GPG)"
+related_commits:
+  - 61021d6                        # PLAN-142 implementation (Owner-GPG); pair-rail restored on codex-cli 0.139.0
+owner: CEO
+depends_on: []
+related_plans:
+  - PLAN-139                       # surfaced this drift; its pair-rail ran via the `codex exec` workaround
+related_adrs:
+  - ADR-010                        # canonical-edit sentinel ceremony
+  - ADR-106                        # pair-rail fail-open-to-ADVISORY contract
+  - ADR-107                        # pair-rail mandatory L2+ — this restores the AUTOMATED rail
+  - ADR-111                        # locked-corpus pin-update protocol (catch_rate re-run)
+  - ADR-114                        # outgoing-prompt egress redaction (fail-closed)
+  - ADR-121                        # signer registry
+risk_tier: C                       # touches MULTIPLE arbitration-kernel paths — KERNEL-HARD-DENY edits
+target_tag: TBD
+budget_tokens: TBD
+context_risk: medium
+debate_round_1: done               # REJECT + 2 ADJUST; wrong-file defect found + plan re-scoped
+debate_round_2: done               # 3×ADJUST; D1 ratified, all must-fixes folded into §3/§4
+provenance:
+  source: "S245 hands-on diagnosis + 2-round debate (each CLI claim re-validated against the live codex-cli 0.139.0 binary)"
+---
+
+# PLAN-142 — Restore the Codex pair-rail on codex-cli 0.139.0
+
+> **One-line goal:** restore the AUTOMATED Codex pair-rail (ADR-107) on the
+> installed `codex-cli 0.139.0`, fixing the LIVE wired hook `check_pair_rail.py`
+> (round-1 caught the original plan fixing the wrong file). Multiple
+> arbitration-kernel paths → executed under the KERNEL-HARD-DENY ceremony.
+> Debate: round-1 REJECT → re-scope → round-2 3×ADJUST (design-coherent with all
+> must-fixes folded in). **Per DEBATE-SCHEMA §13, design-coherence satisfies V0
+> only — shipping still needs V1 tests/CI → V2 Codex pair-rail → V3 Owner GPG.**
+
+## 0. Provenance & honest framing
+
+Surfaced during PLAN-139 (S245). Round-1 debate caught a fatal wrong-file defect
+(the original plan fixed `make_invoke_command`/`codex_invoke.py`, but the
+settings.json:201-wired rail is `check_pair_rail.py:_invoke_codex_review`, which
+hand-rolls its own argv). CEO re-validated hands-on: `codex exec --read-only -` →
+exit 2 on 0.139. Re-scoped; round-2 (3 critics) ratified the re-scope + the D1
+altitude call and surfaced implementation must-fixes, all folded below. Every CLI
+claim here was reproduced against the live 0.139 binary. Cross-model coverage
+continues meanwhile via the manual `codex exec review --uncommitted` workaround
+([[reference-codex-cli-substrate-drift]]).
+
+## 1. Diagnosis (re-validated on the live 0.139 binary)
+
+**Primary (LIVE) rail — `.claude/hooks/check_pair_rail.py` (KERNEL):**
+- `_invoke_codex_review` (L407) runs `[codex_bin,'exec','--read-only','-']` with
+  `input=prompt`. On 0.139 `--read-only` is REJECTED (exit 2; sandbox is now
+  `-s/--sandbox <read-only|workspace-write|danger-full-access>`). Rail returns
+  CodexUnavailable on every L2+ edit.
+- Returns RAW `proc.stdout` (L454); `decide()` feeds it to
+  `_detect_write_shaped_patch` (a FREE-TEXT grammar scan, → binary block/accept)
+  and `_emit_codex_review_invoked` — it NEVER calls `parse_verdict`. So the
+  structured-verdict trust model does not exist on the live rail today
+  (round-2 R-VP-D / R-SEC-2 / R-OPS-4), and ingress is un-redacted.
+
+**Secondary (promotion-gate / debug) path — `codex_invoke.py` (NON-kernel) +
+`_lib/adapters/codex.py:make_invoke_command` (KERNEL):**
+- `make_invoke_command` emits `--no-color` (→ `--color never`), `--json`, and on
+  their code paths `--strict-json` (REJECTED on 0.139 → "unexpected argument") and
+  `--resume <id>` (now an `exec resume` SUBCOMMAND) — full dead-flag set (R-OPS-2).
+- `parse_verdict` + `parse_usage_from_codex_stdout` both `json.loads` the WHOLE
+  stdout → 'Extra data line 2' on the `--json` JSONL event stream.
+- `codex_invoke.py` `subprocess.run` doesn't close stdin (positional path).
+
+**Cross-cutting (round-1 + round-2):**
+- Silent model coercion: `invoke_codex` default `gpt-5.5` ∉ `_VALID_MODELS` →
+  coerced to `gpt-5-codex` (demoted S120) at make_invoke_command:643 regardless of
+  the wrapper default (C3 / R-OPS unseen).
+- Stale kernel supply-chain pins: `codex-cli-pin.txt` (>=0.128,<0.131) +
+  `codex-cli-binary-sha256.txt` (baefc1…) vs the live 0.139 binary (d3be84…) (C2).
+- `substrate-watch.json` has no `codex_cli` component — the detector that should
+  have caught this is blind (R-OPS-6).
+
+## 2. Governance — kernel + release-time entanglements (5, per round-2)
+
+KERNEL-HARD-DENY paths (each needs sentinel GPG `.asc` + `CEO_KERNEL_OVERRIDE=<token>`
++ `CEO_KERNEL_OVERRIDE_ACK=I-ACCEPT`; discover the exact per-path token at execution):
+1. `.claude/hooks/check_pair_rail.py` (_KERNEL_PATHS:170) — live rail invoke + consume.
+2. `.claude/hooks/_lib/adapters/codex.py` (_KERNEL_PATHS:155) — parsers + delegation to the helper.
+3. `.claude/governance/codex-cli-pin.txt` (_KERNEL_PATHS:199) — widen to admit 0.139.
+4. `.claude/governance/codex-cli-binary-sha256.txt` (_KERNEL_PATHS:200) — re-hash to the trusted 0.139 binary.
+
+Release-time coupling (round-2 R-OPS-1 — the 5th entanglement, NOT a kernel edit
+but a release blocker): both edited kernel files are in
+`.claude/governance/pair-rail-inputs-hash-manifest.txt`. `release.yml` step 15
+(`validate-pair-rail-verdict.py --recompute-inputs-hash`) git-hashes every manifest
+entry → editing them changes `inputs_hash` → the next release's
+`pair-rail-verdict-<tag>.md` MUST be regenerated (tool_versions.codex_cli=0.139.0,
+new binary SHA, recomputed inputs_hash) OR the first post-edit release ships under
+`CEO_PAIR_RAIL_VERDICT_OPTIONAL=1` with that bypass explicitly recorded.
+
+Non-kernel files: `codex_invoke.py`, `.claude/hooks/_lib/codex_cli_shape.py` (NEW),
+`.claude/scripts/substrate-watch.json`, tests, the reference memory.
+
+- Run order: this plan is `reviewed`; execution = KERNEL ceremony across paths 1-4.
+- ADR-111: 0.128→0.139 (+ possible reviewer-model change gpt-5.5↔gpt-5-codex) is a
+  large jump — run the locked-corpus catch_rate check, OR defer with a rationale that
+  NAMES the security consequence (possible reduced detection sensitivity), not a
+  generic process deferral (R-SEC-7 / R-OPS-7).
+- The implementation diff's cross-model pass: manual `codex exec review
+  --uncommitted` (bootstrap) PLUS an Owner human review (R-SEC-6).
+
+## 3. Acceptance criteria
+
+**Live rail (the core fix):**
+- `[P0][check_pair_rail.py]` `_invoke_codex_review` no longer uses `--read-only`;
+  builds its argv via the NEW non-kernel shape helper (§4 D2); a REAL
+  Stop/PreToolUse pair-rail run returns a verdict, not CodexUnavailable. (C1)
+- `[P0][check_pair_rail.py]` consume side: read the `-o` last-message file →
+  single-pass redact the FULL byte-string → `parse_verdict_strict` (verdict ∈
+  `_VALID_VERDICTS`, fail-CLOSED-to-ADVISORY) → `decide()`. `_detect_write_shaped_patch`
+  is RETAINED only as a secondary defense-in-depth scan on the redacted text, never
+  the primary verdict signal. (R-VP-D, R-SEC-2, R-OPS-4)
+- `[P0][check_pair_rail.py]` tmpfile hygiene (the untrusted binary is the WRITER —
+  TOCTOU): `tempfile.mkdtemp(0o700)` per call; rail creates the file
+  `O_CREAT|O_EXCL|0o600` at an absolute path; REFUSE to read if it is a symlink /
+  not a regular file / not owned by us; `finally:` unlink + rmdir on the read,
+  timeout, AND exception paths. Degradation matrix → ADVISORY (file missing after
+  exit-0 / empty / oversize-cap / present after exit≠0), never raise. (R-SEC-4, R-VP-E, R-OPS-5)
+
+**Adapter + CLI-shape helper:**
+- `[P0][NEW _lib/codex_cli_shape.py — non-kernel]` THE single argv builder. It owns
+  ALL CLI-shape: flag names (`exec`, `--color never`, `-s/--sandbox`, `-o`,
+  `--output-schema`, `--json`), the model-id list (`_VALID_MODELS` moves here), and
+  the dead-flag migration (`--strict-json` dropped, `--resume`→subcommand).
+  `make_invoke_command`, `codex_invoke.py`, and `check_pair_rail.py` all DELEGATE to
+  it (no private argv, no "OR inline argv"). (R-VP-B, R-VP-C, R-OPS-2)
+- `[P0][grep gate]` after the ceremony, no CLI literal (`exec`, `--[a-z]`,
+  `gpt-5*`/`o3*`/`o4*`, `_VALID_MODELS`) remains in `check_pair_rail.py` or
+  `codex.py` — all routed through the helper. The kernel keeps ONLY trust-boundary
+  logic (`_VALID_VERDICTS`, fail-open-to-ADVISORY, redaction, finding
+  normalization). This is what makes the NEXT codex-cli bump a NON-kernel edit. (R-VP-C)
+- `[P0][_lib/adapters/codex.py]` redaction runs on the FULL raw output BEFORE any
+  `json.loads`; safe for non-redacting callers (run-promotion-gate.py). (R-SEC-1)
+- `[P0][_lib/adapters/codex.py]` verdict accepted ONLY from a structured,
+  schema-validated object (`verdict ∈ _VALID_VERDICTS`), NEVER a free-text scan;
+  forged free-text 'PASS' with no structured verdict → ADVISORY. (R-SEC-2)
+- `[P0][model-id]` reconcile `gpt-5.5` with `_VALID_MODELS` (now in the helper);
+  unknown-model coercion is LOUD (audit breadcrumb / hard-fail), not silent; argv
+  carries the intended model; confirm it is a valid 0.139 id. (C3)
+- `[P0][output contracts converge]` BOTH the live rail and the promotion path build
+  argv via the helper using `-o <tmpfile>` for the verdict. The live rail uses `-o`
+  ONLY (it has no token-usage consumer — usage telemetry consciously DROPPED on the
+  rail, R-SEC-5). The promotion path (codex_invoke.py / run-promotion-gate.py) MAY
+  add `--json` to keep `parse_usage` (rewritten to read the last usage event
+  per-line from JSONL stdout, NOT whole-stdout json.loads). AC: a real
+  run-promotion-gate.py invocation on 0.139 returns a parsed verdict, not 'Extra
+  data line 2'. (R-VP-A, R-OPS-3, R-SEC-5)
+- `[P1][--output-schema]` pass `--output-schema <FILE>` (present on 0.139) with a
+  JSON Schema for `{verdict,findings,summary}` so the CLI ENFORCES the
+  structured-verdict shape at generation time — R-SEC-2 becomes CLI-enforced, not
+  prompt-dependent. (R-VP-F, R-OPS nice)
+
+**Supply-chain + governance:**
+- `[P0][pins]` widen `codex-cli-pin.txt` to admit 0.139 + re-hash
+  `codex-cli-binary-sha256.txt`; honor or consciously defer the ADR-111 catch_rate
+  re-run with a rationale that names the model-behavior change. (C2, R-SEC-7)
+- `[P0][release coupling]` regenerate `pair-rail-verdict-<tag>.md` against the
+  post-edit tree (codex_cli=0.139, new SHA, recomputed inputs_hash) OR record the
+  `CEO_PAIR_RAIL_VERDICT_OPTIONAL=1` bypass for the first post-edit release. (R-OPS-1)
+- `[P0][T-8 attribution]` state in writing that the binary-SHA pin (release-time) —
+  NOT the structured object — is the forged-verdict (T-8) defense; record the
+  mid-session PATH-decoy runtime gap (`_resolve_codex_bin` doesn't hash at
+  invocation) as an ACCEPTED RISK (runtime SHA check is a possible follow-up, not a
+  5th kernel touch this ceremony). (R-SEC-3)
+- `[P1][substrate-watch.json]` register a `codex_cli` component with a watch_for
+  note encoding the 0.139 exec flag surface (`--color`, `-s/--sandbox` enum, `-o`,
+  `--output-schema`, `--json`, the `--strict-json`/`--read-only` removals) so the
+  next bump is a nightly advisory. (R-OPS-6)
+
+**Tests:**
+- `[P0][tests]` OFFLINE golden-fixture tests (the kernel edit can't be
+  dogfooded): a captured REAL 0.139 `-o` last-message file → redact →
+  `parse_verdict_strict` → verdict; plus forged-free-text-PASS → ADVISORY,
+  oversize, symlink-refusal, empty, exit≠0. A `CEO_PAIR_RAIL_FIXTURE_RESPONSE`-
+  injected `check_pair_rail.decide()` test exercising the consume path without the
+  live binary. One opt-in network-gated smoke test (skipped in CI). (R-SEC-6, R-OPS-6, R-VP-E)
+- `[P1][tests]` a captured `--json` stdout sample fixture for the rewritten
+  `parse_usage` (last-event-per-line). (R-VP-A)
+
+## 4. Design decisions (ratified round-2)
+
+- **D1 — `-o/--output-last-message <tmpfile>`** for the verdict (CLI isolates one
+  structured object; no event-schema coupling; verified on 0.139:
+  `{"verdict":"PASS"}` written clean). Verdict comes from a structured object the
+  prompt requests AND `--output-schema` enforces (D-new). Usage telemetry is
+  DROPPED on the live rail (no consumer) and kept via `--json` only on the
+  non-kernel promotion path.
+- **D2 — single argv builder = NEW non-kernel `_lib/codex_cli_shape.py`.** All
+  CLI-shape (flags, model ids, dead-flag migration) lives there; kernel files
+  delegate. This is the structural fix for the recurring GPG tax (next bump =
+  non-kernel edit), enforced by the §3 grep gate.
+- **D3 — `_detect_write_shaped_patch` retained as secondary defense-in-depth**, not
+  the primary verdict signal (the primary is `parse_verdict_strict`).
+- **D4 — T-8 forgery defense = the binary-SHA pin** (release-time); the runtime
+  PATH-decoy gap is an accepted risk this ceremony (runtime hash = follow-up).
+- **D5 — OQ1 model id** (gpt-5-codex vs gpt-5.5) resolved at execution against the
+  live 0.139 catalog; coercion made loud.
+
+## 5. Status
+
+**REVIEWED — execution-ready (design).** 2-round debate complete: round-1 REJECT
+(wrong-file defect) → re-scope → round-2 3×ADJUST with all must-fixes folded into
+§3/§4. Execution = the KERNEL-HARD-DENY ceremony across the 4 kernel paths + the
+release-time verdict regen, under `/spawn` or direct Owner-GPG ceremony. The
+`hook-tests-dual-rail` timeout bump (also a kernel path) stays consciously
+DROPPED. Pair-rail coverage continues via the manual workaround meanwhile.
+Per DEBATE-SCHEMA §13: this satisfies V0 only — ship via V1 (tests/CI) → V2
+(Codex pair-rail, once restored, or the manual workaround + Owner review) → V3
+(Owner GPG).

package/.claude/plans/PLAN-143/architect/round-1/anonymization-map.md

@@ -0,0 +1,22 @@
+---
+plan: PLAN-143
+round: 1
+purpose: anonymization audit record (DEBATE-SCHEMA §13.2)
+---
+
+# Round-1 critic anonymization map
+
+The consensus synthesis consumed ONLY the anonymized critique text. This file
+is the audit record of the label↔archetype mapping (kept out of the synthesis
+input).
+
+| Label | Archetype | Skill | Verdict |
+|---|---|---|---|
+| Critic-A | VP Engineering | architecture-decisions | ADJUST |
+| Critic-B | Staff Security Engineer | security-and-auth | ADJUST |
+| Critic-C | DevOps & Platform Engineer | devops-ci-cd | ADJUST |
+
+Persona → agentId ledger (for round-N resumption, PLAN-135 D4):
+- Critic-A (VP Engineering): `aef6f2e380999415f`
+- Critic-B (Security): `aee48000db20b9eb9`
+- Critic-C (DevOps): `ac6baa82623f36b7d`