greprag 5.74.11 → 5.74.13

package/dist/codex-chip-hooks.js

@@ -66,7 +66,7 @@ function context(input) {
         `Parent session: ${chip.parent.sessionId || 'not recorded'}`,
         `Finish by committing the durable result, then send the parent the commit artifact, checks, caveats, Cleanup line, and Archive: yes|no in the actual native task message. After delivery, Archive: yes means archive this child task yourself. The optional host command is ${cli} codex chip report ${chip.id}.`,
         // adr: adr/codex-landing-doctrine.md — one delivery owner, including FIX missions.
-        'Landing: the parent is the delivery owner for merge, post-merge branch/manifest bookkeeping, and any profile-declared push/deploy/release; the child owns routine archival of its own task after the terminal message is delivered. Do not edit the parent checkout or independently cross delivery boundaries. A mission whose first line begins `FIX:` (emitted by `greprag fix spawn`) is writable in its isolated checkout/worktree and hands its verified checkpoint to that owner without a human approval gate. If no live parent exists and the chip carries the full-goal mission, it becomes delivery owner. `greprag fix spawn` only prints the mission; visible Codex task dispatch creates the isolated checkout/worktree.',
+        'Landing: the parent is the delivery owner for merge, post-merge branch/manifest bookkeeping, and any profile-declared push/deploy/release; the child owns routine archival of its own task after the terminal message is delivered. Do not edit the parent checkout or independently cross delivery boundaries. A mission whose first line begins `FIX:` (emitted by `greprag fix spawn`) is writable in its isolated checkout/worktree and hands its verified commit/result to that owner without a human approval gate. If no live parent exists and the chip carries the full-goal mission, it becomes delivery owner. `greprag fix spawn` only prints the mission; visible Codex task dispatch creates the isolated checkout/worktree.',
     ];
     if ((0, model_1.chipMissionKind)(chip) === 'fix') {
         lines.push('Harness: Codex. Mission: visible native FIX chip with ordinary writable authority, not a same-session helper.', 'Scope: repair GrepRAG-owned harness surfaces in this checkout: load entries, skill templates, docs, hook context, CLI messages, and tests. Codex owns native task creation, worktrees, permissions, Git, and task lifecycle.', 'Own diagnosis, implementation, tests, commit, and parent report. Inspect Codex behavior only far enough to correct GrepRAG guidance or report a precise external blocker.', 'FIX peer handoff: if a peer offers to coordinate, integrate, rework, or take over a harness repair, hand off branch/commit, dirty files, checks, blockers, and caveats. Do not defend patch ownership; peers may take ownership within their assigned GrepRAG harness scope.', 'Visible delegation route: load `codex-chip-spawn` and create the child with `codex_app__create_thread` using the current project worktree target; load `chip-leader` for multi-chip seams. Same-session helper tools never satisfy a visible-chip requirement.');

package/dist/codex-delivery-coordination.js

@@ -0,0 +1,213 @@
+"use strict";
+/** Codex delivery coordination - interrupt the first delivery action once,
+ * then keep the rest of that delivery run non-blocking.
+ *
+ * The hook cannot call native Codex task tools. It names the exact agent-owned
+ * discovery and messaging actions, persists the open delivery window before
+ * denying, and never waits for peer replies or attestation.
+ *
+ * adr: adr/codex-coordinate-gate.md */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELIVERY_COORDINATION_WINDOW_MS = void 0;
+exports.codexDeliveryTrigger = codexDeliveryTrigger;
+exports.codexDeliveryCoordinationText = codexDeliveryCoordinationText;
+exports.evaluateCodexDeliveryCoordination = evaluateCodexDeliveryCoordination;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const coordinate_gate_1 = require("./commands/coordinate-gate");
+exports.DELIVERY_COORDINATION_WINDOW_MS = 30 * 60 * 1000;
+function homeDir() {
+    return process.env.USERPROFILE || process.env.HOME || '';
+}
+function normalize(value) {
+    return path.resolve(value).replace(/\\/g, '/').toLowerCase();
+}
+function gitRoot(cwd) {
+    try {
+        const root = (0, child_process_1.execFileSync)('git', ['rev-parse', '--show-toplevel'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        }).trim();
+        return root ? normalize(root) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function statePath(input, repoRoot) {
+    const home = homeDir();
+    const session = (input.session_id || '').trim();
+    if (!home || !session)
+        return null;
+    const key = crypto.createHash('sha256')
+        .update(`${session}\0${repoRoot}`)
+        .digest('hex')
+        .slice(0, 24);
+    return path.join(home, '.greprag', 'state', `codex-delivery-${key}.json`);
+}
+function readWindow(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeWindow(file, window) {
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(window, null, 2) + '\n');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isShellCapableTool(input) {
+    const name = (input.tool_name || '').toLowerCase();
+    return /(?:^|[.:/_-])(bash|shell|exec|exec_command)$/.test(name);
+}
+function decodeQuoted(value) {
+    if (value.startsWith('"')) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value.startsWith("'")) {
+        return value.slice(1, -1).replace(/\\'/g, "'").replace(/\\\\/g, '\\');
+    }
+    return null;
+}
+function embeddedCommands(code) {
+    const commands = [];
+    const re = /(?:command|cmd)\s*:\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*')/g;
+    for (const match of code.matchAll(re)) {
+        const decoded = decodeQuoted(match[1]);
+        if (decoded)
+            commands.push(decoded);
+    }
+    return commands;
+}
+function commandCandidates(input) {
+    if (!isShellCapableTool(input))
+        return [];
+    const toolInput = input.tool_input;
+    if (typeof toolInput === 'string')
+        return embeddedCommands(toolInput);
+    if (!toolInput || typeof toolInput !== 'object')
+        return [];
+    const candidates = [];
+    const fields = toolInput;
+    for (const key of ['command', 'cmd', 'script']) {
+        const value = fields[key];
+        if (typeof value === 'string')
+            candidates.push(value);
+    }
+    for (const key of ['code', 'input']) {
+        const value = fields[key];
+        if (typeof value === 'string')
+            candidates.push(...embeddedCommands(value));
+    }
+    return candidates;
+}
+function codexDeliveryTrigger(input) {
+    for (const command of commandCandidates(input)) {
+        const trigger = (0, coordinate_gate_1.classifyRiskyCommand)(command);
+        if (trigger)
+            return trigger;
+    }
+    return null;
+}
+function codexDeliveryCoordinationText(trigger) {
+    return `[DELIVERY NOW]
+
+Before ${trigger.label}, call codex_app.list_threads unfiltered and keep only peers in the same repo. Use codex_app.send_message_to_thread once for peers with ready or overlapping work; include your branch/commit and ask only for ready commits or concrete blockers.
+
+Include ready handoffs and clear known blockers, then retry immediately. Do not call wait_threads, wait for replies, or send follow-ups. Missing replies and unfinished peer work do not block delivery.`;
+}
+/** First delivery action opens a 30-minute session/repo window and interrupts
+ * once. Later merge/push/deploy/release actions refresh the same window and
+ * proceed without another coordination round. */
+function evaluateCodexDeliveryCoordination(input, now = Date.now()) {
+    if (input.hook_event_name !== 'PreToolUse')
+        return null;
+    const trigger = codexDeliveryTrigger(input);
+    if (!trigger)
+        return null;
+    const cwd = input.cwd || process.cwd();
+    const repoRoot = gitRoot(cwd);
+    if (!repoRoot)
+        return null;
+    const file = statePath(input, repoRoot);
+    if (!file)
+        return null;
+    const previous = readWindow(file);
+    const previousLastAction = previous ? Date.parse(previous.lastActionAt) : NaN;
+    if (previous
+        && previous.repoRoot === repoRoot
+        && Number.isFinite(previousLastAction)
+        && now - previousLastAction < exports.DELIVERY_COORDINATION_WINDOW_MS) {
+        writeWindow(file, {
+            ...previous,
+            lastActionAt: new Date(now).toISOString(),
+        });
+        return null;
+    }
+    const openedAt = new Date(now).toISOString();
+    if (!writeWindow(file, {
+        sessionId: input.session_id || '',
+        repoRoot,
+        openedAt,
+        lastActionAt: openedAt,
+    })) {
+        return null;
+    }
+    return {
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse',
+            additionalContext: codexDeliveryCoordinationText(trigger),
+            permissionDecision: 'deny',
+            permissionDecisionReason: `Run one same-repo coordination pass, then retry ${trigger.label} immediately; peer replies are not required.`,
+        },
+    };
+}

package/dist/codex-fast-hook.js

@@ -83,10 +83,8 @@ async function main() {
         return;
     }
     if (subcommand === 'codex-posttooluse') {
-        const { evaluateCodexCommitResult } = await Promise.resolve().then(() => __importStar(require('./codex-checkpoint-hook')));
-        const result = evaluateCodexCommitResult(input);
-        if (result)
-            process.stdout.write(JSON.stringify(result) + '\n');
+        // Compatibility no-op for installed configs predating the delivery-boundary
+        // cutover. `greprag init --codex` removes this hook.
         return;
     }
     const { evaluateCodexChipHook } = await Promise.resolve().then(() => __importStar(require('./codex-chip-hooks')));
@@ -97,10 +95,9 @@ async function main() {
         return;
     }
     let result = chipResult;
-    if (subcommand === 'codex-pretooluse') {
-        const { evaluatePendingCodexCheckpoint, recordCodexGitBoundary, } = await Promise.resolve().then(() => __importStar(require('./codex-checkpoint-hook')));
-        result = mergeOutputs(result, evaluatePendingCodexCheckpoint(input));
-        recordCodexGitBoundary(input);
+    if (subcommand === 'codex-pretooluse' && !result?.hookSpecificOutput.permissionDecision) {
+        const { evaluateCodexDeliveryCoordination } = await Promise.resolve().then(() => __importStar(require('./codex-delivery-coordination')));
+        result = mergeOutputs(result, evaluateCodexDeliveryCoordination(input));
     }
     if (!result?.hookSpecificOutput.permissionDecision && input.tool_name === 'Bash') {
         const { runSearchGuard } = await Promise.resolve().then(() => __importStar(require('./commands/search-guard')));

package/dist/commands/codex-chip/inbox.js

@@ -38,7 +38,7 @@ exports.sendChipEvent = sendChipEvent;
 const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
-const checkpoint_helpers_1 = require("../checkpoint-helpers");
+const config_1 = require("../config");
 const identity_1 = require("../identity");
 const model_1 = require("./model");
 const store_1 = require("./store");
@@ -71,7 +71,7 @@ async function sendChipEvent(manifest, targetSession, event, fromSession) {
     try {
         if (!targetSession)
             throw new Error('Chip lifecycle event has no target parent session.');
-        const cfg = (0, checkpoint_helpers_1.getConfig)();
+        const cfg = (0, config_1.getConfig)();
         if (!cfg.apiKey)
             throw new Error('Chip lifecycle inbox delivery has no API key.');
         const handle = await ownHandle(cfg.apiUrl, cfg.apiKey);

package/dist/commands/codex-chip/prompt.js

@@ -40,5 +40,5 @@ Report when done:
 ${reportInstruction}
 - Include a \`Cleanup:\` line naming the task, worktree, and branch actions. When done use \`Cleanup: child archives own task; Codex may prune managed worktree; parent may delete branch after merge\`; when anything must remain open use \`Cleanup: keep task/worktree/branch because ...\`.
 - Put the archive decision in the actual message sent to the LEAD: \`Archive: yes\` or \`Archive: no — <reason>\`. After that message is delivered, \`Archive: yes\` means call \`set_thread_archived\` for your own task; \`Archive: no\` means leave it open. Never make the parent perform routine child-task archival.
-- Landing: do not independently merge, push, deploy, or manually delete the worktree — the parent is the delivery owner and integrates the result, follows the repo profile, and deletes the branch after merge. If this task begins \`FIX:\` (a fix-spawn mission), hand the verified checkpoint to that owner without a human approval gate. If no live parent exists and this task carries the full-goal mission, become delivery owner. \`greprag fix spawn\` only prints the mission; visible Codex task dispatch creates the isolated checkout/worktree.`;
+- Landing: do not independently merge, push, deploy, or manually delete the worktree — the parent is the delivery owner and integrates the result, follows the repo profile, and deletes the branch after merge. If this task begins \`FIX:\` (a fix-spawn mission), hand the verified commit/result to that owner without a human approval gate. If no live parent exists and this task carries the full-goal mission, become delivery owner. \`greprag fix spawn\` only prints the mission; visible Codex task dispatch creates the isolated checkout/worktree.`;
 }

package/dist/commands/collision-check.js

@@ -127,7 +127,7 @@ function buildCollisionDirective(peers, myShort, alias) {
         + `GrepRAG watcher/cross-harness peers: \`greprag send "…what you're about to touch…" --to ${handle}@greprag.com/<their-8hex> --from-session ${myShort}\` `
         + `(YOU compose and send it — this is a notice, not an auto-send; watcher rows are not the Codex peer source of truth); `
         + `(2) do your code work in a worktree on its own branch (\`git worktree add .claude/worktrees/<slug> -b <branch>\`); `
-        + `(3) at completion resolve \`.greprag/delivery.json\`, include every ready peer checkpoint, and let one delivery owner `
+        + `(3) at completion resolve \`.greprag/delivery.json\`, include every ready peer commit/result, and let one delivery owner `
         + `integrate and finish the declared push/deploy/release path. Never edit the shared default checkout concurrently.`);
 }
 /** Reduce the watcher list to OTHER live sessions that are NOT in my repo

package/dist/commands/config.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadEnvFile = loadEnvFile;
+exports.getConfig = getConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const API_URL_DEFAULT = 'https://api.greprag.com';
+function loadEnvFile(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const eqIdx = trimmed.indexOf('=');
+            if (eqIdx < 1)
+                continue;
+            const key = trimmed.slice(0, eqIdx).trim();
+            let value = trimmed.slice(eqIdx + 1).trim();
+            if ((value.startsWith('"') && value.endsWith('"')) ||
+                (value.startsWith("'") && value.endsWith("'"))) {
+                value = value.slice(1, -1);
+            }
+            if (!process.env[key])
+                process.env[key] = value;
+        }
+    }
+    catch {
+        // Missing env files are fine.
+    }
+}
+function getConfig() {
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+    if (homeDir)
+        loadEnvFile(path.join(homeDir, '.greprag', '.env'));
+    if (!process.env.GREPRAG_API_KEY)
+        loadEnvFile(path.join(process.cwd(), '.env'));
+    return {
+        apiUrl: process.env.GREPRAG_API_URL || API_URL_DEFAULT,
+        apiKey: process.env.GREPRAG_API_KEY || '',
+    };
+}

package/dist/commands/coordinate-gate.js

@@ -27,8 +27,8 @@
  *  dedups to stay quiet), the merge gate must reflect live truth each time.
  *
  *  EFFECT is the adapter's choice, not the eval's: Claude/OpenCode inject the
- *  fresh roster as context; Codex denies until artifact-bound conferral evidence
- *  exists because Codex does not support a permission `ask` decision. An
+ *  fresh roster as context. Codex uses the separate local, bounded delivery
+ *  interrupt in codex-delivery-coordination.ts and carries no attestation. An
  *  ingress-source wrapper would inject instead. The eval below only produces
  *  the message.
  *

package/dist/commands/delivery-reminder.js

@@ -12,27 +12,26 @@ exports.buildDeliveryAnnounce = buildDeliveryAnnounce;
 // adr: adr/delivery-announce-pilot.md
 function coordinationLine(platform) {
     if (platform === 'codex') {
-        return 'Codex coordination: call list_threads unfiltered, filter to this repo/worktree, inspect matching tasks, then send_message_to_thread with your branch/commit/status before merge/push/deploy. Use GrepRAG only for cross-harness peers.';
+        return 'Codex: at the merge/deploy gate, call codex_app.list_threads unfiltered, filter to peers in the same repo, then use codex_app.send_message_to_thread once for ready or overlapping work.';
     }
     if (platform === 'claude-code') {
-        return 'Claude Code coordination: discover peers with `greprag inbox watchers --json`, send to the exact session, and keep the Monitor armed for replies.';
+        return 'Claude Code: at the merge/deploy gate, discover peers in the same repo and send one concise delivery notice to peers with ready or overlapping work.';
     }
     if (platform === 'opencode') {
-        return 'OpenCode coordination: use the GrepRAG project/session registry and session-targeted send; the plugin relay delivers replies.';
+        return 'OpenCode: at the merge/deploy gate, use the GrepRAG project/session registry and send one concise delivery notice to peers with ready or overlapping work.';
     }
-    return 'Coordination: discover same-project peers through this harness and use GrepRAG for cross-harness peers.';
+    return 'At the merge/deploy gate, coordinate once with peers in the same repo who have ready or overlapping work.';
 }
 function buildDeliveryAnnounce(env) {
     if (!env.deliveryRepo)
         return null;
     const project = env.projectName?.trim() || 'current repo';
     return [
-        `[DELIVERY CONTROL — ${project}]`,
-        'For full-goal code work, done means checkpointed, coordinated, integrated, pushed, deployed, and production-verified. Checkpoint each passing fix or feature.',
+        `[DELIVERY — ${project}]`,
+        'Commit useful, passing work.',
         coordinationLine(env.platform),
-        'Before merge, push, deploy, or release: elect one delivery owner. That owner includes every ready peer commit, resolves ordinary mission conflicts, and settles unclaimed dirt by adopt, rescue, or discard.',
-        'Use the canonical commit, deploy, and release skills plus this repo\'s delivery configuration. Never borrow a branch, remote, provider command, or verification rule from another repo.',
-        'A full-goal delivery mission already provisions ordinary repo-scoped commit, merge, push, deploy, and verification; do not wait for a second keyword.',
+        'Include ready peer commits and clear known blockers, then merge to the default branch and deploy immediately. Missing replies and unfinished peer work do not block delivery.',
+        'Use this repo\'s delivery profile and verify production.',
     ].join('\n');
 }
 exports.deliveryControlModule = {

package/dist/commands/fix.js

@@ -577,7 +577,7 @@ USAGE
                                                         surface. The caller dispatches it as a visible chip
                                                         using detected workspaceMode: Git -> worktree,
                                                         non-Git/no-commit -> serialized project-local;
-                                                        the chip fixes, verifies, checkpoints, then hands off.
+                                                        the chip fixes, verifies, commits useful work, then hands off.
   greprag fix log "<text>" [--scope <s>] [--repaired]   Audit/design-input note (NOT the friction reflex).
                                                         --repaired records a known rule directly.
   greprag fix list [--all] [--repaired] [--format json] List fixes — open by default;
@@ -623,7 +623,7 @@ async function runFix(args) {
             // THE friction reflex (grepragOS, 2026-07-12): one unit of friction ⇒
             // one fix-chip mission now. The mission detects Git capability and tells
             // native dispatch to use a worktree or serialized project-local mode;
-            // the chip fixes, verifies, checkpoints, then hands to the delivery owner. Replaces queue-first
+            // the chip fixes, verifies, commits useful work, then hands to the delivery owner. Replaces queue-first
             // `fix log` as doctrine.
             return (0, mechanic_spawn_1.fixSpawn)(rest);
         }

package/dist/commands/init.js

@@ -1130,18 +1130,9 @@ function applyCodexHooks(config) {
     if (removedPostToolInbox) {
         changes.push(`Removed ${removedPostToolInbox} Codex PostToolUse inbox hook(s); UserPromptSubmit now owns inbox steering`);
     }
-    const checkpointHook = {
-        matcher: '',
-        hooks: [commandHook('codex-posttooluse', 5, 'Coordinating Codex checkpoint', 'greprag-codex-hook')],
-    };
-    if (!hasGrepragHook(config.hooks.PostToolUse, 'codex-posttooluse')) {
-        if (!config.hooks.PostToolUse)
-            config.hooks.PostToolUse = [];
-        config.hooks.PostToolUse.push(checkpointHook);
-        changes.push('Added Codex PostToolUse hook (successful checkpoint coordination)');
-    }
-    else {
-        changes.push('Codex PostToolUse checkpoint hook already configured (skipped)');
+    const removedPostToolCoord = removeGrepragHook(config.hooks, 'PostToolUse', 'codex-posttooluse');
+    if (removedPostToolCoord) {
+        changes.push(`Removed ${removedPostToolCoord} Codex commit-triggered coordination hook(s); delivery coordination now starts at PreToolUse`);
     }
     const permissionHook = {
         matcher: '',
@@ -1199,8 +1190,8 @@ function applyCodexHooks(config) {
     ];
     // adr: adr/codex-hook-latency.md
     // Collapse the hot PreToolUse safety pair into one fast command process. It
-    // runs the chip/apply_patch guard plus local Bash safety checks. The retired
-    // coordination gate is removed when found so old configs stop blocking.
+    // runs the chip/apply_patch guard, one-shot delivery coordination, and local
+    // Bash safety checks. The legacy split coordination gate is removed.
     const removedPreToolChip = removeGrepragHook(config.hooks, 'PreToolUse', 'codex-chip-hook');
     const removedPreToolCoord = removeGrepragHook(config.hooks, 'PreToolUse', 'codex-coordinate-gate');
     if (removedPreToolChip || removedPreToolCoord) {
@@ -1208,16 +1199,16 @@ function applyCodexHooks(config) {
     }
     const preToolUseHook = {
         matcher: '',
-        hooks: [commandHook('codex-pretooluse', 10, 'Checking GrepRAG Codex safety', 'greprag-codex-hook')],
+        hooks: [commandHook('codex-pretooluse', 10, 'Checking GrepRAG Codex delivery and safety', 'greprag-codex-hook')],
     };
     if (!hasGrepragHookWithMatcher(config.hooks.PreToolUse, 'codex-pretooluse', preToolUseHook.matcher)) {
         if (!config.hooks.PreToolUse)
             config.hooks.PreToolUse = [];
         config.hooks.PreToolUse.push(preToolUseHook);
-        changes.push('Added Codex PreToolUse hook (multiplexed local safety)');
+        changes.push('Added Codex PreToolUse hook (delivery coordination + local safety)');
     }
     else {
-        changes.push('Codex PreToolUse multiplexed safety hook already configured (skipped)');
+        changes.push('Codex PreToolUse delivery/safety hook already configured (skipped)');
     }
     const removedStopChip = removeGrepragHook(config.hooks, 'Stop', 'codex-chip-hook');
     if (removedStopChip) {
@@ -1278,7 +1269,7 @@ function normalizeCodexHookCommands(hooks) {
         'codex-permission-context': { timeout: 3, statusMessage: 'Loading GrepRAG approval context' },
         'codex-subagent-start': { timeout: 3, statusMessage: 'Recording GrepRAG subagent metadata' },
         'codex-chip-hook': { timeout: 3, statusMessage: 'Enforcing Codex chip contract', runner: 'greprag-codex-hook' },
-        'codex-pretooluse': { timeout: 10, statusMessage: 'Checking GrepRAG Codex safety', runner: 'greprag-codex-hook' },
+        'codex-pretooluse': { timeout: 10, statusMessage: 'Checking GrepRAG Codex delivery and safety', runner: 'greprag-codex-hook' },
         'codex-coordinate-gate': { timeout: 10, statusMessage: 'Checking peer coordination' },
         'codex-store': { timeout: 3, statusMessage: 'Storing GrepRAG turn', runner: 'greprag-codex-hook' },
     };
@@ -1789,7 +1780,7 @@ const GREPRAG_CLI_BODY = `## greprag CLI (cross-project memory + async messaging
 - \`email send --to <real-addr> --from <handle>@greprag.com --subject "s" (--body "t" | --body-file <f|->)\` — sends a **REAL outbound SMTP email** from your greprag address to any recipient (\`--attach\`/\`--cc\`/\`--bcc\`/\`--html-file\` available). \`email pending\` · \`email pull\` = drain inbound. **Use this — not \`send\` — when the user says "email X".** The \`send\`-vs-\`email send\` collision is the trap: only \`email send\` is actual email.
 - \`memory search "q"\` · \`memory recap\` (alias \`briefing\`) — search a topic/bug · session catch-up digest; narrative-pyramid tiers \`turns\`·\`hourly\`·\`daily\`·\`weekly\`·\`ships\` (commits/PRs/deploys), each \`--last N\` · \`--from/--to ISO\` · \`--project\`
 - \`corpus upload <file|url> --raw|--enriched [--index]\` · \`corpus search "q" --all\` — ingest + search arbitrary text (books, codebases, refs); \`--raw\` lexical, \`--enriched\` adds LLM vocab bridge; \`--index\` = a multi-doc "index, no bundle" source (llms.txt/sitemap) → one library store, members refreshed cheap-signal-only (ETag→lastmod→content-length, no full-read floor)
-- \`fix spawn "<one unit of friction>"\` · \`fix search|repair\` · \`checkpoint save "5+ word title"\` — THE friction reflex: one visible fix-chip mission per unit; it detects Git before dispatch (worktree for Git, serialized project-local for non-Git/no-commit); the chip fixes, verifies, checkpoints, and hands it to the mission delivery owner (\`fix log\` = audit notes only) · search/repair the fix queue · bookmark a session window
+- \`fix spawn "<one unit of friction>"\` · \`fix search|repair\` — THE friction reflex: one visible fix-chip mission per unit; it detects Git before dispatch (worktree for Git, serialized project-local for non-Git/no-commit); the chip fixes, verifies, commits useful work, and hands it to the mission delivery owner (\`fix log\` = audit notes only) · search/repair the fix queue
 - \`status\` · \`doctor\` — install/auth/hooks state · repair orphan project_id + identity drift
 Hard rule: AI never auto-acts on a brief — summarize + confirm.`;
 /** The previous SHIPPED default (v5.39.x and earlier, pre-markers, unmarked).
@@ -1802,7 +1793,7 @@ const GREPRAG_CLI_BODY_V1 = `## greprag CLI (cross-project memory + async messag
 - \`send "md" --to <handle>@greprag.com[/<8hex>]\` — message a session (\`/<8hex>\`) or cold-open a front desk (bare handle); Discord DM: \`--to discord:<snowflake>\`
 - \`memory search "q"\` · \`memory recap\` (alias \`briefing\`) — search a topic/bug · session catch-up digest; narrative-pyramid tiers \`turns\`·\`hourly\`·\`daily\`·\`ships\` (commits/PRs/deploys), each \`--last N\` · \`--from/--to ISO\` · \`--project\`
 - \`corpus upload <file|url> --raw|--enriched\` · \`corpus search "q" --all\` — ingest + search arbitrary text (books, codebases, refs); \`--raw\` lexical, \`--enriched\` adds LLM vocab bridge
-- \`fix spawn "<unit>"\`|\`fix search\` · \`checkpoint save "5+ word title"\` — emit one visible fix-chip mission per friction unit; native dispatch creates the isolated checkout/worktree; the chip fixes, verifies, checkpoints, and hands it to the mission delivery owner · bookmark a session window
+- \`fix spawn "<unit>"\`|\`fix search\` — emit one visible fix-chip mission per friction unit; native dispatch creates the isolated checkout/worktree; the chip fixes, verifies, commits useful work, and hands it to the mission delivery owner
 - \`status\` · \`doctor\` — install/auth/hooks state · repair orphan project_id + identity drift
 Hard rule: AI never auto-acts on a brief — summarize + confirm.`;
 /** The managed-section registry for ~/.claude/CLAUDE.md. Add a spec here to put

package/dist/commands/mechanic-spawn.js

@@ -19,7 +19,7 @@ exports.mechanicSpawn = mechanicSpawn;
  *
  * The chip's contract is simple: identify the exact friction, make the
  * smallest durable root-cause fix, explain the friction and fix in human
- * terms, then hand its checkpoint to the mission's delivery owner. A full-goal
+ * terms, then hand its commit/result to the mission's delivery owner. A full-goal
  * chip with no live parent becomes that owner and follows the repo profile.
  *
  * This command does NOT create the child task or its workspace. The caller
@@ -116,7 +116,7 @@ function buildFixMission(friction, scope, parentSession, type = inferFixType(fri
                 '3. Confirm you are not in the caller/parent checkout. If you are, STOP and report `CHIP DISPATCH BLOCKED: workspaceMode=worktree was not honored`.',
             ],
             work: 'Work as an ordinary unrestricted read/write session in the dispatch-provided isolated worktree.',
-            completion: 'Use focused tests or checks that prove the fix and commit a checkpoint. If a live parent owns delivery, report the commit and checks so it can integrate and clean up. If no live parent exists and this is the full-goal mission, resolve `.greprag/delivery.json` and become the delivery owner. Gate only effects outside ordinary repo delivery.',
+            completion: 'Use focused tests or checks that prove the fix and commit useful work. If a live parent owns delivery, report the commit and checks so it can integrate and clean up. If no live parent exists and this is the full-goal mission, resolve `.greprag/delivery.json` and become the delivery owner. Gate only effects outside ordinary repo delivery.',
         }
         : {
             selected: 'Workspace mode: local -> no usable Git HEAD detected; native dispatch targets the current project directory directly.',
@@ -202,7 +202,7 @@ async function fixSpawn(args, opts = {}) {
         parentSession: parentSession || null,
         mission,
         dispatch: workspaceMode === 'worktree'
-            ? 'Create a visible native chip/task using the harness worktree path, then send this mission as its first turn. The chip fixes, verifies, commits, and hands the checkpoint to the mission delivery owner.'
+            ? 'Create a visible native chip/task using the harness worktree path, then send this mission as its first turn. The chip fixes, verifies, commits, and hands the result to the mission delivery owner.'
             : 'No usable Git HEAD was detected. Create a visible native chip/task using the harness project-local path; do not attempt a worktree or initialize Git. Yield caller file writes until the chip reports back. The chip fixes, verifies, and hands the result to the mission owner.',
     };
     console.log(JSON.stringify(handoff, null, 2));

package/dist/commands/memory.js

@@ -582,8 +582,7 @@ Subcommands:
                                  least one filter is required (a bare delete is
                                  refused).
     [--project <name>]           Narrow to one project (default: all projects).
-    [--shape <name>]             turn / hourly / daily / weekly / checkpoint /
-                                 ship-event.
+    [--shape <name>]             turn / hourly / daily / weekly / ship-event.
     [--from ISO] [--to ISO]      Created-at range (half-open: >= from, < to).
     [--session <id>]             One session's external id.
     [--yes]                      Execute the delete (omit for a dry run).
@@ -626,7 +625,7 @@ async function deleteCmd(args) {
     const projectArg = getFlag(args, '--project');
     const confirmed = args.includes('--yes');
     if (!shape && !from && !to && !session && !projectArg) {
-        console.error('Usage: greprag memory delete [--project <name>] [--shape <turn|hourly|daily|weekly|checkpoint|ship-event>] [--from ISO] [--to ISO] [--session <id>] [--yes]');
+        console.error('Usage: greprag memory delete [--project <name>] [--shape <turn|hourly|daily|weekly|ship-event>] [--from ISO] [--to ISO] [--session <id>] [--yes]');
         console.error('At least one filter is required (a bare delete is refused).');
         process.exit(1);
     }

package/dist/commands/opencode-chip-mission.js

@@ -69,7 +69,7 @@ function buildMission(input) {
             '**Repair contract**',
             'Work as an ordinary unrestricted read/write session in the isolated checkout.',
             'Find and repair the reusable root mechanism; own discovery, repair, tests, verification, and commit.',
-            'Finish it through the Delivery System: confer with live peers first (`greprag inbox watchers`), resolve `.greprag/delivery.json`, include every ready checkpoint, and let one delivery owner integrate, verify, push, deploy, or release exactly as the profile declares. If a live parent already owns delivery, report your commit and checks for integration; if no parent is available and this is the full-goal mission, become the delivery owner. Gate only effects outside ordinary repo delivery.',
+            'Finish it through the Delivery System: confer with live peers first (`greprag inbox watchers`), resolve `.greprag/delivery.json`, include every ready peer commit/result, and let one delivery owner integrate, verify, push, deploy, or release exactly as the profile declares. If a live parent already owns delivery, report your commit and checks for integration; if no parent is available and this is the full-goal mission, become the delivery owner. Gate only effects outside ordinary repo delivery.',
             'Report DONE or BLOCKED natively to the parent task; do not use a mandatory GrepRAG completion ceremony.',
             '',
             '**Friction / mission**',

package/dist/commands/os-primer-reminder.js

@@ -26,7 +26,7 @@ function buildOsPrimer(env) {
         '• Doctrine vs state: methods ship in the CLI (`greprag load`); live state lives in the repo. A skill that depends on repo state carries a "STATE — read these first" block naming exact paths.',
         '• Discoverability: every durable artifact must be findable next session — docs auto-register, skills auto-mirror, decisions get a dated ADR/decision-log entry, everything else gets its path named in the owning skill/doc. If nothing points at it, you didn\'t finish.',
         '• Pull before derive: `greprag memory search` / `corpus search` / `load` BEFORE asking the operator or re-deriving what the project already knows. Friction or an env/toolchain/worktree/secret bootstrap roadblock → search Memory for the exact error/friction + repo/tool before inventing a workaround. Clear overcome → apply it and continue. Named person/org/project/repo/customer/handle or unexplained proper noun → search Memory before guessing, unless fully defined in-turn.',
-        `• Unresolved friction ⇒ fix: only when Memory has no answer, the remembered overcome fails, or the same friction repeats. Then type by durable repair surface (\`harness|doctrine|injection|env|code\`) ⇒ \`greprag fix spawn --type <type> "<unit>"\`. It PRINTS a fix-chip mission — YOU then create the visible child task with that mission as its first message (how: \`greprag load ${spawnEntry}\`, or your harness's native task tool). Repo write = isolated worktree; data-only row/diagnosis = no repo write. One unresolved unit per chip; the chip fixes, verifies, checkpoints, and hands it to the mission delivery owner.`,
+        `• Unresolved friction ⇒ fix: only when Memory has no answer, the remembered overcome fails, or the same friction repeats. Then type by durable repair surface (\`harness|doctrine|injection|env|code\`) ⇒ \`greprag fix spawn --type <type> "<unit>"\`. It PRINTS a fix-chip mission — YOU then create the visible child task with that mission as its first message (how: \`greprag load ${spawnEntry}\`, or your harness's native task tool). Repo write = isolated worktree; data-only row/diagnosis = no repo write. One unresolved unit per chip; the chip fixes, verifies, commits useful work, and hands it to the mission delivery owner.`,
         '• Teach the system, not the chat: explained twice by the operator ⇒ it belongs in a skill / load entry / STATE block / ADR, not the conversation.',
     ].join('\n');
 }

package/dist/commands/procedure.js

@@ -331,10 +331,10 @@ async function runProcedure(args) {
             console.log(`  started:     ${run.startedAt}`);
             console.log(`  fingerprint: ${run.artifactFingerprint}`);
             console.log(`  outcome:     ${run.outcome || 'active'}`);
-            console.log('  checkpoints:');
-            if (!run.checkpoints.length)
+            console.log('  attestations:');
+            if (!run.attestations.length)
                 console.log('    (none)');
-            for (const c of run.checkpoints)
+            for (const c of run.attestations)
                 console.log(`    ${c.kind} · ${c.via || '-'} · ${c.ref || '-'} · ${c.artifactFingerprint.slice(0, 12)}`);
             return;
         }
@@ -357,11 +357,11 @@ async function runProcedure(args) {
                 process.exit(1);
             }
             try {
-                const next = (0, procedure_run_1.attestProcedureCheckpoint)({
+                const next = (0, procedure_run_1.attestProcedureEvidence)({
                     run, kind, cwd: process.cwd(), via: viaRaw,
                     ref: getFlag(rest.slice(2), '--ref'),
                 });
-                const c = next.checkpoints[next.checkpoints.length - 1];
+                const c = next.attestations[next.attestations.length - 1];
                 console.log(`Attested ${verb}:${kind} for ${c.artifactFingerprint}.`);
             }
             catch (e) {