kenaz 0.0.0-stage → 0.3.2

package/core/.formation/bifrost/setup-codex.test.js

@@ -0,0 +1,102 @@
+'use strict';
+// TASK_2384: node --test .formation/bifrost/setup-codex.test.js
+// Temp CODEX_HOME and a fake `codex` on PATH only; never the real ~/.codex or the real CLI.
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const URL = 'http://localhost:18080/api/mcp';
+const TOOLS = '[mcp_servers.kenaz-dashboard.tools.synapse_recall]\napproval_mode = "approve"\n\n[mcp_servers.kenaz-dashboard.tools.kenaz_task_create]\napproval_mode = "prompt"\n';
+
+const FAKE = `
+const fs=require('fs'),path=require('path');const a=process.argv.slice(2);
+const cfg=path.join(process.env.CODEX_HOME,'config.toml');
+if(a[0]==='--version'){console.log('codex-cli 0.0.0');process.exit(0);}
+const hf=path.join(process.env.CODEX_HOME,'hooks_on');
+if(a[0]==='features'&&a[1]==='list'){console.log('hooks   stable   '+(fs.existsSync(hf)?'true':'false'));process.exit(0);}
+if(a[0]==='features'&&a[1]==='enable'&&a[2]==='hooks'){if(process.env.FAKE_NO_ENABLE)process.exit(2);fs.writeFileSync(hf,'');process.exit(0);}
+if(a[0]==='mcp'&&a[1]==='remove'){const t=fs.readFileSync(cfg,'utf8').split(/\\r?\\n/);let skip=false;const o=[];
+ for(const l of t){if(/^\\s*\\[/.test(l))skip=l.trim().startsWith('[mcp_servers.'+a[2]);if(!skip)o.push(l);}
+ fs.writeFileSync(cfg,o.join('\\n'));process.exit(0);}
+if(a[0]==='mcp'&&a[1]==='add'){const u=a[a.indexOf('--url')+1];fs.appendFileSync(cfg,'\\n[mcp_servers.'+a[2]+']\\nurl = "'+u+'"\\n');process.exit(0);}
+process.exit(1);`;
+
+// fake codex: `mcp remove` drops the whole section + sub-tables (like the real CLI), `mcp add` appends the url.
+function fixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cx-setup-'));
+  const bin = path.join(root, 'bin'), codexHome = path.join(root, 'codex');
+  fs.mkdirSync(bin); fs.mkdirSync(codexHome);
+  fs.writeFileSync(path.join(bin, 'fake-codex.js'), FAKE);
+  const win = process.platform === 'win32';
+  fs.writeFileSync(path.join(bin, win ? 'codex.cmd' : 'codex'),
+    win ? '@node "%~dp0fake-codex.js" %*\r\n' : '#!/bin/sh\nexec node "$(dirname "$0")/fake-codex.js" "$@"\n', { mode: 0o755 });
+  const env = { ...process.env, CODEX_HOME: codexHome, PATH: bin + path.delimiter + process.env.PATH, KENAZ_HTTP_PORT: '18080' };
+  const run = (fn) => spawnSync(process.execPath, ['-e',
+    `require(${JSON.stringify(path.join(__dirname, 'setup-codex.js'))}).${fn}({silent:true});`], { env, encoding: 'utf8' });
+  const codex = (...args) => spawnSync(win ? 'codex.cmd' : 'codex', args, { env, encoding: 'utf8', shell: win });
+  return { cfg: path.join(codexHome, 'config.toml'), codexHome, run, codex };
+}
+
+test('control: bare `codex mcp remove` + add drops the user tool tables', () => {
+  const f = fixture();
+  fs.writeFileSync(f.cfg, '[mcp_servers.kenaz-dashboard]\nurl = "' + URL + '"\n\n' + TOOLS);
+  f.codex('mcp', 'remove', 'kenaz-dashboard');
+  f.codex('mcp', 'add', 'kenaz-dashboard', '--url', URL);
+  assert.ok(!fs.readFileSync(f.cfg, 'utf8').includes('approval_mode'), 'the CLI itself loses them');
+});
+
+test('uninstall + setup keeps [mcp_servers.kenaz-dashboard.tools.*] entries', () => {
+  const f = fixture();
+  fs.writeFileSync(f.cfg, '[mcp_servers.kenaz-dashboard]\nurl = "' + URL + '"\n\n' + TOOLS + '\n[mcp_servers.other]\nurl = "http://x"\n');
+  const u = f.run('uninstall');
+  assert.strictEqual(u.status, 0, u.stderr);
+  const mid = fs.readFileSync(f.cfg, 'utf8');
+  assert.ok(!mid.includes('kenaz-dashboard'), 'uninstall leaves no kenaz-dashboard table in config');
+  assert.ok(mid.includes('[mcp_servers.other]'), 'other servers untouched');
+  const s = f.run('setup');
+  assert.strictEqual(s.status, 0, s.stderr);
+  const after = fs.readFileSync(f.cfg, 'utf8');
+  assert.ok(after.includes('url = "' + URL + '"'));
+  assert.ok(after.includes('[mcp_servers.kenaz-dashboard.tools.synapse_recall]\napproval_mode = "approve"'));
+  assert.ok(after.includes('[mcp_servers.kenaz-dashboard.tools.kenaz_task_create]\napproval_mode = "prompt"'));
+  assert.strictEqual(after.split('tools.synapse_recall').length, 2, 'no duplicates');
+  assert.ok(!fs.existsSync(path.join(f.codexHome, 'kenaz-dashboard-tools.toml')), 'sidecar consumed');
+});
+
+test('stale-URL refresh in setup also keeps the tool tables', () => {
+  const f = fixture();
+  fs.writeFileSync(f.cfg, '[mcp_servers.kenaz-dashboard]\nurl = "http://localhost:9999/api/mcp"\n\n' + TOOLS);
+  const s = f.run('setup');
+  assert.strictEqual(s.status, 0, s.stderr);
+  const after = fs.readFileSync(f.cfg, 'utf8');
+  assert.ok(after.includes('18080/api/mcp') && !after.includes('9999'));
+  assert.ok(after.includes('approval_mode = "approve"') && after.includes('approval_mode = "prompt"'));
+});
+
+test('setup with the MCP entry already present still repairs the rest (skill install not skipped)', () => {
+  const f = fixture();
+  fs.writeFileSync(f.cfg, '[mcp_servers.kenaz-dashboard]\nurl = "' + URL + '"\n');
+  const s = f.run('setup');
+  assert.strictEqual(s.status, 0, s.stderr);
+  assert.ok(fs.existsSync(path.join(f.codexHome, 'skills', 'kenaz', 'SKILL.md')), 'early return on already_registered skipped the $kenaz skill');
+});
+
+test('hook shim path comes from the core that runs setup, not the cwd (npm installs run from a project dir)', () => {
+  const s = require('./setup-codex');
+  const p = s.getHookShimPath(path.join(os.tmpdir(), 'some-project'));
+  assert.ok(fs.existsSync(p), p);
+  assert.strictEqual(path.dirname(p), path.join(__dirname, 'openai'));
+});
+
+test('codex with the stable hooks feature switched off (0.160 default): setup enables it and registers the hooks', () => {
+  const f = fixture();
+  fs.writeFileSync(f.cfg, '');
+  const s = f.run('setup');
+  assert.strictEqual(s.status, 0, s.stderr);
+  assert.ok(fs.existsSync(path.join(f.codexHome, 'hooks_on')), 'codex features enable hooks was not run');
+  const cfg = fs.readFileSync(f.cfg, 'utf8');
+  for (const ev of ['PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'SessionStart', 'Stop']) assert.ok(cfg.includes('[[hooks.' + ev + ']]'), ev);
+});

package/core/.formation/bifrost/shared/ansuz-boot-policy.js

@@ -0,0 +1,31 @@
+'use strict';
+
+function resolveBootPolicy({ specialist = 'Ansuz', depth, bootMode, full = false } = {}) {
+  if (bootMode && !['fast', 'full'].includes(bootMode)) {
+    throw new Error('boot-mode must be fast or full');
+  }
+  if (full && bootMode === 'fast') throw new Error('--full conflicts with --boot-mode fast');
+  const isAnsuz = specialist.toLowerCase() === 'ansuz';
+  // Explicit legacy prompt depths keep their matching initialization contract.
+  const mode = !isAnsuz || full || bootMode === 'full' || (depth && depth !== 'elixir') ? 'full' : 'fast';
+  if (bootMode === 'fast' && mode === 'full') throw new Error('fast boot requires Ansuz with elixir depth');
+  // Ansuz always defaults to elixir, fast or full (full = full Phase 0 ceremony,
+  // same persona). kernel only when passed explicitly. Other specialists have no
+  // elixir.yaml, so they keep kernel.
+  return { specialist, mode, depth: depth || (isAnsuz ? 'elixir' : 'kernel'), allowOffline: isAnsuz && mode === 'fast' };
+}
+
+function renderBootstrap({ policy, projectPath, port = '18080', contextual = false } = {}) {
+  const fast = [
+    'Ansuz fast boot (elixir) is the default. This bootstrap policy supersedes any older instruction to run Phase 0, including the Phase 0 sentence inside elixir.',
+    'Check synapse_status with the active projectPath when available. If unavailable, report that memory is unavailable and continue only read-only inspection and analysis using local evidence; do not claim recall succeeded.',
+    'Lightweight Phase 0 uses the supplied boot context and local project evidence; do not run phase-gate Phase 0 or its boot rituals in fast mode. This also supersedes legacy handoff instructions that promise Phase 0 archival. When offline, defer state-changing execution and memory-dependent work until the required service is restored.',
+    'Existing authorization, scope, verification, task tracking, and merge restrictions remain in force.',
+  ].join('\n');
+  const command = `node .specialist/tools/phase-gate.js enter --phase=0 --specialist=${(policy?.specialist || 'Ansuz').toLowerCase()}${projectPath ? ` --project-path="${projectPath}"` : ''}`;
+  const full = `Before running phase-gate enter, call synapse_status with the active projectPath. If it errors or times out, HALT and emit recovery: confirm Kenaz Dashboard on port ${port}, re-run setup-codex, and restart the Codex session.\nExecute Phase 0 initialization now: run \`${command}\` and follow its checklist.`;
+  if (contextual) return `## Codex Bootstrap Policy\n\nFor Ansuz without an explicit full boot or legacy depth:\n${fast}\n\nFor explicit --full / --boot-mode full or kernel depth, and for other specialists: retain the full bootstrap guard; call synapse_status before Phase 0 and HALT with recovery instructions if it is unavailable. Use the active specialist and project-path for Phase 0.\n`;
+  return `## Codex Bootstrap Policy (${policy.mode})\n\n${policy.mode === 'fast' ? fast : full}\n`;
+}
+
+module.exports = { resolveBootPolicy, renderBootstrap };

package/core/.formation/bifrost/shared/ansuz-boot-policy.test.js

@@ -0,0 +1,40 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { resolveBootPolicy, renderBootstrap } = require('./ansuz-boot-policy');
+
+test('Ansuz defaults to fast/elixir; explicit legacy and other specialists retain full boot', () => {
+  assert.deepEqual(resolveBootPolicy(), { specialist: 'Ansuz', mode: 'fast', depth: 'elixir', allowOffline: true });
+  for (const options of [{ full: true }, { bootMode: 'full' }, { depth: 'kernel' }, { depth: 'skeleton' }, { specialist: 'Amelia' }]) {
+    const policy = resolveBootPolicy(options);
+    assert.equal(policy.mode, 'full');
+    assert.equal(policy.allowOffline, false);
+  }
+  assert.equal(resolveBootPolicy({ full: true }).depth, 'elixir');
+  assert.equal(resolveBootPolicy({ bootMode: 'full' }).depth, 'elixir');
+  assert.equal(resolveBootPolicy({ depth: 'kernel' }).depth, 'kernel');
+  assert.equal(resolveBootPolicy({ specialist: 'Amelia' }).depth, 'kernel');
+  assert.equal(resolveBootPolicy({ depth: 'elixir', full: true }).depth, 'elixir');
+  assert.equal(resolveBootPolicy({ specialist: 'ANSUZ', bootMode: 'fast' }).mode, 'fast');
+});
+
+test('contradictory and invalid boot flags fail explicitly', () => {
+  for (const options of [{ full: true, bootMode: 'fast' }, { depth: 'kernel', bootMode: 'fast' }, { specialist: 'Amelia', bootMode: 'fast' }, { bootMode: 'typo' }]) {
+    assert.throws(() => resolveBootPolicy(options));
+  }
+});
+
+test('renderer preserves full project pin and limits fast offline work without removing safeguards', () => {
+  const projectPath = 'C:\\example project\\quotation';
+  const full = renderBootstrap({ policy: resolveBootPolicy({ full: true }), projectPath });
+  assert.match(full, /HALT/);
+  assert.ok(full.includes(`--project-path="${projectPath}"`));
+  assert.match(full, /--specialist=ansuz/);
+  const fast = renderBootstrap({ policy: resolveBootPolicy() });
+  assert.match(fast, /Lightweight Phase 0/);
+  assert.match(fast, /supersedes any older instruction/);
+  assert.match(fast, /read-only inspection and analysis/);
+  assert.match(fast, /merge restrictions remain in force/);
+  assert.doesNotMatch(fast, /Execute Phase 0 initialization now/);
+  assert.ok(renderBootstrap({ contextual: true }).includes(fast.split('\n\n')[1].trim()));
+});

package/core/.formation/bifrost/shared/boot-context.js

@@ -0,0 +1,68 @@
+"use strict";
+const fs = require("fs");
+const path = require("path");
+// Uses canary.js generate -- same module as Claude path (single definition site).
+// Codex adaptation: generic file modification wording (no Edit/Write tool names).
+// Coexists with Anti-Drift 1-9 -- does NOT replace them.
+function generateCodexCanary(specialist, projectRoot) {
+  try {
+    const p = path.join(projectRoot, ".specialist", "tools", "canary.js");
+    if (!fs.existsSync(p)) return null;
+    const r = require(p).generate({ specialist, task: "boot", scope: "" }, projectRoot);
+    return r.block.replace(/Before EACH file modification \(Edit\/Write\)/g, "Before EACH file modification");
+  } catch (err) { process.stderr.write("[bifrost:boot-context] canary error: " + err.message + "\n"); return null; }
+}
+function renderCanarySection(b) {
+  if (!b) return "";
+  return "## Session Identity (CANARY)\n" + b + "\n\n";
+}
+// Read-only: does NOT consume/delete -- phase-gate.js handles that at Phase 0.
+// Pin-awareness lives in the CALLER: launch.js/session.js resolve the effective
+// project root (--project-path / PROJECT_PATH) before calling in. The real pin
+// store (ansuz_project_pins.json) is session-keyed and not resolvable here.
+function loadHandoffSummary(root) {
+  try {
+    // TASK_1829: boot context wants the LATEST handoff from any prior session —
+    // per-session slots under .kenaz/specialist/handoffs/ (legacy singular slot is
+    // a read-only fallback inside the resolver). Lazy require keeps boot fail-open.
+    const resolver = require(path.resolve(__dirname, "../../..", ".specialist/Ansuz/tools/handoff-resolver.js"));
+    const h = resolver.readLatestHandoff(root);
+    if (!h || h.cleared === true) return null;
+    const sit = h.isbar && h.isbar.situation;
+    const rec = h.isbar && h.isbar.recommendation;
+    const asm = h.isbar && h.isbar.assessment;
+    return { session_id: h.session_id || null, topic: sit && sit.current_topic || null,
+      first_action: rec && rec.first_action || null,
+      pending_decisions: Array.isArray(sit && sit.pending_decisions) ? sit.pending_decisions : [],
+      unfinished: Array.isArray(asm && asm.unfinished) ? asm.unfinished : [] };
+  } catch { return null; }
+}
+// Omitted silently when no summary (per requirement 4 + AC1).
+function renderHandoffSection(s) {
+  if (!s) return "";
+  const out = ["## Previous Session Handoff"];
+  if (s.session_id)   out.push("Session: " + s.session_id);
+  if (s.topic)        out.push("Topic: " + s.topic);
+  if (s.first_action) out.push("First action: " + s.first_action);
+  if (s.unfinished && s.unfinished.length > 0) { out.push("Unfinished:"); s.unfinished.forEach((i) => out.push("  - " + i)); }
+  if (s.pending_decisions && s.pending_decisions.length > 0) { out.push("Pending decisions:"); s.pending_decisions.forEach((d) => out.push("  - " + d)); }
+  out.push(""); out.push("Note: phase-gate.js will fully archive and consume this handoff during Phase 0."); out.push("");
+  return out.join("\n") + "\n";
+}
+// fetchBootContext: assemble the boot context sections (canary + handoff). TASK_2335: the Norn preamble section was removed.
+// @param opts.specialist  - Specialist name
+// @param opts.projectRoot - Trusted core root for Canary code (legacy project default)
+// @param opts.projectPath - Effective project for memory and handoff reads
+// @param opts.includeCanary - False when the inner specialist owns Canary generation
+// @param opts.port        - Ignored (kept so existing callers need no change)
+// @returns Promise<string> - Assembled boot context block (ready to prepend to prompt)
+async function fetchBootContext({ specialist, projectRoot, projectPath, includeCanary = true }) {
+  const effectiveProject = projectPath || projectRoot;
+  const canaryBlock    = includeCanary ? generateCodexCanary(specialist, projectRoot) : null;
+  const handoffSummary = loadHandoffSummary(effectiveProject);
+  const cs = renderCanarySection(canaryBlock);
+  const hs = renderHandoffSection(handoffSummary);
+  const hdr = "# Boot Cognitive Context (Bifrost)\n# Injected at session start -- session identity, prior handoff.\n\n";
+  return hdr + cs + hs;
+}
+module.exports = { fetchBootContext, generateCodexCanary, loadHandoffSummary, renderCanarySection, renderHandoffSection };

package/core/.formation/bifrost/shared/boot-context.test.js

@@ -0,0 +1,67 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+function fixture(offline = false) {
+  const effects = { modules: [], canaries: [], handoffs: [] };
+  const core = path.resolve(__dirname, '../../..');
+  const module = { exports: {} };
+  vm.runInNewContext(fs.readFileSync(path.join(__dirname, 'boot-context.js'), 'utf8'), {
+    __dirname, module, process: { env: {}, stderr: { write() {} } },
+    require(id) {
+      if (id === 'path') return path;
+      if (id === 'fs') return { existsSync: () => true };
+      effects.modules.push(id);
+      if (id === path.join(core, '.specialist/tools/canary.js')) return { generate: (_opts, root) => {
+        effects.canaries.push(root); return { block: 'fixture canary' };
+      } };
+      if (id === path.join(core, '.specialist/Ansuz/tools/handoff-resolver.js')) return { readLatestHandoff: project => {
+        effects.handoffs.push(project);
+        return offline ? null : { session_id: `handoff:${project}` };
+      } };
+      assert.fail(`unexpected module load: ${id}`);
+    },
+  });
+  return { api: module.exports, effects, core };
+}
+
+test('parallel selected projects isolate handoff while loading trusted core code', async () => {
+  const { api, effects, core } = fixture();
+  const projects = [path.resolve('fixture-A'), path.resolve('fixture-B')];
+  const results = await Promise.all(projects.map(projectPath => api.fetchBootContext({ specialist: 'Ansuz', projectRoot: core, projectPath, port: 42 })));
+  for (let i = 0; i < projects.length; i++) {
+    assert.ok(results[i].includes(`handoff:${projects[i]}`));
+    assert.ok(!results[i].includes(projects[1 - i]));
+  }
+  assert.deepEqual(effects.handoffs.sort(), [...projects].sort());
+  assert.deepEqual(effects.canaries, [core, core]);
+  assert.ok(effects.modules.every(id => id.startsWith(core + path.sep)));
+});
+
+test('legacy projectRoot defaults handoff to the supplied root', async () => {
+  const { api, effects, core } = fixture();
+  const result = await api.fetchBootContext({ specialist: 'Ansuz', projectRoot: core });
+  assert.deepEqual(effects.handoffs, [core]);
+  assert.ok(result.includes(`handoff:${core}`));
+});
+
+test('absent handoff is omitted and the canary stays', async () => {
+  const { api, core } = fixture(true);
+  const result = await api.fetchBootContext({ specialist: 'Ansuz', projectRoot: core, projectPath: path.resolve('missing') });
+  assert.doesNotMatch(result, /preamble/i);
+  assert.doesNotMatch(result, /Previous Session Handoff/);
+  assert.match(result, /fixture canary/);
+});
+
+test('external context can omit Canary generation without losing the handoff', async () => {
+  const { api, effects, core } = fixture();
+  const project = path.resolve('selected-project');
+  const result = await api.fetchBootContext({ specialist: 'Ansuz', projectRoot: core, projectPath: project, includeCanary: false });
+  assert.deepEqual(effects.canaries, []);
+  assert.ok(!effects.modules.some(id => id.endsWith('canary.js')));
+  assert.doesNotMatch(result, /Session Identity|fixture canary/);
+  assert.ok(result.includes(`handoff:${project}`));
+});

package/core/.formation/bifrost/shared/codex-appserver.js

@@ -0,0 +1,191 @@
+'use strict';
+// codex-appserver.js — TASK_2167
+//
+// Helpers for the Bifrost interactive launcher's push-target mode: run a
+// loopback-only `codex app-server --listen ws://127.0.0.1:<port>`, attach the
+// normal TUI to it with `--remote`, discover the TUI's thread id over the
+// app-server JSON-RPC protocol, and keep .kenaz/codex/sessions.json (read by
+// dashboard/src-tauri/src/infrastructure/codex_wake.rs) pointing at it.
+//
+// Everything here is dependency-free (Node >= 22 global WebSocket) and
+// fail-open: any failure means "push unavailable for this session", never a
+// launch failure.
+
+const net = require('net');
+const fs = require('fs');
+const { registryPath, readRegistry, writeRegistry, registerInteractive } = require('./codex-session-registry');
+
+const HOST = '127.0.0.1';
+
+/** Free loopback port (bind 0, read, close). Small race window is accepted:
+ * the app-server start failing is handled by the caller's fallback. */
+function pickFreePort() {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.once('error', reject);
+    srv.listen(0, HOST, () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
+}
+
+function wsUrlFor(port) {
+  return `ws://${HOST}:${port}`;
+}
+
+function openWs(url, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    if (typeof WebSocket !== 'function') return reject(new Error('global WebSocket unavailable (Node >= 22 required)'));
+    let ws;
+    const timer = setTimeout(() => { try { ws && ws.close(); } catch {} reject(new Error('ws open timeout')); }, timeoutMs);
+    try { ws = new WebSocket(url); } catch (e) { clearTimeout(timer); return reject(e); }
+    ws.onopen = () => { clearTimeout(timer); resolve(ws); };
+    ws.onerror = () => { clearTimeout(timer); try { ws.close(); } catch {} reject(new Error('ws connect error')); };
+  });
+}
+
+/** Bounded wait until the ws endpoint accepts a connection. `isAlive` lets the
+ * caller abort early when the app-server child already died. Resolves true/false. */
+async function waitForWs(url, { timeoutMs = 15000, intervalMs = 250, isAlive = () => true } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!isAlive()) return false;
+    try {
+      const ws = await openWs(url, 1500);
+      try { ws.close(); } catch {}
+      return true;
+    } catch { /* not up yet */ }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+  return false;
+}
+
+/** Minimal JSON-RPC client over one ws connection (initialize done). */
+async function connectRpc(url, { timeoutMs = 5000 } = {}) {
+  const ws = await openWs(url, timeoutMs);
+  let nextId = 0;
+  const pending = new Map();
+  ws.onmessage = (ev) => {
+    let m; try { m = JSON.parse(typeof ev.data === 'string' ? ev.data : String(ev.data)); } catch { return; }
+    if (m && m.id != null && pending.has(m.id)) { const p = pending.get(m.id); pending.delete(m.id); p(m); }
+  };
+  ws.onclose = () => { for (const p of pending.values()) p({ error: { message: 'ws closed' } }); pending.clear(); };
+  const call = (method, params) => new Promise((resolve, reject) => {
+    const id = ++nextId;
+    const t = setTimeout(() => { pending.delete(id); reject(new Error(`${method} timeout`)); }, timeoutMs);
+    pending.set(id, (m) => { clearTimeout(t); m.error ? reject(new Error(m.error.message || 'rpc error')) : resolve(m.result); });
+    ws.send(JSON.stringify({ id, method, params }));
+  });
+  await call('initialize', { clientInfo: { name: 'bifrost-launch', version: '1.0' } });
+  return { call, close: () => { try { ws.close(); } catch {} } };
+}
+
+/** Live-verified shapes (codex-cli 0.159.2): `thread/loaded/list` ->
+ * {result:{data:[threadId,…]}} (threads loaded in THIS app-server);
+ * `thread/list` -> {result:{data:[{id,updatedAt,…}]}} (global across CODEX_HOME,
+ * so it is only used to rank ids that are loaded here). */
+async function listLoadedThreads(rpc) {
+  const r = await rpc.call('thread/loaded/list', {});
+  return Array.isArray(r && r.data) ? r.data.filter((x) => typeof x === 'string') : [];
+}
+async function listRecentUpdated(rpc) {
+  try {
+    const r = await rpc.call('thread/list', { limit: 50 });
+    const rows = Array.isArray(r && r.data) ? r.data : [];
+    const m = new Map();
+    for (const t of rows) if (t && typeof t.id === 'string') m.set(t.id, Number(t.updatedAt) || 0);
+    return m;
+  } catch { return new Map(); }
+}
+
+/** Pure choice rule. `seen` (Map id -> first-seen order) is mutated.
+ * - a thread that appeared since the last poll wins (the TUI's /new thread),
+ *   newest first-seen if several;
+ * - else keep `current` while it is still loaded;
+ * - else (first discovery / current gone) highest updatedAt among loaded,
+ *   falling back to the most recently first-seen. */
+function chooseThread(loaded, updated, seen, current) {
+  const fresh = [];
+  for (const id of loaded) if (!seen.has(id)) { seen.set(id, seen.size + 1); fresh.push(id); }
+  if (!loaded.length) return null;
+  if (current && fresh.length === 0 && loaded.includes(current)) return current;
+  if (current && fresh.length) return fresh[fresh.length - 1];
+  const ranked = [...loaded].sort((a, b) => (updated.get(b) || 0) - (updated.get(a) || 0) || seen.get(b) - seen.get(a));
+  return ranked[0];
+}
+
+/** Remove only THIS launcher's interactive entry (matched by pid + ws_url) so a
+ * concurrently registered session of another launcher is never clobbered. */
+function unregisterInteractive(projectRoot, wsUrl, pid) {
+  try {
+    if (!fs.existsSync(registryPath(projectRoot))) return false;
+    const all = readRegistry(projectRoot);
+    const keep = all.filter((e) => !(e && e.kind === 'interactive' && e.ws_url === wsUrl && (pid == null || e.pid === pid)));
+    if (keep.length === all.length) return false;
+    writeRegistry(projectRoot, keep);
+    return true;
+  } catch { return false; }
+}
+
+/** Poll loop: register (and re-register on thread change) until stop(). */
+function startThreadWatcher({ projectRoot, wsUrl, pid, intervalMs = 2000, log = () => {} }) {
+  let stopped = false, rpc = null, current = null, timer = null, inflight = null;
+  const seen = new Map();
+  async function tick() {
+    if (stopped) return;
+    if (inflight) return inflight;
+    inflight = run().finally(() => { inflight = null; });
+    return inflight;
+  }
+  async function run() {
+    try {
+      if (!rpc) rpc = await connectRpc(wsUrl);
+      const loaded = await listLoadedThreads(rpc);
+      const updated = loaded.length > 1 || !current ? await listRecentUpdated(rpc) : new Map();
+      const pick = chooseThread(loaded, updated, seen, current);
+      if (stopped) return;
+      if (pick && pick !== current) {
+        if (registerInteractive(projectRoot, wsUrl, pick, pid)) { current = pick; log(`push target thread ${pick}`); }
+      }
+    } catch (e) {
+      log(`watcher: ${e.message}`);
+      if (rpc) { rpc.close(); rpc = null; }
+    }
+  }
+  timer = setInterval(tick, intervalMs);
+  tick();
+  return {
+    current: () => current,
+    tick,
+    stop() {
+      stopped = true; clearInterval(timer);
+      if (rpc) rpc.close();
+      unregisterInteractive(projectRoot, wsUrl, pid);
+    },
+  };
+}
+
+/** TUI argv: today's args, plus `--remote` only when an app-server is live. */
+function buildTuiArgs(baseArgs, wsUrl) {
+  return wsUrl ? ['--remote', wsUrl, ...baseArgs] : [...baseArgs];
+}
+
+/** Same rule as codex_wake.rs codex_push_enabled: <project>/.kenaz/peer.yaml has a
+ * line `codex_push: true` (quotes allowed); missing/unreadable file = off. The
+ * launcher only enters push-target mode (app-server + --remote) when this is on,
+ * so rooms that did not opt in keep the plain TUI. */
+function codexPushEnabled(projectRoot) {
+  let raw;
+  try { raw = fs.readFileSync(require('path').join(projectRoot, '.kenaz', 'peer.yaml'), 'utf8'); } catch { return false; }
+  return raw.split(/\r?\n/).some((line) => {
+    const t = line.trim();
+    if (!t.startsWith('codex_push:')) return false;
+    return t.slice('codex_push:'.length).trim().replace(/^["']+|["']+$/g, '') === 'true';
+  });
+}
+
+module.exports = {
+  HOST, pickFreePort, wsUrlFor, waitForWs, connectRpc, listLoadedThreads, listRecentUpdated,
+  chooseThread, unregisterInteractive, startThreadWatcher, buildTuiArgs, codexPushEnabled,
+};

package/core/.formation/bifrost/shared/codex-injection.js

@@ -0,0 +1,126 @@
+/**
+ * Bifröst Codex Anti-Drift Injection
+ *
+ * Codex-specific reinforcement that hardens compliance against the
+ * recurring failure modes observed in 4/7-4/9 audit (28-hour Codex
+ * Ansuz session). It does NOT replace the specialist kernel — it
+ * prepends to it so the model sees the guards before any kernel content.
+ *
+ * Used by:
+ *   - .formation/bifrost/launch.js   (interactive Codex via AGENTS.override.md)
+ *   - .formation/bifrost/session.js  (headless Codex via relay stdin)
+ *
+ * Each section addresses a specific failure mode with evidence + a
+ * detection signal where possible. Behavioral, not abstract.
+ *
+ * Audit reference: 2026-04-09 Claude Ansuz post-Codex audit.
+ *   - 78-line attribution lie in TASK_1088 commit 820af5fe
+ *   - smoke tests committing source files (TASK_1085/1087/1088)
+ *   - 56 worktrees + 142 branches + 143 stashes accumulated
+ *   - dispatch-notifier.js regression 4 hours after creating it
+ *   - preservation-coordinator.js (235 lines) stranded on task branch
+ *   - 9 conflict regions when trying to recover muninn.js orphan
+ */
+
+'use strict';
+
+function renderCodexAntiDrift() {
+  return `# Bifröst Codex Anti-Drift Protocols
+Guards against failure modes seen in long Codex Ansuz runs (2026-04-09 audit). Rules only — the incident history lives in the header comment of .formation/bifrost/shared/codex-injection.js.
+
+## Anti-Drift 1: DDx First (mechanism before action)
+Non-trivial problem on first contact:
+- You MUST enumerate 3 or more competing hypotheses before the first domain-specific tool call.
+- You MUST perform recall (synapse_recall / cortex_recall) before acting when memory tools are available.
+- You MUST NOT treat the first plausible idea as the plan.
+
+Direct attempt is only allowed when one of these is true:
+- The task is trivial and local, with no meaningful ambiguity.
+- The mechanism is already known and the remaining work is bounded execution, not diagnosis.
+
+If two attempts fail or a hypothesis dies:
+- Stop variant-fiddling.
+- Re-run DDx with fresh competing hypotheses.
+- State what assumption just failed.
+
+If you cannot state the mechanism in one sentence, you are not ready to brute force. Go back to DDx.
+
+## Anti-Drift 2: OUTCOME HONESTY (no lying outcome JSON)
+Audits trust outcome JSON as ground truth, so a wrong actual_files list is the most damaging failure.
+
+Mandatory verification before declaring a task complete:
+1. Run \`git show HEAD --name-only\` and capture every non-merge file.
+2. outcome.actual_files MUST equal that list. No exceptions.
+3. Never list only agent-generated artifacts (chart_*.json, session logs) — if the commit touched source files, those source files MUST appear.
+4. If a file was modified that is NOT in scope_paths, mark it in outcome.surprise_files. Do NOT hide it.
+
+Detection signal: \`diff <(jq -r '.outcome.actual_files[]' task.yaml | sort) <(git show HEAD --name-only | grep -v '^$' | sort)\` MUST return empty. If it doesn't, the outcome is lying.
+
+## Anti-Drift 3: SCOPE LOCK (smoke test discipline)
+If task tags include "smoke" or "runtime" AND any requirement contains "do not modify source files" or "no source files are modified":
+- You MUST NOT call Edit, Write, or any source-mutating tool on files outside scope_paths.
+- BEFORE you start the task, capture the working tree baseline: \`git stash push -u -m "pre-smoke-baseline-${'$'}{TASK_ID}"\`. This separates pre-existing dirty state from your task.
+- BEFORE the final commit, verify the staged set: \`git diff --cached --name-only\` MUST be empty or contain only files within scope_paths. If it contains anything else, abort the commit and investigate.
+- AFTER the task, restore the baseline: \`git stash pop\` (or leave it for the next task to handle if scope still ambiguous).
+
+post-complete.js isRuntimeOnlySmokeTask() is a safety net, not a substitute for these checks.
+
+## Anti-Drift 4: GIT-LOG-FIRST (no self-duplication)
+Before starting any task:
+1. \`git log --oneline -20 --all --grep="${'$'}{TASK_ID}"\` — if the task was already attempted, READ those commits before redoing.
+2. \`git branch --list "task/task_${'$'}{TASK_ID_LOWER}*"\` — if a task branch exists, check what's on it: \`git log main..task/task_xxx --oneline\`.
+3. \`git stash list | grep -i "${'$'}{TASK_ID}"\` — if a stash references the task, look inside before recreating work.
+
+If prior work exists and is partially correct, EXTEND it. Do NOT start over. Self-duplication is a compliance failure.
+
+## Anti-Drift 5: WORKTREE BOOKKEEPING (no orphan accumulation)
+After EVERY successful task, before moving to the next:
+1. \`git status --short\` MUST be empty (or contain only runtime state files like .synapse/, .kenaz/specialist/*).
+2. If the task used a worktree: once it is merged (merge only when authorized, see Anti-Drift 6), prune it: \`git worktree remove .formation/worktrees/task_task_XXX\` then \`git branch -d task/task_XXX\`. Unmerged work keeps its worktree and is reported as committed_unmerged.
+3. If you created stashes during the task, either pop them or document why they're being kept.
+
+post-complete.js "auto-stash before checkout" is an emergency backup, not a workflow; every stash left behind is debt.
+
+## Anti-Drift 6: STRANDED CHECK (report the true integration state)
+Before reporting any task:
+1. Get your commit SHA: \`git rev-parse HEAD\`.
+2. Check where it is: \`git branch --contains <sha>\`.
+3. Report exactly one state: verified_uncommitted, committed_unmerged, or merged. Only "merged" (sha reachable from main) is integrated.
+4. Merge only when merge is authorized (explicit user confirmation, or an active autonomy grant per elixir.yaml autonomy.merge_authority). Never merge just to make a task look complete.
+5. For multi-step tasks where step 2 consumes files added in step 1, verify step 1's files exist on the branch step 2 runs against.
+
+Calling committed_unmerged work "done" is a failure; so is an unauthorized merge.
+
+## Anti-Drift 7: PHASE 9 MANDATORY (verify every requirement)
+Never accept an agent's self-report as verification. Phase 9 is NOT optional. For EVERY requirement and acceptance criterion:
+- If it mentions a file path, grep the file for the named change.
+- If it mentions a function/symbol/flag, grep for it.
+- If it mentions a CLI command (\`node -e "require..."\`, \`grep ... returns non-empty\`), RUN that command.
+- If it mentions an HTTP endpoint, curl it.
+
+Only mark a task complete when EVERY requirement passes its grep/run check. If even one fails, create a FIX task and dispatch it. Half-done is not done.
+
+## Anti-Drift 8: PROACTIVE LESSON CAPTURE (R-301 alignment)
+Proactive lesson capture is mandatory (R-301), so the next session does not rediscover every gotcha.
+
+When you observe a non-obvious technical fact during a session — bug root cause, surprising tool behavior, infrastructure quirk, workflow trap, performance gotcha — inscribe it as an ash rune IMMEDIATELY without waiting for user prompt.
+
+Inscription protocol:
+1. Identify the closest STABLE existing code symbol as the rune anchor (file:function:kind format). Bare file paths are weak anchors and may fail FTS5 indexing silently.
+2. \`synapse_inscribe\` with type=ash, confidence>=0.85, content in ENGLISH (MEM-LANG-001 — FTS5 cannot tokenize CJK reliably).
+3. ALWAYS include trigger_phrases (3-5 natural language phrases) for semantic recall.
+4. WRITE-VERIFY: after inscribe, run \`synapse_recall\` with a unique substring from the rune content. If result_count=0, re-inscribe with a different verified symbol_id, OR fall back to writing to .kenaz/specialist/lessons_pending_index.jsonl.
+
+Anti-patterns to avoid:
+- Inscribing on a non-existent symbol_id (silent index failure).
+- Skipping write-verify ("trust the success message" — discovered 2026-04-09 that inscribe API can return success while FTS5 indexing does not happen).
+- Chinese/CJK content in rune body (FTS5 returns 0 results for CJK queries).
+- Generic content ("we hit a bug, fixed it") — provides no recall value.
+
+## Closing Note
+If a kernel/elixir rule and an Anti-Drift protocol conflict: kernel/elixir wins on identity and safety, Anti-Drift wins on execution and verification.
+
+`;
+}
+
+module.exports = { renderCodexAntiDrift };