kijito-tools 0.2.0

package/providers/codex/test/n0-subject-boundary.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
+const SUBJECT_DIR = "providers/codex/n0-harness";
+const BASE_COMMIT = "afe5afef156e45523d129525360dfff05a11045c";
+
+const BASE_HASHES = new Map(Object.entries({
+  "providers/codex/n0-harness/cli.mjs": "0662c199ce81ac8adb315293db59903d2dab16a61c0a51a0985ce722a9013cef",
+  "providers/codex/n0-harness/evidence-manifest.mjs": "7d1f9f4a578e532f9e80f9c045f1f9508258c7d68258aa5146fced30f5c70008",
+  "providers/codex/n0-harness/fixture.mjs": "ce9f8f709e9673b074e6a9f2322fa6d1718a7551c37ecb7af2966466d11c2725",
+  "providers/codex/n0-harness/lib.mjs": "f32cb7f7347f11c2a4ec61194919bca30cb535f167a4e08f0ad6ac1ac276c8bf",
+  "providers/codex/n0-harness/manifest.mjs": "4d9531d40efa9bb7455a121630195114cadb0517a0f525c3d0a009131bb7b55a",
+  "providers/codex/n0-harness/oracle.mjs": "4ecd55183def821b2f67ec9517d4aa4c042450a852d404a3abfdb9537ff42a5e",
+  "providers/codex/n0-harness/parser.mjs": "4844fadf2fc8d62421dff9d7474e837d48d1ab13da9947ee1559d7063c768146",
+  "providers/codex/n0-harness/prompt.mjs": "1a84084a9f061656c6059c15ff53c508ca5e14fd3831849b90213705bb31c8bb",
+  "providers/codex/n0-harness/snapshot.mjs": "1067a4ebe71e027fc1dc6aa5df397efd2abb30f1a52723f12ba2f62813996cbd",
+  "providers/codex/n0-harness/specimen.mjs": "6adace1ba6ab571624533aa72c4f0c7dfe474b6a797ad247488c62e0dd23dc25",
+  "providers/codex/test/n0-harness.test.mjs": "fb0778e2f1d0ae95dab1cf19f13cbac25bc9786ea63167cdf3707d3c0fd04bce",
+}));
+
+const CLI_CURRENT_HASH = "f5e20e51391985124ff2ddd53e100e5461ca517e0253480adb3e413be1979001";
+const CLI_REVERSE_PATCHES = [
+  [
+    `    if (!key?.startsWith("--") || value === undefined) {\n      usage();\n      return null;\n    }`,
+    `    if (!key?.startsWith("--") || value === undefined) usage();`,
+  ],
+  [
+    `function main(argv) {\n  const parsed = args(argv);\n  if (!parsed) return;\n  const { command, options } = parsed;`,
+    `try {\n  const { command, options } = args(process.argv.slice(2));`,
+  ],
+  [
+    `  if (!options.root || !path.isAbsolute(options.root)) {\n    usage();\n    return;\n  }`,
+    `  if (!options.root || !path.isAbsolute(options.root)) usage();`,
+  ],
+  [
+    `    if (!options.specimen || !options.evidence) {\n      usage();\n      return;\n    }`,
+    `    if (!options.specimen || !options.evidence) usage();`,
+  ],
+  [
+    `  } else {\n    usage();\n  }\n}\n\ntry {\n  main(process.argv.slice(2));\n} catch (error) {`,
+    `  } else {\n    usage();\n  }\n} catch (error) {`,
+  ],
+];
+
+function fail(code, detail) {
+  throw new Error(`${code}: ${detail}`);
+}
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function replaceExactlyOnce(source, from, to, index) {
+  const first = source.indexOf(from);
+  if (first === -1 || source.indexOf(from, first + 1) !== -1) {
+    fail("N0_SUBJECT_CLI_PATCH", `reverse patch ${index + 1} must match exactly once`);
+  }
+  return `${source.slice(0, first)}${to}${source.slice(first + from.length)}`;
+}
+
+const expectedProduction = [...BASE_HASHES.keys()]
+  .filter((file) => file.startsWith(`${SUBJECT_DIR}/`))
+  .sort();
+const actualProduction = readdirSync(path.join(ROOT, SUBJECT_DIR), { withFileTypes: true })
+  .filter((entry) => entry.isFile() && entry.name.endsWith(".mjs"))
+  .map((entry) => `${SUBJECT_DIR}/${entry.name}`)
+  .sort();
+
+if (JSON.stringify(actualProduction) !== JSON.stringify(expectedProduction)) {
+  fail("N0_SUBJECT_INVENTORY", `expected=${JSON.stringify(expectedProduction)} actual=${JSON.stringify(actualProduction)}`);
+}
+
+for (const [file, expectedBaseHash] of BASE_HASHES) {
+  const source = readFileSync(path.join(ROOT, file));
+  const currentHash = sha256(source);
+  if (file.endsWith("/cli.mjs")) {
+    if (currentHash !== CLI_CURRENT_HASH) {
+      fail("N0_SUBJECT_CLI_CURRENT", `expected=${CLI_CURRENT_HASH} actual=${currentHash}`);
+    }
+    let reconstructedBase = source.toString("utf8");
+    for (const [index, [from, to]] of CLI_REVERSE_PATCHES.entries()) {
+      reconstructedBase = replaceExactlyOnce(reconstructedBase, from, to, index);
+    }
+    const reconstructedHash = sha256(reconstructedBase);
+    if (reconstructedHash !== expectedBaseHash) {
+      fail("N0_SUBJECT_CLI_BASE", `base=${BASE_COMMIT} expected=${expectedBaseHash} actual=${reconstructedHash}`);
+    }
+  } else if (currentHash !== expectedBaseHash) {
+    fail("N0_SUBJECT_DRIFT", `${file} base=${BASE_COMMIT} expected=${expectedBaseHash} actual=${currentHash}`);
+  }
+}
+
+process.stdout.write(`N0_SUBJECT_BOUNDARY_GREEN base=${BASE_COMMIT} productionFiles=${actualProduction.length} allowedDelta=cli-control-flow\n`);

package/providers/codex/test/n0-subject-boundary.test.mjs

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import { afterEach, test } from "node:test";
+import { appendFileSync, cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
+const temporaryRoots = [];
+
+afterEach(() => {
+  for (const root of temporaryRoots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function makeSpecimen() {
+  const root = mkdtempSync(path.join(tmpdir(), "n0-subject-boundary-"));
+  temporaryRoots.push(root);
+  mkdirSync(path.join(root, "providers/codex/test"), { recursive: true });
+  cpSync(path.join(ROOT, "providers/codex/n0-harness"), path.join(root, "providers/codex/n0-harness"), { recursive: true });
+  cpSync(path.join(ROOT, "providers/codex/test/n0-subject-boundary.mjs"), path.join(root, "providers/codex/test/n0-subject-boundary.mjs"));
+  cpSync(path.join(ROOT, "providers/codex/test/n0-harness.test.mjs"), path.join(root, "providers/codex/test/n0-harness.test.mjs"));
+  return root;
+}
+
+function run(root) {
+  return spawnSync(process.execPath, ["providers/codex/test/n0-subject-boundary.mjs"], {
+    cwd: root,
+    encoding: "utf8",
+  });
+}
+
+test("subject boundary accepts only the reviewed current bytes", () => {
+  const result = run(makeSpecimen());
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /^N0_SUBJECT_BOUNDARY_GREEN /m);
+});
+
+test("subject boundary rejects production drift and new modules", () => {
+  const driftRoot = makeSpecimen();
+  appendFileSync(path.join(driftRoot, "providers/codex/n0-harness/oracle.mjs"), "\n// drift\n");
+  const drift = run(driftRoot);
+  assert.notEqual(drift.status, 0);
+  assert.match(drift.stderr, /N0_SUBJECT_DRIFT/);
+
+  const inventoryRoot = makeSpecimen();
+  writeFileSync(path.join(inventoryRoot, "providers/codex/n0-harness/extra.mjs"), "export {};\n");
+  const inventory = run(inventoryRoot);
+  assert.notEqual(inventory.status, 0);
+  assert.match(inventory.stderr, /N0_SUBJECT_INVENTORY/);
+});
+
+test("subject boundary rejects a changed or merely base-restored CLI", () => {
+  const changedRoot = makeSpecimen();
+  appendFileSync(path.join(changedRoot, "providers/codex/n0-harness/cli.mjs"), "\n// drift\n");
+  const changed = run(changedRoot);
+  assert.notEqual(changed.status, 0);
+  assert.match(changed.stderr, /N0_SUBJECT_CLI_CURRENT/);
+
+  const baseRoot = makeSpecimen();
+  const cli = path.join(baseRoot, "providers/codex/n0-harness/cli.mjs");
+  const source = readFileSync(cli, "utf8")
+    .replace(`    if (!key?.startsWith("--") || value === undefined) {\n      usage();\n      return null;\n    }`, `    if (!key?.startsWith("--") || value === undefined) usage();`)
+    .replace(`function main(argv) {\n  const parsed = args(argv);\n  if (!parsed) return;\n  const { command, options } = parsed;`, `try {\n  const { command, options } = args(process.argv.slice(2));`)
+    .replace(`  if (!options.root || !path.isAbsolute(options.root)) {\n    usage();\n    return;\n  }`, `  if (!options.root || !path.isAbsolute(options.root)) usage();`)
+    .replace(`    if (!options.specimen || !options.evidence) {\n      usage();\n      return;\n    }`, `    if (!options.specimen || !options.evidence) usage();`)
+    .replace(`  } else {\n    usage();\n  }\n}\n\ntry {\n  main(process.argv.slice(2));\n} catch (error) {`, `  } else {\n    usage();\n  }\n} catch (error) {`);
+  writeFileSync(cli, source);
+  const base = run(baseRoot);
+  assert.notEqual(base.status, 0);
+  assert.match(base.stderr, /N0_SUBJECT_CLI_CURRENT/);
+});

package/providers/codex/test/same-chat-plan-preflight.sh

@@ -0,0 +1,167 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+repo=$(CDPATH= cd -- "$root/../.." && pwd)
+plan="$root/same-chat-continuation-plan.md"
+gate="$root/same-chat-continuation-plan-gate.md"
+readme="$root/README.md"
+repo_readme="$repo/README.md"
+installer="$root/install.mjs"
+parity_plan="$root/codex-kijito-parity-plan.md"
+dispatcher="$repo/install.sh"
+
+must_contain() (
+  file=$1
+  needle=$2
+  marker=$3
+  if command -v rg >/dev/null 2>&1; then
+    rg -F -q -- "$needle" "$file"
+  else
+    grep -F -q -- "$needle" "$file"
+  fi || {
+    printf 'RED %s missing: %s\n' "$marker" "$needle" >&2
+    exit 1
+  }
+  printf '%s\n' "$marker"
+)
+
+must_not_contain() (
+  file=$1
+  needle=$2
+  marker=$3
+  if command -v rg >/dev/null 2>&1; then
+    found=$(rg -F -c -- "$needle" "$file" || true)
+  else
+    found=$(grep -F -c -- "$needle" "$file" || true)
+  fi
+  found=${found:-0}
+  if [ "$found" -ne 0 ]; then
+    printf 'RED %s forbidden: %s\n' "$marker" "$needle" >&2
+    exit 1
+  fi
+)
+
+must_count() (
+  file=$1
+  needle=$2
+  expected=$3
+  marker=$4
+  if command -v rg >/dev/null 2>&1; then
+    found=$(rg -F -c -- "$needle" "$file" || true)
+  else
+    found=$(grep -F -c -- "$needle" "$file" || true)
+  fi
+  found=${found:-0}
+  if [ "$found" -ne "$expected" ]; then
+    printf 'RED %s expected %s occurrence(s), found %s: %s\n' \
+      "$marker" "$expected" "$found" "$needle" >&2
+    exit 1
+  fi
+  printf '%s\n' "$marker"
+)
+
+must_authority_line() (
+  line=$1
+  marker=$2
+  must_count "$plan" "$line" 2 "${marker}_PLAN"
+  must_count "$gate" "$line" 1 "${marker}_GATE"
+)
+
+# Each marker names a false-pass class in the gate record and is emitted only when the corresponding
+# rejection text is present. This is static presence lint; it does not construct a specimen.
+must_contain "$plan" "If Jason's installed build exposes no such independently" \
+  "FP01_IDENTITY_CHANNEL_REJECTED"
+must_contain "$plan" "a receipt without the matching native run identity is RED" \
+  "FP02_CHAT_ONLY_WORK_REJECTED"
+must_contain "$plan" "There is no assumed programmatic Scheduled management API" \
+  "FP03_UI_API_ASSUMPTION_REJECTED"
+must_contain "$plan" "never retries solely because the lease expired" \
+  "FP04_EXPIRED_LEASE_REPLAY_REJECTED"
+must_contain "$plan" '`BLOCKED_ROW(<id>)` and cannot advance the checkpoint' \
+  "FP05_POISON_GREEN_REJECTED"
+must_contain "$plan" '`mark_read=true` is courtesy presentation metadata' \
+  "FP06_UNREAD_ACK_REJECTED"
+must_contain "$plan" "The versioned, user-authored prompt fixes the allowed tools" \
+  "FP07_AUTHORITY_EXPANSION_REJECTED"
+must_contain "$plan" "ARMED is unreachable while PID 38082 or any legacy notifier" \
+  "FP08_DOUBLE_CONSUMER_REJECTED"
+must_contain "$plan" "proving the scheduled input queues and never uses steering" \
+  "FP09_STEER_REJECTED"
+must_contain "$plan" "Notification, summary," \
+  "FP10_SUMMARY_ONLY_REJECTED"
+
+for finding in L1 L2 L3 L4 L5 L6 L7 L8 L9 L10; do
+  must_contain "$gate" "| $finding " "ROUND1_${finding}_TRACED"
+done
+for finding in LB-1 LB-2 LB-3 LB-4 LB-5 LB-6 LB-7; do
+  must_contain "$gate" "| $finding " "ROUND2_${finding}_TRACED"
+done
+for finding in N-1 N-2 N-3; do
+  must_contain "$gate" "| $finding " "ROUND3_${finding}_TRACED"
+done
+must_contain "$gate" "| N4-1 " "ROUND5_N4-1_TRACED"
+
+# Gate-6 (2026-08-15): the withdrawn dedicated-thread notifier's install path was retired
+# outright with the controller era. The fences these three rows pin are now the RETIREMENT
+# declarations — same intent (nobody reinstalls or re-describes the notifier), stronger state.
+must_contain "$readme" "the controller era is over" "RETIRED_README_FENCE_PRESENT"
+# PR #25 (2026-09-08, public-ready sweep, codex-assessed msg 8877): the root README no longer carries the
+# withdrawal BANNER; the same intent is now the retirement declaration in the provider table. Pin that.
+must_contain "$repo_readme" 'The controller-era runtime is retired' \
+  "RETIRED_ROOT_README_FENCE_PRESENT"
+must_contain "$installer" "controller-era full install was retired at gate 6" \
+  "RETIRED_INSTALLER_FENCE_PRESENT"
+must_contain "$dispatcher" "controller-era full install retired at gate 6" \
+  "RETIRED_DISPATCHER_FENCE_PRESENT"
+must_contain "$parity_plan" "this historical plan does not authorize installation" \
+  "WITHDRAWN_PARITY_PLAN_FENCE_PRESENT"
+must_contain "$plan" "PR #5 is closed as withdrawn" "WITHDRAWN_PR_DISPOSITION_PRESENT"
+must_contain "$plan" 'segments, bytes, and start time as `DRAINING_BACKLOG`' \
+  "PARTIAL_BACKLOG_DRAIN_PRESENT"
+must_contain "$plan" 'Any release failure enters `CLAIM_RELEASE_FAILED(M)`' \
+  "CLAIM_RELEASE_FAILURE_FENCE_PRESENT"
+must_contain "$plan" '`REQUIRES_USER(M)` is a fenced terminal disposition, not a retry state.' \
+  "REQUIRES_USER_TERMINAL_PRESENT"
+must_contain "$plan" '`AMBIGUOUS_ACTION(M)` means crash reconciliation cannot prove' \
+  "AMBIGUOUS_ACTION_DEFINED"
+must_contain "$plan" 'For every runtime state or production execution bound added by a revision' \
+  "FIVE_POINT_STATE_CHECK_PRESENT"
+must_contain "$plan" 'No operator-authored checkpoint or control-plane field may be writable by a scheduled run.' \
+  "OPERATOR_WRITE_PARTITION_PRESENT"
+must_contain "$plan" '`CODEX_CONTINUATION_OPERATOR_DECISION_V1` journal' \
+  "OPERATOR_JOURNAL_PRESENT"
+must_contain "$plan" 'Exactly one rollout' \
+  "TARGET_CHAT_ACQUISITION_PRESENT"
+must_contain "$plan" 'Corrupt derived scan state' \
+  "CORRUPT_SCAN_REPAIR_PRESENT"
+must_contain "$plan" 'server age at most 135 seconds' \
+  "HEARTBEAT_BOUND_PRESENT"
+must_contain "$plan" 'single inbound row can terminally halt the lane' \
+  "TERMINAL_HALT_DISCLOSURE_PRESENT"
+must_contain "$gate" '| `DRAINING_BACKLOG` | enumerated | blocks ARMED |' \
+  "STATE_DRAINING_FIVE_POINT_TRACED"
+must_contain "$gate" '| `BLOCKED_ROW(id)` | enumerated | blocks ARMED |' \
+  "STATE_BLOCKED_ROW_FIVE_POINT_TRACED"
+must_contain "$gate" '| ten-slice/ten-minute bound → `REQUIRES_USER(id)` | enumerated | blocks ARMED |' \
+  "STATE_REQUIRES_USER_FIVE_POINT_TRACED"
+must_contain "$gate" '| `AMBIGUOUS_ACTION(id)` | enumerated | blocks ARMED |' \
+  "STATE_AMBIGUOUS_ACTION_FIVE_POINT_TRACED"
+must_contain "$gate" '| `CLAIM_RELEASE_FAILED(id)` | enumerated | blocks ARMED |' \
+  "STATE_CLAIM_RELEASE_FAILED_FIVE_POINT_TRACED"
+must_authority_line "**AUTHORITY:** Two consecutive Assay-CLEAN reviews of this exact plan digest open N0a/N0b only." \
+  "CANONICAL_AUTHORITY_LINE1"
+must_authority_line "GREEN N0 then authorizes disposable test-persona probes of the current N1-N3 surfaces, but no" \
+  "CANONICAL_AUTHORITY_LINE2"
+must_authority_line "Codex-provider or Kijito-server implementation. If N1 rejects the current API, a separate" \
+  "CANONICAL_AUTHORITY_LINE3"
+must_authority_line "provider-neutral claim/operator-decision API plan owned by River must receive two consecutive" \
+  "CANONICAL_AUTHORITY_LINE4"
+must_authority_line "Assay-CLEAN reviews before any such API code is written. An installable Codex provider remains" \
+  "CANONICAL_AUTHORITY_LINE5"
+must_authority_line "forbidden until N0-N3 are GREEN and Jason explicitly accepts N3." \
+  "CANONICAL_AUTHORITY_LINE6"
+must_not_contain "$gate" "INTERNAL GOLDEN" "NO_SELF_ATTESTED_GOLDEN"
+must_not_contain "$plan" "Only Assay CLEAN opens N0" "NO_SINGLE_CLEAN_GATE"
+
+printf 'PLAN_AUTHOR_PREFLIGHT_GREEN\n'

package/providers/codex/tools/refresh-manifest.mjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+// Recompute the gated hashes in providers/codex/release-manifest.json from the files on disk.
+//
+// WHY THIS IS A SCRIPT AND NOT A HAND EDIT. release-manifest.json records the sha256 of every
+// live executable artifact, and install.mjs (the verify path) refuses to pass when a hash
+// disagrees. That gate is the point — but it means ANY edit to a gated file leaves the manifest
+// stale, and the symptom is a verify-time error that reads like corruption rather than "you
+// forgot to refresh". Regenerating by hand also invites the failure mode where you refresh, then
+// make one more edit, and ship the stale hash.
+//
+//   node providers/codex/tools/refresh-manifest.mjs          # rewrite the manifest
+//   node providers/codex/tools/refresh-manifest.mjs --check   # verify only; non-zero if stale
+//
+// --check is what the conformance test runs, so a stale manifest fails the suite instead of
+// surfacing later as a mysterious verify failure.
+//
+// GATE-6 (2026-08-15): the controller-era entries were retired to the manifest's
+// `legacyArtifacts` block (files under legacy/codex-controller-era-2026-08/); this map now covers
+// only the LIVE set, and it deliberately does NOT touch legacyArtifacts — those hashes are frozen
+// provenance of what was retired, and re-stamping them would erase the record.
+//
+// The plan hash is likewise NOT recomputed: it is RECORDED provenance, not a gate (the fold
+// demoted it), and silently re-stamping it would erase the record of which plan revision the
+// release was actually reviewed against.
+
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const providerRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const manifestFile = path.join(providerRoot, "release-manifest.json");
+
+const GATED = {
+  // The shared wake core: executable code the wake helper imports at runtime (parseEventLine and
+  // fixedWakeText — the event validator and the injection fence). Gated since the fold; stays
+  // gated because splitting a gated import chain into gated + ungated halves would leave the
+  // fence editable while verify still reports GREEN.
+  wakeCoreSha256: path.join(providerRoot, "..", "_shared", "wake-core.mjs"),
+  // The CI workflow is the thing that RUNS all of the above. It was a modified companion of every
+  // recent round and declared nowhere, so a change to what CI executes left no trace in the
+  // manifest that records what the release is.
+  workflowSha256: path.join(providerRoot, "..", "..", ".github", "workflows", "test.yml"),
+  // Gate-5 native live wake (argus's PR#19 gating ruling, stated as a property: every executable
+  // artifact a skill/install path causes a user session to run belongs in the manifest).
+  // kijito-start's arm step names the helper, so the helper and its runtime import are gated;
+  // the tests + mock join per the gated-tests precedent (they are the helper's safety argument).
+  // status-probe.mjs and TRANSPORT-NOTES.md stay ungated: instrument + doc, not on the user path.
+  wakeHelperSha256: path.join(providerRoot, "wake-helper", "kijito-wake-helper.mjs"),
+  wsUdsSha256: path.join(providerRoot, "wake-helper", "ws-uds.mjs"),
+  wakeHelperTestsSha256: path.join(providerRoot, "wake-helper", "kijito-wake-helper.test.mjs"),
+  wakeHelperIntegrationTestsSha256: path.join(providerRoot, "wake-helper", "integration.test.mjs"),
+  wakeHelperMockDaemonSha256: path.join(providerRoot, "wake-helper", "mock-daemon.mjs"),
+};
+
+const sha256 = (file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+
+const manifest = JSON.parse(fs.readFileSync(manifestFile, "utf8"));
+const drift = [];
+for (const [key, file] of Object.entries(GATED)) {
+  const actual = sha256(file);
+  if (manifest.artifacts[key] !== actual) {
+    drift.push({ key, file: path.relative(providerRoot, file), was: manifest.artifacts[key], now: actual });
+    manifest.artifacts[key] = actual;
+  }
+}
+
+if (process.argv.includes("--check")) {
+  if (drift.length === 0) {
+    process.stdout.write("release-manifest.json: all gated hashes current\n");
+  } else {
+    for (const d of drift) process.stderr.write(`STALE ${d.key} (${d.file})\n  manifest: ${d.was}\n  on disk:  ${d.now}\n`);
+    process.stderr.write("Run: node providers/codex/tools/refresh-manifest.mjs\n");
+    process.exitCode = 1;
+  }
+} else if (drift.length === 0) {
+  process.stdout.write("release-manifest.json: already current, nothing written\n");
+} else {
+  fs.writeFileSync(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`);
+  for (const d of drift) process.stdout.write(`refreshed ${d.key} (${d.file}) -> ${d.now}\n`);
+}

package/providers/codex/wake-helper/TRANSPORT-NOTES.md

@@ -0,0 +1,25 @@
+# Daemon transport — measured facts (build verification, 2026-08-15 00:3x-00:5xZ)
+
+Source: openai/codex tag rust-v0.147.0 (sparse clone, /tmp/codex-src on the Mac) + live smoke
+against a real daemon in a THROWAWAY CODEX_HOME (/tmp/kijito-smoke-*; the staged gate-4
+sandbox untouched).
+
+1. **The control socket is a WebSocket server over the UDS** (`app-server-transport/src/
+   transport/unix_socket.rs`: tungstenite `accept_async` on the UnixStream). Raw JSONL
+   written to the socket is silently ignored at the handshake layer — measured: initialize
+   timed out over both raw socket and `codex app-server proxy` (which proxies bytes, not
+   framing).
+2. **Client dial**: UnixStream connect → RFC6455 client handshake with URL `ws://localhost/rpc`
+   (`app-server-client/src/remote.rs`, `UDS_WEBSOCKET_HANDSHAKE_URL`) → JSON-RPC, one message
+   per text frame. No auth on UDS (0600 socket mode is the auth; bearer/JWT applies to
+   non-loopback websocket listeners only).
+3. **Daemon needs the managed standalone install** under `$CODEX_HOME/packages/standalone/
+   current/codex` — a throwaway home works by symlinking the real `~/.codex/packages`.
+4. **Live smoke results** (real daemon, 0.147.0): initialize OK (server echoes a composed
+   userAgent), `thread/start {cwd, ephemeral:false}` OK (id + status=idle returned),
+   `thread/resume {threadId}` on a FRESH thread fails `-32600 no rollout found` — a rollout
+   exists only once a thread has recorded turns. The helper's real target (the user's live
+   session thread) always has turns; the BATTERY must create its session thread with one real
+   turn before attaching the helper (added to battery preconditions).
+5. Helper + mock + tests all speak the measured transport (`ws-uds.mjs`, zero-dep RFC6455
+   client+server-accept; 16/16 tests green on it).