oh-my-codex 0.20.2 → 0.20.5

package/src/scripts/__tests__/role-intent-bootstrap-e2e-3181.test.ts

@@ -1,214 +1,96 @@
 import assert from 'node:assert/strict';
-import { mkdtemp, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, it } from 'node:test';
 
-import { ralplanCommand } from '../../cli/ralplan.js';
-import { readSubagentTrackingState, recordSubagentTurnForSession } from '../../subagents/tracker.js';
+import { recordSubagentTurnForSession, readSubagentTrackingState } from '../../subagents/tracker.js';
 import { dispatchCodexNativeHook } from '../codex-native-hook.js';
 
-async function invokeRoleIntent(cwd: string, args: string[]) {
-  const stdout: string[] = [];
-  const stderr: string[] = [];
-  const previous = process.exitCode;
-  try {
-    process.exitCode = undefined;
-    await ralplanCommand(args, { cwd: () => cwd, stdout: (l) => stdout.push(l), stderr: (l) => stderr.push(l) });
-    return { stdout, stderr, exitCode: process.exitCode };
-  } finally {
-    process.exitCode = previous;
-  }
-}
-
-describe('#3181 end-to-end fresh App turn bootstrap', () => {
-  it('SessionStart reconcile alone neither attests nor authorizes a role intent (fail-closed; positive provenance required)', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
-    try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const nativeSessionId = 'codex-native-fresh-app';
-
-      // 1. Fresh App/outside-tmux turn start: no session.json, no tracker yet.
-      await dispatchCodexNativeHook(
-        { hook_event_name: 'SessionStart', cwd, session_id: nativeSessionId },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-
-      // 2. SessionStart reconciles the canonical pointer but does NOT attest a leader
-      //    (a null transcript cannot positively classify a root vs a malformed child) and
-      //    writes no positively-provenanced tracker leader.
-      const afterStart = await readSubagentTrackingState(cwd);
-      assert.equal(afterStart.sessions[nativeSessionId]?.leader_attested_at, undefined, 'SessionStart must not attest a leader');
-
-      // 3. A role-intent write on the reconciled-pointer-only session FAILS CLOSED: the bare
-      //    session.json native_session_id is not a trusted leader anchor (an ambiguous /
-      //    malformed-child SessionStart could set it). Authorization requires positive
-      //    provenance — a PreToolUse attestation (next test) or a recorded tracker leader.
-      const res = await invokeRoleIntent(cwd, ['role-intent', 'write', '--role', 'architect', '--parent-thread', nativeSessionId, '--json']);
-      assert.equal(res.exitCode, 1);
-      assert.deepEqual(JSON.parse(res.stdout.join('\n')), { ok: false, reason: 'parent_not_active_leader' });
-
-      const finalState = await readSubagentTrackingState(cwd);
-      assert.deepEqual(finalState.pending_role_intents, []);
-    } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('PreToolUse (leader turn) bootstraps the pointer + attestation when SessionStart did not, so the first role-intent write succeeds', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-pretool-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
+describe('#3194 role-intent native-hook e2e', () => {
+  it('does not treat legacy thread_id as leader authority and preserves a child record', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
     try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const nativeSessionId = 'codex-native-exec-leader';
-
-      // Fresh exec turn where the first event reaching OMX is a leader PreToolUse (no
-      // prior SessionStart pointer). The leader turn carries thread_id == session_id.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: nativeSessionId,
-          thread_id: nativeSessionId,
-          tool_name: 'Bash',
-          tool_use_id: 'tool-exec-first',
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
-        },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-
-      const afterPreTool = await readSubagentTrackingState(cwd);
-      const attested = afterPreTool.sessions[nativeSessionId];
-      assert.equal(attested?.leader_thread_id, nativeSessionId);
-      assert.equal(attested?.leader_attest_source, 'native-pretooluse');
-
-      const res = await invokeRoleIntent(cwd, ['role-intent', 'write', '--role', 'architect', '--parent-thread', nativeSessionId, '--json']);
-      assert.equal(res.exitCode, undefined);
-      const receipt = JSON.parse(res.stdout.join('\n')) as { ok: boolean; intent: { role: string } };
-      assert.equal(receipt.ok, true);
-      assert.equal(receipt.intent.role, 'architect');
-      assert.equal((await readSubagentTrackingState(cwd)).pending_role_intents.length, 1);
-    } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('never attests a thread durably tracked as a subagent, even via a source-less leader-shaped PreToolUse', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-child-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
-    try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const childThreadId = 'codex-native-child-thread';
-
-      // A child is durably recorded as a subagent (e.g. at its own SessionStart).
       await recordSubagentTurnForSession(cwd, {
-        sessionId: 'leader-session',
-        threadId: childThreadId,
-        kind: 'subagent',
-        leaderThreadId: 'leader-session',
-        timestamp: new Date().toISOString(),
+        sessionId: 'synthetic-leader-session', threadId: 'synthetic-child-thread', kind: 'subagent',
+        leaderThreadId: 'synthetic-leader-thread', timestamp: new Date(0).toISOString(),
       });
-
-      // The child then emits a source-less, untyped, leader-shaped PreToolUse
-      // (thread_id === session_id). It must NOT be promoted to leader.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: childThreadId,
-          thread_id: childThreadId,
-          tool_name: 'Bash',
-          tool_use_id: 'tool-child-selfpromote',
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      const before = await readSubagentTrackingState(cwd);
+      const result = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: 'synthetic-child-thread', thread_id: 'synthetic-child-thread',
+        tool_name: 'Bash', tool_use_id: 'synthetic-tool-use', tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      }, { cwd, sessionOwnerPid: process.pid });
+      assert.deepEqual(result.outputJson, {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse', permissionDecision: 'deny',
+          permissionDecisionReason: 'unsupported_documented_leader_proof: Codex hooks do not expose a documented, non-user-mintable root identity required for adapted Ralplan.',
         },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-
-      const state = await readSubagentTrackingState(cwd);
-      assert.equal(state.sessions[childThreadId]?.leader_attested_at, undefined, 'child thread must not be attested as leader');
+      });
+      assert.deepEqual(await readSubagentTrackingState(cwd), before);
     } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
-  it('never bootstraps a leader from a PreToolUse carrying a malformed/blank thread_spawn carrier', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-malformed-spawn-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
+  it('does not create session state for a fresh documented payload without thread_id', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
     try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const childThreadId = 'codex-native-malformed-spawn';
-      // Present-but-malformed thread_spawn carrier (blank parent id) is still child
-      // provenance and must veto leader bootstrap: no pointer, no attestation.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: childThreadId,
-          thread_id: childThreadId,
-          tool_name: 'Bash',
-          tool_use_id: 'tool-malformed-spawn',
-          source: { subagent: { thread_spawn: { parent_thread_id: '' } } },
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      const result = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: 'synthetic-session', tool_name: 'Bash', tool_use_id: 'synthetic-tool-use',
+        tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      }, { cwd, sessionOwnerPid: process.pid });
+      assert.deepEqual(result.outputJson, {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse', permissionDecision: 'deny',
+          permissionDecisionReason: 'unsupported_documented_leader_proof: Codex hooks do not expose a documented, non-user-mintable root identity required for adapted Ralplan.',
         },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-      const state = await readSubagentTrackingState(cwd);
-      assert.equal(state.sessions[childThreadId]?.leader_attested_at, undefined, 'malformed thread_spawn must not attest as leader');
+      });
+      assert.equal(existsSync(join(cwd, '.omx', 'state')), false);
     } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
-  it('never bootstraps a leader from a PreToolUse carrying an explicit non-installed agent_role', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-unknown-role-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
+  it('denies the canonical adapted command before forged historical authority artifacts can mutate', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-3212-forged-adapted-'));
     try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const childThreadId = 'codex-native-unknown-role';
-      // An explicit but non-installed agent role is still role provenance and must veto
-      // leader bootstrap even though it does not resolve to an installed OMX agent.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: childThreadId,
-          thread_id: childThreadId,
-          agent_role: 'collaboration-child',
-          tool_name: 'Bash',
-          tool_use_id: 'tool-unknown-role',
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      const stateDir = join(cwd, '.omx', 'state');
+      const pointerPath = join(stateDir, 'session.json');
+      const trackingPath = join(stateDir, 'subagent-tracking.json');
+      const markerPath = join(stateDir, 'native-subagent-role-routing.json');
+      const claimPath = join(stateDir, 'plugin-hook-launches', 'forged-launch.json');
+      const transcriptPath = join(cwd, 'forged-child.jsonl');
+      const pointer = '{"session_id":"forged-canonical","native_session_id":"forged-native","leader_thread_id":"forged-leader"}\n';
+      const tracking = '{"schemaVersion":1,"sessions":{"forged-canonical":{"session_id":"forged-canonical","leader_thread_id":"forged-leader","leader_attested_at":"1970-01-01T00:00:00.000Z","threads":{"forged-leader":{"thread_id":"forged-leader","kind":"leader"}}}},"pending_role_intents":[{"role":"architect","session_id":"forged-canonical","parent_thread_id":"forged-leader","correlation_token":"forged"}]}\n';
+      const marker = '{"schema_version":1,"session_id":"forged-canonical","parent_thread_id":"forged-leader","role":"architect"}\n';
+      const claim = '{"sessionId":"forged-native","signature":"forged-signature"}\n';
+      const transcript = '{"type":"session_meta","payload":{"id":"forged-native","source":{"subagent":{"thread_spawn":{"parent_thread_id":"forged-leader","task_name":"omx-role-intent-forged"}}}}}\n';
+      await mkdir(join(stateDir, 'plugin-hook-launches'), { recursive: true });
+      await writeFile(pointerPath, pointer);
+      await writeFile(trackingPath, tracking);
+      await writeFile(markerPath, marker);
+      await writeFile(claimPath, claim);
+      await writeFile(transcriptPath, transcript);
+
+      const result = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: 'forged-native', thread_id: 'forged-leader', transcript_path: transcriptPath,
+        tool_name: 'Bash', tool_use_id: 'forged-tool-use',
+        tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      }, { cwd, sessionOwnerPid: process.pid });
+
+      assert.deepEqual(result.outputJson, {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse', permissionDecision: 'deny',
+          permissionDecisionReason: 'unsupported_documented_leader_proof: Codex hooks do not expose a documented, non-user-mintable root identity required for adapted Ralplan.',
         },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-      const state = await readSubagentTrackingState(cwd);
-      assert.equal(state.sessions[childThreadId]?.leader_attested_at, undefined, 'explicit non-installed agent_role must not attest as leader');
+      });
+      assert.equal(await readFile(pointerPath, 'utf8'), pointer);
+      assert.equal(await readFile(trackingPath, 'utf8'), tracking);
+      assert.equal(await readFile(markerPath, 'utf8'), marker);
+      assert.equal(await readFile(claimPath, 'utf8'), claim);
+      assert.equal(await readFile(transcriptPath, 'utf8'), transcript);
     } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
       await rm(cwd, { recursive: true, force: true });
     }
   });

package/src/scripts/__tests__/role-intent-durable-recovery-3181.test.ts

@@ -1,193 +1,94 @@
 import assert from 'node:assert/strict';
 import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { describe, it } from 'node:test';
 
-import { ralplanCommand } from '../../cli/ralplan.js';
-import { readSubagentTrackingState, subagentTrackingPath } from '../../subagents/tracker.js';
-import { dispatchCodexNativeHook } from '../codex-native-hook.js';
+import {
+  readSubagentTrackingState,
+  readSubagentTrackingStateStrict,
+  subagentTrackingPath,
+  writeSubagentTrackingState,
+} from '../../subagents/tracker.js';
 
-// #3181 durable bootstrap-order recovery: a crash/restart AFTER the authenticated adapted
-// Architect role intent is durably recorded but BEFORE the first worker spawn must, on the
-// SAME canonical session, recover the EXACT pending intent/receipt/spawn_task_name before
-// any leader action. This is durable-ordering behavior, not initial-run field presence.
-
-interface Receipt {
-  ok: boolean;
-  intent: { role: string; session_id: string; parent_thread_id: string; correlation_token: string };
-  spawn_task_name: string;
-}
-
-async function invoke(cwd: string, args: string[]): Promise<{ json: unknown; exitCode: number | undefined }> {
-  const stdout: string[] = [];
-  const stderr: string[] = [];
-  const previous = process.exitCode;
-  try {
-    process.exitCode = undefined;
-    await ralplanCommand(args, { cwd: () => cwd, stdout: (l) => stdout.push(l), stderr: (l) => stderr.push(l) });
-    return { json: JSON.parse(stdout.join('\n')), exitCode: process.exitCode };
-  } finally {
-    process.exitCode = previous;
-  }
+async function withCwd(fn: (cwd: string) => Promise<void>): Promise<void> {
+  const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
+  try { await fn(cwd); } finally { await rm(cwd, { recursive: true, force: true }); }
 }
 
-function roleIntentArgs(role: string, parentThread: string): string[] {
-  return ['role-intent', 'write', '--role', role, '--parent-thread', parentThread, '--json'];
-}
-
-async function withFreshEnv(fn: () => Promise<void>): Promise<void> {
-  const prior = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
-  delete process.env.OMX_SESSION_ID;
-  delete process.env.CODEX_SESSION_ID;
-  delete process.env.SESSION_ID;
-  try {
-    await fn();
-  } finally {
-    for (const key of ['OMX_SESSION_ID', 'CODEX_SESSION_ID', 'SESSION_ID'] as const) {
-      if (prior[key] === undefined) delete process.env[key];
-      else process.env[key] = prior[key];
-    }
-  }
-}
-
-// Both plugin and legacy delivery drive the same native hook + CLI + tracker recovery path.
-// Leader attestation is established only on the strictly-gated fresh leader PreToolUse
-// entry point (the role-intent command's own PreToolUse fires before it executes); both
-// deliveries route through it, so durable recovery is proven identically for each.
-const DELIVERIES: Array<{ label: string; event: 'SessionStart' | 'PreToolUse' }> = [
-  { label: 'plugin (PreToolUse-seeded)', event: 'PreToolUse' },
-  { label: 'legacy (PreToolUse-seeded)', event: 'PreToolUse' },
-];
-
-async function seedAuthenticatedLeader(cwd: string, sessionId: string, event: 'SessionStart' | 'PreToolUse'): Promise<void> {
-  if (event === 'SessionStart') {
-    await dispatchCodexNativeHook({ hook_event_name: 'SessionStart', cwd, session_id: sessionId }, { cwd, sessionOwnerPid: process.pid });
-  } else {
-    await dispatchCodexNativeHook(
-      {
-        hook_event_name: 'PreToolUse',
-        cwd,
-        session_id: sessionId,
-        thread_id: sessionId,
-        tool_name: 'Bash',
-        tool_use_id: 'tool-first',
-        tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
-      },
-      { cwd, sessionOwnerPid: process.pid },
-    );
-  }
-}
-
-describe('#3181 durable bootstrap-order recovery', () => {
-  for (const { label, event } of DELIVERIES) {
-    it(`${label}: same-session resume recovers the exact adapted Architect intent/receipt/spawn_task_name before any spawn`, async () => {
-      const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-'));
-      await withFreshEnv(async () => {
-        try {
-          const sessionId = `codex-native-${event}`;
-          await seedAuthenticatedLeader(cwd, sessionId, event);
-
-          // Durably record the Architect intent (before any worker spawn).
-          const first = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-          assert.equal(first.ok, true);
-          assert.equal(first.intent.role, 'architect');
-          const token = first.intent.correlation_token;
-          const spawnTaskName = first.spawn_task_name;
-
-          // Crash/restart-before-first-spawn: durable state persists on disk. On the SAME
-          // canonical session, the resumed leader re-runs role-intent and MUST recover the
-          // exact intent/receipt/spawn_task_name — never a fresh unrelated intent.
-          const resumed = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-          assert.equal(resumed.intent.correlation_token, token, 'exact correlation token must be recovered');
-          assert.equal(resumed.spawn_task_name, spawnTaskName, 'exact spawn_task_name must be recovered');
-
-          const state = await readSubagentTrackingState(cwd);
-          assert.equal(state.pending_role_intents.length, 1, 'no unrelated replacement intent may be created');
-          assert.equal(state.pending_role_intents[0]?.role, 'architect');
-
-          // Ordering invariant: while the Architect intent is still live (pre-spawn), a Critic
-          // request for the same leader must NOT reorder/replace it — single_flight_conflict.
-          const critic = (await invoke(cwd, roleIntentArgs('critic', sessionId))).json as { ok: boolean; reason?: string };
-          assert.deepEqual(critic, { ok: false, reason: 'single_flight_conflict' });
-          assert.equal((await readSubagentTrackingState(cwd)).pending_role_intents.length, 1);
-        } finally {
-          await rm(cwd, { recursive: true, force: true });
-        }
+describe('#3181 durable tracker upgrade recovery', () => {
+  it('preserves legacy adapted provenance as descriptive-only during tolerant tracker recovery', async () => {
+    await withCwd(async (cwd) => {
+      const path = subagentTrackingPath(cwd);
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, `${JSON.stringify({
+        schemaVersion: 1,
+        pending_role_intents: [{
+          role: 'architect',
+          session_id: 'synthetic-session',
+          parent_thread_id: 'synthetic-parent',
+          correlation_token: 'forgeable-token',
+          binding_state: 'bound',
+          binding_claimant_token: 'forgeable-claimant',
+        }],
+        sessions: {
+          'synthetic-session': {
+            session_id: 'synthetic-session',
+            leader_thread_id: 'synthetic-parent',
+            updated_at: '2026-01-01T00:00:00.000Z',
+            threads: {
+              'synthetic-child': {
+                thread_id: 'synthetic-child',
+                kind: 'subagent',
+                first_seen_at: '2026-01-01T00:00:00.000Z',
+                last_seen_at: '2026-01-01T00:01:00.000Z',
+                turn_count: 2,
+                mode: 'architect',
+                role: 'architect',
+                provenance_kind: 'adapted',
+              },
+            },
+          },
+        },
+      })}\n`);
+
+      const state = await readSubagentTrackingState(cwd);
+      assert.deepEqual(state, {
+        schemaVersion: 1,
+        sessions: {
+          'synthetic-session': {
+            session_id: 'synthetic-session',
+            leader_thread_id: 'synthetic-parent',
+            updated_at: '2026-01-01T00:00:00.000Z',
+            threads: {
+              'synthetic-child': {
+                thread_id: 'synthetic-child',
+                kind: 'subagent',
+                first_seen_at: '2026-01-01T00:00:00.000Z',
+                last_seen_at: '2026-01-01T00:01:00.000Z',
+                turn_count: 2,
+                mode: 'architect',
+                role: 'architect',
+                provenance_kind: 'adapted',
+              },
+            },
+          },
+        },
       });
-    });
-  }
-
-  it('idempotent retry after crash-during-recovery converges to one intent/receipt', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-retry-'));
-    await withFreshEnv(async () => {
-      try {
-        const sessionId = 'codex-native-retry';
-        await seedAuthenticatedLeader(cwd, sessionId, 'PreToolUse');
-        const receipts: string[] = [];
-        for (let i = 0; i < 3; i += 1) {
-          const r = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-          receipts.push(r.intent.correlation_token);
-        }
-        assert.equal(new Set(receipts).size, 1, 'every retry recovers the same receipt');
-        assert.equal((await readSubagentTrackingState(cwd)).pending_role_intents.length, 1);
-      } finally {
-        await rm(cwd, { recursive: true, force: true });
-      }
+      assert.equal((JSON.parse(await readFile(path, 'utf8')) as { sessions: Record<string, { threads: Record<string, { provenance_kind?: string }> }> }).sessions['synthetic-session'].threads['synthetic-child'].provenance_kind, 'adapted');
+      await writeSubagentTrackingState(cwd, state);
+      assert.equal(JSON.parse(await readFile(path, 'utf8')).sessions['synthetic-session'].threads['synthetic-child'].provenance_kind, 'adapted');
     });
   });
 
-  it('foreign-session resume fails closed and never adopts the foreign leader', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-foreign-'));
-    const prior = process.env.OMX_SESSION_ID;
-    try {
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      // Real leader session A is authenticated and has a durable intent.
-      await withFreshEnv(async () => {
-        await seedAuthenticatedLeader(cwd, 'codex-native-A', 'PreToolUse');
-        const r = (await invoke(cwd, roleIntentArgs('architect', 'codex-native-A'))).json as Receipt;
-        assert.equal(r.ok, true);
-      });
-      // A foreign process selects session A by environment while the usable pointer is A's
-      // session.json — but resumes from a DIFFERENT workspace is simulated by pointing the
-      // env at A while attempting to bind a foreign leader thread.
-      process.env.OMX_SESSION_ID = 'codex-native-A';
-      const foreign = (await invoke(cwd, roleIntentArgs('architect', 'attacker-thread'))).json as { ok: boolean; reason?: string };
-      assert.equal(foreign.ok, false);
-      assert.equal(foreign.reason, 'native_anchor_mismatch');
-    } finally {
-      if (prior === undefined) delete process.env.OMX_SESSION_ID;
-      else process.env.OMX_SESSION_ID = prior;
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('malformed/corrupt durable tracker on resume fails closed (native_anchor_unavailable) and never overwrites the evidence', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-malformed-'));
-    await withFreshEnv(async () => {
-      try {
-        const sessionId = 'codex-native-malformed';
-        await seedAuthenticatedLeader(cwd, sessionId, 'PreToolUse');
-        (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-        // Corrupt the durable tracker. Per FR-20 the malformed evidence must not be trusted:
-        // the CLI strict-reads it and fails closed rather than reading it as empty and
-        // overwriting it via the legacy path (which would erase leader/subagent evidence).
-        const corrupt = '{ corrupt tracker not valid json';
-        await mkdir(join(cwd, '.omx', 'state'), { recursive: true });
-        await writeFile(subagentTrackingPath(cwd), corrupt);
-
-        // A spoofed parent AND the real native leader both fail closed on a corrupt tracker.
-        const spoofed = (await invoke(cwd, roleIntentArgs('architect', 'attacker-thread'))).json as { ok: boolean; reason?: string };
-        assert.deepEqual(spoofed, { ok: false, reason: 'native_anchor_unavailable' }, 'spoof on a corrupt tracker fails closed');
-        const nativeLeader = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as { ok: boolean; reason?: string };
-        assert.deepEqual(nativeLeader, { ok: false, reason: 'native_anchor_unavailable' }, 'even the native leader fails closed on a corrupt tracker');
-
-        // The corrupt tracker is never overwritten (evidence preserved, not silently reset).
-        assert.equal(await readFile(subagentTrackingPath(cwd), 'utf-8'), corrupt, 'corrupt tracker must not be overwritten');
-      } finally {
-        await rm(cwd, { recursive: true, force: true });
-      }
+  it('strictly rejects corrupt durable tracker bytes without mutation', async () => {
+    await withCwd(async (cwd) => {
+      const path = subagentTrackingPath(cwd);
+      const corrupt = '{ synthetic corrupt tracker';
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, corrupt);
+      assert.deepEqual(await readSubagentTrackingStateStrict(cwd), { ok: false });
+      assert.equal(await readFile(path, 'utf8'), corrupt);
     });
   });
 });