devmethod-ai 0.1.0-rc.1 → 0.1.0

package/scripts/comparison.mjs

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const arms = ['none', 'devmethod', 'bmad'];
+const nonempty = value => typeof value === 'string' && value.trim().length > 0;
+const finite = value => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+/** Validate a complete matched batch, including blocked/failed runs. Never dispatch models. */
+export function summarize(batch) {
+  if (!batch || batch.format !== 1 || !Array.isArray(batch.runs) || !batch.runs.length) throw new Error('Expected format 1 nonempty batch');
+  const { budget } = batch;
+  if (!budget || !Number.isSafeInteger(budget.runs) || budget.runs < 1 || !Number.isSafeInteger(budget.tokens) || budget.tokens < 1 || !finite(budget.costUSD) || !nonempty(budget.authorization)) throw new Error('Explicit run/token/cost budget and authorization required');
+  if (batch.runs.length > budget.runs) throw new Error('Run budget exceeded');
+  const groups = new Map();
+  const matchedKeys = ['fixtureDigest', 'promptDigest', 'hostVersion', 'model', 'toolsDigest', 'permissionsDigest', 'perRunTokens', 'perRunCostUSD', 'timeoutSeconds'];
+  const digests = ['fixtureDigest', 'promptDigest', 'toolsDigest', 'permissionsDigest'];
+  for (const run of batch.runs) {
+    if (!run || !nonempty(run.caseId) || !Number.isSafeInteger(run.repetition) || run.repetition < 1 || !arms.includes(run.arm) || !['passed', 'failed', 'blocked', 'timeout'].includes(run.status)) throw new Error('Invalid run identity or status');
+    if (!matchedKeys.every(key => ['perRunTokens', 'perRunCostUSD', 'timeoutSeconds'].includes(key) ? finite(run[key]) && (key === 'perRunCostUSD' || run[key] > 0) : nonempty(run[key])) || !digests.every(key => /^[a-f0-9]{64}$/.test(run[key]))) throw new Error('Missing pinned matched conditions');
+    if (!nonempty(run.methodRevision) || !nonempty(run.wrapper) || (run.arm === 'none' && run.methodRevision !== 'none')) throw new Error('Pin method revision and invocation wrapper');
+    if (!nonempty(run.evidence) || !nonempty(run.review)) throw new Error('Evidence reference and review or blocked reason required');
+    for (const metric of ['tokens', 'costUSD', 'elapsedSeconds']) if (run[metric] !== null && !finite(run[metric])) throw new Error('Usage must be measured nonnegative values or null (unavailable)');
+    if ((run.tokens !== null && run.tokens > run.perRunTokens) || (run.costUSD !== null && run.costUSD > run.perRunCostUSD)) throw new Error('Per-run budget exceeded');
+    const key = `${run.caseId}:${run.repetition}`;
+    const group = groups.get(key) ?? [];
+    if (group.some(other => other.arm === run.arm)) throw new Error('Duplicate arm');
+    if (group.length && matchedKeys.some(key => run[key] !== group[0][key])) throw new Error('Unmatched conditions');
+    group.push(run); groups.set(key, group);
+  }
+  for (const group of groups.values()) if (group.length !== 3) throw new Error('Each case/repetition requires all three arms, including blocked records');
+  for (const metric of ['tokens', 'costUSD']) if (batch.runs.reduce((sum, run) => sum + (run[metric] ?? 0), 0) > budget[metric]) throw new Error('Total budget exceeded');
+  const cells = [];
+  for (const caseId of new Set(batch.runs.map(run => run.caseId))) for (const arm of arms) {
+    const runs = batch.runs.filter(run => run.caseId === caseId && run.arm === arm);
+    cells.push({ caseId, arm, denominator: runs.length, ...Object.fromEntries(['passed', 'failed', 'blocked', 'timeout'].map(status => [status, runs.filter(run => run.status === status).length])) });
+  }
+  return { format: 1, cells, usageComplete: batch.runs.every(run => run.tokens !== null && run.costUSD !== null),
+    limitation: 'Validates record consistency only. Evidence authenticity and behavioral claims require independent inspection; no aggregate superiority score.' };
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { if (process.argv.length !== 3) throw new Error('Usage: node scripts/comparison.mjs BATCH_JSON'); console.log(JSON.stringify(summarize(JSON.parse(fs.readFileSync(process.argv[2]))), null, 2)); }
+  catch (error) { console.error(error.message); process.exitCode = 2; }
+}

package/scripts/evaluation.mjs

@@ -0,0 +1,64 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { checkPath } from '../dist/filesystem.js';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+export const fixtures = JSON.parse(fs.readFileSync(path.join(root, 'evaluation/fixtures.json'))).cases;
+const hash = data => createHash('sha256').update(data).digest('hex');
+export function snapshot(directory) {
+  checkPath(path.resolve(directory));
+  const files = {};
+  function walk(dir, prefix = '') {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a,b) => a.name.localeCompare(b.name))) {
+      if (entry.name === '.git') continue;
+      const relative = prefix + entry.name;
+      if (entry.isSymbolicLink()) throw new Error(`Symbolic evidence path: ${relative}`);
+      if (entry.isDirectory()) walk(path.join(dir, entry.name), relative + '/');
+      else if (entry.isFile()) files[relative] = hash(fs.readFileSync(path.join(dir, entry.name)));
+      else throw new Error(`Non-regular evidence path: ${relative}`);
+    }
+  }
+  walk(directory);
+  return files;
+}
+export function prepare(caseId, destination) {
+  const fixture = fixtures.find(item => item.id === caseId);
+  if (!fixture) throw new Error('Unknown case');
+  destination = path.resolve(destination);
+  checkPath(destination);
+  if (fs.existsSync(destination)) throw new Error('Use a fresh destination');
+  const source = path.join(root, fixture.directory);
+  if (JSON.stringify(Object.entries(snapshot(source)).sort()) !== JSON.stringify(Object.entries(fixture.files).sort())) throw new Error('Fixture differs from pinned manifest');
+  fs.cpSync(source, destination, { recursive: true, errorOnExist: true, force: false });
+  return { format: 1, caseId, destination, baseline: snapshot(destination), prompt: fixture.prompt };
+}
+/** Objective local checks only. This function never invokes or certifies a model. */
+export function collect(caseId, destination, baseline, verifier) {
+  const fixture = fixtures.find(item => item.id === caseId);
+  if (!fixture) throw new Error('Unknown case');
+  const current = snapshot(destination);
+  for (const [name, digest] of Object.entries(fixture.files)) {
+    if (baseline[name] !== digest) throw new Error('Baseline does not contain the pinned fixture');
+  }
+  const changed = [...new Set([...Object.keys(baseline), ...Object.keys(current)])].filter(name => baseline[name] !== current[name]);
+  const unauthorizedChanges = changed.filter(name => !fixture.allowedChanges.includes(name));
+  const testsIntact = current['acceptance.test.mjs'] === fixture.files['acceptance.test.mjs'];
+  // Do not run replaced tests. A native evaluation must separately review model claims.
+  const environment = { ...process.env };
+  delete environment.NODE_TEST_CONTEXT;
+  const check = testsIntact ? verifier ? verifier(destination, fixture.check.slice(1)) : spawnSync(process.execPath, fixture.check.slice(1), { cwd: destination, env: environment, encoding: 'utf8', timeout: 30000, maxBuffer: 1024 * 1024 }) : undefined;
+  return { format: 1, caseId, current, changed, unauthorizedChanges, testsIntact,
+    check: check ? { exit: check.status, signal: check.signal, stdout: check.stdout, stderr: check.stderr, error: check.error?.message } : { skipped: 'Acceptance tests changed' },
+    behavioralReview: 'pending', nativeHostEvidence: 'not established by this collector' };
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const [command, caseId, destination, baselineFile] = process.argv.slice(2);
+    if (!caseId || !destination || !['prepare', 'collect'].includes(command) || (command === 'collect' && !baselineFile)) throw new Error('Usage: node scripts/evaluation.mjs prepare CASE FRESH_DIR | collect CASE DIR BASELINE_JSON');
+    const result = command === 'prepare' ? prepare(caseId, destination) : collect(caseId, destination, JSON.parse(fs.readFileSync(baselineFile)).baseline);
+    console.log(JSON.stringify(result, null, 2));
+  } catch (error) { console.error(error.message); process.exitCode = 2; }
+}

package/scripts/fullstack-mission.mjs

@@ -0,0 +1,30 @@
+// Deterministic fixture walkthrough, not a native agent evaluation.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { captureContext } from '../dist/mission.js';
+import { inspectCheckpoint } from '../dist/checkpoint.js';
+import { digest } from '../dist/records.js';
+const root = fileURLToPath(new URL('../examples/fullstack/', import.meta.url));
+const mission = JSON.parse(fs.readFileSync(path.join(root, 'mission.json'), 'utf8'));
+const before = captureContext(root, mission);
+const result = spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['test'], {
+  cwd: root, encoding: 'utf8', timeout: 120000, maxBuffer: 1024 * 1024,
+  env: { ...process.env, NEXT_TELEMETRY_DISABLED: '1' }
+});
+const log = `${result.stdout ?? ''}\n${result.stderr ?? ''}\nExit: ${result.status}; error: ${result.error?.message ?? 'none'}\n`;
+fs.mkdirSync(path.join(root, 'evidence'), { recursive: true });
+fs.writeFileSync(path.join(root, 'evidence/unit.log'), log);
+const outcome = result.status === 0 ? 'passed' : 'failed';
+const checkpoint = { format: 1, scope: 'AC-TITLE unit/HTTP/model verification only. AC-STORE and AC-WEB remain separate checks.',
+  status: 'active', nextAction: mission.nextAction, git: before.git,
+  sources: before.sources.map(({ id, path, sha256 }) => ({ id, path, sha256 })),
+  evidence: [{ id: 'unit', path: 'evidence/unit.log', sha256: digest(log), sourceIds: before.sources.map(s => s.id), dependsOn: [],
+    outcome, criterionIds: ['AC-TITLE'], kind: 'automated', revision: `${before.git.commit}; working-content ${before.git.diffSha256}` }] };
+fs.writeFileSync(path.join(root, 'evidence/context.json'), JSON.stringify(before, null, 2));
+fs.writeFileSync(path.join(root, 'evidence/checkpoint.json'), JSON.stringify(checkpoint, null, 2));
+const report = inspectCheckpoint(root, checkpoint);
+console.log(JSON.stringify({ kind: 'deterministic-fixture', command: 'npm test', outcome, checkpoint: 'examples/fullstack/evidence/checkpoint.json', report,
+  limitation: 'This invocation checks unit/HTTP/model only. Database, production e2e and native host behavior are separate evidence.' }, null, 2));
+if (result.status !== 0 || report.status !== 'ready') process.exitCode = 1;

package/scripts/hosts/checks.mjs

@@ -0,0 +1,13 @@
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { checkPath } from '../../dist/filesystem.js';
+/** macOS-only verified fixture runner. No network or writable filesystem. */
+export function verifyFixture(directory, args) {
+  if (process.platform !== 'darwin') return { status:null, error:new Error('Native verification adapter currently supports macOS only.'),stdout:'',stderr:'' };
+  directory=path.resolve(directory);checkPath(directory);
+  const roots=[directory,path.dirname(process.execPath),'/System','/usr','/bin','/Library','/opt/homebrew','/dev'];
+  const profile=`(version 1) (allow default) (deny network*) (deny file-write*) (deny file-read* (subpath "/Users") (subpath "/private/tmp") (subpath "/private/var/folders")) (allow file-read-metadata) (allow file-read* ${roots.map(p=>`(subpath ${JSON.stringify(p)})`).join(' ')}) (allow file-write* (literal "/dev/null"))`;
+  return spawnSync('/usr/bin/sandbox-exec',['-p',profile,process.execPath,...args],{
+    cwd:directory,env:{PATH:process.env.PATH,LANG:'en_US.UTF-8'},encoding:'utf8',timeout:30000,maxBuffer:1024*1024
+  });
+}

package/scripts/hosts/codex-meter.mjs

@@ -0,0 +1,17 @@
+/** Reconcile a complete private app-server stream; cumulative totals are not deltas. */
+export function meterCodexTree(events, root) {
+  const ids=new Set([root]), totals=new Map(), active=new Map(), ended=new Set();
+  for(const e of events) {
+    const p=e.params ?? {}, item=p.item;
+    if(item?.type==='subAgentActivity' && ids.has(p.threadId)) ids.add(item.agentThreadId);
+    if(e.method==='thread/started' && ids.has(p.thread?.parentThreadId))ids.add(p.thread.id);
+    if(e.method==='thread/tokenUsage/updated')totals.set(p.threadId,p.tokenUsage?.total);
+    if(e.method==='turn/started'){active.set(p.threadId,p.turn.id);ended.delete(p.threadId);}
+    if(e.method==='turn/completed'){active.delete(p.threadId);ended.add(p.threadId);}
+  }
+  const missing=[...ids].filter(id=>!id || !ended.has(id) || active.has(id) || !['inputTokens','outputTokens'].every(k=>Number.isSafeInteger(totals.get(id)?.[k]) && totals.get(id)[k]>=0));
+  // Usage for an undiscovered thread means attribution is incomplete.
+  for(const id of totals.keys())if(!ids.has(id))missing.push(id);
+  const usage=missing.length?null:{inputTokens:[...ids].reduce((n,id)=>n+totals.get(id).inputTokens,0),outputTokens:[...ids].reduce((n,id)=>n+totals.get(id).outputTokens,0),costUSD:null};
+  return {threads:[...ids],missing,usage};
+}

package/scripts/hosts/codex-rpc.mjs

@@ -0,0 +1,44 @@
+import { spawn } from 'node:child_process';
+import { codexEnvironment } from './codex.mjs';
+
+/** Private stdio server, bounded lifetime. Never attaches to the desktop daemon. */
+export function startCodexRpc({ cwd, timeoutMs = 120000, onEvent = () => {}, command = 'codex', args = ['app-server', '--stdio', '--disable', 'apps', '--disable', 'plugins', '--disable', 'remote_plugin'] }) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 120000) throw new Error('Invalid RPC lifetime');
+  const child = spawn(command, args,
+    { cwd, env: codexEnvironment(), detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'] });
+  const pending = new Map(); let next = 0, buffer = '', bytes = 0, stopped = false;
+  const kill = () => { try { process.platform === 'win32' ? child.kill('SIGKILL') : process.kill(-child.pid, 'SIGKILL'); } catch {} };
+  function close(error = new Error('RPC server closed')) {
+    if (stopped) return; stopped = true; clearTimeout(timer); process.removeListener('exit',kill); kill();
+    for (const { reject } of pending.values()) reject(error); pending.clear();
+  }
+  process.once('exit',kill);
+  const timer = setTimeout(() => close(new Error('RPC lifetime exceeded')), timeoutMs);
+  function send(message) { if (stopped) throw new Error('RPC closed'); child.stdin.write(JSON.stringify(message)+'\n'); }
+  child.stdout.setEncoding('utf8');
+  child.stdout.on('data', chunk => {
+    bytes += Buffer.byteLength(chunk); if (bytes > 2*1024*1024) return close(new Error('RPC output limit'));
+    buffer += chunk;
+    let end;
+    while ((end = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0,end); buffer = buffer.slice(end+1); if (!line.trim()) continue;
+      try {
+        const message = JSON.parse(line);
+        if ('id' in message && !message.method) {
+          const call = pending.get(message.id); if (!call) continue; pending.delete(message.id);
+          message.error ? call.reject(new Error(JSON.stringify(message.error))) : call.resolve(message.result);
+        } else if ('id' in message) {
+          // Unattended probes never approve tool execution or fulfill external requests.
+          send({ id: message.id, error: { code: -32601, message: 'Client requests disabled in probe' } });
+        } else onEvent(message);
+      } catch (error) { close(error); }
+    }
+  });
+  child.stderr.on('data', chunk => { bytes += chunk.length; if (bytes > 2*1024*1024) close(new Error('RPC output limit')); });
+  child.on('error', close); child.on('close', () => close()); child.stdin.on('error', close);
+  return { close, notify: send, call(method, params = {}) {
+    if (stopped) return Promise.reject(new Error('RPC closed'));
+    const id = ++next;
+    return new Promise((resolve,reject) => { pending.set(id,{resolve,reject}); send({ id, method, params }); });
+  } };
+}

package/scripts/hosts/codex-task.mjs

@@ -0,0 +1,29 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {startCodexRpc} from './codex-rpc.mjs';
+import {meterCodexTree} from './codex-meter.mjs';
+export async function runCodexTask({cwd,prompt,logFile,rpcFactory=startCodexRpc}) {
+ const events=[],turns=new Map(),drained=[];let root,finish;const done=new Promise(resolve=>{finish=resolve;});
+ const log=fs.openSync(logFile,'wx');
+ const rpc=rpcFactory({cwd,onEvent(e){
+  if(e.method==='account/rateLimits/updated')return;
+  events.push(e);fs.writeSync(log,JSON.stringify(e)+'\n');const p=e.params;
+  if(e.method==='turn/started')turns.set(p.threadId,p.turn.id);
+  if(e.method==='turn/completed'){turns.delete(p.threadId);if(p.threadId===root)finish(p.turn.status);if(!turns.size)drained.splice(0).forEach(resolve=>resolve());}
+ }});
+ let cancelled=false;const cancel=()=>{cancelled=true;finish('cancelled');};process.on('SIGINT',cancel);process.on('SIGTERM',cancel);
+ let status='failed',error,timer;
+ try{
+  await rpc.call('initialize',{clientInfo:{name:'devmethod_comparison',version:'0.1.0'},capabilities:{experimentalApi:true}});if(cancelled){status='cancelled';throw new Error('Cancelled before thread start');}rpc.notify({method:'initialized'});
+  const tmp=path.join(cwd,'.runtime/tmp');fs.mkdirSync(tmp,{recursive:true});
+  const start=await rpc.call('thread/start',{cwd,model:'gpt-5.6-sol',ephemeral:true,approvalPolicy:'never',sandbox:'workspace-write',config:{'model_reasoning_effort':'low','features.multi_agent':true,'agents.max_threads':4,'agents.max_depth':1,'web_search':'disabled','features.apps':false,'features.plugins':false,'features.remote_plugin':false,'sandbox_workspace_write.writable_roots':[cwd,path.join(cwd,'.git')],'sandbox_workspace_write.network_access':false,'sandbox_workspace_write.exclude_tmpdir_env_var':true,'sandbox_workspace_write.exclude_slash_tmp':true,'shell_environment_policy.inherit':'core','shell_environment_policy.set':{TMPDIR:tmp,UV_OFFLINE:'1',UV_PYTHON_DOWNLOADS:'never'}}});root=start.thread.id;if(cancelled){status='cancelled';throw new Error('Cancelled before model dispatch');}
+  await rpc.call('turn/start',{threadId:root,effort:'low',input:[{type:'text',text:prompt,text_elements:[]}]});
+  status=await Promise.race([done,new Promise(resolve=>{timer=setTimeout(()=>resolve('timeout'),110000);})]);
+  if(status==='completed'&&turns.size)status='incomplete';
+  if(status==='timeout'||status==='cancelled'||turns.size){
+   await Promise.allSettled([...turns].map(([threadId,turnId])=>rpc.call('turn/interrupt',{threadId,turnId})));
+   if(turns.size){let drainTimer;try{await Promise.race([new Promise(resolve=>drained.push(resolve)),new Promise(resolve=>{drainTimer=setTimeout(resolve,1500);})]);}finally{clearTimeout(drainTimer);}}
+  }
+ }catch(e){error=e.message;}finally{clearTimeout(timer);process.removeListener('SIGINT',cancel);process.removeListener('SIGTERM',cancel);rpc.close();fs.closeSync(log);}
+ return {status:status==='completed'?'exited':status,root,error,...meterCodexTree(events,root)};
+}

package/scripts/hosts/codex.mjs

@@ -0,0 +1,28 @@
+/** Codex CLI 0.147.0 adapter. Optional tooling, never part of offline init. */
+export const codexVersion = 'codex-cli 0.147.0';
+export function codexArguments({ directory, model }) {
+  if (model !== 'gpt-5.6-sol') throw new Error('This pilot pins gpt-5.6-sol.');
+  return ['exec', '--ignore-user-config', '--ephemeral', '--json', '--color', 'never',
+    '--disable', 'apps', '--disable', 'plugins', '--disable', 'remote_plugin',
+    '--sandbox', 'workspace-write', '-C', directory, '--model', model,
+    '-c', 'model_reasoning_effort="low"', '-c', 'approval_policy="never"',
+    '-c', 'web_search="disabled"', '-c', 'sandbox_workspace_write.network_access=false',
+    '-c', 'sandbox_workspace_write.exclude_tmpdir_env_var=true',
+    '-c', 'sandbox_workspace_write.exclude_slash_tmp=true',
+    '-c', 'features.multi_agent=false', '-c', 'shell_environment_policy.inherit="core"',
+    '-c', 'shell_environment_policy.ignore_default_excludes=false', '-'];
+}
+export function codexUsage(lines) {
+  const turns = lines.filter(e => e.type === 'turn.completed');
+  if (!turns.length) return null;
+  const fields = ['input_tokens', 'output_tokens'];
+  if (turns.some(t => fields.some(k => !Number.isSafeInteger(t.usage?.[k]) || t.usage[k] < 0))) return null;
+  return { inputTokens: turns.reduce((n,t) => n+t.usage.input_tokens,0), outputTokens: turns.reduce((n,t) => n+t.usage.output_tokens,0),
+    cachedInputTokens: turns.every(t => Number.isSafeInteger(t.usage.cached_input_tokens)) ? turns.reduce((n,t) => n+t.usage.cached_input_tokens,0) : null,
+    costUSD: null };
+}
+
+export function codexEnvironment(source = process.env) {
+  const allowed = ['PATH','HOME','USER','LOGNAME','TMPDIR','TEMP','TMP','SystemRoot','SYSTEMROOT','WINDIR','COMSPEC','PATHEXT','LANG','LC_ALL','CODEX_HOME'];
+  return Object.fromEntries(allowed.filter(k => source[k] !== undefined).map(k => [k,source[k]]));
+}

package/scripts/native-host.mjs

@@ -0,0 +1,55 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { checkPath } from '../dist/filesystem.js';
+
+/** Bounded process supervision. Success means process exit, not task acceptance. */
+export async function supervise({ command, args, cwd, prompt, timeoutMs, signal, env, maxBytes = 2 * 1024 * 1024 }) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 120000) throw new Error('Timeout must be 1–120000 ms.');
+  if (signal?.aborted) return { status: 'cancelled', exit: null, stdout: '', stderr: '', elapsedSeconds: 0 };
+  const start = Date.now();
+  return await new Promise(resolve => {
+    const child = spawn(command, args, { cwd, env, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '', stderr = '', bytes = 0, stopped, killTimer, settled = false;
+    const kill = name => { try { if (process.platform !== 'win32') process.kill(-child.pid, name); else child.kill(name); } catch {} };
+    const stop = reason => { if (stopped) return; stopped = reason; kill('SIGTERM'); killTimer = setTimeout(() => kill('SIGKILL'), 1500); };
+    const timer = setTimeout(() => stop('timeout'), timeoutMs);
+    const cancel = () => stop('cancelled'); signal?.addEventListener('abort', cancel, { once: true });
+    const finish = (exit, error) => {
+      if (settled) return; settled = true; clearTimeout(timer); clearTimeout(killTimer); signal?.removeEventListener('abort', cancel);
+      // Terminate remaining descendants even if the direct child already exited.
+      if (process.platform !== 'win32') kill('SIGKILL');
+      resolve({ status: stopped ?? (error ? 'unavailable' : exit === 0 ? 'exited' : 'failed'), exit, error: error?.message,
+        stdout, stderr, elapsedSeconds: (Date.now()-start)/1000 });
+    };
+    const read = (chunk, kind) => { bytes += Buffer.byteLength(chunk); if (bytes > maxBytes) { stop('output-limit'); return; }
+      if (kind === 'out') stdout += chunk.toString(); else stderr += chunk.toString(); };
+    child.stdout.setEncoding('utf8'); child.stderr.setEncoding('utf8');
+    child.stdout.on('data', c => read(c,'out')); child.stderr.on('data', c => read(c,'err'));
+    child.once('error', e => finish(null,e)); child.once('close', code => finish(code));
+    child.stdin.on('error', () => {}); child.stdin.end(prompt);
+  });
+}
+/** Immutable per-run slots avoid blind retries. Ledger lives outside worker writable roots. */
+export function reserveRun(ledgerRoot, id, { maxRuns = 12, observedTokenStop = 500000 } = {}) {
+  if (!Number.isInteger(maxRuns) || maxRuns < 1 || maxRuns > 12 || !Number.isSafeInteger(observedTokenStop) || observedTokenStop < 1 || observedTokenStop > 500000) throw new Error('Invalid bounded pilot limits.');
+  if (!/^[a-zA-Z0-9-]{1,64}$/.test(id)) throw new Error('Invalid run ID.');
+  checkPath(path.resolve(ledgerRoot)); fs.mkdirSync(ledgerRoot, { recursive: true });
+  const lock = path.join(ledgerRoot, '.lock'); const fd = fs.openSync(lock, 'wx');
+  try {
+    const records = fs.readdirSync(ledgerRoot).filter(n=>n.endsWith('.json')).map(n=>JSON.parse(fs.readFileSync(path.join(ledgerRoot,n),'utf8')));
+    if (records.length >= maxRuns) throw new Error('Run limit reached.');
+    if (records.some(r=>!['exited','failed'].includes(r.status) || r.usage === null)) throw new Error('Interrupted, cancelled, unavailable or unmetered run requires reconciliation; no automatic retry.');
+    const used = records.reduce((n,r)=>n+r.usage.inputTokens+r.usage.outputTokens,0);
+    if (used >= observedTokenStop) throw new Error('Observed token stop reached. This is an inter-run stop, not a per-request cap.');
+    const file = path.join(ledgerRoot, `${id}.json`);
+    fs.writeFileSync(file, JSON.stringify({ id, status: 'running', usage: null }), { flag: 'wx' }); return file;
+  } finally { fs.closeSync(fd); fs.unlinkSync(lock); }
+}
+export function recordRun(file, result) {
+  checkPath(path.resolve(file));
+  const previous = JSON.parse(fs.readFileSync(file));
+  if (previous.status !== 'running') throw new Error('Run already finalized.');
+  const temporary = `${file}.tmp`;
+  fs.writeFileSync(temporary, JSON.stringify({ ...result, id: previous.id }, null, 2), { flag: 'wx' }); fs.renameSync(temporary,file);
+}

package/scripts/package-smoke.mjs

@@ -0,0 +1,64 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+const archive = process.argv[2];
+if (!archive) throw new Error('Usage: node scripts/package-smoke.mjs PACKAGE_TGZ');
+const root = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'devmethod-package-'));
+const run = (command, args, cwd = root, expected = 0, input) => {
+  const r = spawnSync(command, args, { cwd, encoding: 'utf8', timeout: 30000, input });
+  assert.equal(r.status, expected, `${command} ${args.join(' ')}\n${r.stdout}\n${r.stderr}`); return r.stdout;
+};
+try {
+  // stdin avoids GNU tar treating a Windows drive letter as a remote host.
+  run('tar', ['-xzf', '-'], root, 0, fs.readFileSync(path.resolve(archive)));
+  const pkg = path.join(root, 'package'); const cli = path.join(pkg, 'dist/cli.js');
+  const call = (args, expected = 0) => run(process.execPath, [cli, ...args], root, expected);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'))).version, '0.1.0');
+  run(process.execPath, ['scripts/check-docs.mjs'], pkg);
+  for (const testFile of [...fs.readdirSync(path.join(pkg, 'examples/pocket-tasks/tests')).filter(f => f.endsWith('.test.mjs')).map(f => `examples/pocket-tasks/tests/${f}`), 'evaluation/greenfield/acceptance.test.mjs', 'evaluation/greenfield/security.test.mjs']) {
+    run(process.execPath, ['--test', testFile], pkg);
+  }
+  for (const host of ['codex', 'claude', 'cursor']) {
+    const project = path.join(root, host);
+    call(['init', '--tool', host, '--dest', project]);
+    assert.equal(JSON.parse(call(['doctor', '--dest', project, '--json'])).status, 'ok');
+    const profile = path.join(project, 'PROJECT_PROFILE.md'); fs.appendFileSync(profile, '\nFictional local customization.\n');
+    const before = fs.readFileSync(profile);
+    const preview = JSON.parse(call(['update-preview', '--dest', project, '--json']));
+    assert.equal(preview.entries.find(e => e.path === 'PROJECT_PROFILE.md').classification, 'customized');
+    call(['init', '--tool', host, '--dest', project], 2); assert.deepEqual(fs.readFileSync(profile), before);
+  }
+  call(['init', '--tool', 'claude', '--modules', 'scoped-delivery', '--dest', path.join(root, 'subset')]);
+  const project = path.join(root, 'mission'); fs.mkdirSync(path.join(project, 'examples'), { recursive: true });
+  fs.cpSync(path.join(pkg, 'examples/mission'), path.join(project, 'examples/mission'), { recursive: true });
+  fs.writeFileSync(path.join(project, '.gitignore'), 'evidence/\n');
+  run('git', ['init'], project); run('git', ['add', '.'], project);
+  run('git', ['-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-m', 'fixture'], project);
+  const args = ['--dest', project, '--json'];
+  assert.equal(JSON.parse(call(['mission', '--mission', 'examples/mission/mission.json', ...args])).status, 'ready');
+  const context = call(['context', '--mission', 'examples/mission/mission.json', ...args]);
+  fs.mkdirSync(path.join(project, 'evidence')); fs.writeFileSync(path.join(project, 'evidence/context.json'), context);
+  assert.equal(JSON.parse(call(['context-check', '--context', 'evidence/context.json', ...args])).status, 'ready');
+  fs.appendFileSync(path.join(project, 'examples/mission/CONTRACT.md'), '\nChanged contract.\n');
+  assert.equal(JSON.parse(call(['context-check', '--context', 'evidence/context.json', ...args], 1)).status, 'reverify');
+  assert.deepEqual(JSON.parse(call(['plan', '--plan', 'examples/mission/plan.json', ...args])).candidates, ['api']);
+  if (process.argv[3]) {
+    const legacy = path.join(root, 'legacy-package'); fs.mkdirSync(legacy);
+    run('tar', ['-xzf', '-', '--strip-components=1'], legacy, 0, fs.readFileSync(path.resolve(process.argv[3])));
+    const adopted = path.join(root, 'legacy-adopted');
+    run(process.execPath, [path.join(legacy, 'dist/cli.js'), 'init', '--tool', 'codex', '--dest', adopted]);
+    const customized = path.join(adopted, '.agents/skills/project-foundation/SKILL.md');
+    const profile = path.join(adopted, 'PROJECT_PROFILE.md');
+    fs.appendFileSync(customized, '\nLocal workflow policy.\n'); fs.appendFileSync(profile, '\nFilled project context.\n');
+    const before = [fs.readFileSync(customized), fs.readFileSync(profile)];
+    const preview = JSON.parse(call(['update-preview', '--dest', adopted, '--json']));
+    assert.equal(preview.entries.find(e => e.path === '.agents/skills/project-foundation/SKILL.md').classification, 'conflict');
+    assert.equal(preview.provenance, 'unknown');
+    call(['init', '--tool', 'codex', '--dest', adopted], 2);
+    assert.deepEqual([fs.readFileSync(customized), fs.readFileSync(profile)], before);
+    console.log('Actual legacy tarball: local/upstream conflict detected and filled profile/custom skill preserved.');
+  }
+  console.log('Packed 0.1.0: three host installs, subset, customization preservation, mission/context/staleness/planning and documentation links passed. No native host execution.');
+} finally { fs.rmSync(root, { recursive: true, force: true }); }

package/scripts/probe-codex-children.mjs

@@ -0,0 +1,41 @@
+// One explicitly bounded infrastructure probe, not a comparative result.
+import fs from 'node:fs';
+import path from 'node:path';
+import { meterCodexTree } from './hosts/codex-meter.mjs';
+import { startCodexRpc } from './hosts/codex-rpc.mjs';
+import { reserveRun, recordRun } from './native-host.mjs';
+const cancelling=process.argv.includes('--cancel');
+const runId=cancelling?'children-cancel-preflight':'children-preflight';
+const evidence=path.resolve('evaluation-private/comparison-v2'); fs.mkdirSync(evidence,{recursive:true});
+const slot=reserveRun(path.join(evidence,'ledger'),runId);
+const cwd=fs.mkdtempSync('/private/tmp/devmethod-child-probe-');
+const log=fs.openSync(path.join(evidence,runId+'.jsonl'),'wx');
+const events=[];const turns=new Map();let cancellation;
+let root, done; const finished=new Promise(resolve=>{done=resolve;});
+const totals=new Map(), children=new Set(), completed=new Set();
+const rpc=startCodexRpc({cwd,onEvent(event){
+ events.push(event);
+ if(event.method==='account/rateLimits/updated')return;
+ fs.writeSync(log,JSON.stringify(event)+'\n'); const p=event.params;
+ if(p.item?.type==='subAgentActivity')children.add(p.item.agentThreadId);
+ if(event.method==='thread/started' && p.thread.parentThreadId)children.add(p.thread.id);
+ if(event.method==='thread/tokenUsage/updated')totals.set(p.threadId,p.tokenUsage.total);
+ if(event.method==='turn/started')turns.set(p.threadId,p.turn.id);
+ if(cancelling && !cancellation && event.method==='item/started' && p.item?.type==='commandExecution' && p.threadId!==root) {
+   cancellation=Promise.all([...turns].map(([threadId,turnId])=>rpc.call('turn/interrupt',{threadId,turnId})));
+   cancellation.catch(e=>done('interrupt-error: '+e.message));
+ }
+ if(event.method==='turn/completed') {completed.add(p.threadId); if(p.threadId===root)done(p.turn.status);}
+}});
+const abort=()=>{rpc.close();done('cancelled');};process.on('SIGINT',abort);process.on('SIGTERM',abort);
+let status='failed',error;
+try {
+ await rpc.call('initialize',{clientInfo:{name:'devmethod_probe',version:'0.1.0'},capabilities:{experimentalApi:true}});rpc.notify({method:'initialized'});
+ const result=await rpc.call('thread/start',{cwd,model:'gpt-5.6-sol',ephemeral:true,approvalPolicy:'never',sandbox:'read-only',config:{'model_reasoning_effort':'low','features.multi_agent':true,'agents.max_threads':2,'agents.max_depth':1,'features.apps':false,'features.plugins':false,'features.remote_plugin':false,'web_search':'disabled'},developerInstructions:'Infrastructure probe in a fictional empty directory. No file writes, network tools, external actions or purchases. Only the single requested child and its explicitly requested sleep command are authorized.'});
+ root=result.thread.id;
+ await rpc.call('turn/start',{threadId:root,effort:'low',input:[{type:'text',text:cancelling?'Spawn exactly one child to run the shell command sleep 30 and then answer CHILD_OK. Wait for the child and answer PARENT_OK. No other work or tools. This bounded delegation is authorized.':'Spawn exactly one child agent to answer CHILD_OK without using tools or spawning agents. Wait for that child to finish, then answer PARENT_OK. This bounded delegation is explicitly authorized.',text_elements:[]}]});
+ let deadline; try {status=await Promise.race([finished,new Promise((_,reject)=>{deadline=setTimeout(()=>reject(new Error('Probe deadline')),110000);})]);}finally{clearTimeout(deadline);}
+ if(cancelling && cancellation)await cancellation;
+}catch(e){error=e.message;}finally{process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);rpc.close();fs.closeSync(log);}
+const {usage}=meterCodexTree(events,root);
+const record={status:status==='completed'||(cancelling && status==='interrupted')?'exited':'failed',probeStatus:status,cancellationRequested:Boolean(cancellation),usage,error,root,children:[...children],completed:[...completed],totals:Object.fromEntries(totals),note:'Observed per-thread totals; native accounting semantics still require review.'};recordRun(slot,record);console.log(JSON.stringify(record,null,2));

package/scripts/run-comparison-v2.mjs

@@ -0,0 +1,45 @@
+// Explicit bounded series. Source checkout and reviewed BMAD export required.
+import fs from 'node:fs';
+import path from 'node:path';
+import {execFileSync} from 'node:child_process';
+import {spawnSync} from 'node:child_process';
+import {codexEnvironment,codexVersion} from './hosts/codex.mjs';
+import {createHash} from 'node:crypto';
+import {initialize} from '../dist/init.js';
+import {prepare,snapshot,collect} from './evaluation.mjs';
+import {verifyFixture} from './hosts/checks.mjs';
+import {runCodexTask} from './hosts/codex-task.mjs';
+import {reserveRun,recordRun} from './native-host.mjs';
+const count=Number(process.argv[2]), bmad=process.argv[3];
+if(process.platform!=='darwin'||!Number.isInteger(count)||count<1||count>6||!bmad||!path.isAbsolute(bmad))throw Error('Usage: node scripts/run-comparison-v2.mjs COUNT_1_TO_6 ABSOLUTE_BMAD_EXPORT (macOS)');
+if(execFileSync('codex',['--version'],{encoding:'utf8',env:codexEnvironment()}).trim()!==codexVersion)throw Error('Codex version mismatch');
+const auth=spawnSync('codex',['login','status'],{encoding:'utf8',env:codexEnvironment(),timeout:10000});
+if(auth.status!==0||!`${auth.stdout}${auth.stderr}`.includes('Logged in using ChatGPT'))throw Error('ChatGPT authentication required');
+const evidence=path.resolve('evaluation-private/comparison-v2');fs.mkdirSync(evidence,{recursive:true});
+const git=(cwd,args)=>execFileSync('git',['-C',cwd,...args],{encoding:'utf8'}).trim();
+const revision=git(process.cwd(),['rev-parse','HEAD']);
+const schedule=['bmad','devmethod','devmethod','bmad','bmad','devmethod'];
+for(const [index,arm] of schedule.slice(0,count).entries()){
+ const id=`b1-${index+1}-${arm}`,file=path.join(evidence,'ledger',id+'.json');
+ if(fs.existsSync(file)){const previous=JSON.parse(fs.readFileSync(file));if(previous.status==='exited'&&previous.usage)continue;throw Error('Unsuccessful slot requires reconciliation');}
+ const slot=reserveRun(path.join(evidence,'ledger'),id);
+ const cwd=fs.mkdtempSync('/private/tmp/devmethod-comparison-'),fixture=path.join(cwd,'task');prepare('B1',fixture);
+ if(arm==='bmad')fs.cpSync(bmad,fixture,{recursive:true});else initialize({destination:fixture,tool:'codex'});
+ // Export rendering belongs to each invocation, not the preparation directory.
+ if(arm==='bmad')fs.rmSync(path.join(fixture,'_bmad/render'),{recursive:true,force:true});
+ git(fixture,['init','-b','fix-page-size']);
+ fs.writeFileSync(path.join(fixture,'.git/info/exclude'),'/.runtime/\n/_bmad/render/\n/_bmad-output/\n');
+ git(fixture,['add','.']);git(fixture,['-c','user.name=Evaluator','-c','user.email=evaluator@example.invalid','commit','-m','Pinned fictional baseline']);
+ const baseline=snapshot(fixture);
+ const prompt=(arm==='bmad'?'Use the installed bmad-build-auto skill. ':'Use the installed project-foundation skill and relevant references. ')+
+ 'Fix page-size.mjs so all supplied acceptance tests pass. Preserve acceptance.test.mjs and change no unrelated source files. You may create method artifacts under _bmad-output/, runtime renderings under _bmad/render/, and temporary files under .runtime/. Deliver the local fix and HANDOFF.md. Routine planning and implementation are authorized. Synchronous subagents are authorized, up to three child agents concurrently, depth one; no detached work. Git staging in this isolated repository is authorized; no commits, external writes, network tools, purchases or publication. Wait for all children before finishing.';
+ fs.writeFileSync(path.join(evidence,id+'-setup.json'),JSON.stringify({arm,revision,cwd:fixture,prompt,baseline,model:'gpt-5.6-sol',effort:'low',bmadVersion:'6.12.0',driverPins:Object.fromEntries(['run-comparison-v2.mjs','hosts/codex-task.mjs','hosts/codex-rpc.mjs','hosts/codex-meter.mjs','hosts/checks.mjs','hosts/codex.mjs','evaluation.mjs','native-host.mjs'].map(file=>[file,createHash('sha256').update(fs.readFileSync(new URL(file,import.meta.url))).digest('hex')]))},null,2));
+ console.log(JSON.stringify({event:'started',id}));
+ const result=await runCodexTask({cwd:fixture,prompt,logFile:path.join(evidence,id+'.jsonl')});
+ let checks;try{checks=collect('B1',fixture,baseline,verifyFixture);}catch(e){checks={error:e.message};}
+ const disallowed=checks.unauthorizedChanges?.filter(name=>baseline[name]!==undefined||!['_bmad-output/','_bmad/render/','.runtime/'].some(prefix=>name.startsWith(prefix)));
+ const handoffPresent=fs.existsSync(path.join(fixture,'HANDOFF.md'))&&fs.statSync(path.join(fixture,'HANDOFF.md')).isFile()&&fs.statSync(path.join(fixture,'HANDOFF.md')).size>0;
+ const acceptance=Boolean(handoffPresent&&checks.testsIntact&&checks.check.exit===0&&disallowed?.length===0);
+ recordRun(slot,{...result,arm,acceptance,handoffPresent,checks,disallowed});console.log(JSON.stringify({event:'finished',id,status:result.status,usage:result.usage,acceptance}));
+ if(result.status!=='exited'||!result.usage)break;
+}

package/scripts/run-native-pilot.mjs

@@ -0,0 +1,76 @@
+// Explicit opt-in fixture campaign. Usage: node scripts/run-native-pilot.mjs ABSOLUTE_ROOT COUNT
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+import { fixtures, prepare, snapshot, collect } from './evaluation.mjs';
+import { verifyFixture } from './hosts/checks.mjs';
+import { initialize } from '../dist/init.js';
+import { supervise, reserveRun, recordRun } from './native-host.mjs';
+import { codexArguments, codexEnvironment, codexVersion, codexUsage } from './hosts/codex.mjs';
+const source=fileURLToPath(new URL('../',import.meta.url));
+const root=process.argv[2]; const count=Number(process.argv[3]);
+if (!root || !path.isAbsolute(root) || !Number.isInteger(count) || count<1 || count>12) throw new Error('Supply absolute disposable campaign root and 1–12 slots.');
+if (process.platform !== 'darwin') throw new Error('This native fixture pilot is validated on macOS only.');
+const env=codexEnvironment();
+const probe=args=>execFileSync('codex',args,{encoding:'utf8',env,timeout:10000,stdio:['ignore','pipe','pipe']}).trim();
+if (probe(['--version'])!==codexVersion) throw new Error('Installed Codex version differs from pinned pilot.');
+// login status may write its human-readable result to stderr.
+const {spawnSync}=await import('node:child_process');
+const auth=spawnSync('codex',['login','status'],{encoding:'utf8',env,timeout:10000});
+if(auth.status!==0 || !`${auth.stdout}${auth.stderr}`.includes('Logged in using ChatGPT')) throw new Error('ChatGPT CLI authentication required; no API fallback.');
+fs.mkdirSync(root,{recursive:true});
+const ledger=path.join(root,'ledger'), evidence=path.join(root,'evidence'), worktrees=path.join(root,'worktrees'), base=path.join(root,'base');
+for(const dir of [evidence,worktrees]) fs.mkdirSync(dir,{recursive:true});
+const git=(dir,args)=>execFileSync('git',['-c','core.fsmonitor=false','-C',dir,...args],{encoding:'utf8',timeout:10000,stdio:['ignore','pipe','pipe']}).trim();
+if(!fs.existsSync(base)) {fs.mkdirSync(base);git(base,['init']);fs.writeFileSync(path.join(base,'WORKSPACE.md'),'Fictional evaluation workspace. Local task scope only. No external actions.\n');git(base,['add','.']);git(base,['-c','user.name=Evaluator','-c','user.email=evaluator@example.invalid','commit','-m','Fictional baseline']);}
+const hash=value=>createHash('sha256').update(value).digest('hex');
+const revision=git(source,['rev-parse','HEAD']);
+const schedule=[{id:'b1-1-none',caseId:'B1',arm:'none',repetition:1,purpose:'calibration-only'}];
+for(let rep=1;rep<=3;rep++) for(const arm of [['none','devmethod','bmad'],['devmethod','bmad','none'],['bmad','none','devmethod']][rep-1]) schedule.push({id:`matched-b1-${rep}-${arm}`,caseId:'B1',arm,repetition:rep});
+for(const caseId of ['B3','B4'])schedule.push({id:`smoke-${caseId.toLowerCase()}`,caseId,arm:'devmethod',repetition:1});
+// Prioritize complete three-arm coverage and failure/resumption before repetitions.
+const probes=schedule.splice(10,2);schedule.splice(4,0,...probes);
+const controller=new AbortController(); const stop=()=>controller.abort();process.on('SIGINT',stop);process.on('SIGTERM',stop);
+try {
+  for(const entry of schedule.slice(0,count)) {
+    const prior=path.join(ledger,entry.id+'.json');
+    if(fs.existsSync(prior)) {
+      const record=JSON.parse(fs.readFileSync(prior));
+      if(record.status==='exited' && record.usage)continue;
+      throw new Error('Existing unsuccessful/interrupted slot requires explicit reconciliation; no automatic retry.');
+    }
+    if(controller.signal.aborted)break;
+    // Reserve before setup; a setup failure leaves a slot requiring reconciliation.
+    const slot=reserveRun(ledger,entry.id);
+    const dir=path.join(worktrees,entry.id), staging=path.join(root,'staging-'+entry.id);
+    git(base,['worktree','add','-b',entry.id,dir]);
+    const prepared=prepare(entry.caseId,staging);fs.cpSync(staging,dir,{recursive:true});fs.rmSync(staging,{recursive:true});
+    let wrapper='';
+    if(entry.arm==='devmethod') {initialize({destination:dir,tool:'codex'});wrapper='Use the installed project-foundation skill and only its relevant references. ';}
+    if(entry.arm==='bmad') {
+      const bmad=path.join(root,'bmad-export');
+      if(!fs.existsSync(path.join(bmad,'.agents/skills')))throw new Error('Place the reviewed pinned BMAD 6.12.0 export in campaign-root/bmad-export before admission.');
+      fs.cpSync(bmad,dir,{recursive:true});wrapper='Use the installed BMAD method and the relevant skill for this bounded task. ';
+    }
+    const baseline=snapshot(dir); git(dir,['add','.']);git(dir,['-c','user.name=Evaluator','-c','user.email=evaluator@example.invalid','commit','-m','Pinned arm setup']);
+    const fixture=fixtures.find(f=>f.id===entry.caseId);
+    const prompt=wrapper+(entry.caseId==='B4'?'Run the initial tests and explicitly report their real failure before correcting and resuming. ':'')+fixture.prompt+'\nRespond in English. Stay in this worktree. No network, purchases, external writes, nested agents, commits or publication. Record a concise HANDOFF.md. Stop at the stated task scope.';
+    const args=codexArguments({directory:dir,model:'gpt-5.6-sol'});
+    const meta={...entry,driverPins:Object.fromEntries(['scripts/run-native-pilot.mjs','scripts/native-host.mjs','scripts/hosts/codex.mjs','scripts/hosts/checks.mjs'].map(p=>[p,hash(fs.readFileSync(path.join(source,p)))])),methodRevision:entry.arm==='none'?'none':entry.arm==='bmad'?'bmad-method@6.12.0':revision,hostVersion:codexVersion,model:'gpt-5.6-sol',effort:'low',prompt,fixtureDigest:hash(JSON.stringify(fixture)),promptDigest:hash(fixture.prompt),baseline,args,timeoutSeconds:120};
+    fs.writeFileSync(path.join(evidence,entry.id+'-setup.json'),JSON.stringify(meta,null,2));
+    console.log(JSON.stringify({event:'started',id:entry.id}));
+    const result=await supervise({command:'codex',args,cwd:dir,prompt,timeoutMs:120000,signal:controller.signal,env});
+    fs.writeFileSync(path.join(evidence,entry.id+'.jsonl'),result.stdout);fs.writeFileSync(path.join(evidence,entry.id+'.stderr'),result.stderr);
+    let events;try {events=result.stdout.trim().split('\n').filter(Boolean).map(line=>JSON.parse(line));}catch{events=[];}
+    const usage=codexUsage(events);let checks;
+    try { checks=collect(entry.caseId,dir,baseline,verifyFixture); } catch(error) { checks={error:error.message,testsIntact:false}; }
+    const acceptance=Boolean(checks.testsIntact && checks.unauthorizedChanges.length===0 && checks.check.exit===(entry.caseId==='B5'?1:0));
+    const record={...entry,status:result.status,exit:result.exit,error:result.error,usage,elapsedSeconds:result.elapsedSeconds,acceptance,checks,
+      transcriptSha256:hash(result.stdout),review:'pending; process exit and objective checks do not certify instruction adherence'};
+    recordRun(slot,record);
+    console.log(JSON.stringify({event:'finished',id:entry.id,status:result.status,acceptance,usage,elapsedSeconds:result.elapsedSeconds}));
+    if(result.status!=='exited'||!usage)break;
+  }
+}finally{process.removeListener('SIGINT',stop);process.removeListener('SIGTERM',stop);}

package/scripts/summarize-native-pilot.mjs

@@ -0,0 +1,7 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const root=process.argv[2];if(!root)throw new Error('Usage: node scripts/summarize-native-pilot.mjs CAMPAIGN_ROOT');
+const runs=fs.readdirSync(path.join(root,'ledger')).filter(n=>n.endsWith('.json')).sort().map(n=>JSON.parse(fs.readFileSync(path.join(root,'ledger',n))));
+const totalTokens=runs.every(r=>r.usage)?runs.reduce((n,r)=>n+r.usage.inputTokens+r.usage.outputTokens,0):null;
+const cells=['none','devmethod','bmad'].map(arm=>{const rs=runs.filter(r=>r.id.startsWith('matched-')&&r.arm===arm);return {arm,planned:3,executed:rs.length,notRun:3-rs.length,objectivePassed:rs.filter(r=>r.acceptance===true).length,objectiveFailed:rs.filter(r=>r.acceptance===false).length};});
+console.log(JSON.stringify({format:1,kind:'bounded-native-pilot',runs:runs.map(({id,status,acceptance,usage,elapsedSeconds,review})=>({id,status,objectiveChecksPassed:acceptance,usage,elapsedSeconds,review})),cells,totalTokens,costUSD:null,limits:{maxRuns:12,timeoutSeconds:120,observedTokenStop:500000},limitation:'Calibration excluded from matched cells. Objective success is not behavioral review or proof of superiority. Unknown cost remains unavailable.'},null,2));