oh-my-codex 0.21.0 → 0.21.2

package/plugins/oh-my-codex/skills/omx-setup/SKILL.md

@@ -48,7 +48,7 @@ omx doctor
 
 Expect doctor evidence for prompts and skills in the selected scope, project-root AGENTS.md, `.omx/state`, and CLI-first config in the scope target `config.toml`. First-party MCP and shared registry sync are omitted unless setup used `--mcp compat` (if supported by the installed CLI).
 
-If using local source, run `npm run build` before `node bin/omx.js setup --force --verbose` and `node bin/omx.js doctor`. If AGENTS was not overwritten or merged, stop the active OMX session and rerun with `--force` or `--merge-agents`; do not edit lifecycle state manually.
+If using local source, run `npm run build` before `node dist/cli/omx.js setup --force --verbose` and `node dist/cli/omx.js doctor`. If AGENTS was not overwritten or merged, stop the active OMX session and rerun with `--force` or `--merge-agents`; do not edit lifecycle state manually.
 
 ## Discovery troubleshooting
 

package/plugins/oh-my-codex/skills/ralplan/SKILL.md

@@ -13,10 +13,19 @@ Ralplan is the canonical consensus-planning stage used by Autopilot between `$de
 $ralplan "task description"
 ```
 
+Standalone advisory planning is explicitly opt-in:
+
+```text
+$ralplan --advisory "task description"
+```
+
+Advisory runs the same sequential Planner → Architect → Critic review lifecycle, binds the plan and both review artifacts to exact bytes and one tracker-backed iteration, then returns to the caller with `active:false`. It is a cooperative workflow pause, not a security fence or permission system. It never emits a `PreToolUse` allow/block decision, never completes the host consensus gate, never authorizes execution, and never suppresses unrelated host behavior. Terminal state must carry explicit `false` values for the consensus gate, host verification, and execution handoff rather than omitting them. A later concrete affirmative execution request may produce non-authoritative routing context, but it does not persist a permission, rewrite terminal evidence, or create an automatic handoff; quotations, code, examples, documentation, questions, modal requests, negations, and vague approval remain classifier negatives. `approved+proven` requires complete lifecycle digests plus post-write revalidation. Administrative abandonment is append-only, idempotent for prepared or committed journals, and records a separate byte-bound admin event without rewriting the original closeout journal. Real enforcement requires an explicit host-issued, host-verified receipt or capability on a non-user-mintable surface; local Advisory files, prompts, session/thread fields, tracker records, and HERDR observability cannot substitute for it. On Darwin, each Advisory evidence artifact is limited to 128 KiB by the pinned-directory reader; other supported platforms allow up to 8 MiB.
+
 ## Flags
 
 - `--interactive`: Enables user prompts at key decision points (draft review in step 2 and final approval in step 6). Without this flag the workflow runs fully automated — Planner → Architect → Critic loop — and outputs the final plan without asking for confirmation.
 - `--deliberate`: Forces deliberate mode for high-risk work. Adds pre-mortem (3 scenarios) and expanded test planning (unit/integration/e2e/observability). Without this flag, deliberate mode can still auto-enable when the request explicitly signals high risk (auth/security, migrations, destructive changes, production incidents, compliance/PII, public API breakage).
+- `--advisory`: Standalone only. It cannot be combined with Autopilot, Pipeline, Team, Ralph, Ultragoal, execution flags, or unknown flags. Activation requires canonical session, root thread, and turn identity.
 
 ## Ontology-heavy review
 
@@ -194,7 +203,7 @@ The gate auto-passes when it detects **any** concrete signal. You do not need al
 | Gate fires on a well-specified prompt | Add a file reference, function name, or issue number to anchor the request |
 | Want to bypass the gate | Prefix with `force:` or `!` (e.g., `force: ralph fix it`) |
 | Gate does not fire on a vague prompt | The gate only catches prompts with <=15 effective words and no concrete anchors; add more detail or use `$ralplan` explicitly |
-| Redirected to ralplan but want to skip planning | In the ralplan workflow, say "just do it" or "skip planning" to transition directly to execution |
+| Redirected to ralplan but want to stop planning | Cancel or abandon through the workflow's administrative path. Advisory is cooperative and does not enforce host permissions; a real security gate would require an explicit host-issued, host-verified receipt. |
 
 ## Scenario Examples
 

package/plugins/oh-my-codex/skills/team/SKILL.md

@@ -15,6 +15,8 @@ Use only for an explicit `$team` request or `omx team ...` launch that benefits
 - Require `tmux -V`, a leader session with `$TMUX`, and the intended `omx` executable. In Codex App/plain non-tmux sessions, explain the runtime boundary instead of pretending Team is available.
 - Before launch, ground the task in a recent `.omx/context/{slug}-*.md`; create a concise snapshot when none exists. Include target, evidence, constraints, unknowns, and likely touchpoints.
 - Do not launch nested Team runs. Pick worker roles deliberately; use `OMX_TEAM_WORKER_CLI=codex|claude|auto` or `OMX_TEAM_WORKER_CLI_MAP=...` only when needed.
+- Per-agent reasoning is set by `agentReasoning`; accepted values are `low`, `medium`, `high`, `xhigh`, and `max`. `max` is passed unchanged and remains capability-dependent. `ultra` is unsupported and is not an alias for `max`.
+- Invalid configured values use the built-in role-default fallback. An explicit raw `-c model_reasoning_effort=...` is opaque and wins. When both sources are present, explicit raw reasoning wins over inherited Team reasoning and environment reasoning. Do not downgrade or retry `max` as `xhigh`; built-in role defaults remain unchanged.
 
 ## Operational steps
 

package/skills/doctor/SKILL.md

@@ -17,7 +17,7 @@ omx doctor --force            # repair eligible repo artifact ownership issues
 omx doctor --dry-run --force  # preview eligible ownership repairs
 ```
 
-For a local source checkout, build first and invoke `node bin/omx.js doctor`. Keep command output and exact paths for the report.
+For a local source checkout, build first and invoke `node dist/cli/omx.js doctor`. Keep command output and exact paths for the report.
 
 ### Plugin cache and version
 

package/skills/omx-setup/SKILL.md

@@ -48,7 +48,7 @@ omx doctor
 
 Expect doctor evidence for prompts and skills in the selected scope, project-root AGENTS.md, `.omx/state`, and CLI-first config in the scope target `config.toml`. First-party MCP and shared registry sync are omitted unless setup used `--mcp compat` (if supported by the installed CLI).
 
-If using local source, run `npm run build` before `node bin/omx.js setup --force --verbose` and `node bin/omx.js doctor`. If AGENTS was not overwritten or merged, stop the active OMX session and rerun with `--force` or `--merge-agents`; do not edit lifecycle state manually.
+If using local source, run `npm run build` before `node dist/cli/omx.js setup --force --verbose` and `node dist/cli/omx.js doctor`. If AGENTS was not overwritten or merged, stop the active OMX session and rerun with `--force` or `--merge-agents`; do not edit lifecycle state manually.
 
 ## Discovery troubleshooting
 

package/skills/ralplan/SKILL.md

@@ -13,10 +13,19 @@ Ralplan is the canonical consensus-planning stage used by Autopilot between `$de
 $ralplan "task description"
 ```
 
+Standalone advisory planning is explicitly opt-in:
+
+```text
+$ralplan --advisory "task description"
+```
+
+Advisory runs the same sequential Planner → Architect → Critic review lifecycle, binds the plan and both review artifacts to exact bytes and one tracker-backed iteration, then returns to the caller with `active:false`. It is a cooperative workflow pause, not a security fence or permission system. It never emits a `PreToolUse` allow/block decision, never completes the host consensus gate, never authorizes execution, and never suppresses unrelated host behavior. Terminal state must carry explicit `false` values for the consensus gate, host verification, and execution handoff rather than omitting them. A later concrete affirmative execution request may produce non-authoritative routing context, but it does not persist a permission, rewrite terminal evidence, or create an automatic handoff; quotations, code, examples, documentation, questions, modal requests, negations, and vague approval remain classifier negatives. `approved+proven` requires complete lifecycle digests plus post-write revalidation. Administrative abandonment is append-only, idempotent for prepared or committed journals, and records a separate byte-bound admin event without rewriting the original closeout journal. Real enforcement requires an explicit host-issued, host-verified receipt or capability on a non-user-mintable surface; local Advisory files, prompts, session/thread fields, tracker records, and HERDR observability cannot substitute for it. On Darwin, each Advisory evidence artifact is limited to 128 KiB by the pinned-directory reader; other supported platforms allow up to 8 MiB.
+
 ## Flags
 
 - `--interactive`: Enables user prompts at key decision points (draft review in step 2 and final approval in step 6). Without this flag the workflow runs fully automated — Planner → Architect → Critic loop — and outputs the final plan without asking for confirmation.
 - `--deliberate`: Forces deliberate mode for high-risk work. Adds pre-mortem (3 scenarios) and expanded test planning (unit/integration/e2e/observability). Without this flag, deliberate mode can still auto-enable when the request explicitly signals high risk (auth/security, migrations, destructive changes, production incidents, compliance/PII, public API breakage).
+- `--advisory`: Standalone only. It cannot be combined with Autopilot, Pipeline, Team, Ralph, Ultragoal, execution flags, or unknown flags. Activation requires canonical session, root thread, and turn identity.
 
 ## Ontology-heavy review
 
@@ -194,7 +203,7 @@ The gate auto-passes when it detects **any** concrete signal. You do not need al
 | Gate fires on a well-specified prompt | Add a file reference, function name, or issue number to anchor the request |
 | Want to bypass the gate | Prefix with `force:` or `!` (e.g., `force: ralph fix it`) |
 | Gate does not fire on a vague prompt | The gate only catches prompts with <=15 effective words and no concrete anchors; add more detail or use `$ralplan` explicitly |
-| Redirected to ralplan but want to skip planning | In the ralplan workflow, say "just do it" or "skip planning" to transition directly to execution |
+| Redirected to ralplan but want to stop planning | Cancel or abandon through the workflow's administrative path. Advisory is cooperative and does not enforce host permissions; a real security gate would require an explicit host-issued, host-verified receipt. |
 
 ## Scenario Examples
 

package/skills/team/SKILL.md

@@ -15,6 +15,8 @@ Use only for an explicit `$team` request or `omx team ...` launch that benefits
 - Require `tmux -V`, a leader session with `$TMUX`, and the intended `omx` executable. In Codex App/plain non-tmux sessions, explain the runtime boundary instead of pretending Team is available.
 - Before launch, ground the task in a recent `.omx/context/{slug}-*.md`; create a concise snapshot when none exists. Include target, evidence, constraints, unknowns, and likely touchpoints.
 - Do not launch nested Team runs. Pick worker roles deliberately; use `OMX_TEAM_WORKER_CLI=codex|claude|auto` or `OMX_TEAM_WORKER_CLI_MAP=...` only when needed.
+- Per-agent reasoning is set by `agentReasoning`; accepted values are `low`, `medium`, `high`, `xhigh`, and `max`. `max` is passed unchanged and remains capability-dependent. `ultra` is unsupported and is not an alias for `max`.
+- Invalid configured values use the built-in role-default fallback. An explicit raw `-c model_reasoning_effort=...` is opaque and wins. When both sources are present, explicit raw reasoning wins over inherited Team reasoning and environment reasoning. Do not downgrade or retry `max` as `xhigh`; built-in role defaults remain unchanged.
 
 ## Operational steps
 

package/src/scripts/__tests__/postinstall.test.ts

@@ -33,6 +33,7 @@ describe("runPostinstall", () => {
       const result = await runPostinstall({
         env: { npm_config_global: "true" },
         getCurrentVersion: async () => "0.14.1",
+        hydrateRuntime: async () => "/cache/omx-runtime",
         log: (message) => logs.push(message),
         readStamp: async () => ({
           installed_version: "0.14.0",
@@ -44,6 +45,7 @@ describe("runPostinstall", () => {
       });
 
       assert.equal(result.status, "hinted");
+      assert.match(logs.join("\n"), /Hydrated omx-runtime/);
       assert.match(logs.join("\n"), /OMX setup is explicit opt-in; run `omx setup` or `omx update` when you're ready/);
 
       const stamp = JSON.parse(await readFile(stampPath, "utf-8")) as {
@@ -68,6 +70,7 @@ describe("runPostinstall", () => {
       const result = await runPostinstall({
         env: { npm_config_global: "true" },
         getCurrentVersion: async () => "0.14.1",
+        hydrateRuntime: async () => "/cache/omx-runtime",
         log: (message) => logs.push(message),
         readStamp: async () => ({
           installed_version: "0.14.0",
@@ -100,6 +103,7 @@ describe("runPostinstall", () => {
         npm_config_user_agent: "bun/1.2.0 npm/? node/v22.0.0 linux x64",
       },
       getCurrentVersion: async () => "0.14.1",
+      hydrateRuntime: async () => "/cache/omx-runtime",
       readStamp: async () => null,
       writeStamp: async (stamp) => {
         writtenStamp = stamp;
@@ -114,15 +118,21 @@ describe("runPostinstall", () => {
     const result = await runPostinstall({
       env: { npm_config_global: "false" },
       getCurrentVersion: async () => "0.14.1",
+      hydrateRuntime: async () => "/cache/omx-runtime",
     });
 
     assert.equal(result.status, "noop-local");
   });
 
   it("does not rerun setup when the installed version matches the saved stamp", async () => {
+    let hydrated = false;
     const result = await runPostinstall({
       env: { npm_config_global: "true" },
       getCurrentVersion: async () => "0.14.1",
+      hydrateRuntime: async () => {
+        hydrated = true;
+        return "/cache/omx-runtime";
+      },
       readStamp: async () => ({
         installed_version: "0.14.1",
         setup_completed_version: "0.14.1",
@@ -131,5 +141,23 @@ describe("runPostinstall", () => {
     });
 
     assert.equal(result.status, "noop-same-version");
+    assert.equal(hydrated, true, "same-version reinstalls must repair a missing native runtime cache");
+  });
+
+  it("keeps global installation non-fatal when runtime hydration fails", async () => {
+    const logs: string[] = [];
+    const result = await runPostinstall({
+      env: { npm_config_global: "true" },
+      getCurrentVersion: async () => "0.14.1",
+      hydrateRuntime: async () => {
+        throw new Error("offline");
+      },
+      log: (message) => logs.push(message),
+      readStamp: async () => null,
+      writeStamp: async () => {},
+    });
+
+    assert.equal(result.status, "hinted");
+    assert.match(logs.join("\n"), /hydration failed non-fatally: offline/);
   });
 });

package/src/scripts/__tests__/ralplan-advisory-hook.test.ts

@@ -0,0 +1,320 @@
+import { afterEach, describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+import {
+  readCurrentRalplanAdvisory,
+  reconcileRalplanAdvisory,
+  observeRalplanAdvisoryPrompt,
+  terminalizeRalplanAdvisory,
+} from '../../ralplan/advisory.js';
+import { activateOrResumeRalplanAdvisory } from '../../ralplan/advisory-activation.js';
+import {
+  buildRalplanAdvisoryRoutingObservation,
+  dispatchCodexNativeHook,
+} from '../codex-native-hook.js';
+
+const roots: string[] = [];
+afterEach(async () => Promise.all(roots.splice(0).map((path) => rm(path, { recursive: true, force: true }))));
+
+async function terminalFixture(prefix: string) {
+  const cwd = await mkdtemp(join(tmpdir(), prefix));
+  roots.push(cwd);
+  const sessionId = 'session-a';
+  const stateDir = join(cwd, '.omx', 'state');
+  const sessionDir = join(stateDir, 'sessions', sessionId);
+  await mkdir(sessionDir, { recursive: true });
+  await writeFile(join(stateDir, 'session.json'), JSON.stringify({
+    session_id: sessionId, native_session_id: sessionId, owner_codex_session_id: sessionId,
+    leader_thread_id: 'root-a', started_at: '2026-08-28T00:00:00.000Z', cwd, state_root: stateDir,
+  }));
+  await writeFile(join(stateDir, 'subagent-tracking.json'), JSON.stringify({
+    schemaVersion: 1,
+    sessions: {
+      [sessionId]: {
+        session_id: sessionId, leader_thread_id: 'root-a',
+        threads: { 'root-a': { thread_id: 'root-a', kind: 'leader' } },
+      },
+    },
+  }));
+  const { activation } = await activateOrResumeRalplanAdvisory({
+    cwd, sessionId, rootThreadId: 'root-a', activationTurnId: 'turn-a', generationId: 'generation-a',
+    prompt: '$ralplan --advisory hook fixture', producer: 'native', threadKind: 'root-or-drift',
+  });
+  const activeMode = {
+    active: true, mode: 'ralplan', current_phase: 'draft', iteration: 1,
+    session_id: sessionId, thread_id: 'root-a', turn_id: 'turn-a',
+    workflow_variant: 'advisory', advisory_generation_id: activation.generation_id,
+    execution_handoff_authorized: false, host_verified: false, planning_complete: false,
+  };
+  await writeFile(join(sessionDir, 'ralplan-state.json'), JSON.stringify(activeMode));
+  await terminalizeRalplanAdvisory({
+    cwd, sessionId, generationId: activation.generation_id, closingTurnId: 'turn-close', iteration: 1,
+    outcome: 'cancelled', integrityStatus: 'proven',
+  });
+  const inactiveMode = {
+    ...activeMode, active: false, current_phase: 'complete', planning_complete: true,
+    execution_handoff_authorized: false, host_verified: false,
+    ralplan_consensus_gate: { complete: false },
+  };
+  await writeFile(join(sessionDir, 'ralplan-state.json'), JSON.stringify(inactiveMode));
+  await writeFile(join(stateDir, 'ralplan-state.json'), JSON.stringify(inactiveMode));
+  return { cwd, sessionId, stateDir, sessionDir, activation };
+}
+
+async function conflictingReplayFixture(prefix: string, standardPhase = 'architect-review') {
+  const fixture = await terminalFixture(prefix);
+  // Replace the committed cancellation fixture with a fresh generation whose
+  // journal is deliberately left prepared before any mirror replay.
+  await rm(join(fixture.sessionDir, 'ralplan-advisory'), { recursive: true, force: true });
+  const { activation } = await activateOrResumeRalplanAdvisory({
+    cwd: fixture.cwd, sessionId: fixture.sessionId, rootThreadId: 'root-a', activationTurnId: 'turn-replay', generationId: 'generation-replay',
+    prompt: '$ralplan --advisory replay fixture', producer: 'native', threadKind: 'root-or-drift',
+  });
+  const advisoryMode = {
+    active: true, mode: 'ralplan', current_phase: 'draft', session_id: fixture.sessionId, thread_id: 'root-a', turn_id: 'turn-replay',
+    workflow_variant: 'advisory', advisory_generation_id: activation.generation_id,
+  };
+  await writeFile(join(fixture.sessionDir, 'ralplan-state.json'), JSON.stringify(advisoryMode));
+  await assert.rejects(terminalizeRalplanAdvisory({
+    cwd: fixture.cwd, sessionId: fixture.sessionId, generationId: activation.generation_id,
+    closingTurnId: 'turn-close-replay', iteration: 1, outcome: 'cancelled', integrityStatus: 'proven',
+    terminalModeUpdates: {
+      ...advisoryMode, active: false, current_phase: 'cancelled', execution_handoff_authorized: false, host_verified: false,
+    },
+    failpoint: (name) => { if (name === 'journal-prepare') throw new Error('prepared-replay'); },
+  }), /prepared-replay/);
+  const standardMode = {
+    active: true, mode: 'ralplan', workflow_variant: 'standard', current_phase: standardPhase,
+    session_id: fixture.sessionId, thread_id: 'root-standard', turn_id: 'turn-standard',
+  };
+  const modePath = join(fixture.sessionDir, 'ralplan-state.json');
+  await writeFile(modePath, JSON.stringify(standardMode));
+  return { ...fixture, activation, generationDir: join(fixture.sessionDir, 'ralplan-advisory', activation.generation_id), modePath, standardMode };
+}
+
+async function snapshotDirectoryBytes(root: string): Promise<Array<[string, string]>> {
+  const values: Array<[string, string]> = [];
+  const walk = async (directory: string, prefix = ''): Promise<void> => {
+    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+      const path = join(directory, entry.name);
+      if (entry.isDirectory()) await walk(path, relative);
+      else values.push([relative, (await readFile(path)).toString('base64')]);
+    }
+  };
+  await walk(root);
+  return values;
+}
+
+describe('ralplan advisory non-authoritative native hooks', () => {
+  it('the packed hook never emits a PreToolUse block for Advisory, including mutation and unknown MCP transports', async () => {
+    const { cwd, sessionId } = await terminalFixture('omx-advisory-nonauthoritative-pretool-');
+    for (const toolName of ['Write', 'Bash', 'mcp__omx_goal__create_goal', 'mcp__thirdparty__commit', 'mcp__unknown__anything']) {
+      const packed = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: sessionId, thread_id: 'root-a',
+        tool_name: toolName, tool_input: { file_path: join(cwd, 'src', 'x.ts'), content: 'x' },
+      } as never, { cwd });
+      assert.notEqual(packed.outputJson?.decision, 'block', toolName);
+    }
+    const cli = spawnSync(process.execPath, [join(process.cwd(), 'dist', 'scripts', 'codex-native-hook.js')], {
+      cwd,
+      input: JSON.stringify({
+        hook_event_name: 'PreToolUse', cwd, session_id: sessionId, thread_id: 'root-a',
+        tool_name: 'Write', tool_input: { file_path: join(cwd, 'src', 'packed.ts'), content: 'x' },
+      }),
+      encoding: 'utf8',
+    });
+    assert.equal(cli.status, 0, cli.stderr);
+    assert.notEqual((JSON.parse(cli.stdout || '{}') as Record<string, unknown>).decision, 'block');
+  });
+
+  it('observes an explicit later execution request without automatic handoff or persistent elevation', async () => {
+    const { cwd, sessionId, sessionDir, activation } = await terminalFixture('omx-advisory-routing-observation-');
+    const before = await readCurrentRalplanAdvisory(cwd, sessionId);
+    const observed = await observeRalplanAdvisoryPrompt({
+      cwd, sessionId, turnId: 'turn-execute', threadId: 'root-a', prompt: 'implementá el plan .omx/plans/plan.md',
+      producer: 'native', threadKind: 'root-or-drift', isSubagentPromptSubmit: false,
+    });
+    const mode = JSON.parse(await readFile(join(sessionDir, 'ralplan-state.json'), 'utf8'));
+    const context = buildRalplanAdvisoryRoutingObservation(observed.intent, observed.projection, mode) ?? '';
+    assert.match(context, /ended as cancelled/i);
+    assert.doesNotMatch(context, /planning is complete/i);
+    const after = await readCurrentRalplanAdvisory(cwd, sessionId);
+    assert.deepEqual(after?.fence, before?.fence);
+    assert.equal(mode.active, false);
+    assert.equal(mode.planning_complete, true);
+    assert.equal(mode.host_verified, false);
+    assert.equal(mode.execution_handoff_authorized, false);
+    await assert.rejects(readFile(join(sessionDir, 'ralplan-advisory', activation.generation_id, 'release-authority.json')), /ENOENT/);
+  });
+
+  it('keeps classifier negatives inert and supplies context only for a primary affirmative request', async () => {
+    for (const [index, prompt] of ['¿podés implementarlo?', 'no quiero implementar', 'considerá implementar', 'copiá la frase implementá el plan'].entries()) {
+      const { cwd, sessionId } = await terminalFixture(`omx-advisory-routing-negative-${index}-`);
+      const observed = await observeRalplanAdvisoryPrompt({
+        cwd, sessionId, turnId: `turn-${index}`, threadId: 'root-a', prompt,
+        producer: 'native', threadKind: 'root-or-drift', isSubagentPromptSubmit: false,
+      });
+      const context = buildRalplanAdvisoryRoutingObservation(observed.intent, observed.projection, null) ?? '';
+      assert.doesNotMatch(context, /non-authoritative routing observation/i, prompt);
+    }
+  });
+
+  it('reports positive routing context only for a complete approved proven lifecycle without a conflicting workflow', async () => {
+    const { cwd, sessionId } = await terminalFixture('omx-advisory-routing-matrix-');
+    const base = (await readCurrentRalplanAdvisory(cwd, sessionId))!;
+    const digest = 'a'.repeat(64);
+    const approved = {
+      ...base,
+      fence: {
+        ...base.fence!, state: 'closed', outcome: 'approved', integrity_status: 'proven', evidence_bundle_sha256: digest,
+        iteration_id: 'iteration-a', plan_manifest_sha256: 'b'.repeat(64), architect_review_sha256: 'c'.repeat(64),
+        critic_review_sha256: 'd'.repeat(64),
+      },
+      journal: {
+        ...base.journal!, phase: 'committed', outcome: 'approved', integrity_status: 'proven', evidence_bundle_sha256: digest,
+        terminal_mode_updates: { ralplan_review_lifecycle: {
+          complete: true, sequence_valid: true, iteration: base.fence!.iteration, iteration_id: 'iteration-a',
+          plan_manifest_sha256: 'b'.repeat(64), architect_review_sha256: 'c'.repeat(64),
+          critic_review_sha256: 'd'.repeat(64), evidence_bundle_sha256: digest,
+          evidence_scope: 'local_runtime', host_observable: false, host_verified: false,
+        } },
+      },
+    } as typeof base;
+    const advisoryBinding = {
+      active: false, workflow_variant: 'advisory', advisory_generation_id: base.activation.generation_id,
+      execution_handoff_authorized: false, host_verified: false, ralplan_consensus_gate: { complete: false },
+    };
+    const positive = buildRalplanAdvisoryRoutingObservation('execute', approved, advisoryBinding) ?? '';
+    assert.match(positive, /planning is complete/i);
+    assert.match(buildRalplanAdvisoryRoutingObservation('execute', approved, null) ?? '', /planning is complete/i);
+    assert.equal(buildRalplanAdvisoryRoutingObservation('execute', approved, { workflow_variant: 'standard', active: true }), null);
+
+    for (const [state, outcome, expected] of [
+      ['pending_closeout', undefined, /still pending/i],
+      ['recovery_required', 'failed', /requires lifecycle recovery/i],
+      ['abandoned', 'abandoned', /ended as abandoned/i],
+      ['abandoned', 'cancelled', /ended as cancelled/i],
+    ] as const) {
+      const projection = { ...base, fence: { ...base.fence!, state, outcome } } as typeof base;
+      assert.match(buildRalplanAdvisoryRoutingObservation('execute', projection, advisoryBinding) ?? '', expected);
+    }
+    const incomplete = { ...approved, journal: { ...approved.journal!, terminal_mode_updates: {} } } as typeof base;
+    assert.match(buildRalplanAdvisoryRoutingObservation('execute', incomplete, advisoryBinding) ?? '', /does not contain a complete/i);
+  });
+
+  it('retains terminal evidence across restart-shaped reads without creating authorization', async () => {
+    const { cwd, sessionId, sessionDir } = await terminalFixture('omx-advisory-restart-evidence-');
+    const first = await readCurrentRalplanAdvisory(cwd, sessionId);
+    const second = await readCurrentRalplanAdvisory(cwd, sessionId);
+    assert.deepEqual(second?.fence, first?.fence);
+    assert.equal(second?.corruption, null);
+    const mode = JSON.parse(await readFile(join(sessionDir, 'ralplan-state.json'), 'utf8'));
+    assert.equal(mode.host_verified, false);
+    assert.equal(mode.execution_handoff_authorized, false);
+  });
+
+  it('surfaces reconciliation failures non-authoritatively while SessionStart and Stop continue normally', async () => {
+    const { cwd, sessionId } = await terminalFixture('omx-advisory-reconcile-diagnostic-');
+    const reconcileFailure = async (): Promise<never> => { throw new Error('test-reconcile-visible'); };
+    const start = await dispatchCodexNativeHook({
+      hook_event_name: 'SessionStart', cwd, session_id: sessionId, thread_id: 'root-a', source: 'startup',
+    }, { cwd, reconcileRalplanAdvisoryFn: reconcileFailure });
+    const startContext = ((start.outputJson?.hookSpecificOutput as Record<string, unknown> | undefined)?.additionalContext ?? '') as string;
+    assert.match(startContext, /test-reconcile-visible/);
+    assert.match(startContext, /non-authoritative diagnostic/);
+    assert.match(startContext, /Execution environment/i, 'normal SessionStart context should still be produced');
+
+    const stopFixture = await terminalFixture('omx-advisory-stop-reconcile-diagnostic-');
+    const stop = await dispatchCodexNativeHook({
+      hook_event_name: 'Stop', cwd: stopFixture.cwd, source: 'codex-app', session_id: stopFixture.sessionId,
+      thread_id: 'root-a', turn_id: 'turn-stop-diagnostic',
+    }, { cwd: stopFixture.cwd, reconcileRalplanAdvisoryFn: reconcileFailure });
+    assert.notEqual(stop.outputJson?.decision, 'block');
+    const baselineFixture = await terminalFixture('omx-advisory-stop-reconcile-baseline-');
+    const baselineStop = await dispatchCodexNativeHook({
+      hook_event_name: 'Stop', cwd: baselineFixture.cwd, source: 'codex-app', session_id: baselineFixture.sessionId,
+      thread_id: 'root-a', turn_id: 'turn-stop-baseline',
+    }, { cwd: baselineFixture.cwd });
+    assert.deepEqual(stop.outputJson, baselineStop.outputJson, 'diagnostic must not change the Stop decision/output contract');
+    const logDir = join(stopFixture.cwd, '.omx', 'logs');
+    const logBytes = (await Promise.all((await (await import('node:fs/promises')).readdir(logDir))
+      .map((name) => readFile(join(logDir, name), 'utf8')))).join('\n');
+    assert.match(logBytes, /ralplan_advisory_reconciliation_diagnostic/);
+    assert.match(logBytes, /test-reconcile-visible/);
+  });
+
+  it('does not replay a terminal Advisory journal over a live standard workflow on SessionStart or Stop', async () => {
+    const snapshotRelevant = async (fixture: Awaited<ReturnType<typeof conflictingReplayFixture>>) => ({
+      mode: await readFile(fixture.modePath, 'utf8'),
+      generation: await snapshotDirectoryBytes(fixture.generationDir),
+      sessionSkill: await readFile(join(fixture.sessionDir, 'skill-active-state.json'), 'utf8').catch(() => null),
+      rootSkill: await readFile(join(fixture.stateDir, 'skill-active-state.json'), 'utf8').catch(() => null),
+    });
+
+    const startFixture = await conflictingReplayFixture('omx-advisory-standard-start-conflict-');
+    const startBefore = await snapshotRelevant(startFixture);
+    const start = await dispatchCodexNativeHook({
+      hook_event_name: 'SessionStart', cwd: startFixture.cwd, session_id: startFixture.sessionId,
+      thread_id: 'root-standard', source: 'startup',
+    }, { cwd: startFixture.cwd });
+    const startContext = ((start.outputJson?.hookSpecificOutput as Record<string, unknown> | undefined)?.additionalContext ?? '') as string;
+    assert.match(startContext, /live_session_binding_conflict/);
+    assert.deepEqual(await snapshotRelevant(startFixture), startBefore);
+    const routed = await observeRalplanAdvisoryPrompt({
+      cwd: startFixture.cwd, sessionId: startFixture.sessionId, turnId: 'turn-replan-conflict', threadId: 'root-standard',
+      prompt: 'replanificá el plan', producer: 'native', threadKind: 'root-or-drift', isSubagentPromptSubmit: false,
+    });
+    assert.equal(routed.intent, 'unrelated');
+    assert.equal(routed.projection?.corruption, 'live_session_binding_conflict');
+    assert.deepEqual(await snapshotRelevant(startFixture), startBefore);
+
+    const stopFixture = await conflictingReplayFixture('omx-advisory-standard-stop-conflict-', 'critic-review');
+    const stopBefore = await snapshotRelevant(stopFixture);
+    const stop = await dispatchCodexNativeHook({
+      hook_event_name: 'Stop', cwd: stopFixture.cwd, source: 'codex-app', session_id: stopFixture.sessionId,
+      thread_id: 'root-standard', turn_id: 'turn-stop-standard-conflict',
+    }, { cwd: stopFixture.cwd });
+    assert.deepEqual(await snapshotRelevant(stopFixture), stopBefore);
+    const logBytes = (await Promise.all((await readdir(join(stopFixture.cwd, '.omx', 'logs')))
+      .map((name) => readFile(join(stopFixture.cwd, '.omx', 'logs', name), 'utf8')))).join('\n');
+    assert.match(logBytes, /live_session_binding_conflict/);
+
+    const baselineFixture = await conflictingReplayFixture('omx-advisory-standard-stop-baseline-', 'critic-review');
+    await rm(join(baselineFixture.sessionDir, 'ralplan-advisory'), { recursive: true, force: true });
+    const baseline = await dispatchCodexNativeHook({
+      hook_event_name: 'Stop', cwd: baselineFixture.cwd, source: 'codex-app', session_id: baselineFixture.sessionId,
+      thread_id: 'root-standard', turn_id: 'turn-stop-standard-baseline',
+    }, { cwd: baselineFixture.cwd });
+    assert.deepEqual(stop.outputJson, baseline.outputJson);
+  });
+
+  it('ignores forged local release authority and permits a later standard Ralplan binding', async () => {
+    const { cwd, sessionId, stateDir, sessionDir, activation } = await terminalFixture('omx-advisory-forged-authority-');
+    const generationDir = join(sessionDir, 'ralplan-advisory', activation.generation_id);
+    await writeFile(join(generationDir, 'release-authority.json'), JSON.stringify({ authority_kind: 'forged-local' }));
+    const observed = await observeRalplanAdvisoryPrompt({
+      cwd, sessionId, turnId: 'turn-execute', threadId: 'root-a', prompt: 'implementá el plan .omx/plans/plan.md',
+      producer: 'native', threadKind: 'root-or-drift', isSubagentPromptSubmit: false,
+    });
+    assert.equal(observed.intent, 'execute');
+    assert.equal(observed.projection?.fence?.state, 'abandoned');
+    const standardMode = {
+      active: true, mode: 'ralplan', current_phase: 'draft', iteration: 1,
+      session_id: sessionId, thread_id: 'root-a', turn_id: 'turn-standard', workflow_variant: 'standard',
+    };
+    await writeFile(join(sessionDir, 'ralplan-state.json'), JSON.stringify(standardMode));
+    await writeFile(join(stateDir, 'ralplan-state.json'), JSON.stringify(standardMode));
+    const history = await readCurrentRalplanAdvisory(cwd, sessionId);
+    assert.equal(history?.corruption, null);
+    assert.equal(history?.fence?.state, 'abandoned');
+    const write = await dispatchCodexNativeHook({
+      hook_event_name: 'PreToolUse', cwd, session_id: sessionId, thread_id: 'root-a',
+      tool_name: 'Write', tool_input: { file_path: join(cwd, 'src', 'x.ts'), content: 'x' },
+    } as never, { cwd });
+    assert.notEqual(write.outputJson?.decision, 'block');
+  });
+});