mtech-ai-local-runner 0.1.28 → 0.1.30

package/README.md

@@ -1,3 +1,43 @@
+## 0.1.30: governed local alert investigation evidence
+
+The Gateway candidate offers explicit Local Codex Runner or Local Claude Runner
+selection for read-only Sentry investigation. It binds the chosen adapter/model
+and employee device to the exact approved launch; it never falls back to another
+adapter. Each adapter retains authenticated host-owned bounded read observations
+through completion and cleanup. These counts are employee-runner evidence, not
+independent root-cause verification.
+
+This release does not remove Claude's current unsupported host-admission gate.
+An installed or authenticated CLI alone is not execution permission. Gateway
+deployment, feature activation and actual execution approvals remain separate.
+
+## 0.1.29: reviewed daemon Codex admission
+
+This candidate connects the installed, hash-pinned root policy observer to the
+existing employee-privileged Codex CLI adapter. The observer accepts only its
+fixed employee UID and runs only a fixed read-only machine-policy command; it
+never runs a model or reads credentials. A fresh per-job inventory and local
+forced-policy checks are required. Managed, partial, stale and unknown evidence
+block execution. This snapshot is not continuous machine-policy monitoring.
+
+The package alone does not install or start the privileged service. Deployment
+and employee-daemon upgrade remain separately approved operations. The daemon
+advertises Codex only when the installed observer and supported binary/account
+checks pass; the current account settings and Claude path are retained. Existing
+manual releases remain separately registered. Already approved foreground Codex
+acceptance is not daemon acceptance.
+
+Terminal completion requests are persisted before delivery and replayed with
+the original generation, lease and result after an unknown acknowledgement;
+this never reruns a model. Admitted task duration/count remain unbounded. The
+preparation, lease, cancellation, path and authenticated-MCP checks remain.
+
+Starting the upgraded employee daemon can refresh Gateway OAuth credentials.
+Future actual Codex execution may refresh its original shared account tokens.
+Neither effect is part of no-model local verification. See the repository
+`docs/ai-ops-gateway/codex-daemon-admission-validation.md` for exact evidence and
+remaining acceptance gates.
+
 # MTEC AI Local Runner
 
 Install and configure the employee-bound macOS daemon:
@@ -8,7 +48,15 @@ npx mtech-ai-local-runner setup
 
 The package stores safe runner configuration locally and keeps OAuth refresh credentials in macOS Keychain when available.
 
-Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
+Public npm installation requires no npm account or publishing OTP. Setup requires
+the employee's own Gateway OAuth login and a supported, authenticated selected
+CLI. Codex uses the employee's ChatGPT account. Claude requires its own login
+and a separately verified host admission; it is currently not admitted.
+
+For the current unattended Codex pilot, an administrator must separately install
+the reviewed, employee-UID-bound policy observer on that Mac. The npm setup
+command does not install that privileged service. A fresh employee computer is
+not ready merely because npm installation succeeds.
 
 ## 0.1.28: completion receipt wire compatibility
 

package/dist/src/adapters/claude-code/adapter.js

@@ -8,6 +8,7 @@ import { completionEvent } from "./completion-report.js";
 import { requireJobSecurity } from "../../safety/job-security-policy.js";
 import { HOOK_POLICY_ENV_VAR, buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
 import { formatHookCommand } from "../../safety/hook-command.js";
+import { localEndpointReadObservations } from '../../safety/local-tool-server.js';
 const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV", "CLAUDE_CONFIG_DIR"];
 const ALLOWED_SUPERVISOR_COMMANDS = new Set(["continue", "answer_question", "request_revision", "request_checkpoint", "submit_for_review"]);
 const LOCAL_NAMES = ["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`);
@@ -44,7 +45,16 @@ export class ClaudeCodeAdapter {
     cancelled = false;
     started = false;
     receipt;
+    toolEndpoint;
+    readSnapshot;
     securityReceipt() { return this.receipt ? structuredClone(this.receipt) : undefined; }
+    localReadObservations() {
+        const endpoint = this.toolEndpoint;
+        const observed = endpoint ? localEndpointReadObservations(endpoint.url, endpoint.token) : undefined;
+        if (observed)
+            this.readSnapshot = observed;
+        return this.readSnapshot ? structuredClone(this.readSnapshot) : undefined;
+    }
     constructor(options) {
         this.options = options;
     }
@@ -97,6 +107,7 @@ export class ClaudeCodeAdapter {
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             const endpoint = await this.tools.start();
+            this.toolEndpoint = endpoint;
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             const mcpConfigPath = this.options.writeLocalMcpConfig(endpoint);
@@ -222,6 +233,8 @@ export class ClaudeCodeAdapter {
         await this.cleanup();
     }
     async cleanup() {
+        this.localReadObservations();
+        this.toolEndpoint = undefined;
         const tools = this.tools;
         const handle = this.handle;
         this.tools = undefined;

package/dist/src/adapters/codex/adapter.js

@@ -19,6 +19,7 @@ export class CodexAdapter {
     started = false;
     receipt;
     terminalAudit;
+    localReadObservations() { return this.usingOfficialExec ? this.ownedExec?.localReadObservations() : undefined; }
     securityReceipt() { return this.terminalAudit ? structuredClone(this.terminalAudit) : this.usingOfficialExec ? this.ownedExec?.receipt() : this.receipt ? structuredClone(this.receipt) : undefined; }
     cancelled = false;
     usingOfficialExec = false;

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,6 +1,6 @@
 import { performance } from 'node:perf_hooks';
 import { PreparationClock, CODEX_PREPARATION_BUDGET_MS } from '../../safety/preparation-timing.js';
-import { localEndpointObservations } from '../../safety/local-tool-server.js';
+import { localEndpointObservations, localEndpointReadObservations } from '../../safety/local-tool-server.js';
 import { processStartupObservations, freezeProcessLaunchObservation } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
@@ -24,6 +24,7 @@ export class CodexExecLaunchHost {
     handle;
     inspection;
     exitAudit;
+    readAudit;
     inspectionFingerprint;
     handshake;
     receiptValue;
@@ -105,7 +106,7 @@ export class CodexExecLaunchHost {
                 this.inspectionFingerprint = hash(this.inspection.snapshot);
                 this.current();
                 const invocation = requireOfficialExecPlan(this.plan);
-                const manual = ctx.approvedTaskPackage?.security_requirements?.mdm_verification === 'manual_prelaunch';
+                const manual = ctx.approvedTaskPackage?.security_requirements?.mdm_verification !== undefined;
                 if (manual && typeof this.inspection.beforeSpawn !== 'function')
                     throw fail();
                 assertPreparationBudget();
@@ -233,9 +234,22 @@ export class CodexExecLaunchHost {
     catch {
         return undefined;
     } }
+    localReadObservations() {
+        if (!this.stopped) {
+            try {
+                const token = requireOfficialExecPlan(this.plan).env.AI_GATEWAY_JOB_MCP_TOKEN;
+                const current = token ? localEndpointReadObservations(this.plan.endpoint, token) : undefined;
+                if (current)
+                    this.readAudit = current;
+            }
+            catch { /* Absent observation is never interpreted as successful reads. */ }
+        }
+        return this.readAudit ? structuredClone(this.readAudit) : undefined;
+    }
     cancel() {
         if (this.closePromise)
             return this.closePromise;
+        this.localReadObservations();
         this.stopped = true;
         this.receiptValue = undefined;
         if (!this.ownsAttempt) {

package/dist/src/adapters/codex/exec-release-policy.js

@@ -1,3 +1,4 @@
+import { PRIVILEGED_MDM_MODE, PRIVILEGED_MDM_RISK, validPolicyObserverPin } from './prelaunch-policy.js';
 import { MANUAL_MDM_RISK } from './manual-policy-scope.js';
 import { UNMANAGED_EXEC_MODE, UNMANAGED_SCOPE, requirePolicyScope } from './unmanaged-scope.js';
 import { isDeepStrictEqual } from 'node:util';
@@ -6,13 +7,13 @@ export const EXEC_RELEASE_GATES = Object.freeze(['binary_release', 'official_per
 export const EXEC_INPUT_GATES = Object.freeze(['exact_inputs', 'launch_binding', 'repository_scope', 'private_paths_environment', 'owned_lifecycle']);
 export const EXEC_RELEASE_RISKS = Object.freeze(['vendor_native_policy_enforcement', 'managed_policy_not_directly_observed_per_job', 'first_inference_order_not_observed_per_job', 'job_mcp_token_possession_not_os_identity', 'account_startup_may_refresh_shared_credentials']);
 export const releaseGates = (mode) => mode === UNMANAGED_EXEC_MODE ? EXEC_RELEASE_GATES.map(g => g === 'managed_policy_enforcement' ? 'managed_scope_exclusion' : g) : EXEC_RELEASE_GATES;
-export const releaseRisks = (mode, mdmVerification) => mode === UNMANAGED_EXEC_MODE ? [...EXEC_RELEASE_RISKS, 'concurrent_policy_change_not_atomic', 'local_account_metadata_not_remote_entitlement', ...(mdmVerification === 'manual_prelaunch' ? [MANUAL_MDM_RISK] : [])] : EXEC_RELEASE_RISKS;
+export const releaseRisks = (mode, mdmVerification) => mode === UNMANAGED_EXEC_MODE ? [...EXEC_RELEASE_RISKS, 'concurrent_policy_change_not_atomic', 'local_account_metadata_not_remote_entitlement', ...(mdmVerification === 'manual_prelaunch' ? [MANUAL_MDM_RISK] : mdmVerification === PRIVILEGED_MDM_MODE ? [PRIVILEGED_MDM_RISK] : [])] : EXEC_RELEASE_RISKS;
 const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const exact = (v, keys) => isDeepStrictEqual(Object.keys(v).sort(), keys.sort());
 const checks = (v, gates, basis) => Array.isArray(v) && v.length === gates.length && gates.every(g => v.filter(c => record(c) && exact(c, ['gate', 'status', 'basis']) && c.gate === g && c.status === 'verified' && c.basis === basis).length === 1);
 export function requireReleaseDescriptor(r) {
     const v3 = r.security_mode === UNMANAGED_EXEC_MODE;
-    if (!['release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'fingerprint'].every(k => typeof r[k] === 'string' && /^[a-f0-9]{64}$/.test(r[k])) || !Array.isArray(r.model_ids) || !r.model_ids.length || new Set(r.model_ids).size !== r.model_ids.length || r.model_ids.some(m => typeof m !== 'string' || !m || m.length > 255 || /[\r\n\0]/.test(m)) || !exact(r, ['version', 'security_mode', 'transport', 'status', 'adapter_id', 'adapter_version', 'mandatory_gates', 'accepted_residual_risks', 'evidence_class', 'release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'model_ids', 'fingerprint', ...(v3 ? ['policy_scope', 'managed_enforcement', ...(r.mdm_verification === undefined ? [] : ['mdm_verification'])] : [])]) || r.version !== (v3 ? 'cli-exec-security-requirements-v3' : 'cli-exec-security-requirements-v2') || !isReleaseExecMode(r.security_mode) || v3 && (r.policy_scope !== UNMANAGED_SCOPE || r.managed_enforcement !== 'not_run' || r.mdm_verification !== undefined && r.mdm_verification !== 'manual_prelaunch') || r.evidence_class !== 'reviewed_release_and_current_inputs' || !isDeepStrictEqual(r.mandatory_gates, [...releaseGates(r.security_mode), ...EXEC_INPUT_GATES, 'authenticated_mcp_discovery']) || !isDeepStrictEqual(r.accepted_residual_risks, releaseRisks(r.security_mode, r.mdm_verification)))
+    if (!['release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'fingerprint'].every(k => typeof r[k] === 'string' && /^[a-f0-9]{64}$/.test(r[k])) || !Array.isArray(r.model_ids) || !r.model_ids.length || new Set(r.model_ids).size !== r.model_ids.length || r.model_ids.some(m => typeof m !== 'string' || !m || m.length > 255 || /[\r\n\0]/.test(m)) || !exact(r, ['version', 'security_mode', 'transport', 'status', 'adapter_id', 'adapter_version', 'mandatory_gates', 'accepted_residual_risks', 'evidence_class', 'release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'model_ids', 'fingerprint', ...(v3 ? ['policy_scope', 'managed_enforcement', ...(r.mdm_verification === undefined ? [] : ['mdm_verification']), ...(r.mdm_verification === PRIVILEGED_MDM_MODE ? ['policy_observer'] : [])] : [])]) || r.version !== (v3 ? 'cli-exec-security-requirements-v3' : 'cli-exec-security-requirements-v2') || !isReleaseExecMode(r.security_mode) || v3 && (r.policy_scope !== UNMANAGED_SCOPE || r.managed_enforcement !== 'not_run' || r.mdm_verification !== undefined && r.mdm_verification !== 'manual_prelaunch' && r.mdm_verification !== PRIVILEGED_MDM_MODE) || r.mdm_verification === PRIVILEGED_MDM_MODE && !validPolicyObserverPin(r.policy_observer) || r.evidence_class !== 'reviewed_release_and_current_inputs' || !isDeepStrictEqual(r.mandatory_gates, [...releaseGates(r.security_mode), ...EXEC_INPUT_GATES, 'authenticated_mcp_discovery']) || !isDeepStrictEqual(r.accepted_residual_risks, releaseRisks(r.security_mode, r.mdm_verification)))
         throw Error('EXEC_RELEASE_DESCRIPTOR_REJECTED');
 }
 /** Diagnostic validator only; live currentness and trusted dependency origin
@@ -28,7 +29,7 @@ export function assessReleaseExec(value, plan) {
             return { ready: false, reasonCodes: ['EXEC_RELEASE_EVIDENCE_UNAVAILABLE', ...EXEC_RELEASE_GATES.map(g => 'EXEC_RELEASE_' + g.toUpperCase() + '_UNVERIFIED'), ...EXEC_INPUT_GATES.map(g => 'EXEC_INPUT_' + g.toUpperCase() + '_UNVERIFIED')] };
         need(isReleaseExecMode(plan.mode) && exact(value, ['version', 'securityMode', 'transport', 'executionNonce', 'identity', 'invocationFingerprint', 'acceptedResidualRisks', 'release', 'inputs', 'warnings', ...(v3 ? ['policyScope'] : [])]) && value.version === (v3 ? 'cli-exec-release-evidence-v3' : 'cli-exec-release-evidence-v2') && value.securityMode === plan.mode && value.transport === EXEC_TRANSPORT, 'EXEC_RELEASE_EVIDENCE_SHAPE');
         need(value.executionNonce === plan.executionNonce && value.invocationFingerprint === plan.invocationFingerprint && isDeepStrictEqual(value.identity, plan.identity), 'EXEC_RELEASE_IDENTITY_MISMATCH');
-        need(isDeepStrictEqual(value.acceptedResidualRisks, releaseRisks(plan.mode, record(value.policyScope) && record(value.policyScope.manual_verification) ? value.policyScope.manual_verification.mode : undefined)), 'EXEC_RELEASE_RISK_MISMATCH');
+        need(isDeepStrictEqual(value.acceptedResidualRisks, releaseRisks(plan.mode, record(value.policyScope) && record(value.policyScope.manual_verification) ? value.policyScope.manual_verification.mode : record(value.policyScope) && record(value.policyScope.privileged_verification) ? value.policyScope.privileged_verification.mode : undefined)), 'EXEC_RELEASE_RISK_MISMATCH');
         need(Array.isArray(value.warnings) && value.warnings.length === 0, 'EXEC_RELEASE_WARNING');
         const r = record(value.release) ? value.release : {};
         need(exact(r, ['source', 'binarySha256', 'manifestFingerprint', 'fixturesFingerprint', 'checks']) && r.source === 'reviewed_compiled_release' && r.binarySha256 === plan.identity.binarySha256 && r.manifestFingerprint === plan.identity.releaseManifestFingerprint && r.fixturesFingerprint === plan.identity.barrierFingerprint, 'EXEC_RELEASE_PIN_MISMATCH');

package/dist/src/adapters/codex/manual-policy-scope.js

@@ -1,13 +1,18 @@
+import { PRIVILEGED_MDM_MODE, validPolicyObserverPin } from './prelaunch-policy.js';
 import { isDeepStrictEqual } from 'node:util';
 import { assessMdmInventory } from '../../safety/codex-native-observation.js';
 import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
 import { classifyUnmanagedEnvironment } from './unmanaged-scope.js';
 const denied = () => Error('CODEX_MANUAL_POLICY_REJECTED');
 export const MANUAL_MDM_RISK = 'manual_prelaunch_mdm_snapshot_not_continuously_reobserved';
-/** Trusted in-process controller only, never a task/env/receipt deserializer.
- * Administrator provenance belongs to that controller. Arbitrary JSON is not
- * OS attestation. This module cannot query profiles or create elevated code. */
-export function createManualPolicyScopeVerifier(input) {
+export function createManualPolicyScopeVerifier(input) { return createPrelaunchVerifier(input); }
+/** Trusted caller must obtain metadata from the pinned peer-fenced native client. */
+export function createPrivilegedPolicyScopeVerifier(input, observer) {
+    if (!validPolicyObserverPin(observer))
+        throw denied();
+    return createPrelaunchVerifier(input, structuredClone(observer));
+}
+function createPrelaunchVerifier(input, observer) {
     const binding = structuredClone(input.binding), inventory = structuredClone(input.inventory), lease = input.leaseDigest, read = input.readLocal, now = input.now ?? Date.now;
     const identityKeys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
     if (!isDeepStrictEqual(Object.keys(binding).sort(), identityKeys.sort()) || !Number.isSafeInteger(binding.generation) || binding.generation < 1 || !['jobId', 'actorId', 'runnerId'].every(k => typeof binding[k] === 'string' && binding[k].length > 0 && binding[k].length <= 256 && !/[\r\n\0]/.test(binding[k])) || !/^[a-f0-9]{40}$/.test(binding.sourceSha) || !['binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'].every(k => /^[a-f0-9]{64}$/.test(binding[k])) || !/^[a-f0-9]{64}$/.test(lease))
@@ -47,8 +52,8 @@ export function createManualPolicyScopeVerifier(input) {
             catch {
                 dead = true;
             } return !dead; };
-            const verification = Object.freeze({ mode: 'manual_prelaunch', observedAt: inventory.observedAt, inventoryFingerprint: inventory.inventoryFingerprint, continuousMdmMonitoring: false, bindingFingerprint: hash({ ...binding, leaseDigest: lease }) });
-            return Object.freeze({ sourcesFingerprint: first.sourcesFingerprint, accountFingerprint: first.accountFingerprint, accountRootFingerprint: first.accountRootFingerprint, observedAt: inventory.observedAt, manualVerification: verification, isCurrent: current,
+            const verification = Object.freeze({ mode: observer ? PRIVILEGED_MDM_MODE : 'manual_prelaunch', ...(observer ? { observer } : {}), observedAt: inventory.observedAt, inventoryFingerprint: inventory.inventoryFingerprint, continuousMdmMonitoring: false, bindingFingerprint: hash({ ...binding, leaseDigest: lease }) });
+            return Object.freeze({ sourcesFingerprint: first.sourcesFingerprint, accountFingerprint: first.accountFingerprint, accountRootFingerprint: first.accountRootFingerprint, observedAt: inventory.observedAt, ...(observer ? { privilegedVerification: verification } : { manualVerification: verification }), isCurrent: current,
                 beforeSpawn(identity, leaseDigest) {
                     if (started || spent || !isDeepStrictEqual(identity, binding) || leaseDigest !== lease || !current()) {
                         dead = true;

package/dist/src/adapters/codex/prelaunch-policy.js

@@ -0,0 +1,9 @@
+/** Compiled observer identity, never a task-selected executable or command. */
+export const PRIVILEGED_MDM_MODE = 'privileged_prelaunch';
+export const PRIVILEGED_MDM_RISK = 'privileged_prelaunch_mdm_snapshot_not_continuously_reobserved';
+export function validPolicyObserverPin(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return false;
+    const p = v;
+    return Object.keys(p).sort().join(',') === 'protocol,sha256' && p.protocol === 'policy-inventory-v1' && typeof p.sha256 === 'string' && /^[a-f0-9]{64}$/.test(p.sha256);
+}

package/dist/src/adapters/codex/unmanaged-scope.js

@@ -1,3 +1,4 @@
+import { PRIVILEGED_MDM_MODE, validPolicyObserverPin } from './prelaunch-policy.js';
 import { isDeepStrictEqual } from 'node:util';
 import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
 export const UNMANAGED_EXEC_MODE = 'supported_cli_exec_release_policy_v3';
@@ -68,18 +69,26 @@ export function policyScopeReceipt(plan, leaseDigest, observation) {
     if (accountRootFingerprint !== observation.accountRootFingerprint)
         throw denied();
     const manual = observation.manualVerification;
-    const value = { ...(manual ? { manual_verification: manual } : {}), version: 'codex-policy-scope-v1', scope: UNMANAGED_SCOPE, classification: 'unmanaged_personal', managed_enforcement: 'not_run', managed_hosts: 'unsupported', sources_fingerprint: observation.sourcesFingerprint, account_fingerprint: observation.accountFingerprint, account_root_fingerprint: accountRootFingerprint, observed_at: observation.observedAt, lease_digest: leaseDigest, binding_fingerprint: hash(scopeBinding(plan, leaseDigest, accountRootFingerprint, observation.sourcesFingerprint, observation.accountFingerprint)) };
+    const privileged = observation.privilegedVerification;
+    const value = { ...(manual ? { manual_verification: manual } : {}), ...(privileged ? { privileged_verification: privileged } : {}), version: 'codex-policy-scope-v1', scope: UNMANAGED_SCOPE, classification: 'unmanaged_personal', managed_enforcement: 'not_run', managed_hosts: 'unsupported', sources_fingerprint: observation.sourcesFingerprint, account_fingerprint: observation.accountFingerprint, account_root_fingerprint: accountRootFingerprint, observed_at: observation.observedAt, lease_digest: leaseDigest, binding_fingerprint: hash(scopeBinding(plan, leaseDigest, accountRootFingerprint, observation.sourcesFingerprint, observation.accountFingerprint)) };
     return { ...value, fingerprint: hash(value) };
 }
 /** Audit shape validation is not OS attestation; live trusted currentness must
  * additionally be supplied by the owning host before spawn and every tool. */
 export function requirePolicyScope(value, plan) {
+    if (value && typeof value === 'object' && 'manual_verification' in value && 'privileged_verification' in value)
+        throw denied();
     if (value && typeof value === 'object' && 'manual_verification' in value) {
         const m = value.manual_verification;
         if (!exact(m, ['mode', 'observedAt', 'inventoryFingerprint', 'continuousMdmMonitoring', 'bindingFingerprint']) || m.mode !== 'manual_prelaunch' || m.continuousMdmMonitoring !== false || !Number.isSafeInteger(m.observedAt) || m.observedAt < 0 || m.observedAt !== value.observed_at || !digest(m.inventoryFingerprint) || m.bindingFingerprint !== hash({ ...plan.identity, leaseDigest: value.lease_digest }))
             throw denied();
     }
-    if (!exact(value, ['version', 'scope', 'classification', 'managed_enforcement', 'managed_hosts', 'sources_fingerprint', 'account_fingerprint', 'account_root_fingerprint', 'observed_at', 'lease_digest', 'binding_fingerprint', 'fingerprint', ...(value && typeof value === 'object' && 'manual_verification' in value ? ['manual_verification'] : [])]) || value.version !== 'codex-policy-scope-v1' || value.scope !== UNMANAGED_SCOPE || value.classification !== 'unmanaged_personal' || value.managed_enforcement !== 'not_run' || value.managed_hosts !== 'unsupported' || !Number.isSafeInteger(value.observed_at) || value.observed_at < 0
+    if (value && typeof value === 'object' && 'privileged_verification' in value) {
+        const m = value.privileged_verification;
+        if (!exact(m, ['mode', 'observedAt', 'inventoryFingerprint', 'continuousMdmMonitoring', 'bindingFingerprint', 'observer']) || m.mode !== PRIVILEGED_MDM_MODE || !validPolicyObserverPin(m.observer) || m.continuousMdmMonitoring !== false || !Number.isSafeInteger(m.observedAt) || m.observedAt < 0 || m.observedAt !== value.observed_at || !digest(m.inventoryFingerprint) || m.bindingFingerprint !== hash({ ...plan.identity, leaseDigest: value.lease_digest }))
+            throw denied();
+    }
+    if (!exact(value, ['version', 'scope', 'classification', 'managed_enforcement', 'managed_hosts', 'sources_fingerprint', 'account_fingerprint', 'account_root_fingerprint', 'observed_at', 'lease_digest', 'binding_fingerprint', 'fingerprint', ...(value && typeof value === 'object' && 'manual_verification' in value ? ['manual_verification'] : []), ...(value && typeof value === 'object' && 'privileged_verification' in value ? ['privileged_verification'] : [])]) || value.version !== 'codex-policy-scope-v1' || value.scope !== UNMANAGED_SCOPE || value.classification !== 'unmanaged_personal' || value.managed_enforcement !== 'not_run' || value.managed_hosts !== 'unsupported' || !Number.isSafeInteger(value.observed_at) || value.observed_at < 0
         || !['sources_fingerprint', 'account_fingerprint', 'account_root_fingerprint', 'lease_digest', 'binding_fingerprint', 'fingerprint'].every(k => digest(value[k])) || hash(value) !== value.fingerprint || hash(scopeBinding(plan, value.lease_digest, value.account_root_fingerprint, value.sources_fingerprint, value.account_fingerprint)) !== value.binding_fingerprint || hash({ accountRoot: plan.accountRoot }) !== value.account_root_fingerprint)
         throw denied();
 }

package/dist/src/daemon/execution-coordinator.js

@@ -116,10 +116,11 @@ export class ExecutionCoordinator {
                 throw new Error("Binding outcome requires reconciliation");
             }
             // Retain this exact safe terminal payload until Gateway acknowledges it.
+            const completionRequest = { jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
+                status: "blocked", result: { preparation_failure: { ...diagnostic } } };
             await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
-                phase: "preparation_failed", preparationFailure: diagnostic });
-            await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
-                status: "blocked", result: { preparation_failure: { ...diagnostic } } });
+                phase: "terminal_pending", preparationFailure: diagnostic, completionRequest: structuredClone(completionRequest) });
+            await this.deps.gateway.complete(completionRequest);
             await this.deps.state.clear();
             return;
         }
@@ -183,6 +184,16 @@ export class ExecutionCoordinator {
                 const evidence = this.deps.terminalEvidenceCollector.collect({ checkoutPath: workspace.path, baseSha: workspace.baseCommitSha });
                 payload = { ...payload, diff_hash: evidence.diffHash, changed_file_manifest_hash: evidence.changedFileManifestHash };
             }
+            // A vendor report cannot supply host observations, even when its shape looks valid.
+            if (payload) {
+                payload = { ...payload };
+                delete payload.local_read_observations;
+            }
+            if (isTerminalEventType(event.eventType) || event.eventType === 'blocked' || event.eventType === 'scope_conflict') {
+                const reads = safeLocalReadObservations(adapter.localReadObservations?.());
+                if (reads)
+                    payload = { ...payload, local_read_observations: reads };
+            }
             const normalized = {
                 protocolVersion: PROTOCOL_VERSION, bindingId: binding.bindingId,
                 sequence: sequence + 1, eventType: event.eventType,
@@ -272,7 +283,14 @@ export class ExecutionCoordinator {
         const diagnostic = status === "failed" || terminal.eventType === "blocked" ? completionReportDiagnostic(terminal.payload?.completion_report) : undefined;
         const reportDiagnostic = diagnostic && (terminal.eventType === "blocked"
             ? diagnostic.code === "CODEX_COMPLETION_REPORT_BLOCKED" : diagnostic.code !== "CODEX_COMPLETION_REPORT_BLOCKED") ? diagnostic : undefined;
-        await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(adapter.securityReceipt?.() ? { security_receipt: adapter.securityReceipt() } : {}) } });
+        const securityReceipt = adapter.securityReceipt?.();
+        const reads = safeLocalReadObservations(adapter.localReadObservations?.());
+        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
+        await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
+            phase: "terminal_pending", bindingId: binding.bindingId, terminalEventType: terminal.eventType,
+            completionRequest: structuredClone(completionRequest) });
+        await this.deps.gateway.complete(completionRequest);
         await this.deps.state.clear();
     }
 }
+import { safeLocalReadObservations } from '../safety/local-read-observations.js';

package/dist/src/daemon/runtime.js

@@ -1,4 +1,6 @@
-import { createCodexRuntimeHost } from '../safety/codex-runtime-host.js';
+import { createCodexDaemonHost } from '../safety/codex-daemon-host.js';
+import { reconcileTerminalState } from './terminal-recovery.js';
+import { packageVersion } from '../package-version.js';
 import { hostname } from "node:os";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
@@ -21,7 +23,7 @@ import { packagedHookCommandParts } from "../safety/hook-command.js";
 export async function buildDaemon(input) {
     if (input.codexSupportedProbe && !input.codexSecurityHost)
         throw new Error('CODEX_SUPPORTED_HOST_REQUIRED');
-    const production = !input.codexSecurityHost && !input.codexSupportedProbe ? createCodexRuntimeHost({ runnerId: input.runnerId, binary: input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: input.env.HOME ?? '', codexHome: input.env.CODEX_HOME, searchPath: input.env.PATH }) : undefined;
+    const production = !input.codexSecurityHost && !input.codexSupportedProbe ? createCodexDaemonHost({ runnerId: input.runnerId, binary: input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: input.env.HOME ?? '', codexHome: input.env.CODEX_HOME, searchPath: input.env.PATH }) : undefined;
     let pendingCodexClaim;
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
     // The same parts the CLI self-test ran before starting this daemon (verifyPackagedHook).
@@ -62,7 +64,8 @@ export async function buildDaemon(input) {
                 if (renewed?.job) {
                     if (renewed.job.id !== job.id || renewed.job.generation !== job.generation)
                         throw new Error('CODEX_JOB_LEASE_FENCE_MISMATCH');
-                    production?.heartbeat(job.id, job.generation, renewed.job.lease_expires_at);
+                    if (job.taskPackage.runtime_adapter === 'codex_cli')
+                        production?.heartbeat(job.id, job.generation, renewed.job.lease_expires_at);
                 }
             },
             complete: async (result) => { await gateway.completeLocalJob(result); await production?.releaseJob(result.jobId); pendingCodexClaim = undefined; },
@@ -80,12 +83,29 @@ export async function buildDaemon(input) {
     });
     const poller = new JobPoller({
         reportError: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "poller_failed", ...diagnostic })}\n`); },
-        heartbeat: () => gateway.heartbeatLocalRunner({
-            deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
-            displayName: runnerDisplayName(), packageVersion: "0.1.11",
-            capabilities: probes.map((probe) => ({ adapter: probe.id, version: probe.version,
-                capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
-        }).then(() => undefined),
+        heartbeat: async () => {
+            let current;
+            try {
+                current = await codex.probe();
+            }
+            catch {
+                current = { available: false, authenticated: false, capabilities: [] };
+            }
+            const ready = current.available && current.authenticated && !!current.executableVersion && codex.capabilities.every(c => current.capabilities.includes(c));
+            const index = probes.findIndex(p => p.id === 'codex_cli');
+            if (index >= 0)
+                probes[index] = { id: 'codex_cli', version: '1', ...current, authenticated: ready };
+            if (ready)
+                versions.codex_cli = '1';
+            else
+                delete versions.codex_cli;
+            await gateway.heartbeatLocalRunner({
+                deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
+                displayName: runnerDisplayName(), packageVersion: packageVersion(),
+                capabilities: probes.map((probe) => ({ adapter: probe.id, version: probe.version,
+                    capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
+            });
+        },
         wait: async () => {
             const claim = await gateway.waitForLocalJob(versions, 25);
             if (claim.status !== "claimed" || !claim.job || !claim.task_package || !claim.lease_token || !claim.launch_grant)
@@ -110,26 +130,12 @@ export async function buildDaemon(input) {
         lock: new ProcessLock(join(input.stateRoot, "daemon.lock")), state,
         reconcile: async (stored) => {
             const previous = stored;
+            if (await reconcileTerminalState(previous, { gateway: { complete: request => gateway.completeLocalJob(request) }, state }))
+                return;
             if (await reconcilePreparationState(previous, {
                 complete: (result) => gateway.completeLocalJob(result), clear: () => state.clear(),
             }))
                 return;
-            if (previous.bindingId && previous.jobId && previous.generation && previous.leaseToken) {
-                try {
-                    const receipt = await gateway.readBindingEvents(previous.bindingId, previous.eventCursor ?? 0);
-                    const status = receipt.terminal
-                        ? (receipt.terminalEventType ?? previous.terminalEventType) === "completed" ? "completed"
-                            : (receipt.terminalEventType ?? previous.terminalEventType) === "cancelled" ? "cancelled" : "failed"
-                        : "failed";
-                    await gateway.completeLocalJob({
-                        jobId: previous.jobId, generation: previous.generation, leaseToken: previous.leaseToken, status,
-                        result: { binding_id: previous.bindingId, recovery: receipt.terminal ? "terminal_event_reconciled" : "daemon_restarted_before_terminal_event" },
-                    });
-                }
-                catch {
-                    // An expired generation is safely fenced by Gateway and will be reclaimed.
-                }
-            }
             await state.clear();
         },
         poller,

package/dist/src/daemon/terminal-recovery.js

@@ -0,0 +1,59 @@
+import { isTerminalEventType } from '../protocol.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function nonempty(value) { return typeof value === 'string' && value.trim().length > 0; }
+function invalid() { throw new Error('Terminal outcome requires reconciliation: invalid pending completion receipt'); }
+/** Replay only the stored completion request; never restart an adapter or reconstruct evidence. */
+export async function reconcileTerminalState(previous, deps) {
+    if (previous === null || previous === undefined)
+        return false;
+    if (!record(previous))
+        invalid();
+    if (previous.phase !== 'terminal_pending') {
+        if (!['claimed', 'shadow', 'binding', 'binding_uncertain', 'preparation_failed'].includes(String(previous.phase))
+            || !nonempty(previous.jobId) || !Number.isSafeInteger(previous.generation) || previous.generation < 1
+            || !nonempty(previous.leaseToken))
+            invalid();
+        // Only preparation states without execution evidence may reach the legacy
+        // preparation handler (whose caller may clear an unhandled receipt).
+        const allowed = ['phase', 'jobId', 'generation', 'leaseToken', 'workspaceManifest'];
+        if (previous.phase === 'preparation_failed' || previous.phase === 'binding_uncertain')
+            allowed.push('preparationFailure');
+        if (Object.keys(previous).some(key => !allowed.includes(key)))
+            invalid();
+        if (previous.phase === 'preparation_failed' || previous.preparationFailure !== undefined) {
+            const diagnostic = previous.preparationFailure;
+            if (!record(diagnostic) || !nonempty(diagnostic.stage) || !nonempty(diagnostic.code)
+                || Object.keys(diagnostic).some(key => !['stage', 'code', 'tool'].includes(key))
+                || (diagnostic.tool !== undefined && !nonempty(diagnostic.tool)))
+                invalid();
+        }
+        return false;
+    }
+    const request = previous.completionRequest;
+    if (!record(request) || Object.keys(request).sort().join(',') !== 'generation,jobId,leaseToken,result,status'
+        || !nonempty(previous.jobId) || !Number.isSafeInteger(previous.generation) || previous.generation < 1
+        || !nonempty(previous.leaseToken) || request.jobId !== previous.jobId
+        || request.generation !== previous.generation || request.leaseToken !== previous.leaseToken || !record(request.result))
+        invalid();
+    const result = request.result;
+    if (previous.bindingId !== undefined) {
+        const eventType = result.event_type;
+        if (!nonempty(previous.bindingId) || result.binding_id !== previous.bindingId || typeof eventType !== 'string'
+            || (!isTerminalEventType(eventType) && eventType !== 'blocked' && eventType !== 'scope_conflict') || previous.terminalEventType !== eventType || typeof result.summary !== 'string')
+            invalid();
+        const status = eventType === 'completed' ? 'completed' : eventType === 'cancelled' ? 'cancelled'
+            : eventType === 'blocked' || eventType === 'scope_conflict' ? 'blocked' : 'failed';
+        if (request.status !== status)
+            invalid();
+    }
+    else if (request.status !== 'blocked' || !record(result.preparation_failure)
+        || result.binding_id !== undefined || result.event_type !== undefined || previous.terminalEventType !== undefined
+        || !nonempty(result.preparation_failure.stage) || !nonempty(result.preparation_failure.code))
+        invalid();
+    // Snapshot the validated receipt so a transport cannot mutate retained recovery state.
+    await deps.gateway.complete(structuredClone(request));
+    await deps.state.clear();
+    return true;
+}

package/dist/src/package-version.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'node:fs';
+// Both the source tree (src/) and packaged build (dist/src/) resolve their own metadata.
+export function packageVersion(moduleUrl = import.meta.url) {
+    const semver = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+    for (const relative of ['../package.json', '../../package.json']) {
+        let metadata;
+        try {
+            metadata = JSON.parse(readFileSync(new URL(relative, moduleUrl), 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw new Error('Runner package version metadata is invalid');
+        }
+        if (metadata && typeof metadata === 'object' && metadata.name === 'mtech-ai-local-runner') {
+            const version = metadata.version;
+            if (typeof version === 'string' && semver.test(version))
+                return version;
+            throw new Error('Runner package version metadata is invalid');
+        }
+    }
+    throw new Error('Runner package version metadata is missing');
+}

package/dist/src/safety/codex-daemon-host.js

@@ -0,0 +1,101 @@
+import { CODEX_DAEMON_EXEC_RELEASES } from './codex-daemon-releases.js';
+import { registeredPrelaunchDependencies, CODEX_MANUAL_BINARY } from './codex-manual-registered.js';
+import { createPrivilegedDaemonController } from './codex-manual-controller.js';
+import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
+import { PRIVILEGED_MDM_MODE } from '../adapters/codex/prelaunch-policy.js';
+import { buildCodexExecJobOptions } from '../adapters/codex/exec-runtime-options.js';
+import { reviewedCodexExecRelease } from './codex-exec-production-host.js';
+/** Compiled/trusted host composition. No environment, task or saved JSON creates
+ * an admission capability. A missing reviewed release stays unavailable. */
+export function createCodexDaemonHost(input, deps) {
+    const claims = new Map(), controllers = new Map(), hosts = new Map(), leases = new Map();
+    const releases = structuredClone(deps?.native.releases ?? CODEX_DAEMON_EXEC_RELEASES);
+    const native = deps?.native ?? (releases.length ? { ...registeredPrelaunchDependencies(input.home, input.codexHome, PRIVILEGED_MDM_MODE, releases), releases } : undefined);
+    let selected;
+    const available = async () => {
+        const matches = releases.filter(r => reviewedCodexExecRelease(r) && r.mdmVerification === PRIVILEGED_MDM_MODE && r.credentialBackend === 'auto');
+        if (!native || matches.length !== 1)
+            return { available: false, authenticated: false, capabilities: [], reason: 'CODEX_DAEMON_REVIEWED_OBSERVER_UNAVAILABLE' };
+        try {
+            const pin = matches[0].policyObserver;
+            (native.verifyObserver ?? verifyPolicyObserver)(pin);
+            await (native.checkObserverReady ?? (p => createPolicyInventoryClient(p).checkReady()))(pin);
+            return await native.probe();
+        }
+        catch {
+            return { available: false, authenticated: false, capabilities: [], reason: 'CODEX_DAEMON_REVIEWED_OBSERVER_UNAVAILABLE' };
+        }
+    };
+    return {
+        probe: available,
+        registerClaim(value) {
+            if (selected || claims.size)
+                throw Error('CODEX_ACTIVE_CLAIM_CONFLICT');
+            if (value.task_package?.security_requirements?.mdm_verification !== PRIVILEGED_MDM_MODE)
+                throw Error('CODEX_DAEMON_PROVENANCE_REQUIRED');
+            if (!native || releases.length !== 1)
+                throw Error('CODEX_DAEMON_REVIEWED_OBSERVER_UNAVAILABLE');
+            const c = structuredClone(value);
+            if (!c.job?.id || !Number.isSafeInteger(c.job.lease_expires_at))
+                throw Error('CODEX_DAEMON_CLAIM_REJECTED');
+            selected = c.job.id;
+            claims.set(selected, c);
+            leases.set(selected, { generation: c.job.generation, expires: c.job.lease_expires_at });
+        },
+        options(jobId, worktreePath, stateRoot, env) {
+            const claim = claims.get(jobId);
+            if (selected !== jobId || !claim || !native)
+                throw Error('CODEX_TRUSTED_CLAIM_REQUIRED');
+            let inner, cleanup, closed = false;
+            const lazy = { async prepare(ctx) {
+                    if (closed || controllers.has(jobId))
+                        throw Error('CODEX_DAEMON_PREPARATION_REUSED');
+                    const pin = releases[0].policyObserver;
+                    const client = createPolicyInventoryClient(pin);
+                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary ?? CODEX_MANUAL_BINARY, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
+                    controllers.set(jobId, controller);
+                    const host = await controller.prepare();
+                    if (closed) {
+                        await host.close();
+                        throw Error('CODEX_DAEMON_CANCELLED');
+                    }
+                    hosts.set(jobId, host);
+                    const lease = leases.get(jobId);
+                    host.heartbeat(jobId, lease.generation, lease.expires);
+                    inner = host.job(jobId, worktreePath);
+                    if (cleanup)
+                        inner.attachCleanup(cleanup);
+                    return inner.prepare(ctx);
+                }, async inspect(plan) { if (!inner || closed)
+                    throw Error('CODEX_DAEMON_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { closed = true; controllers.get(jobId)?.cancel(); inner?.revoke(); }, attachCleanup(action) { if (cleanup || closed)
+                    throw Error('CODEX_DAEMON_CLEANUP_REUSED'); cleanup = action; }, async close() { closed = true; controllers.get(jobId)?.cancel(); await inner?.close(); } };
+            return buildCodexExecJobOptions({ jobId, worktreePath, stateRoot, env, productionJob: () => lazy, processHost: deps?.processHost });
+        },
+        heartbeat(id, generation, expires) { const l = leases.get(id); if (!l || l.generation !== generation || !Number.isSafeInteger(expires) || expires * 1000 <= Date.now())
+            throw Error('CODEX_JOB_LEASE_FENCE_MISMATCH'); l.expires = expires; hosts.get(id)?.heartbeat(id, generation, expires); },
+        async releaseJob(id) { try {
+            await controllers.get(id)?.close();
+        }
+        finally {
+            controllers.delete(id);
+            hosts.delete(id);
+            claims.delete(id);
+            leases.delete(id);
+            if (selected === id)
+                selected = undefined;
+        } },
+        async close() { for (const c of controllers.values())
+            c.cancel(); try {
+            const results = await Promise.allSettled([...controllers.values()].map(c => c.close()));
+            if (results.some(r => r.status === 'rejected'))
+                throw Error('CODEX_DAEMON_CLEANUP_FAILED');
+        }
+        finally {
+            claims.clear();
+            controllers.clear();
+            hosts.clear();
+            leases.clear();
+            selected = undefined;
+        } },
+    };
+}

package/dist/src/safety/codex-daemon-releases.js

@@ -0,0 +1,42 @@
+/** Installed no-model observer evidence; actual daemon model acceptance remains pending.
+ * Prior exact CLI gate fixtures are inherited, not rerun or relabelled as daemon acceptance. */
+export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
+        "version": "codex-exec-supported-release-v3",
+        "adapterVersion": "1",
+        "transport": "official_exec_v1",
+        "securityMode": "supported_cli_exec_release_policy_v3",
+        "policyScope": "unmanaged_personal_only",
+        "managedEnforcement": "not_run",
+        "executableVersion": "codex-cli 0.163.0-alpha.10.2",
+        "binarySha256": "1afb28c01d7d49e892bd75f11076b10f1451e34e0ee308a95e5ab7f69f9c84fe",
+        "modelIds": [
+            "gpt-5.6-sol"
+        ],
+        "decisionId": "d31b9b90-2aeb-4735-88eb-61b5de777d85",
+        "acceptedResidualRisks": [
+            "vendor_native_policy_enforcement",
+            "managed_policy_not_directly_observed_per_job",
+            "first_inference_order_not_observed_per_job",
+            "job_mcp_token_possession_not_os_identity",
+            "account_startup_may_refresh_shared_credentials",
+            "concurrent_policy_change_not_atomic",
+            "local_account_metadata_not_remote_entitlement",
+            "privileged_prelaunch_mdm_snapshot_not_continuously_reobserved"
+        ],
+        "credentialBackend": "auto",
+        "mdmVerification": "privileged_prelaunch",
+        "fixtureEvidence": {
+            "binary_release": "fa1cd6ce84178d0696c1ae397c05cf7cea35dcac5616e91dda85725e50976371",
+            "official_permissions": "cabb85e115996d50fe375f234aad4551dbfa5c7fe7a86cbda0f3d30c1d6fd471",
+            "managed_scope_exclusion": "a559199e229e153759f7a7cbd682aae423c0e3d33ef2a692fcccb5eed7c57ed3",
+            "required_mcp_startup": "e7305dcdfc4c86fd30d02d311ae7a061e7a21800ef86c3f7d1035330d49ae474",
+            "source_exclusion": "93697ceee0d5e864dc7267dab99fabd93db35c7d841dce50e39d6d6ad705bd08",
+            "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
+        },
+        "fixturesFingerprint": "f1ccefe90b39aae420b47b902be5a2d61d957e2b600dd26081ae91e5e94dc0af",
+        "commands": [],
+        "policyObserver": {
+            "protocol": "policy-inventory-v1",
+            "sha256": "2a07812cd47782826a359b749096b681a6ee49e91f990d48abdc60f2d46e4c9c"
+        }
+    }]);

package/dist/src/safety/codex-exec-production-host.js

@@ -1,3 +1,5 @@
+import { isDeepStrictEqual } from 'node:util';
+import { PRIVILEGED_MDM_MODE, validPolicyObserverPin } from '../adapters/codex/prelaunch-policy.js';
 import { createHash } from 'node:crypto';
 import { UNMANAGED_EXEC_MODE, UNMANAGED_SCOPE, createUnmanagedScopeVerifier, policyScopeReceipt } from '../adapters/codex/unmanaged-scope.js';
 import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, accountAncestorPaths, requireGlobalInstructionInvocation } from '../adapters/codex/global-instructions.js';
@@ -22,7 +24,7 @@ const exact = (v, keys) => JSON.stringify(Object.keys(v).sort()) === JSON.string
 const inside = (r, p) => p === r || p.startsWith(r + path.sep);
 export const execReleaseFingerprint = (value) => hash(value);
 export function reviewedCodexExecRelease(r) { try {
-    return exact(r, ['version', 'adapterVersion', 'transport', 'securityMode', 'executableVersion', 'binarySha256', 'modelIds', 'decisionId', 'acceptedResidualRisks', 'credentialBackend', 'fixtureEvidence', 'fixturesFingerprint', 'commands', ...(r.securityMode === UNMANAGED_EXEC_MODE ? ['policyScope', 'managedEnforcement', ...(r.mdmVerification === undefined ? [] : ['mdmVerification'])] : [])]) && r.version === (r.securityMode === UNMANAGED_EXEC_MODE ? 'codex-exec-supported-release-v3' : 'codex-exec-supported-release-v2') && (r.securityMode !== UNMANAGED_EXEC_MODE || r.policyScope === UNMANAGED_SCOPE && r.managedEnforcement === 'not_run' && (r.mdmVerification === undefined || r.mdmVerification === 'manual_prelaunch')) && r.adapterVersion === '1' && r.transport === 'official_exec_v1' && isReleaseExecMode(r.securityMode) && (r.credentialBackend === 'file' || r.securityMode === UNMANAGED_EXEC_MODE && r.credentialBackend === 'auto') && typeof r.executableVersion === 'string' && !!r.executableVersion && !/[\r\n\0]/.test(r.executableVersion) && hex(r.binarySha256) && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(r.decisionId) && Array.isArray(r.modelIds) && r.modelIds.length > 0 && new Set(r.modelIds).size === r.modelIds.length && r.modelIds.every(m => typeof m === 'string' && m.length > 0 && m.length < 256 && !/[\r\n\0]/.test(m)) && JSON.stringify(r.acceptedResidualRisks) === JSON.stringify(releaseRisks(r.securityMode, r.mdmVerification)) && r.fixtureEvidence && exact(r.fixtureEvidence, [...releaseGates(r.securityMode)]) && Object.values(r.fixtureEvidence).every(hex) && r.fixturesFingerprint === fingerprint(r.fixtureEvidence) && Array.isArray(r.commands) && new Set(r.commands.map(c => c.id)).size === r.commands.length && r.commands.every(registeredCommandValid);
+    return exact(r, ['version', 'adapterVersion', 'transport', 'securityMode', 'executableVersion', 'binarySha256', 'modelIds', 'decisionId', 'acceptedResidualRisks', 'credentialBackend', 'fixtureEvidence', 'fixturesFingerprint', 'commands', ...(r.securityMode === UNMANAGED_EXEC_MODE ? ['policyScope', 'managedEnforcement', ...(r.mdmVerification === undefined ? [] : ['mdmVerification']), ...(r.mdmVerification === PRIVILEGED_MDM_MODE ? ['policyObserver'] : [])] : [])]) && r.version === (r.securityMode === UNMANAGED_EXEC_MODE ? 'codex-exec-supported-release-v3' : 'codex-exec-supported-release-v2') && (r.securityMode !== UNMANAGED_EXEC_MODE || r.policyScope === UNMANAGED_SCOPE && r.managedEnforcement === 'not_run' && (r.mdmVerification === undefined || r.mdmVerification === 'manual_prelaunch' || r.mdmVerification === PRIVILEGED_MDM_MODE && validPolicyObserverPin(r.policyObserver))) && r.adapterVersion === '1' && r.transport === 'official_exec_v1' && isReleaseExecMode(r.securityMode) && (r.credentialBackend === 'file' || r.securityMode === UNMANAGED_EXEC_MODE && r.credentialBackend === 'auto') && typeof r.executableVersion === 'string' && !!r.executableVersion && !/[\r\n\0]/.test(r.executableVersion) && hex(r.binarySha256) && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(r.decisionId) && Array.isArray(r.modelIds) && r.modelIds.length > 0 && new Set(r.modelIds).size === r.modelIds.length && r.modelIds.every(m => typeof m === 'string' && m.length > 0 && m.length < 256 && !/[\r\n\0]/.test(m)) && JSON.stringify(r.acceptedResidualRisks) === JSON.stringify(releaseRisks(r.securityMode, r.mdmVerification)) && r.fixtureEvidence && exact(r.fixtureEvidence, [...releaseGates(r.securityMode)]) && Object.values(r.fixtureEvidence).every(hex) && r.fixturesFingerprint === fingerprint(r.fixtureEvidence) && Array.isArray(r.commands) && new Set(r.commands.map(c => c.id)).size === r.commands.length && r.commands.every(registeredCommandValid);
 }
 catch {
     return false;
@@ -64,7 +66,7 @@ export function createCodexExecProductionHost(original) {
             if (!credential || credential.backend !== backend || !credential.available || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= Date.now())
                 throw reject();
             const policyObservation = matches[0].securityMode === UNMANAGED_EXEC_MODE ? policyVerifier.observe() : undefined;
-            if (policyObservation && (policyObservation.accountRootFingerprint !== hash({ accountRoot: account }) || Boolean(policyObservation.manualVerification) !== Boolean(matches[0].mdmVerification)))
+            if (policyObservation && (policyObservation.accountRootFingerprint !== hash({ accountRoot: account }) || (policyObservation.manualVerification?.mode ?? policyObservation.privilegedVerification?.mode) !== matches[0].mdmVerification || matches[0].mdmVerification === PRIVILEGED_MDM_MODE && !isDeepStrictEqual(policyObservation.privilegedVerification?.observer, matches[0].policyObserver)))
                 throw reject();
             return { policyObservation, binary, release: matches[0], config, binaryStamp, configStamp: configData.stamp };
         }
@@ -119,7 +121,7 @@ export function createCodexExecProductionHost(original) {
                     try {
                         selected = await inspect();
                         const r = requireSecurityRequirements(p.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' }), release = selected.release;
-                        if (r.mdm_verification !== release.mdmVerification || r.security_mode !== release.securityMode || value.generation !== j.generation || value.resolvedModelId !== p.resolved_model_id || !release.modelIds.includes(value.resolvedModelId) || fingerprint(value.approvedTaskPackage) !== c.task_package_fingerprint || value.securityBinding?.contractFingerprint !== c.contract_fingerprint || value.securityBinding?.taskPackageFingerprint !== c.task_package_fingerprint || value.securityBinding?.launchFingerprint !== j.launch_fingerprint || r.release_manifest_sha256 !== execReleaseFingerprint(release) || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || r.tools_sha256 !== fingerprint({ tools: localToolInventory() }) || JSON.stringify(r.model_ids) !== JSON.stringify(release.modelIds))
+                        if (r.mdm_verification !== release.mdmVerification || !isDeepStrictEqual(r.policy_observer, release.policyObserver) || r.security_mode !== release.securityMode || value.generation !== j.generation || value.resolvedModelId !== p.resolved_model_id || !release.modelIds.includes(value.resolvedModelId) || fingerprint(value.approvedTaskPackage) !== c.task_package_fingerprint || value.securityBinding?.contractFingerprint !== c.contract_fingerprint || value.securityBinding?.taskPackageFingerprint !== c.task_package_fingerprint || value.securityBinding?.launchFingerprint !== j.launch_fingerprint || r.release_manifest_sha256 !== execReleaseFingerprint(release) || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || r.tools_sha256 !== fingerprint({ tools: localToolInventory() }) || JSON.stringify(r.model_ids) !== JSON.stringify(release.modelIds))
                             throw reject();
                         const source = await realpath(sourceRoot), home = await realpath(account);
                         if (inside(source, home) || inside(home, source))

package/dist/src/safety/codex-manual-controller.js

@@ -1,3 +1,4 @@
+import { PRIVILEGED_MDM_MODE, validPolicyObserverPin } from '../adapters/codex/prelaunch-policy.js';
 import { executionError } from './execution-failure.js';
 import { eligiblePersonalAccount } from '../adapters/codex/unmanaged-scope.js';
 import { securityRequirementsFingerprint as hash } from './security-requirements.js';
@@ -15,13 +16,15 @@ import { CODEX_EXEC_RELEASES } from './codex-exec-releases.js';
 import { measureCommandFile } from './registered-command-integrity.js';
 import { readStableText } from './stable-file-read.js';
 import { createManualProfileQuery } from './codex-manual-profile-query.js';
-import { createManualPolicyScopeVerifier } from '../adapters/codex/manual-policy-scope.js';
+import { createManualPolicyScopeVerifier, createPrivilegedPolicyScopeVerifier } from '../adapters/codex/manual-policy-scope.js';
 const rejected = () => Error('CODEX_MANUAL_PILOT_REJECTED');
-/** Foreground composition for an already approved, authenticated Gateway claim.
- * Dependencies are compiled/trusted code, not serialized task/env authority.
- * No release/native reader fallback exists; missing dependencies refuse before
- * an administrator prompt. This never changes the installed daemon. */
-export function createManualPilotController(input, deps) {
+export function createManualPilotController(input, deps) { return createPrelaunchController(input, deps, 'manual_prelaunch'); }
+export function createPrivilegedDaemonController(input, deps) {
+    if (!validPolicyObserverPin(deps.observer) || typeof deps.collectInventory !== 'function')
+        throw rejected();
+    return createPrelaunchController(input, deps, PRIVILEGED_MDM_MODE);
+}
+function createPrelaunchController(input, deps, mode) {
     const claim = structuredClone(input.claim), releases = structuredClone(deps?.releases ?? CODEX_EXEC_RELEASES), readLocal = deps?.readLocal, now = deps?.now ?? Date.now;
     const account = path.resolve(input.codexHome ?? path.join(input.home, '.codex'));
     let used = false, closed = false, manual, host;
@@ -37,13 +40,13 @@ export function createManualPilotController(input, deps) {
                 if (!readLocal || !path.isAbsolute(input.binary) || !path.isAbsolute(input.home) || await realpath(input.home) !== input.home || await realpath(account) !== account)
                     throw rejected();
                 stage = 'codex_manual_release';
-                const sha = await measureCommandFile(input.binary), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.mdmVerification === 'manual_prelaunch' && r.binarySha256 === sha);
+                const sha = await measureCommandFile(input.binary), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.mdmVerification === mode && r.binarySha256 === sha);
                 if (matches.length !== 1)
                     throw rejected();
                 const release = matches[0], requirements = claim.task_package?.security_requirements;
                 stage = 'codex_manual_config';
                 const config = parse((await readStableText(path.join(account, 'config.toml'))).text);
-                if ((config.cli_auth_credentials_store ?? 'auto') !== release.credentialBackend || requirements?.release_manifest_sha256 !== execReleaseFingerprint(release) || requirements?.mdm_verification !== 'manual_prelaunch')
+                if ((config.cli_auth_credentials_store ?? 'auto') !== release.credentialBackend || requirements?.release_manifest_sha256 !== execReleaseFingerprint(release) || requirements?.mdm_verification !== mode || mode === PRIVILEGED_MDM_MODE && !isDeepStrictEqual(release.policyObserver, deps?.observer))
                     throw rejected();
                 host = createCodexExecProductionHost({ runnerId: input.runnerId, binary: input.binary, home: input.home, codexHome: account, releases: [release], readNativeAuth: deps?.readNativeAuth, policyScopeVerifier: { observe() { if (closed || !manual)
                             throw rejected(); return manual.observe(); } } });
@@ -71,14 +74,15 @@ export function createManualPilotController(input, deps) {
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_policy_scope';
-                manual = createManualPolicyScopeVerifier({ binding: { jobId: job.id, generation: job.generation, actorId: claim.security_context.actor_id, runnerId: input.runnerId, sourceSha: p.repository.base_commit_sha, binarySha256: release.binarySha256, releaseManifestFingerprint: String(r.release_manifest_sha256), requirementsFingerprint: String(r.fingerprint), contractFingerprint: claim.contract_fingerprint, taskPackageFingerprint: claim.task_package_fingerprint, launchFingerprint: job.launch_fingerprint, commandsFingerprint: String(r.commands_sha256), toolSchemaFingerprint: String(r.tools_sha256), barrierFingerprint: String(r.fixtures_sha256) }, leaseDigest: createHash('sha256').update(claim.lease_token).digest('hex'), inventory, readLocal, now });
+                const scopeInput = { binding: { jobId: job.id, generation: job.generation, actorId: claim.security_context.actor_id, runnerId: input.runnerId, sourceSha: p.repository.base_commit_sha, binarySha256: release.binarySha256, releaseManifestFingerprint: String(r.release_manifest_sha256), requirementsFingerprint: String(r.fingerprint), contractFingerprint: claim.contract_fingerprint, taskPackageFingerprint: claim.task_package_fingerprint, launchFingerprint: job.launch_fingerprint, commandsFingerprint: String(r.commands_sha256), toolSchemaFingerprint: String(r.tools_sha256), barrierFingerprint: String(r.fixtures_sha256) }, leaseDigest: createHash('sha256').update(claim.lease_token).digest('hex'), inventory, readLocal, now };
+                manual = mode === PRIVILEGED_MDM_MODE ? createPrivilegedPolicyScopeVerifier(scopeInput, deps.observer) : createManualPolicyScopeVerifier(scopeInput);
                 stage = 'codex_manual_host_probe';
                 if (!(await host.probe()).available || closed)
                     throw rejected();
                 return host;
             }
             catch (error) {
-                const safe = executionError(error, stage, 'CODEX_MANUAL_PILOT_REJECTED');
+                const safe = executionError(error, mode === PRIVILEGED_MDM_MODE ? 'codex_policy_inventory' : stage, mode === PRIVILEGED_MDM_MODE ? 'CODEX_POLICY_INVENTORY_REJECTED' : 'CODEX_MANUAL_PILOT_REJECTED');
                 await close().catch(() => { });
                 throw safe;
             }

package/dist/src/safety/codex-manual-registered.js

@@ -12,13 +12,15 @@ import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
 /** Compiled reviewed identity; never selected by task, environment or receipts. */
 export const CODEX_MANUAL_BINARY = '/Applications/ChatGPT.app/Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex';
 export const CODEX_MANUAL_NATIVE_READER = Object.freeze({ "binary": "/Library/PrivilegedHelperTools/com.mtec.ai-gateway.codex-observe.681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986", "sha256": "681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986" });
-export function registeredManualDependencies(home, codexHome) {
+export function registeredManualDependencies(home, codexHome) { return registeredPrelaunchDependencies(home, codexHome, 'manual_prelaunch', CODEX_EXEC_RELEASES); }
+/** Trusted compiled registration shared by manual and daemon host composition. */
+export function registeredPrelaunchDependencies(home, codexHome, mode, releases) {
     const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER;
     if (!path.isAbsolute(home) || !pin)
         throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');
     const reader = createNativeObservationReader({ accountRoot: account, backend: 'auto', keyringKind: 'direct', process: nativeMetadataProcess(pin.binary, pin.sha256), systemSource: systemPolicySource, mdmInventory: () => { throw Error('MANUAL_INVENTORY_ONLY'); } });
     return Object.freeze({ binary: CODEX_MANUAL_BINARY, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
-            const digest = await measureCommandFile(CODEX_MANUAL_BINARY), matches = CODEX_EXEC_RELEASES.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === 'manual_prelaunch' && r.credentialBackend === 'auto');
+            const digest = await measureCommandFile(CODEX_MANUAL_BINARY), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
             const config = parse((await readStableText(path.join(account, 'config.toml'))).text);
             if (matches.length !== 1 || (config.cli_auth_credentials_store ?? 'auto') !== 'auto' || config.features?.secret_auth_storage === true)
                 throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');

package/dist/src/safety/local-read-observations.js

@@ -0,0 +1,17 @@
+export function safeLocalReadObservations(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    const v = value, c = v.classification_counts;
+    if (Object.keys(v).sort().join() !== ['version', 'successful_read_calls', 'unique_successful_paths', 'failed_read_calls', 'classification_counts', 'truncated'].sort().join()
+        || v.version !== 'local-read-observations-v1' || typeof v.truncated !== 'boolean' || !c || typeof c !== 'object' || Array.isArray(c))
+        return;
+    const counts = c;
+    if (Object.keys(counts).sort().join() !== 'documentation,source')
+        return;
+    const numbers = [v.successful_read_calls, v.unique_successful_paths, v.failed_read_calls, counts.documentation, counts.source];
+    if (numbers.some(n => !Number.isSafeInteger(n) || Number(n) < 0 || Number(n) > 1_000_000)
+        || Number(v.unique_successful_paths) > 1024 || Number(v.unique_successful_paths) > Number(v.successful_read_calls)
+        || Number(counts.documentation) + Number(counts.source) !== v.successful_read_calls)
+        return;
+    return structuredClone(value);
+}

package/dist/src/safety/local-tool-server.js

@@ -1,5 +1,6 @@
 import { createServer } from 'node:http';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import path from 'node:path';
 import { LOCAL_TOOL_NAMES } from './local-tool-policy.js';
 const discoveryScopes = new WeakMap();
 export function localDiscoveryScopeMatches(scope, endpoint, token) {
@@ -10,6 +11,10 @@ export function localDiscoveryScopeMatches(scope, endpoint, token) {
 }
 // Bounded diagnostic metadata; possession grants neither discovery nor tool authority.
 const endpointObservations = new Map();
+export function localEndpointReadObservations(url, token) {
+    const record = endpointObservations.get(url);
+    return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? record.reads() : undefined;
+}
 export function localEndpointObservations(url, token) {
     const record = endpointObservations.get(url);
     return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? [...record.values] : [];
@@ -28,6 +33,32 @@ export function localToolInventory() {
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {
     options;
+    readCounts = { version: 'local-read-observations-v1', successful_read_calls: 0, unique_successful_paths: 0, failed_read_calls: 0, classification_counts: { documentation: 0, source: 0 }, truncated: false };
+    readPathDigests = new Set();
+    /** Counts are server-authored observations, not model evidence or a policy attestation. */
+    readObservations() { return structuredClone(this.readCounts); }
+    recordRead(success, args) {
+        const count = success ? 'successful_read_calls' : 'failed_read_calls';
+        if (this.readCounts[count] >= 1_000_000) {
+            this.readCounts.truncated = true;
+            return;
+        }
+        this.readCounts[count]++;
+        if (!success)
+            return;
+        const value = (args && typeof args === 'object' && !Array.isArray(args) ? args.path : undefined);
+        const file = path.posix.normalize(typeof value === 'string' ? value : '');
+        const category = file.startsWith('docs/') ? 'documentation' : 'source';
+        this.readCounts.classification_counts[category]++;
+        const digest = createHash('sha256').update(file).digest('hex');
+        if (!this.readPathDigests.has(digest)) {
+            if (this.readPathDigests.size < 1024)
+                this.readPathDigests.add(digest);
+            else
+                this.readCounts.truncated = true;
+        }
+        this.readCounts.unique_successful_paths = this.readPathDigests.size;
+    }
     observations = new Set();
     server = null;
     revoked = false;
@@ -174,6 +205,8 @@ export class LocalToolServer {
                         return;
                     }
                     send({ content: [{ type: 'text', text: JSON.stringify(result) }] });
+                    if (params.name === 'local_read')
+                        this.recordRead(true, params.arguments);
                 }
                 catch (error) {
                     if (this.token !== token || !this.allowed()) {
@@ -182,6 +215,8 @@ export class LocalToolServer {
                     }
                     // Only stable policy error identifiers cross this boundary, never raw paths/stderr.
                     const code = error instanceof Error ? error.message.match(/^(DENIED_[A-Z_]+|LOCAL_SANDBOX_UNAVAILABLE)/)?.[0] : undefined;
+                    if (params.name === 'local_read')
+                        this.recordRead(false, params.arguments);
                     send({ isError: true, content: [{ type: 'text', text: code ?? 'LOCAL_TOOL_FAILED' }] });
                 }
             }
@@ -203,7 +238,7 @@ export class LocalToolServer {
         if (!address || typeof address === 'string')
             throw new Error('Failed to bind local tool server');
         this.url = `http://127.0.0.1:${address.port}/mcp`;
-        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations });
+        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations, reads: () => this.readObservations() });
         discoveryScopes.set(this.discoveryScope, { endpoint: this.url, credentialHash: createHash('sha256').update(this.token).digest('hex') });
         return { url: this.url, token: this.token };
     }

package/dist/src/safety/policy-inventory-client.js

@@ -0,0 +1,77 @@
+import { execFile } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { regularFileStamp } from './stable-file-read.js';
+import { validPolicyObserverPin } from '../adapters/codex/prelaunch-policy.js';
+const denied = () => Error('CODEX_POLICY_INVENTORY_REJECTED');
+export const policyObserverPath = (pin) => `/Library/PrivilegedHelperTools/com.mtec.ai-gateway.policy-observer.${pin.sha256}`;
+/** Only compiled reviewed registrations select this executable, never task/env input. */
+export function verifyPolicyObserver(pin) {
+    if (!validPolicyObserverPin(pin))
+        throw denied();
+    const binary = policyObserverPath(pin);
+    if (realpathSync(binary) !== binary)
+        throw denied();
+    const file = lstatSync(binary);
+    if (!file.isFile() || file.isSymbolicLink() || file.uid !== 0 || (file.mode & 0o022) !== 0 || (file.mode & 0o111) === 0)
+        throw denied();
+    for (let dir = path.dirname(binary);; dir = path.dirname(dir)) {
+        const s = lstatSync(dir);
+        if (!s.isDirectory() || s.isSymbolicLink() || s.uid !== 0 || (s.mode & 0o022) !== 0)
+            throw denied();
+        if (dir === path.dirname(dir))
+            break;
+    }
+    const before = regularFileStamp(binary);
+    if (createHash('sha256').update(readFileSync(binary)).digest('hex') !== pin.sha256 || regularFileStamp(binary) !== before)
+        throw denied();
+}
+const query = (binary, args, request, signal) => new Promise((resolve, reject) => {
+    const child = execFile(binary, [...args], { encoding: 'utf8', timeout: args[0] === '--ready' ? 5000 : 70_000, maxBuffer: 8192, signal, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } }, (error, stdout, stderr) => { if (error || stderr || !stdout)
+        return reject(denied()); resolve(stdout); });
+    child.stdin?.on('error', () => reject(denied()));
+    child.stdin?.end(request);
+});
+/** Single-use asynchronous IPC; the native client verifies root peer credentials.
+ * Injection seams are trusted in-process test code, not configuration loaders. */
+export function createPolicyInventoryClient(original, deps) {
+    if (!validPolicyObserverPin(original))
+        throw denied();
+    const pin = Object.freeze({ ...original });
+    let used = false;
+    const perform = async (operation, signal) => {
+        if (used)
+            throw denied();
+        used = true;
+        try {
+            if (signal?.aborted)
+                throw denied();
+            const verify = deps?.verify ?? verifyPolicyObserver, now = deps?.now ?? Date.now;
+            verify(pin);
+            const startedAt = now(), nonce = (deps?.nonce ?? (() => randomBytes(32).toString('hex')))();
+            if (!Number.isSafeInteger(startedAt) || startedAt < 0 || !/^[a-f0-9]{64}$/.test(nonce))
+                throw denied();
+            const raw = await (deps?.run ?? query)(policyObserverPath(pin), [operation === 'ready' ? '--ready' : '--query'], JSON.stringify({ version: 1, operation, nonce }), signal);
+            if (signal?.aborted || typeof raw !== 'string' || Buffer.byteLength(raw) > 8192)
+                throw denied();
+            verify(pin);
+            const at = now(), r = JSON.parse(raw), keys = operation === 'ready' ? 'nonce,observerSha256,operation,status,version' : 'complete,empty,inventoryFingerprint,nonce,observedAt,observerSha256,operation,status,version';
+            if (!r || typeof r !== 'object' || Array.isArray(r) || Object.keys(r).sort().join(',') !== keys || r.version !== 1 || r.operation !== operation || r.nonce !== nonce || r.observerSha256 !== pin.sha256 || !Number.isSafeInteger(at) || at < startedAt)
+                throw denied();
+            if (operation === 'ready') {
+                if (r.status !== 'ready')
+                    throw denied();
+                return;
+            }
+            if (r.status !== 'completed' || r.complete !== true || r.empty !== true || !Number.isSafeInteger(r.observedAt) || r.observedAt < startedAt || r.observedAt > at || at - r.observedAt > 60_000 || typeof r.inventoryFingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(r.inventoryFingerprint))
+                throw denied();
+            return Object.freeze({ version: 1, exit: 0, euid: 0, scope: 'machine_and_current_user', complete: true, empty: true, observedAt: r.observedAt, inventoryFingerprint: r.inventoryFingerprint });
+        }
+        catch {
+            throw denied();
+        }
+    };
+    return Object.freeze({ async checkReady(signal) { await perform('ready', signal); }, async collectOnce(signal) { const r = await perform('inventory', signal); if (!r)
+            throw denied(); return r; } });
+}

package/dist/src/state-store.js

@@ -20,9 +20,22 @@ export class FileDaemonStateStore {
     async save(state) {
         mkdirSync(this.root, { recursive: true, mode: 0o700 });
         const temporary = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;
-        await fs.writeFile(temporary, JSON.stringify(state, null, 2), { mode: 0o600 });
+        const file = await fs.open(temporary, 'wx', 0o600);
+        try {
+            await file.writeFile(JSON.stringify(state, null, 2));
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
         await fs.rename(temporary, this.filePath);
-        await fs.chmod(this.filePath, 0o600);
+        const directory = await fs.open(this.root, 'r');
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
     }
     async clear() { await fs.rm(this.filePath, { force: true }); }
 }

package/native/policy-observer-installed-evidence.json

@@ -0,0 +1,22 @@
+{
+  "fixture_class": "installed_observer_no_model_fixture",
+  "work_item_id": "bcb9164a-d4f8-4caa-8f61-5eeb7b8a1cc0",
+  "worklog_id": "dbf85621-b9ed-4843-8eeb-cc648ab758e1",
+  "checkpoint_id": "2748b184-39c2-412f-b542-d86fee2c13d8",
+  "observer_sha256": "2a07812cd47782826a359b749096b681a6ee49e91f990d48abdc60f2d46e4c9c",
+  "observer_protocol": "policy-inventory-v1",
+  "plist_sha256": "1fc069a257349b49a8dabd8c18defc12e9a94b14902ffa129c3b4438441c455d",
+  "employee_uid": 501,
+  "ready_requests": 1,
+  "machine_inventory_queries": 1,
+  "machine_complete": true,
+  "machine_empty": true,
+  "current_user_forced_config": false,
+  "current_user_forced_requirements": false,
+  "owned_query_children_remaining": 0,
+  "existing_employee_daemon_unloaded": true,
+  "actual_codex_daemon_model_acceptance": false,
+  "different_uid_and_cancellation_coverage": "synthetic_only",
+  "continuous_mdm_monitoring": false,
+  "inherited_manual_fixture_gate": "3bb8b2ad50a44cdea5a2a3f388f8009b51d8c60d46230fb3d0b7fed0b9f7452d"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "private": false,
   "license": "UNLICENSED",
   "bin": {
@@ -10,7 +10,9 @@
     "dist/src",
     "README.md",
     "LICENSE",
-    "native/bin/codex-observe-darwin-arm64"
+    "native/bin/codex-observe-darwin-arm64",
+    "native/bin/policy-observer-darwin-arm64",
+    "native/policy-observer-installed-evidence.json"
   ],
   "type": "module",
   "engines": {