devlyn-cli 4.1.0 → 4.2.0

package/config/skills/_shared/invocation-receipt.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Create and validate run-owned Codex invocation receipts."""
+"""Dispatch `codex exec` for codex-monitored.sh: exact argv, an optional sealed prompt file, native process ownership."""
 from __future__ import annotations
 
 import runpy
@@ -18,16 +18,10 @@ import tempfile
 import time
 
 
-SCHEMA_VERSION = "2.0"
-PHASES = {"plan", "implement", "build_gate", "cleanup"}
-SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
-SAFE_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
-DANGEROUS_FLAGS = {"--dangerously-bypass-approvals-and-sandbox", "--yolo"}
-NETWORK_ACCESS_CONFIG = "sandbox_workspace_write.network_access"
 PLATFORM = runpy.run_path(pathlib.Path(__file__).with_name("platform-support.py"))
 
 
-class ReceiptError(ValueError):
+class TransportError(ValueError):
     pass
 
 
@@ -69,62 +63,6 @@ def atomic_write(path: pathlib.Path, value: object) -> None:
         raise
 
 
-def relative_file(work: pathlib.Path, raw_path: str, label: str, *, require: bool) -> tuple[pathlib.Path, str]:
-    path = pathlib.Path(raw_path)
-    candidate = path if path.is_absolute() else work / path
-    try:
-        if require and candidate.is_symlink():
-            raise ReceiptError(f"{label} must not be a symlink: {raw_path}")
-        resolved = candidate.resolve(strict=require)
-        relative = resolved.relative_to(work.resolve()).as_posix()
-    except (OSError, ValueError) as exc:
-        raise ReceiptError(f"{label} is missing or escapes the worktree: {raw_path}") from exc
-    if require and not resolved.is_file():
-        raise ReceiptError(f"{label} is not a regular file: {raw_path}")
-    return resolved, relative
-
-
-def option_values(argv: list[str], short: str, long: str) -> list[str]:
-    values = []
-    index = 0
-    while index < len(argv):
-        token = argv[index]
-        if token in {short, long}:
-            if index + 1 >= len(argv):
-                raise ReceiptError(f"{token} requires a value")
-            values.append(argv[index + 1])
-            index += 2
-            continue
-        if token.startswith(long + "="):
-            values.append(token.split("=", 1)[1])
-        elif token.startswith(short + "="):
-            values.append(token.split("=", 1)[1])
-        index += 1
-    return values
-
-
-def option_value(argv: list[str], short: str, long: str) -> str | None:
-    values = option_values(argv, short, long)
-    if len(values) > 1:
-        raise ReceiptError(f"duplicate {long} option")
-    return values[0] if values else None
-
-
-def sandbox_network_access(argv: list[str], phase: str) -> bool:
-    enabled = phase == "build_gate"
-    expected = f"{NETWORK_ACCESS_CONFIG}={'true' if enabled else 'false'}"
-    related = [
-        raw for raw in option_values(argv, "-c", "--config")
-        if "sandbox_workspace_write" in raw or "network_access" in raw
-    ]
-    if related != [expected]:
-        raise ReceiptError(
-            f"Codex {phase} requires exactly one -c {expected}; "
-            "alternate, table, missing, and duplicate network overrides are forbidden"
-        )
-    return enabled
-
-
 def file_prompt_args(argv):
     """File mode accepts one explicit stdin prompt and no positional competitors."""
     values = {"-C", "--cd", "-s", "--sandbox", "-m", "--model", "-c", "--config",
@@ -138,7 +76,7 @@ def file_prompt_args(argv):
         token = argv[index]
         if token in values:
             if index + 1 >= len(argv):
-                raise ReceiptError(f"{token} requires a value")
+                raise TransportError(f"{token} requires a value")
             index += 2
         elif any(token.startswith(key + "=") for key in values) or token in flags:
             index += 1
@@ -149,22 +87,22 @@ def file_prompt_args(argv):
             positional.append(token)
             index += 1
         else:
-            raise ReceiptError(f"unsupported Codex file-transport option: {token}")
+            raise TransportError(f"unsupported Codex file-transport option: {token}")
     if positional != ["-"]:
-        raise ReceiptError("file transport requires the sole prompt argument '-'; competing prompts are forbidden")
+        raise TransportError("file transport requires the sole prompt argument '-'; competing prompts are forbidden")
 
 
-def prepare_transport(prompt_path, command, argv, seconds, *, isolated=False):
+def prepare_transport(prompt_path, command, argv, seconds):
     path = pathlib.Path(prompt_path).resolve(strict=True)
     with PLATFORM["open_stdin"](path) as source:
         raw = source.read()
     record = {"schema_version": 1, "transport": "stdin-file",
               "prompt": {"path": str(path), "sha256": sha256(raw), "bytes": len(raw)},
-              "command": command, "argv": argv, "timeout_sec": seconds, "isolated": isolated,
+              "command": command, "argv": argv, "timeout_sec": seconds,
               "status": "started", "exit_code": None}
     carrier = path.with_name(path.name + ".transport.json")
     if carrier.exists():
-        raise ReceiptError(f"prompt transport already exists: {carrier}")
+        raise TransportError(f"prompt transport already exists: {carrier}")
     stream = tempfile.TemporaryFile("w+b")
     try:
         stream.write(raw)
@@ -181,330 +119,23 @@ def write_transport(path, record):
 
 
 def finish_transport(path, exit_code):
-    record = read_receipt(path)
+    record = read_transport(path)
     if record.get("status") != "started":
-        raise ReceiptError("prompt transport is not open")
+        raise TransportError("prompt transport is not open")
     record.update(status="completed", exit_code=exit_code)
     atomic_write(path, record)
 
 
-def validate_transport(path, prompt_raw):
-    record = read_receipt(path)
-    if set(record) != {"schema_version", "transport", "prompt", "command", "argv", "timeout_sec", "isolated", "status", "exit_code"}:
-        raise ReceiptError("invalid prompt transport shape")
-    prompt = record["prompt"]
-    if not isinstance(prompt, dict) or set(prompt) != {"path", "sha256", "bytes"}:
-        raise ReceiptError("invalid delivered prompt binding")
-    if (record["schema_version"] != 1 or record["transport"] != "stdin-file"
-            or record["status"] != "completed" or type(record["exit_code"]) is not int
-            or type(record["timeout_sec"]) is not int or record["timeout_sec"] < 0
-            or type(record["isolated"]) is not bool
-            or prompt["sha256"] != sha256(prompt_raw) or type(prompt["bytes"]) is not int
-            or prompt["bytes"] != len(prompt_raw)):
-        raise ReceiptError("delivered prompt/transport mismatch")
-    original = pathlib.Path(prompt["path"])
-    # Custody may relocate this sealed bundle; rehash its local prompt, not a live source tree.
-    if (not original.is_absolute() or path.name != original.name + ".transport.json"
-            or path.with_name(original.name).read_bytes() != prompt_raw):
-        raise ReceiptError("transport prompt path/bytes mismatch")
-    command, actual = record["command"], record["argv"]
-    if not all(isinstance(args, list) and args and all(isinstance(arg, str) for arg in args)
-               for args in (command, actual)) or len(actual) < len(command) or actual[len(actual) - len(command) + 1:] != command[1:]:
-        raise ReceiptError("transport actual argv mismatch")
-    return record
-
-
-def start_receipt(
-    work: pathlib.Path,
-    receipt_path: pathlib.Path,
-    run_id: str,
-    phase: str,
-    round_: int,
-    prompt_path: str,
-    session_path: str,
-    argv: list[str],
-    *, transport: dict | None = None,
-) -> None:
-    if receipt_path.exists():
-        raise ReceiptError(f"invocation receipt already exists: {receipt_path}")
-    if SAFE_ID_RE.fullmatch(run_id) is None:
-        raise ReceiptError("run id is invalid")
-    if phase not in PHASES:
-        raise ReceiptError(f"unsupported invocation phase: {phase}")
-    if round_ < 0:
-        raise ReceiptError("round must be non-negative")
-    evidence_manifest = (
-        work / ".devlyn" / "process-evidence" / run_id / phase
-        / f"round-{round_}" / "manifest.json"
-    )
-    if evidence_manifest.is_file():
-        manifest = loads_strict_json(evidence_manifest.read_text(encoding="utf-8"))
-        entries = manifest.get("entries") if isinstance(manifest, dict) else None
-        if not isinstance(entries, list):
-            raise ReceiptError("existing process-evidence manifest is malformed")
-        if any(
-            isinstance(entry, dict)
-            and isinstance(entry.get("classification"), dict)
-            and entry["classification"].get("kind") == "capability_denied"
-            for entry in entries
-        ):
-            raise ReceiptError(
-                "capability-denied phase/round cannot launch another Codex invocation"
-            )
-    forbidden = sorted(DANGEROUS_FLAGS.intersection(argv))
-    if forbidden:
-        raise ReceiptError(f"forbidden Codex bypass flag: {forbidden[0]}")
-    if "--json" not in argv[:-1]:
-        raise ReceiptError("receipt-bound Codex invocation requires --json before the prompt")
-    model = option_value(argv, "-m", "--model")
-    sandbox = option_value(argv, "-s", "--sandbox")
-    invocation_workdir = option_value(argv, "-C", "--cd")
-    if not model:
-        raise ReceiptError("Codex invocation requires an explicit model")
-    if not sandbox:
-        raise ReceiptError("Codex invocation requires an explicit sandbox")
-    if sandbox != "workspace-write":
-        raise ReceiptError(
-            f"Codex {phase} sandbox must remain workspace-write, got {sandbox}"
-        )
-    network_access = sandbox_network_access(argv, phase)
-    if not invocation_workdir:
-        raise ReceiptError("Codex invocation requires an explicit workdir")
-    try:
-        if pathlib.Path(invocation_workdir).resolve(strict=True) != work.resolve():
-            raise ReceiptError("Codex invocation workdir does not match receipt workdir")
-    except OSError as exc:
-        raise ReceiptError("Codex invocation workdir is missing") from exc
-
-    prompt_file, prompt_relative = relative_file(work, prompt_path, "invocation prompt", require=True)
-    session_file, session_relative = relative_file(work, session_path, "worker session", require=False)
-    receipt_file, receipt_relative = relative_file(work, str(receipt_path), "invocation receipt", require=False)
-    expected_receipt = f".devlyn/{phase}.invocation.{round_}.json"
-    expected_session = f".devlyn/{phase}.worker-session.{round_}.jsonl"
-    expected_prompt = f".devlyn/{phase}.prompt.{round_}"
-    if receipt_relative != expected_receipt:
-        raise ReceiptError(
-            f"invocation receipt path expected {expected_receipt}, got {receipt_relative}"
-        )
-    if session_relative != expected_session:
-        raise ReceiptError(
-            f"worker session path expected {expected_session}, got {session_relative}"
-        )
-    if prompt_relative != expected_prompt:
-        raise ReceiptError(
-            f"invocation prompt path expected {expected_prompt}, got {prompt_relative}"
-        )
-    prompt_raw = prompt_file.read_bytes()
-    try:
-        prompt_argument = prompt_raw.decode("utf-8").rstrip("\n")
-    except UnicodeError as exc:
-        raise ReceiptError("invocation prompt is not UTF-8") from exc
-    if transport is not None:
-        file_prompt_args(argv)
-        if (transport["prompt"] != {"path": str(prompt_file), "sha256": sha256(prompt_raw), "bytes": len(prompt_raw)}
-                or transport["command"][1:] != ["exec", *argv]):
-            raise ReceiptError("delivered prompt file/bytes or actual argv does not match the canonical invocation")
-    elif not argv or argv[-1] == "-" or argv[-1] != prompt_argument:
-        raise ReceiptError("Codex prompt argument does not match the canonical prompt file")
-
-    atomic_write(receipt_file, {
-        "schema_version": SCHEMA_VERSION,
-        "run_id": run_id,
-        "phase": phase,
-        "round": round_,
-        "engine": "codex",
-        "model": model,
-        "sandbox": sandbox,
-        "sandbox_network_access": network_access,
-        "prompt": {"path": prompt_relative, "sha256": sha256(prompt_raw)},
-        "session": {"path": session_relative, "sha256": None, "bytes": None},
-        "argv_sha256": sha256(json.dumps(argv, separators=(",", ":")).encode("utf-8")),
-        "status": "started",
-        "exit_code": None,
-        **({"transport": {"path": prompt_relative + ".transport.json", "sha256": None}} if transport is not None else {}),
-    })
-
-
-def read_receipt(path: pathlib.Path) -> dict:
+def read_transport(path: pathlib.Path) -> dict:
     try:
         value = loads_strict_json(path.read_text(encoding="utf-8"))
     except (OSError, UnicodeError, ValueError) as exc:
-        raise ReceiptError(f"invocation receipt is invalid: {exc}") from exc
+        raise TransportError(f"prompt transport is invalid: {exc}") from exc
     if not isinstance(value, dict):
-        raise ReceiptError("invocation receipt must contain an object")
+        raise TransportError("prompt transport must contain an object")
     return value
 
 
-def finish_receipt(work: pathlib.Path, receipt_path: pathlib.Path, exit_code: int) -> None:
-    receipt = read_receipt(receipt_path)
-    if receipt.get("status") != "started" or receipt.get("exit_code") is not None:
-        raise ReceiptError("invocation receipt is not open")
-    session = receipt.get("session")
-    session_path = session.get("path") if isinstance(session, dict) else None
-    if not isinstance(session_path, str):
-        raise ReceiptError("invocation receipt session path is invalid")
-    session_file, _ = relative_file(work, session_path, "worker session", require=True)
-    raw = session_file.read_bytes()
-    receipt["session"] = {
-        "path": session_path,
-        "sha256": sha256(raw),
-        "bytes": len(raw),
-    }
-    receipt["status"] = "completed"
-    receipt["exit_code"] = exit_code
-    if "transport" in receipt:
-        carrier, _ = relative_file(work, receipt["transport"]["path"], "prompt transport", require=True)
-        receipt["transport"]["sha256"] = sha256(carrier.read_bytes())
-    atomic_write(receipt_path, receipt)
-
-
-def validate_receipt_artifacts(
-    work: pathlib.Path,
-    receipt_path: pathlib.Path,
-    *,
-    run_id: str,
-    phase: str,
-) -> tuple[dict, pathlib.Path, pathlib.Path, pathlib.Path]:
-    """Validate self-contained receipt identity and every referenced byte carrier."""
-    receipt_file, receipt_relative = relative_file(
-        work, str(receipt_path), "invocation receipt", require=True,
-    )
-    receipt = read_receipt(receipt_file)
-    if set(receipt) - {"transport"} != {
-        "schema_version", "run_id", "phase", "round", "engine", "model",
-        "sandbox", "sandbox_network_access", "prompt", "session", "argv_sha256",
-        "status", "exit_code",
-    }:
-        raise ReceiptError("invocation receipt has an invalid shape")
-    round_ = receipt.get("round")
-    if isinstance(round_, bool) or not isinstance(round_, int) or round_ < 0:
-        raise ReceiptError("invocation receipt round is invalid")
-    expected_path = f".devlyn/{phase}.invocation.{round_}.json"
-    if receipt_relative != expected_path:
-        raise ReceiptError(f"invocation receipt path expected {expected_path}")
-    expected_identity = (SCHEMA_VERSION, run_id, phase, round_, "codex", "completed")
-    actual_identity = (
-        receipt["schema_version"], receipt["run_id"], receipt["phase"], receipt["round"],
-        receipt["engine"], receipt["status"],
-    )
-    if actual_identity != expected_identity:
-        raise ReceiptError("invocation receipt identity/status mismatch")
-    if not isinstance(receipt["model"], str) or not receipt["model"]:
-        raise ReceiptError("invocation receipt model is invalid")
-    if receipt["sandbox"] != "workspace-write":
-        raise ReceiptError("invocation receipt sandbox must be workspace-write")
-    expected_network_access = phase == "build_gate"
-    if receipt["sandbox_network_access"] is not expected_network_access:
-        raise ReceiptError("invocation receipt sandbox network-access capability mismatch")
-    if not isinstance(receipt["exit_code"], int) or isinstance(receipt["exit_code"], bool):
-        raise ReceiptError("invocation receipt exit_code is invalid")
-    if not isinstance(receipt["argv_sha256"], str) or SHA256_RE.fullmatch(receipt["argv_sha256"]) is None:
-        raise ReceiptError("invocation receipt argv digest is invalid")
-    prompt = receipt["prompt"]
-    if not isinstance(prompt, dict) or set(prompt) != {"path", "sha256"}:
-        raise ReceiptError("invocation receipt prompt binding is invalid")
-    prompt_file, _ = relative_file(work, prompt["path"], "invocation prompt", require=True)
-    if prompt["path"] != f".devlyn/{phase}.prompt.{round_}":
-        raise ReceiptError("invocation receipt prompt path mismatch")
-    if (
-        not isinstance(prompt["sha256"], str)
-        or SHA256_RE.fullmatch(prompt["sha256"]) is None
-        or sha256(prompt_file.read_bytes()) != prompt["sha256"]
-    ):
-        raise ReceiptError("invocation prompt digest mismatch")
-    if "transport" in receipt:
-        binding = receipt["transport"]
-        if not isinstance(binding, dict) or set(binding) != {"path", "sha256"} or binding["path"] != prompt["path"] + ".transport.json":
-            raise ReceiptError("invocation transport binding is invalid")
-        carrier, _ = relative_file(work, binding["path"], "prompt transport", require=True)
-        if sha256(carrier.read_bytes()) != binding["sha256"]:
-            raise ReceiptError("invocation transport digest mismatch")
-        transport = validate_transport(carrier, prompt_file.read_bytes())
-        argv = transport["command"][2:]
-        file_prompt_args(argv)
-        if (transport["command"][1:2] != ["exec"] or transport["exit_code"] != receipt["exit_code"]
-                or sha256(json.dumps(argv, separators=(",", ":")).encode("utf-8")) != receipt["argv_sha256"]
-                or option_value(argv, "-m", "--model") != receipt["model"]
-                or option_value(argv, "-s", "--sandbox") != receipt["sandbox"]
-                or sandbox_network_access(argv, phase) != receipt["sandbox_network_access"]):
-            raise ReceiptError("invocation actual argv/capability mismatch")
-    session = receipt["session"]
-    if not isinstance(session, dict) or set(session) != {"path", "sha256", "bytes"}:
-        raise ReceiptError("invocation receipt session binding is invalid")
-    if not isinstance(session["path"], str):
-        raise ReceiptError("invocation receipt session path is invalid")
-    session_file, relative_session = relative_file(
-        work, session["path"], "worker session", require=True,
-    )
-    if relative_session != f".devlyn/{phase}.worker-session.{round_}.jsonl":
-        raise ReceiptError("invocation receipt session path mismatch")
-    raw = session_file.read_bytes()
-    if (
-        not isinstance(session["sha256"], str)
-        or SHA256_RE.fullmatch(session["sha256"]) is None
-        or isinstance(session["bytes"], bool)
-        or not isinstance(session["bytes"], int)
-        or session["bytes"] < 0
-        or session["sha256"] != sha256(raw)
-        or session["bytes"] != len(raw)
-    ):
-        raise ReceiptError("invocation worker-session digest mismatch")
-    return receipt, receipt_file, prompt_file, session_file
-
-
-def validate_receipt(
-    work: pathlib.Path,
-    receipt_path: pathlib.Path,
-    *,
-    run_id: str,
-    phase: str,
-    round_: int,
-    model: str,
-    prompt_sha256: str,
-    session_path: pathlib.Path,
-) -> dict:
-    receipt, receipt_file, _prompt_file, receipt_session = validate_receipt_artifacts(
-        work, receipt_path, run_id=run_id, phase=phase,
-    )
-    if receipt["round"] != round_ or receipt["model"] != model:
-        raise ReceiptError("invocation receipt round/model mismatch")
-    if receipt["prompt"]["sha256"] != prompt_sha256:
-        raise ReceiptError("invocation prompt digest mismatch")
-    supplied_session, _ = relative_file(
-        work, str(session_path), "worker session", require=True,
-    )
-    if supplied_session != receipt_session:
-        raise ReceiptError("invocation receipt session path mismatch")
-    raw = receipt_session.read_bytes()
-    if sha256(raw) != receipt["session"]["sha256"]:
-        raise ReceiptError("invocation worker-session digest mismatch")
-    for number, line in enumerate(raw.decode("utf-8").split("\n"), start=1):
-        if not line.strip():
-            continue
-        try:
-            event = loads_strict_json(line)
-        except ValueError as exc:
-            raise ReceiptError(f"invalid worker-session JSONL at line {number}: {exc}") from exc
-        if not isinstance(event, dict):
-            raise ReceiptError(f"worker-session event at line {number} must be an object")
-        item = event.get("item")
-        if (event.get("type") == "item.completed" and isinstance(item, dict)
-                and item.get("type") == "error" and isinstance(item.get("message"), str)
-                and item["message"].startswith("model rerouted: ")):
-            raise ReceiptError(
-                f"Codex reported model reroute at worker-session line {number}; "
-                "requested model was not preserved; inspect the retained session"
-            )
-    return {
-        "path": receipt_file.relative_to(work.resolve()).as_posix(),
-        "sha256": sha256(receipt_file.read_bytes()),
-        "sandbox": receipt["sandbox"],
-        "sandbox_network_access": receipt["sandbox_network_access"],
-        "argv_sha256": receipt["argv_sha256"],
-        "exit_code": receipt["exit_code"],
-    }
-
-
 def monitor_descendant_regression() -> None:
     if os.name == "nt":
         print("SKIP POSIX shell process-group fixture; test-windows-portability.py exercises native Node/Python trees")
@@ -547,8 +178,7 @@ def monitor_descendant_regression() -> None:
         env = os.environ.copy()
         for key in tuple(env):
             if (
-                key.startswith("DEVLYN_INVOCATION_")
-                or key.startswith("DEVLYN_WATCHDOG_TEST_")
+                key.startswith("DEVLYN_WATCHDOG_TEST_")
                 or key.startswith("CODEX_MONITORED_")
                 or key in {"CODEX_BLOCKED", "CODEX_REAL_BIN", "DEVLYN_CODEX_PROMPT_FILE"}
             ):
@@ -783,342 +413,23 @@ def monitor_descendant_regression() -> None:
 
 def self_test() -> int:
     monitor_descendant_regression()
+    if os.name == "nt":
+        print("SKIP POSIX executable-shell wrapper fixture; native npm transport is covered by test-windows-portability.py")
+        return 0
     with tempfile.TemporaryDirectory() as raw_tmp:
         work = pathlib.Path(raw_tmp)
-        devlyn = work / ".devlyn"
-        devlyn.mkdir()
-        prompt = devlyn / "implement.prompt.0"
-        prompt.write_text("do the task\n", encoding="utf-8")
-        session = devlyn / "implement.worker-session.0.jsonl"
-        session.write_text('{"type":"thread.started"}\n', encoding="utf-8")
-        receipt = devlyn / "implement.invocation.0.json"
-        argv = [
-            "--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-test",
-            "-c", "sandbox_workspace_write.network_access=false", "do the task",
-        ]
-        start_receipt(work, receipt, "rs-receipt", "implement", 0, str(prompt), str(session), argv)
-        finish_receipt(work, receipt, 0)
-        bound = validate_receipt(
-            work, receipt, run_id="rs-receipt", phase="implement", round_=0,
-            model="gpt-test", prompt_sha256=sha256(prompt.read_bytes()), session_path=session,
-        )
-        assert bound["sandbox"] == "workspace-write" and bound["exit_code"] == 0
-        original_session = session.read_bytes()
-        original_receipt = receipt.read_bytes()
-        reroute = "model rerouted: gpt-test -> another-model (Policy)"
-        cases = [
-            ({"type": "item.completed", "item": {"type": "error", "message": reroute}}, True),
-            ({"type": "item.completed", "item": {"type": "agent_message", "text": reroute}}, False),
-            ({"type": "item.completed", "item": {"type": "command_execution", "aggregated_output": reroute}}, False),
-            ({"type": "item.completed", "item": {"type": "error", "message": "recoverable tool error"}}, False),
-        ]
-        cases.append(({"type": "item.completed", "item": {
-            "type": "agent_message", "text": "ordinary \u2028 \u2029 \u0085 message",
-        }}, False))
-        for event, blocked in cases:
-            raw = original_session + (json.dumps(event, ensure_ascii=False) + '\n{"type":"turn.completed"}\n').encode()
-            session.write_bytes(raw)
-            receipt.unlink()
-            start_receipt(work, receipt, "rs-receipt", "implement", 0, str(prompt), str(session), argv)
-            finish_receipt(work, receipt, 0)
-            sealed = receipt.read_bytes()
-            try:
-                validate_receipt(work, receipt, run_id="rs-receipt", phase="implement", round_=0,
-                                 model="gpt-test", prompt_sha256=sha256(prompt.read_bytes()), session_path=session)
-            except ReceiptError as exc:
-                assert blocked and "reported model reroute" in str(exc), str(exc)
-            else:
-                assert not blocked, "native reroute followed by success was accepted"
-            validate_receipt_artifacts(work, receipt, run_id="rs-receipt", phase="implement")
-            assert receipt.read_bytes() == sealed and session.read_bytes() == raw
-        for malformed in (b'{broken\n', b'null\n', b'{"type":"item.completed","type":"ignored"}\n'):
-            session.write_bytes(malformed)
-            receipt.unlink()
-            start_receipt(work, receipt, "rs-receipt", "implement", 0, str(prompt), str(session), argv)
-            finish_receipt(work, receipt, 0)
-            try:
-                validate_receipt(work, receipt, run_id="rs-receipt", phase="implement", round_=0,
-                                 model="gpt-test", prompt_sha256=sha256(prompt.read_bytes()), session_path=session)
-            except ReceiptError:
-                pass
-            else:
-                raise AssertionError("malformed worker event was accepted")
-            validate_receipt_artifacts(work, receipt, run_id="rs-receipt", phase="implement")
-        session.write_bytes(original_session)
-        receipt.write_bytes(original_receipt)
-        plan_prompt = devlyn / "plan.prompt.0"
-        plan_prompt.write_text("plan exactly\n", encoding="utf-8")
-        plan_session = devlyn / "plan.worker-session.0.jsonl"
-        plan_session.write_text('{"type":"thread.started"}\n', encoding="utf-8")
-        plan_receipt = devlyn / "plan.invocation.0.json"
-        plan_argv = [
-            "--json", "-C", str(work), "-s", "workspace-write",
-            "-m", "gpt-plan", "-c",
-            "sandbox_workspace_write.network_access=false", "plan exactly",
-        ]
-        start_receipt(
-            work, plan_receipt, "rs-receipt", "plan", 0,
-            str(plan_prompt), str(plan_session), plan_argv,
-        )
-        finish_receipt(work, plan_receipt, 0)
-        plan_bound = validate_receipt(
-            work, plan_receipt, run_id="rs-receipt", phase="plan", round_=0,
-            model="gpt-plan", prompt_sha256=sha256(plan_prompt.read_bytes()),
-            session_path=plan_session,
-        )
-        assert plan_bound["sandbox"] == "workspace-write"
-        try:
-            loads_strict_json('{"run_id":"a","run_id":"b"}')
-        except ValueError as exc:
-            assert "duplicate JSON key" in str(exc)
-        else:
-            raise AssertionError("duplicate invocation receipt key was accepted")
-        try:
-            start_receipt(
-                work, devlyn / "cleanup.invocation.0.json", "rs-receipt", "cleanup", 0,
-                str(prompt), str(devlyn / "cleanup.worker-session.0.jsonl"),
-                ["--json", "--dangerously-bypass-approvals-and-sandbox", "-s", "danger-full-access",
-                 "-m", "gpt-test", "do the task"],
-            )
-        except ReceiptError as exc:
-            assert "forbidden Codex bypass flag" in str(exc)
-        else:
-            raise AssertionError("Codex bypass flag was accepted")
-        cleanup_prompt = devlyn / "cleanup.prompt.0"
-        cleanup_prompt.write_text("do the task\n", encoding="utf-8")
-        try:
-            start_receipt(
-                work, devlyn / "cleanup.invocation.0.json", "rs-receipt", "cleanup", 0,
-                str(cleanup_prompt), str(devlyn / "cleanup.worker-session.0.jsonl"),
-                ["--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-test",
-                 "do the task"],
-            )
-        except ReceiptError as exc:
-            assert "requires exactly one -c sandbox_workspace_write.network_access=false" in str(exc)
-        else:
-            raise AssertionError("Codex cleanup accepted implicit network capability")
-        try:
-            start_receipt(
-                work, devlyn / "cleanup.invocation.0.json", "rs-receipt", "cleanup", 0,
-                str(cleanup_prompt), str(devlyn / "cleanup.worker-session.0.jsonl"),
-                ["--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-test",
-                 "-c", "sandbox_workspace_write.network_access=true", "do the task"],
-            )
-        except ReceiptError as exc:
-            assert "requires exactly one -c sandbox_workspace_write.network_access=false" in str(exc)
-        else:
-            raise AssertionError("Codex cleanup accepted enabled network capability")
-        try:
-            start_receipt(
-                work, devlyn / "cleanup.invocation.0.json", "rs-receipt", "cleanup", 0,
-                str(cleanup_prompt), str(devlyn / "cleanup.worker-session.0.jsonl"),
-                ["--json", "-s", "danger-full-access", "-m", "gpt-test", "do the task"],
-            )
-        except ReceiptError as exc:
-            assert "must remain workspace-write" in str(exc)
-        else:
-            raise AssertionError("widened Codex sandbox was accepted")
-        try:
-            start_receipt(
-                work, devlyn / "cleanup.invocation.0.json", "rs-receipt", "cleanup", 0,
-                str(cleanup_prompt), str(devlyn / "cleanup.worker-session.0.jsonl"),
-                ["--json", "-C", str(devlyn), "-s", "workspace-write", "-m", "gpt-test",
-                 "-c", "sandbox_workspace_write.network_access=false", "do the task"],
-            )
-        except ReceiptError as exc:
-            assert "workdir does not match" in str(exc)
-        else:
-            raise AssertionError("Codex invocation accepted a different working directory")
-        session.write_text('{"type":"thread.started","mutated":true}\n', encoding="utf-8")
-        try:
-            validate_receipt(
-                work, receipt, run_id="rs-receipt", phase="implement", round_=0,
-                model="gpt-test", prompt_sha256=sha256(prompt.read_bytes()), session_path=session,
-            )
-        except ReceiptError as exc:
-            assert "worker-session digest mismatch" in str(exc)
-        else:
-            raise AssertionError("mutated worker session was accepted")
-
-        build_prompt = devlyn / "build_gate.prompt.0"
-        build_prompt.write_text("verify the task\n", encoding="utf-8")
-        build_session = devlyn / "build_gate.worker-session.0.jsonl"
-        build_receipt = devlyn / "build_gate.invocation.0.json"
-        try:
-            start_receipt(
-                work, build_receipt, "rs-wrapper", "build_gate", 0,
-                str(build_prompt), str(build_session),
-                ["--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-wrapper",
-                 "verify the task"],
-            )
-        except ReceiptError as exc:
-            assert "requires exactly one -c sandbox_workspace_write.network_access=true" in str(exc)
-        else:
-            raise AssertionError("Codex build_gate accepted missing network capability")
-        try:
-            start_receipt(
-                work, build_receipt, "rs-wrapper", "build_gate", 0,
-                str(build_prompt), str(build_session),
-                ["--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-wrapper",
-                 "-c", "sandbox_workspace_write.network_access=true",
-                 "-c", "sandbox_workspace_write.network_access=false",
-                 "verify the task"],
-            )
-        except ReceiptError as exc:
-            assert "duplicate network overrides are forbidden" in str(exc)
-        else:
-            raise AssertionError("Codex build_gate accepted duplicate network capabilities")
-        for alternate in (
-            "sandbox_workspace_write={network_access=true}",
-            '"sandbox_workspace_write".network_access=true',
-        ):
-            try:
-                start_receipt(
-                    work, build_receipt, "rs-wrapper", "build_gate", 0,
-                    str(build_prompt), str(build_session),
-                    ["--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-wrapper",
-                     "-c", "sandbox_workspace_write.network_access=true",
-                     "--config=" + alternate, "verify the task"],
-                )
-            except ReceiptError as exc:
-                assert "alternate, table, missing, and duplicate" in str(exc)
-            else:
-                raise AssertionError(f"Codex build_gate accepted alternate override: {alternate}")
-        glued_prompt = devlyn / "build_gate.prompt.1"
-        glued_prompt.write_text("verify glued config\n", encoding="utf-8")
-        glued_session = devlyn / "build_gate.worker-session.1.jsonl"
-        glued_session.write_text('{"type":"thread.started"}\n', encoding="utf-8")
-        glued_receipt = devlyn / "build_gate.invocation.1.json"
-        start_receipt(
-            work, glued_receipt, "rs-glued", "build_gate", 1,
-            str(glued_prompt), str(glued_session),
-            ["--json", "-C", str(work), "-s", "workspace-write", "-m", "gpt-wrapper",
-             "-c=sandbox_workspace_write.network_access=true", "verify glued config"],
-        )
-        finish_receipt(work, glued_receipt, 0)
-        assert validate_receipt(
-            work, glued_receipt, run_id="rs-glued", phase="build_gate", round_=1,
-            model="gpt-wrapper", prompt_sha256=sha256(glued_prompt.read_bytes()),
-            session_path=glued_session,
-        )["sandbox_network_access"] is True
-        if os.name == "nt":
-            print("SKIP POSIX executable-shell wrapper fixtures; native npm worker/judge transport is covered by test-windows-portability.py")
-            return 0
         fake_codex = work / "fake-codex"
-        fake_codex.write_text(
-            "#!/usr/bin/env bash\n"
-            "touch native-started\n"
-            "printf '%s\\n' '{\"type\":\"thread.started\"}'\n",
-            encoding="utf-8",
-        )
+        fake_codex.write_text("#!/usr/bin/env bash\ntouch native-started\n", encoding="utf-8")
         fake_codex.chmod(0o755)
         wrapper = pathlib.Path(__file__).with_name("codex-monitored.sh")
         widened = subprocess.run(
-            [
-                "bash", str(wrapper), "-C", str(work), "-s", "danger-full-access",
-                "-m", "gpt-wrapper", "verify the task",
-            ],
-            cwd=work,
-            env={**os.environ, "CODEX_BIN": str(fake_codex)},
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-            check=False,
-        )
-        assert widened.returncode == 64
-        assert b"forbidden Codex sandbox" in widened.stderr
-        assert widened.stdout == b""
-        env = os.environ.copy()
-        env.pop("DEVLYN_CODEX_PROMPT_FILE", None)
-        env.update({
-            "CODEX_BIN": str(fake_codex),
-            "CODEX_MONITORED_HEARTBEAT": "1",
-            "DEVLYN_INVOCATION_RUN_ID": "rs-wrapper",
-            "DEVLYN_INVOCATION_PHASE": "build_gate",
-            "DEVLYN_INVOCATION_ROUND": "0",
-            "DEVLYN_INVOCATION_WORKDIR": str(work),
-            "DEVLYN_INVOCATION_PROMPT_FILE": str(build_prompt),
-            "DEVLYN_INVOCATION_SESSION_FILE": str(build_session),
-            "DEVLYN_INVOCATION_RECEIPT": str(build_receipt),
-        })
-        with build_session.open("wb") as stdout:
-            missing_json = subprocess.run(
-                ["bash", str(wrapper), "-C", str(work), "-s", "workspace-write",
-                 "-m", "gpt-wrapper", "-c",
-                 "sandbox_workspace_write.network_access=true", "verify the task"],
-                cwd=work, env=env, stdout=stdout, stderr=subprocess.PIPE,
-                check=False,
-            )
-        assert missing_json.returncode == 64 and b"requires --json" in missing_json.stderr, missing_json.stderr
-        assert build_session.read_bytes() == b"" and not (work / "native-started").exists()
-        assert not build_receipt.exists()
-        with build_session.open("wb") as stdout:
-            wrapped = subprocess.run(
-                [
-                    "bash", str(wrapper), "--json", "-C", str(work), "-s", "workspace-write",
-                    "-m", "gpt-wrapper", "-c",
-                    "sandbox_workspace_write.network_access=true", "verify the task",
-                ],
-                cwd=work,
-                env=env,
-                stdout=stdout,
-                stderr=subprocess.PIPE,
-                check=False,
-            )
-        assert wrapped.returncode == 0, wrapped.stderr.decode("utf-8", errors="replace")
-        wrapper_bound = validate_receipt(
-            work, build_receipt, run_id="rs-wrapper", phase="build_gate", round_=0,
-            model="gpt-wrapper", prompt_sha256=sha256(build_prompt.read_bytes()),
-            session_path=build_session,
-        )
-        assert wrapper_bound["exit_code"] == 0
-        assert wrapper_bound["sandbox_network_access"] is True
-
-        wrapped_plan_prompt = devlyn / "plan.prompt.1"
-        wrapped_plan_prompt.write_text("plan through wrapper\n", encoding="utf-8")
-        wrapped_plan_session = devlyn / "plan.worker-session.1.jsonl"
-        wrapped_plan_receipt = devlyn / "plan.invocation.1.json"
-        plan_env = os.environ.copy()
-        plan_env.pop("DEVLYN_CODEX_PROMPT_FILE", None)
-        plan_env.update({
-            "CODEX_BIN": str(fake_codex),
-            "CODEX_MONITORED_HEARTBEAT": "1",
-            "DEVLYN_INVOCATION_RUN_ID": "rs-plan-wrapper",
-            "DEVLYN_INVOCATION_PHASE": "plan",
-            "DEVLYN_INVOCATION_ROUND": "1",
-            "DEVLYN_INVOCATION_WORKDIR": str(work),
-            "DEVLYN_INVOCATION_PROMPT_FILE": str(wrapped_plan_prompt),
-            "DEVLYN_INVOCATION_SESSION_FILE": str(wrapped_plan_session),
-            "DEVLYN_INVOCATION_RECEIPT": str(wrapped_plan_receipt),
-        })
-        with wrapped_plan_session.open("wb") as stdout:
-            wrapped_plan = subprocess.run(
-                [
-                    "bash", str(wrapper), "--json", "-C", str(work),
-                    "-s", "workspace-write", "-m", "gpt-plan-wrapper",
-                    "-c", "sandbox_workspace_write.network_access=false",
-                    "plan through wrapper",
-                ],
-                cwd=work,
-                env=plan_env,
-                stdout=stdout,
-                stderr=subprocess.PIPE,
-                check=False,
-            )
-        assert wrapped_plan.returncode == 0, wrapped_plan.stderr.decode(
-            "utf-8", errors="replace",
-        )
-        plan_wrapper_bound = validate_receipt(
-            work, wrapped_plan_receipt, run_id="rs-plan-wrapper", phase="plan",
-            round_=1, model="gpt-plan-wrapper",
-            prompt_sha256=sha256(wrapped_plan_prompt.read_bytes()),
-            session_path=wrapped_plan_session,
-        )
-        assert plan_wrapper_bound["exit_code"] == 0
-        print(
-            "PASS invocation receipt identity, prompt/session digest, bypass guard, "
-            "phase-scoped BUILD_GATE network capability, and monitored-wrapper "
-            "integration including PLAN"
+            ["bash", str(wrapper), "-C", str(work), "-s", "danger-full-access", "-m", "gpt-wrapper", "verify the task"],
+            cwd=work, env={**os.environ, "CODEX_BIN": str(fake_codex)},
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False,
         )
+        assert widened.returncode == 64 and b"forbidden Codex sandbox" in widened.stderr, widened.stderr
+        assert widened.stdout == b"" and not (work / "native-started").exists()
+    print("PASS monitored-wrapper descendant cleanup and authority-widening refusal")
     return 0
 
 
@@ -1127,10 +438,6 @@ def complete_dispatch(exit_code):
     if prompt:
         path = pathlib.Path(prompt).resolve()
         finish_transport(path.with_name(path.name + ".transport.json"), exit_code)
-    if os.environ.get("DEVLYN_INVOCATION_RECEIPT"):
-        work = pathlib.Path(os.environ["DEVLYN_INVOCATION_WORKDIR"]).resolve()
-        path = pathlib.Path(os.environ["DEVLYN_INVOCATION_RECEIPT"])
-        finish_receipt(work, path if path.is_absolute() else work / path, exit_code)
 
 
 def dispatch_codex(args):
@@ -1139,23 +446,12 @@ def dispatch_codex(args):
     actual = PLATFORM["native_argv"](command)
     prompt = os.environ.get("DEVLYN_CODEX_PROMPT_FILE")
     if prompt == "":
-        raise ReceiptError("DEVLYN_CODEX_PROMPT_FILE must name a readable prompt file")
+        raise TransportError("DEVLYN_CODEX_PROMPT_FILE must name a readable prompt file")
     stream, carrier, transport = None, None, None
     try:
         if prompt:
             file_prompt_args(argv)
-            stream, carrier, transport = prepare_transport(
-                prompt, command, actual, args.timeout,
-                isolated=bool(os.environ.get("CODEX_MONITORED_ISOLATED")),
-            )
-        if os.environ.get("DEVLYN_INVOCATION_RECEIPT"):
-            env = os.environ
-            work = pathlib.Path(env["DEVLYN_INVOCATION_WORKDIR"]).resolve()
-            path = pathlib.Path(env["DEVLYN_INVOCATION_RECEIPT"])
-            start_receipt(work, path if path.is_absolute() else work / path,
-                          env["DEVLYN_INVOCATION_RUN_ID"], env["DEVLYN_INVOCATION_PHASE"],
-                          int(env["DEVLYN_INVOCATION_ROUND"]), env["DEVLYN_INVOCATION_PROMPT_FILE"],
-                          env["DEVLYN_INVOCATION_SESSION_FILE"], argv, transport=transport)
+            stream, carrier, transport = prepare_transport(prompt, command, actual, args.timeout)
         if transport is not None:
             write_transport(carrier, transport)
         if os.name != "nt":
@@ -1176,19 +472,6 @@ def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--self-test", action="store_true")
     subparsers = parser.add_subparsers(dest="action")
-    start = subparsers.add_parser("start")
-    start.add_argument("--workdir", required=True)
-    start.add_argument("--receipt", required=True)
-    start.add_argument("--run-id", required=True)
-    start.add_argument("--phase", choices=sorted(PHASES), required=True)
-    start.add_argument("--round", type=int, required=True)
-    start.add_argument("--prompt-file", required=True)
-    start.add_argument("--session-file", required=True)
-    start.add_argument("argv", nargs=argparse.REMAINDER)
-    finish = subparsers.add_parser("finish")
-    finish.add_argument("--workdir", required=True)
-    finish.add_argument("--receipt", required=True)
-    finish.add_argument("--exit-code", type=int, required=True)
     dispatch = subparsers.add_parser("dispatch")
     dispatch.add_argument("--binary", required=True)
     dispatch.add_argument("--timeout", type=int, required=True)
@@ -1204,20 +487,6 @@ def main() -> int:
             return dispatch_codex(args)
         elif args.action == "complete-dispatch":
             complete_dispatch(args.exit_code)
-        elif args.action == "start":
-            argv = args.argv[1:] if args.argv[:1] == ["--"] else args.argv
-            start_receipt(
-                pathlib.Path(args.workdir).resolve(), pathlib.Path(args.receipt), args.run_id,
-                args.phase, args.round, args.prompt_file, args.session_file, argv,
-            )
-        elif args.action == "finish":
-            work = pathlib.Path(args.workdir).resolve()
-            receipt_path = pathlib.Path(args.receipt)
-            if not receipt_path.is_absolute():
-                receipt_path = work / receipt_path
-            finish_receipt(
-                work, receipt_path, args.exit_code,
-            )
         else:
             parser.error("an action is required")
     except (OSError, UnicodeError, ValueError) as exc: