devlyn-cli 3.0.1 → 3.1.1

package/AGENTS.md

@@ -38,7 +38,7 @@ Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not du
 
 Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md. If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); legacy executor (with optional separate worker/primary/pair profiles) uses the canonical skill's orchestrator-supported default, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine; no pin / no file → use the canonical skill's orchestrator-supported default. The pair-judge pin stays pipeline-scoped. `/devlyn:engines role` configures explicit engine/model/effort for supported worker and judge routes; `/devlyn:resolve --role-config <path>` overrides roles for one run. Canonical skills define precedence, evidence and unsupported-route errors; absent profiles preserve existing defaults.
 
-Conversational entry: Before writes, inspect requested files and relevant callers/tests. Default to direct execution only for clear, local, reversible, low-risk work with a decisive existing or small task-specific acceptance check. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval.
+Conversational entry: Before writes, inspect requested files and relevant callers/tests. Default to direct execution only for clear, local, reversible, low-risk work with a decisive existing or small task-specific acceptance check. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval. For direct/full/queue work, the outer owner reads `references/task-completion.md` relative to the installed `devlyn:resolve` skill's directory: prospective task-branch ownership (linked worktree optional), scoped commit acceptance, then PR/merge and recoverable owned-resource cleanup after required archive/queue commits. Local-only/no-push wins; delivery pending/failure stays separate from product verification.
 
 Use full `/devlyn:resolve` for material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes, or inconclusive inspection/checks. Counts of lines, files or words alone do not establish low risk. Explicit resolve (even small), formal spec workflows and queue drains retain all canonical phases, independent verification, pins and failure handling. If new risk appears mid-edit, preserve the delta in the full run's scope/evidence; do not hide it in a new baseline or reconfirm existing authorization.
 

package/CLAUDE.md

@@ -51,7 +51,7 @@ Each skill's `SKILL.md` is the source of truth for its flags and workflow — do
 
 ### Conversational entry + full-route handoff
 
-Before writes, inspect requested files and relevant callers/tests. Default to direct execution only for clear, local, reversible, low-risk work with a decisive existing or small task-specific acceptance check. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval.
+Before writes, inspect requested files and relevant callers/tests. Default to direct execution only for clear, local, reversible, low-risk work with a decisive existing or small task-specific acceptance check. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval. For direct/full/queue work, the outer owner reads `references/task-completion.md` relative to the installed `devlyn:resolve` skill's directory: prospective task-branch ownership (linked worktree optional), scoped commit acceptance, then PR/merge and recoverable owned-resource cleanup after required archive/queue commits. Local-only/no-push wins; delivery pending/failure stays separate from product verification.
 
 Use full `/devlyn:resolve` for material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes, or inconclusive inspection/checks. Counts of lines, files or words alone do not establish low risk. Explicit resolve (even small), formal spec workflows and queue drains retain all canonical phases, independent verification, pins and failure handling. If new risk appears mid-edit, preserve the delta in the full run's scope/evidence; do not hide it in a new baseline or reconfirm existing authorization.
 
@@ -60,9 +60,9 @@ The user does not invoke skills manually; the orchestrating model does. Large ta
 1. Write the agreed contract to `docs/specs/<id>/spec.md` (+ `spec.expected.json` when mechanical verifications exist). Always a spec file for large work — a written spec is the user's reviewed contract; free-form large now assumes-and-logs instead of halting (zero-scope-signal goals still halt to ideate).
 2. Present a one-screen plan-contract summary — the user's single review checkpoint, BEFORE the pipeline starts.
 3. On go-ahead, commit the scoped queue-item delta (when applicable) and linked spec bundle, then invoke `/devlyn:resolve --spec <path>` hands-free to completion.
-4. **Per-task outer loop**: read the terminal verdict. PASS → done. Verdicts backed by spec/verification findings (NEEDS_WORK, verify/build-gate exhaustion) → adjudicate the findings, amend the spec (recorded in the spec file; spec stays read-only inside a run), commit that scoped amendment, then re-invoke — at most 3 outer iterations, then surface with the findings trail. Infrastructure, invalid-input, engine-availability, and implement-empty BLOCKED verdicts are not spec-amendable: surface immediately. Every iteration re-enters through committed durable artifacts (spec, findings, run archive), never conversation memory.
+4. **Per-task outer loop**: read the terminal verdict. Successful normal-run archive → outer-owner completion per the canonical task-completion reference, after any terminal queue commit. Verdicts backed by spec/verification findings (NEEDS_WORK, verify/build-gate exhaustion) → adjudicate the findings, amend the spec (recorded in the spec file; spec stays read-only inside a run), commit that scoped amendment, then re-invoke — at most 3 outer iterations, then surface with the findings trail. Infrastructure, invalid-input, engine-availability, and implement-empty BLOCKED verdicts are not spec-amendable: surface immediately. Every iteration re-enters through committed durable artifacts (spec, findings, run archive), never conversation memory.
 
-**Intent queue (unattended drain)**: the user stacks intents in `docs/specs/queue.md` (ordered checklist; `/devlyn:queue` is the front-end — no args shows status, `add <intent>` appends, `drain` starts the serial drain). Drain strictly serially — per item: spec it, commit the scoped owner baseline, run the outer loop, mark `[x]` done or `[F]` blocked with reason, commit that terminal transition, then continue; a blocked item never halts the queue. The queue entry is the user's go-ahead, so assume-and-log replaces the interactive checkpoint — but unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults. Material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review`, commit it, and move on. End the drain with a per-item verdict + assumptions report. The canonical commit order is `config/skills/devlyn:resolve/references/outer-loop.md`.
+**Intent queue (unattended drain)**: the user stacks intents in `docs/specs/queue.md` (ordered checklist; `/devlyn:queue` is the front-end — no args shows status, `add <intent>` appends, `drain` starts the serial drain). Drain strictly serially — per item: spec it, commit the scoped owner baseline, run the outer loop, mark `[x]` done or `[F]` blocked with reason, commit that terminal transition, then complete eligible delivery once. Retain PR/pending workspaces; unavailable separate safe placement stops the drain with remaining items pending. A product-blocked item otherwise never halts the queue. The queue entry is the user's go-ahead, so assume-and-log replaces the interactive checkpoint — but unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults. Material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review`, commit it, and move on. End the drain with a per-item product verdict, separate delivery status/URL/resume and assumptions report. The canonical commit order is `config/skills/devlyn:resolve/references/outer-loop.md`.
 
 ## Subtractive-first editing — perfection = nothing left to remove
 <!-- runtime-principles:section=subtractive-first:begin -->

package/README.md

@@ -62,7 +62,7 @@ Skip ideate entirely if you have a spec or just want to describe the work — `/
 
 ### Step 2 — Resolve with `/devlyn:resolve`
 
-Before writes, inspect requested files and relevant callers/tests. Clear, local, reversible, low-risk conversational edits with a decisive acceptance check run directly, honoring scope, constraints and executor pins; finish required checks and diff review, then report evidence. Material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes or no decisive check use full `/devlyn:resolve`. Explicit resolve (including small tasks), formal specs and queue drains keep the full workflow below. Pass a spec, a free-form goal, or a diff to verify.
+Before writes, inspect requested files and relevant callers/tests. Clear, local, reversible, low-risk conversational edits with a decisive acceptance check run directly, honoring scope, constraints and executor pins; finish required checks and diff review, then accept the scoped commit for owner completion below. Material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes or no decisive check use full `/devlyn:resolve`. Explicit resolve (including small tasks), formal specs and queue drains keep the full workflow below. Pass a spec, a free-form goal, or a diff to verify.
 
 ```
 /devlyn:resolve "fix the login bug"                                # free-form
@@ -97,9 +97,21 @@ golden fixture, risk-probe, or pair-evidence candidate must also include
 difference from rejected or solo-saturated controls such as `S2`-`S6`; without
 that, `/devlyn:resolve` stops with `BLOCKED:solo-ceiling-avoidance-required`.
 
+Accepted tasks default to owner completion: scoped commit → push → PR → normal
+protected merge → recoverable cleanup of prospectively owned resources. Set
+`git config --local devlyn.completionMode pr` to stop at a PR, or `auto` to restore
+the default; `task-complete.py complete --mode auto|pr` overrides one task.
+Local-only/no-push instructions take precedence. Linked worktrees are optional;
+existing branches cannot be adopted. Full runs require successful archive before
+delivery; direct tasks use their actual checks and root acceptance. Verify-only
+never publishes. Pending checks or unsupported merge policy retain resources and
+report a receipt-based resume command separately from product verification.
+See [task completion](config/skills/devlyn:resolve/references/task-completion.md)
+for allocation, acceptance, writer cessation and recovery.
+
 ### Queue multiple intents for unattended drain — `/devlyn:queue`
 
-Stack tasks to run back-to-back without supervision. `/devlyn:queue add "<intent>"` appends to `docs/specs/queue.md` (an ordered checklist); `/devlyn:queue drain` runs each item serially — spec it, run the resolve outer loop, mark `[x]` done or `[F]` blocked with a reason, then move on. A blocked item never halts the queue, and unattended runs only take scope-narrowing, reversible defaults — anything user-visible or ambiguous is marked `[F] needs-review` for you to adjudicate afterward. `/devlyn:queue` with no args shows status.
+Stack tasks to run back-to-back without supervision. `/devlyn:queue add "<intent>"` appends to `docs/specs/queue.md` (an ordered checklist); `/devlyn:queue drain` runs each item serially — spec it, run the resolve outer loop, commit `[x]` done or `[F]` blocked with a reason, then complete eligible delivery once. Product verdict and delivery status are separate. A blocked product otherwise never halts the queue; pending delivery retains its branch, and the next item requires separate safe placement. Unattended runs only take scope-narrowing, reversible defaults — anything user-visible or ambiguous is marked `[F] needs-review` for you to adjudicate afterward. `/devlyn:queue` with no args shows status.
 
 ### Engine roles — auto-detected, pinnable with `/devlyn:engines`
 
@@ -293,9 +305,14 @@ Selected during install. Run `npx devlyn-cli` again to add more.
 
 ## Requirements
 
-- **Node.js 18+**
+- **Node.js 18+** and npm
+- **Python 3.11+** available as `python3`, and Git for the resolve harness
 - **[Claude Code](https://docs.anthropic.com/en/docs/claude-code)** installed and configured
 
+On native Windows, use native Node/npm and Python plus Git for Windows Bash for the shipped shell wrapper. Run `npx devlyn-cli -y` in the project; add Codex with `npx devlyn-cli agents codex`. npm extraction and installed directories use the legal U+F03A colon alias (for example `devlyn\uf03aresolve`); logical skill names remain `devlyn:resolve`. Do not rename them by hand. Harness text is UTF-8 without requiring `PYTHONUTF8`.
+
+Windows completion preserves the workspace, owned refs and recovery receipt when writer cessation cannot be proved, even after merge; resume guidance and delivery status remain separate from product verification. The portability workflow tests a POSIX-packed npm artifact on native Windows without checking out colon paths. A POSIX pass alone does not establish Windows support: acceptance requires the passing Windows job for the exact source SHA/artifact hashes.
+
 ## Contributing
 
 - **Add a skill** — directory in `config/skills/` with `SKILL.md`

package/bin/devlyn.js

@@ -18,6 +18,33 @@ const DEVLYN_CORE_SKILLS = ['devlyn:resolve', 'devlyn:ideate', 'devlyn:design-ui
 const DEVLYN_SKILL_DIR_STAMP = '__DEVLYN_SKILL_DIR__';
 const DEVLYN_INSTALL_MARKER = '.devlyn-install.json';
 
+function logicalSkillName(name) {
+  return name.replace(/\uF03A/g, ':');
+}
+
+function physicalSkillName(name) {
+  return process.platform === 'win32' ? name.replace(/:/g, '\uF03A') : name;
+}
+
+function skillPath(root, name) {
+  name = logicalSkillName(name);
+  const aliases = [...new Set([name, name.replace(/:/g, '\uF03A')])];
+  const entries = fs.existsSync(root) ? fs.readdirSync(root) : [];
+  const found = aliases.filter((alias) => entries.includes(alias));
+  if (found.length > 1) throw new Error(`Ambiguous skill aliases in ${root}: ${found.join(', ')}`);
+  return path.join(root, found[0] || physicalSkillName(name));
+}
+
+function preflightSkillDirs(source, target, names) {
+  for (const name of names) {
+    skillPath(source, name);
+    skillPath(target, name);
+  }
+  for (const relative of DEPRECATED_DIRS) {
+    skillPath(target, path.basename(relative));
+  }
+}
+
 // Cross-agent shared skills directory read by BOTH oh-my-pi and Pi. Verified
 // from the omp binary's skill-provider strings ("skills from .agents/skills —
 // project walk-up + user home") and Pi's docs ("~/.agents/skills/"). Installing
@@ -313,6 +340,8 @@ function listContents() {
 
 function cleanupDeprecated(targetDir) {
   let removed = 0;
+  const deprecated = DEPRECATED_DIRS.map((relPath) =>
+    [relPath, skillPath(path.join(targetDir, 'skills'), path.basename(relPath))]);
   for (const relPath of DEPRECATED_FILES) {
     const fullPath = path.join(targetDir, relPath);
     if (fs.existsSync(fullPath)) {
@@ -321,8 +350,7 @@ function cleanupDeprecated(targetDir) {
       removed++;
     }
   }
-  for (const relPath of DEPRECATED_DIRS) {
-    const fullPath = path.join(targetDir, relPath);
+  for (const [relPath, fullPath] of deprecated) {
     if (fs.existsSync(fullPath)) {
       fs.rmSync(fullPath, { recursive: true });
       log(`  ✕ ${relPath}/ (removed)`, 'dim');
@@ -337,13 +365,14 @@ function copyRecursive(src, dest, baseDir) {
 
   if (stats.isDirectory()) {
     // Never install dev workspaces, even when running from source repo.
-    if (UNSHIPPED_SKILL_DIRS.has(path.basename(src))) return;
+    if (UNSHIPPED_SKILL_DIRS.has(logicalSkillName(path.basename(src)))) return;
     if (!fs.existsSync(dest)) {
       fs.mkdirSync(dest, { recursive: true });
     }
 
     for (const item of fs.readdirSync(src)) {
-      copyRecursive(path.join(src, item), path.join(dest, item), baseDir);
+      const name = src === path.join(CONFIG_SOURCE, 'skills') ? physicalSkillName(logicalSkillName(item)) : item;
+      copyRecursive(path.join(src, item), path.join(dest, name), baseDir);
     }
   } else {
     const destDir = path.dirname(dest);
@@ -360,9 +389,19 @@ function clearInstallMarker(skillsDir) {
 }
 
 function assertCompleteSkillInstall(sourceSkillsDir, skillsDir, skillNames) {
-  const missing = skillNames.filter((skillName) =>
-    !fs.existsSync(path.join(sourceSkillsDir, skillName))
-      || !fs.existsSync(path.join(skillsDir, skillName)));
+  function complete(src, dest) {
+    if (!fs.existsSync(src) || !fs.existsSync(dest)) return false;
+    if (fs.statSync(src).isDirectory()) {
+      return fs.statSync(dest).isDirectory() && fs.readdirSync(src).every((name) =>
+        complete(path.join(src, name), path.join(dest, name)));
+    }
+    return fs.statSync(dest).isFile();
+  }
+  const missing = skillNames.filter((name) => {
+    const src = skillPath(sourceSkillsDir, name);
+    const dest = skillPath(skillsDir, name);
+    return !complete(src, dest) || (name !== '_shared' && !fs.existsSync(path.join(src, 'SKILL.md')));
+  });
   if (missing.length > 0) {
     throw new Error(`Incomplete devlyn skill install; missing: ${missing.join(', ')}`);
   }
@@ -440,11 +479,12 @@ const UNSHIPPED_SKILL_DIRS = new Set([
 // no counterpart in source. Dev workspaces are skipped entirely.
 function cleanManagedSkillDirs(sourceSkillsDir, targetSkillsDir) {
   if (!fs.existsSync(sourceSkillsDir) || !fs.existsSync(targetSkillsDir)) return 0;
+  preflightSkillDirs(sourceSkillsDir, targetSkillsDir, fs.readdirSync(sourceSkillsDir));
   let cleaned = 0;
   for (const entry of fs.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    if (UNSHIPPED_SKILL_DIRS.has(entry.name)) continue;
-    const targetPath = path.join(targetSkillsDir, entry.name);
+    if (UNSHIPPED_SKILL_DIRS.has(logicalSkillName(entry.name))) continue;
+    const targetPath = skillPath(targetSkillsDir, entry.name);
     if (fs.existsSync(targetPath)) {
       fs.rmSync(targetPath, { recursive: true, force: true });
       cleaned++;
@@ -547,9 +587,11 @@ function multiSelect(items, preselectedIndices = []) {
 }
 
 function installLocalSkill(skillName) {
-  const src = path.join(OPTIONAL_SKILLS_SOURCE, skillName);
+  const src = skillPath(OPTIONAL_SKILLS_SOURCE, skillName);
   const targetDir = getTargetDir();
-  const dest = path.join(targetDir, 'skills', skillName);
+  const targets = new Set([path.join(targetDir, 'skills'), ...Object.values(CLI_TARGETS)
+    .map((cli) => cli.skillsDir).filter((dir) => dir && fs.existsSync(dir))]);
+  for (const target of targets) skillPath(target, skillName);
 
   if (!fs.existsSync(src)) {
     log(`   ⚠️  Skill "${skillName}" not found`, 'yellow');
@@ -557,7 +599,6 @@ function installLocalSkill(skillName) {
   }
 
   log(`\n🛠️  Installing ${skillName}...`, 'cyan');
-  copyRecursive(src, dest, targetDir);
 
   // Mirror to every CLI skill-loader directory that already exists so optional
   // skills are picked up by Codex/omp/Pi (and any future CLI with a skillsDir)
@@ -565,13 +606,12 @@ function installLocalSkill(skillName) {
   // create an agent install just because someone opted into a Claude-side skill.
   // De-dup by directory: omp and Pi share ~/.agents/skills, so the mirror runs
   // once per unique destination.
-  const mirrored = new Set();
-  for (const cli of Object.values(CLI_TARGETS)) {
-    if (!cli.skillsDir || mirrored.has(cli.skillsDir) || !fs.existsSync(cli.skillsDir)) continue;
-    mirrored.add(cli.skillsDir);
-    const cliDest = path.join(cli.skillsDir, skillName);
-    if (fs.existsSync(cliDest)) fs.rmSync(cliDest, { recursive: true, force: true });
-    copyRecursive(src, cliDest, cli.skillsDir);
+  for (const target of targets) {
+    fs.rmSync(skillPath(target, skillName), { recursive: true, force: true });
+    const dest = path.join(target, physicalSkillName(skillName));
+    copyRecursive(src, dest, target);
+    stampInstalledSkillDir(dest, dest);
+    assertCompleteSkillInstall(OPTIONAL_SKILLS_SOURCE, target, [skillName]);
   }
   return true;
 }
@@ -632,6 +672,7 @@ function installSkillsForCLI(cliKey) {
     fs.mkdirSync(cli.skillsDir, { recursive: true });
   }
   clearInstallMarker(cli.skillsDir);
+  preflightSkillDirs(sourceSkillsDir, cli.skillsDir, cli.skillsToInstall);
 
   const removed = cleanupDeprecated(path.dirname(cli.skillsDir));
   if (removed > 0) {
@@ -640,13 +681,14 @@ function installSkillsForCLI(cliKey) {
 
   let copied = 0;
   for (const skillName of cli.skillsToInstall) {
-    const src = path.join(sourceSkillsDir, skillName);
-    const dest = path.join(cli.skillsDir, skillName);
+    const src = skillPath(sourceSkillsDir, skillName);
+    const previous = skillPath(cli.skillsDir, skillName);
+    const dest = path.join(cli.skillsDir, physicalSkillName(skillName));
     if (!fs.existsSync(src)) continue;
     // Full replace per cleanManagedSkillDirs semantics: stale files in the
     // installed mirror would otherwise persist forever.
-    if (fs.existsSync(dest)) {
-      fs.rmSync(dest, { recursive: true, force: true });
+    if (fs.existsSync(previous)) {
+      fs.rmSync(previous, { recursive: true, force: true });
     }
     copyRecursive(src, dest, cli.skillsDir);
     stampInstalledSkillDir(dest, dest);
@@ -777,6 +819,10 @@ function installClaudeCore() {
   }
   copyRecursive(CONFIG_SOURCE, targetDir, targetDir);
   assertCompleteSkillInstall(path.join(CONFIG_SOURCE, 'skills'), skillsDir, DEVLYN_CORE_SKILLS);
+  for (const name of DEVLYN_CORE_SKILLS) {
+    const dest = skillPath(skillsDir, name);
+    stampInstalledSkillDir(dest, dest);
+  }
   writeInstallMarker(skillsDir);
 
   // Remove deprecated files from previous versions

package/config/skills/_shared/adapters/claude.md

@@ -22,7 +22,7 @@ two targeted probes; the invoking phase sets `--effort`, pair-JUDGE uses
 `medium`):
 
 ```bash
-python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- claude -p "<judge prompt>" \
+python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 --stdin-file "<judge-prompt-file>" --record-transport -- claude -p \
   --permission-mode dontAsk \
   --tools "Read,Grep,Glob" --allowedTools "Read,Grep,Glob" \
   --setting-sources project --strict-mcp-config --mcp-config '{"mcpServers":{}}' \
@@ -30,6 +30,7 @@ python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- claude -p "<judge prompt>" \
   > .devlyn/claude-judge.stdout 2> .devlyn/claude-judge.stderr
 ```
 
+- Write the complete prompt as exact UTF-8 file bytes; no positional prompt or shell substitution. With `--record-transport`, the runner snapshots stdin and exclusively creates `<judge-prompt-file>.transport.json` to bind actual native argv and delivered bytes; an existing carrier rejects dispatch. Preserve it for explicit judge-role authentication. Ordinary `--stdin-file` reads require no output or writable input directory; without it, stdin remains DEVNULL.
 - Omit `--model` — the CLI's configured default is used (zero-touch, same
   rule as codex-config.md's "omit `-m`").
 - `dontAsk` denies anything not allowlisted (official guide: "denies
@@ -46,7 +47,7 @@ python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- claude -p "<judge prompt>" \
   `.devlyn/verify.pair.findings.jsonl`. Raw stdout stays diagnostic at
   `.devlyn/claude-judge.stdout`; `verify-merge-findings.py` blocks the run
   if stdout contains findings the canonical file lacks.
-- Exit 124 is a wall-budget abort (kills the process group) → the orchestrator
+- Exit 124 is a wall-budget abort (terminates the native child process tree; POSIX process group) → the orchestrator
   writes `.devlyn/verify.pair.timeout.json`; budget abort ≠ availability failure
   and the fail-closed availability rules above are unchanged.
 - Do not pipe stdout (`| tail`, `| grep`); capture to file. Non-zero exit other

package/config/skills/_shared/adapters/codex.md

@@ -14,7 +14,7 @@ Your default is efficient, direct, task-oriented. The canonical body specifies t
 
 Resolve the request in the fewest useful tool loops without sacrificing correctness. For retrieval tasks: start with one broad search using short discriminative keywords; make another retrieval call only when the top results don't answer the core question or a required fact / parameter / source is missing. For tool-heavy tasks, start with a brief preamble: a one-line acknowledgment of the request and the first step you'll take.
 
-For VERIFY JUDGE retrieval, batch related reads. After sealed parity proves a
+For a constrained-read VERIFY packet, judge the supplied material without tools; missing or unbound inputs require a verdict-binding BLOCKED finding. Keep the read-only sandbox and bounded review. Otherwise, for VERIFY JUDGE retrieval, batch related reads. After sealed parity proves a
 canonical file and its `.agents` mirror are byte-identical, inspect the
 canonical file only. Open self-test bodies or MECHANICAL raw streams only for a
 named clause that remains unresolved after the broad pass.

package/config/skills/_shared/archive_run.py

@@ -535,7 +535,7 @@ def completion_self_test() -> None:
         for i, final in enumerate(invalid):
             path = runs / f"indeterminate-{i:02d}" / "pipeline.state.json"
             path.parent.mkdir()
-            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": final}}))
+            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": final}}), encoding="utf-8")
             preserved.append(path)
         for i, raw in enumerate((b"{", b"\xff", b"null", b'{"phases":{}}', b'{"run_id":[]}')):
             path = runs / f"malformed-{i}" / "pipeline.state.json"
@@ -545,14 +545,14 @@ def completion_self_test() -> None:
         for i, pattern in enumerate(BOOTSTRAP_TEMP_PATTERNS):
             path = runs / f"residue-{i}" / "pipeline.state.json"
             path.parent.mkdir()
-            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[0]}}))
+            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[0]}}), encoding="utf-8")
             residue = path.with_name(pattern.replace("*", "interrupted"))
             residue.write_bytes(b"interrupted initialization")
             preserved.extend((path, residue))
         for i in range(12):
             path = runs / f"complete-{i:02d}" / "pipeline.state.json"
             path.parent.mkdir()
-            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[i % 8]}}))
+            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[i % 8]}}), encoding="utf-8")
         before = {p: p.read_bytes() for p in preserved}
         assert prune(runs) == 2
         assert {p: p.read_bytes() for p in preserved} == before
@@ -901,6 +901,7 @@ def self_test() -> int:
             [sys.executable, str(pathlib.Path(__file__).resolve()), "--devlyn-dir", str(bad)],
             capture_output=True,
             text=True,
+            encoding="utf-8",
         )
         assert blocked_cli.returncode == 1
         assert "error: archive blocked:" in blocked_cli.stderr
@@ -948,4 +949,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    runpy.run_path(str(pathlib.Path(__file__).with_name("platform-support.py")))["configure_utf8"]()
     raise SystemExit(main())

package/config/skills/_shared/codex-config.md

@@ -4,7 +4,7 @@ Single source of truth for how every skill calls Codex. **MCP is not used.** Ski
 
 ## Canonical invocations
 
-All long-running Codex calls go through `codex-monitored.sh` — a thin wrapper that closes stdin (codex 0.124.0 hangs when both stdin is open and a prompt arg is given), streams Codex stdout fully (no `tail -n` truncation), and prints a `[codex-monitored] heartbeat` line every 30s so the outer `claude -p` byte-watchdog stays fed during long reasoning gaps. The wrapper passes its arguments through verbatim to the underlying CLI, so the canonical flag set is unchanged from a raw call — only the launcher differs.
+All long-running Codex calls go through `codex-monitored.sh`. It streams full stdout and emits a `[codex-monitored] heartbeat` every 30s on stderr. Write multiline prompts as exact UTF-8 bytes to a task-local file; set `DEVLYN_CODEX_PROMPT_FILE` and pass the sole prompt argument `-`. The wrapper snapshots those bytes before dispatch and seals actual argv, prompt digest and completion in `<prompt-file>.transport.json`. Missing/unreadable files, competing prompt arguments and receipt/prompt mismatches fail before launch. Without file transport, stdin remains DEVNULL (avoiding the open-stdin plus argument-prompt hang).
 
 Before the first Codex call, resolve the wrapper from the invoked skill directory:
 
@@ -25,22 +25,22 @@ fi
 **Read-only critique / adversarial review / debate** (`/devlyn:resolve` VERIFY pair-mode, plus any future ideate read-only critique). Security review stays native to Claude Code BUILD_GATE. Codex returns findings on stdout; the orchestrator writes files.
 
 ```bash
-CODEX_MONITORED_ISOLATED=1 bash "$CODEX_MONITORED_PATH" \
+DEVLYN_CODEX_PROMPT_FILE="<prompt-file>" CODEX_MONITORED_ISOLATED=1 CODEX_MONITORED_TIMEOUT_SEC=600 bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s read-only \
   -c model_reasoning_effort=xhigh \
-  "<inlined-prompt>"
+  -
 ```
 
 **Workspace-write implementation** (`/devlyn:resolve` IMPLEMENT phase when `--engine codex` or `--engine auto` routes to Codex, plus codex-routed `/devlyn:ideate` phases):
 
 ```bash
-bash "$CODEX_MONITORED_PATH" \
+DEVLYN_CODEX_PROMPT_FILE="<prompt-file>" bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s workspace-write \
   -c sandbox_workspace_write.network_access=false \
   -c model_reasoning_effort=xhigh \
-  "<inlined-prompt>"
+  -
 ```
 
 **CI-equivalent BUILD_GATE** keeps the same write sandbox and enables general
@@ -48,15 +48,16 @@ outbound network access inside that sandbox, including the loopback servers and
 network-backed test gates that CI may exercise:
 
 ```bash
-bash "$CODEX_MONITORED_PATH" \
+DEVLYN_CODEX_PROMPT_FILE="<prompt-file>" bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s workspace-write \
   -c sandbox_workspace_write.network_access=true \
   -c model_reasoning_effort=xhigh \
-  "<inlined-prompt>"
+  -
 ```
 
 Notes:
+- `DEVLYN_CODEX_PROMPT_FILE` — use the same file as `DEVLYN_INVOCATION_PROMPT_FILE` for receipt-bound calls. Retain the generated transport carrier with the prompt/session/argv evidence; a path or claimed environment value alone does not prove delivery. Do not use shell command substitution for prompt bytes.
 - `-C` — project root so Codex's working directory matches.
 - `-s read-only` / `-s workspace-write` — sandbox policy. Use workspace-write for implementation/probe phases that write tracked files or `.devlyn` artifacts.
 - `-c sandbox_workspace_write.network_access=<true|false>` — required and receipt-bound for mutation phases: `true` only for BUILD_GATE and, per call, PROBE-DERIVE when the probe's visible Verification command requires a localhost service; `false` for PLAN, IMPLEMENT, CLEANUP, and PROBE-DERIVE by default. This allows CI-equivalent loopback/network tests without widening to `danger-full-access` and prevents user configuration from silently changing other phases.
@@ -66,6 +67,10 @@ Notes:
 - Wrapper calls are **foreground-blocking**. Never launch them via a backgrounded shell (`run_in_background`, `&`, `nohup`) and never end the orchestrator message while one runs: a headless print-mode session kills backgrounded children at wind-down (observed 2026-07-07: an FS1 A-arm IMPLEMENT codex call was killed at turn end → 0-byte delivery). The heartbeat stream is the observability channel; block on the call. Interactive Claude Code caps a foreground Bash call at `BASH_MAX_TIMEOUT_MS` (the installer sets at least 3600000 ms, IMPLEMENT's effective outer ceiling), so every foreground Codex wrapper call must pass the Bash `timeout` explicitly at that ceiling or the phase's own budget (for example, 600s judges) — never rely on the 120 s default.
 - Raw `codex exec ...` invocations are **forbidden** in skill prompts. The benchmark variant arm runs a PATH shim (`scripts/codex-shim/codex`) that transparently re-routes any raw `codex exec` to the wrapper as a safety net, but skills should always emit the wrapper form directly so the orchestrator's first-attempt has the right shape. Two prior iterations (iter-0006 universal foreground ban, iter-0008 prompt-level kill-shape contract) failed because the orchestrator picked starvation-prone shapes (`codex exec ... 2>&1 | tail -200`) from its own pattern prior — the wrapper plus the shim is the runtime binding layer those iters lacked. See `autoresearch/iterations/0009-wrapper-and-hook.md`.
 
+## Constrained Windows judge reads
+
+Codex supports [native Windows sandboxing](https://learn.chatgpt.com/docs/windows/windows-sandbox). A policy-denied read selects a constrained-read route for that judge; it does not establish that Windows lacks sandbox support or denies every read. The orchestrator supplies the complete spec, sibling expected contract, accepted source SHA and cumulative diff, relevant source/tests with file:line locators, and validated sealed MECHANICAL results, manifests and required raw streams inline in the prompt file. Tell the fresh judge: "Judge only the supplied evidence; run no tools. Missing, truncated or unbound inputs require a verdict-binding BLOCKED finding." Keep `-s read-only`, isolation, freshness, selected model/effort, the 600s budget and normal findings/timeout handling. Never widen sandbox permissions or invent evidence to complete the packet.
+
 ## Availability check
 
 Before the first Codex call in a run, verify the CLI is on PATH:
@@ -84,4 +89,4 @@ The local Codex CLI, fronted by `codex-monitored.sh`, is the integration boundar
 
 Skills write the invocation as a Bash command the runtime executes. Example shape from `/devlyn:resolve` PHASE 2 IMPLEMENT when routed to Codex:
 
-> Run `bash "$CODEX_MONITORED_PATH" --json -C <state.base_ref.repo_root> -s workspace-write -m <model_requested> -c sandbox_workspace_write.network_access=false -c model_reasoning_effort=xhigh "<IMPLEMENT prompt>"`. Capture stdout as the IMPLEMENT reply; non-zero exit → treat as subagent failure. The wrapper emits `[codex-monitored]` heartbeat and lifecycle lines on **stderr** — stdout stays clean for Codex output, so the orchestrator can parse the reply without filtering. Heartbeat-on-stderr keeps the orchestrator's combined-output stream non-silent (defeats the iter-0008 byte-watchdog kill) without polluting the codex-reply view of stdout. Do not pipe the wrapper; direct capture or file redirection preserves streaming and avoids the pipe-refusal exit.
+> Run `DEVLYN_CODEX_PROMPT_FILE="<IMPLEMENT-prompt-file>" bash "$CODEX_MONITORED_PATH" --json -C <state.base_ref.repo_root> -s workspace-write -m <model_requested> -c sandbox_workspace_write.network_access=false -c model_reasoning_effort=xhigh -`. Capture stdout as the IMPLEMENT reply; non-zero exit → treat as subagent failure. The wrapper emits `[codex-monitored]` heartbeat and lifecycle lines on **stderr** — stdout stays clean for Codex output, so the orchestrator can parse the reply without filtering. Heartbeat-on-stderr keeps the orchestrator's combined-output stream non-silent (defeats the iter-0008 byte-watchdog kill) without polluting the codex-reply view of stdout. Do not pipe the wrapper; direct capture or file redirection preserves streaming and avoids the pipe-refusal exit.

package/config/skills/_shared/codex-monitored.sh

@@ -21,7 +21,7 @@
 #      clear message so the orchestrator can self-correct on retry.
 #      (Round 2 finding #1 fix: shim alone does not defeat `| tail`; the
 #      wrapper must reject the pipe shape directly.)
-#   2. Closes stdin (`< /dev/null`) — kills the codex 0.124.0 stdin hang.
+#   2. Closes stdin unless DEVLYN_CODEX_PROMPT_FILE supplies the sole prompt.
 #   3. Streams codex stdout to OUR stdout line-by-line — the orchestrator reads
 #      stdout as the subagent reply (per `_shared/codex-config.md`) so we MUST
 #      NOT swallow it (e.g. `tail -n 200`). codex stderr forwards to OUR stderr.
@@ -54,6 +54,7 @@
 #   CODEX_MONITORED_ALLOW_PIPED    — set non-empty to skip the pipe-stdout
 #                                     refusal. Reserved for tests; don't use
 #                                     in skill prompts.
+#   DEVLYN_CODEX_PROMPT_FILE      — exact binary stdin prompt; requires sole `-`.
 #   DEVLYN_INVOCATION_*             — run/phase/round/workdir/prompt/session/
 #                                     receipt identity. When any is set, all
 #                                     are required and the wrapper seals a
@@ -269,22 +270,17 @@ if [ -n "${CODEX_MONITORED_ISOLATED:-}" ]; then
   printf '[codex-monitored] isolated=1\n' >&2
 fi
 
-if [ -n "$RECEIPT_ENABLED" ]; then
-  RECEIPT_HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/invocation-receipt.py"
-  python3 "$RECEIPT_HELPER" start \
-    --workdir "$DEVLYN_INVOCATION_WORKDIR" \
-    --receipt "$DEVLYN_INVOCATION_RECEIPT" \
-    --run-id "$DEVLYN_INVOCATION_RUN_ID" \
-    --phase "$DEVLYN_INVOCATION_PHASE" \
-    --round "$DEVLYN_INVOCATION_ROUND" \
-    --prompt-file "$DEVLYN_INVOCATION_PROMPT_FILE" \
-    --session-file "$DEVLYN_INVOCATION_SESSION_FILE" \
-    -- "${CODEX_ARGS[@]}" || exit 64
+RECEIPT_HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/invocation-receipt.py"
+# Native Python owns Windows PIDs and the timeout tree; MSYS PIDs are different.
+if [ "${OS:-}" = Windows_NT ]; then
+  exec python3 "$RECEIPT_HELPER" dispatch --binary "$CODEX_BIN" \
+    --timeout "$TIMEOUT_SEC" --heartbeat "$HEARTBEAT_SEC" -- "${CODEX_ARGS[@]}" < /dev/null
 fi
 
-# Launch codex with stdin closed; output streams directly to OUR stdout/stderr.
+# The dispatcher snapshots file input, seals actual argv, then execs in this group.
 set -m
-"$CODEX_BIN" exec "${CODEX_ARGS[@]}" < /dev/null &
+python3 "$RECEIPT_HELPER" dispatch --binary "$CODEX_BIN" \
+  --timeout "$TIMEOUT_SEC" --heartbeat "$HEARTBEAT_SEC" -- "${CODEX_ARGS[@]}" < /dev/null &
 CODEX_PID=$!
 printf '[codex-monitored] codex pid=%d\n' "$CODEX_PID" >&2
 
@@ -308,11 +304,8 @@ if [ -n "$TIMEOUT_FLAG" ] && [ -f "$TIMEOUT_FLAG" ]; then
   EXIT=124
 fi
 
-if [ -n "$RECEIPT_ENABLED" ]; then
-  python3 "$RECEIPT_HELPER" finish \
-    --workdir "$DEVLYN_INVOCATION_WORKDIR" \
-    --receipt "$DEVLYN_INVOCATION_RECEIPT" \
-    --exit-code "$EXIT" || exit 64
+if [ -n "$RECEIPT_ENABLED" ] || [ -n "${DEVLYN_CODEX_PROMPT_FILE:-}" ]; then
+  python3 "$RECEIPT_HELPER" complete-dispatch --exit-code "$EXIT" || exit 64
 fi
 
 printf '[codex-monitored] codex exited: code=%d elapsed=%ds\n' \

package/config/skills/_shared/collect-codex-findings.py

@@ -501,4 +501,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    runpy.run_path(str(pathlib.Path(__file__).with_name("platform-support.py")))["configure_utf8"]()
     raise SystemExit(main())

package/config/skills/_shared/engine-preflight.md

@@ -49,6 +49,8 @@ Do not report a downgraded successful run when a required engine is missing.
 
 ## Canonical cross-engine invocations
 
+For native Windows, use native Node/npm and Python (`python3` on PATH), with Git for Windows Bash for the shipped shell wrapper. Supported npm engine shims resolve to native argv; unsupported/malformed shims fail visibly. Deliver multiline prompts from files: Codex uses `DEVLYN_CODEX_PROMPT_FILE` with explicit `-`; Claude uses `run-bounded.py 600 --stdin-file <prompt-file> --record-transport -- claude -p`. Retain generated transport evidence. A policy-denied Codex judge read uses the complete inline no-tools packet in `_shared/codex-config.md#constrained-windows-judge-reads`, keeping read-only isolation and the selected role.
+
 After the availability check passes, Codex keeps the monitored `codex-monitored.sh`
 path; every other resolved OTHER engine follows `_shared/adapters/<name>.md`
 `## Invocation`. Capture `.devlyn/<name>-judge.stdout`, then normalize it with

package/config/skills/_shared/finish-gate.py

@@ -2,6 +2,7 @@
 """Deterministic PHASE 6 final-diff gate for /devlyn:resolve."""
 from __future__ import annotations
 
+import runpy
 import argparse
 import importlib.util
 import json
@@ -43,6 +44,7 @@ def git(work: pathlib.Path, *args: str) -> subprocess.CompletedProcess[str]:
         cwd=str(work),
         capture_output=True,
         text=True,
+        encoding="utf-8",
     )
 
 
@@ -329,7 +331,7 @@ def write_state(devlyn: pathlib.Path, state: dict) -> None:
 
 def read_findings(devlyn: pathlib.Path) -> list[dict]:
     path = devlyn / FINDINGS_NAME
-    return [SPEC_VERIFY.loads_strict_json(line) for line in path.read_text().splitlines() if line.strip()]
+    return [SPEC_VERIFY.loads_strict_json(line) for line in path.read_text(encoding="utf-8").splitlines() if line.strip()]
 
 
 def read_summary(devlyn: pathlib.Path) -> dict:
@@ -515,4 +517,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    runpy.run_path(str(pathlib.Path(__file__).with_name("platform-support.py")))["configure_utf8"]()
     raise SystemExit(main())