polydeukes 0.7.1 → 0.9.0

package/README.ko.md

@@ -17,7 +17,9 @@ CLI 명령은 다음과 같습니다.
 
 - `pdks covenant check`
 - `pdks init`
+- `pdks-claude-code init` (`@polydeukes/adapter-claude-code`가 제공)
 - `pdks-grok init` (`@polydeukes/adapter-grok`가 제공)
+- `pdks-codex init` (`@polydeukes/adapter-codex`가 제공)
 - `pdks explain`
 - `pdks docs [topic]`
 

package/README.md

@@ -18,7 +18,9 @@ CLI commands:
 
 - `pdks covenant check`
 - `pdks init`
+- `pdks-claude-code init` (ships with `@polydeukes/adapter-claude-code`)
 - `pdks-grok init` (ships with `@polydeukes/adapter-grok`)
+- `pdks-codex init` (ships with `@polydeukes/adapter-codex`)
 - `pdks explain`
 - `pdks docs [topic]`
 

package/dist/covenant/discipline.d.ts

@@ -41,6 +41,12 @@ export type CompileDisciplinesSpec = {
     witness?: CovenantRegistration['witness'];
     transcript?: CanonicalTranscript;
 };
+/**
+ * Relativize a file-change path against the root for glob matching. A relative path passes
+ * through; an absolute path outside `rootDir` yields null (never matches — discipline scope
+ * is declared repo-relative).
+ */
+export declare function relativizeForScope(filePath: string, rootDir: string): string | null;
 /** One change as one world, under the repo-relative path the declaration's scope reads. */
 export type SuppliedWorld = {
     readonly path: string;

package/dist/covenant/discipline.js

@@ -18,7 +18,7 @@ import { deriveShellChanges } from './shell-evidence.js';
  * through; an absolute path outside `rootDir` yields null (never matches — discipline scope
  * is declared repo-relative).
  */
-function relativizeForScope(filePath, rootDir) {
+export function relativizeForScope(filePath, rootDir) {
     if (!isAbsolute(filePath)) {
         // A relative spelling normalizes before matching — `./x` and `a/../x` name x, and a
         // spelling that resolves out of the root matches nothing. Matching verbatim instead

package/dist/covenant/dispatch.d.ts

@@ -83,13 +83,16 @@ export type CovenantRegistration = {
  * Match registrations against a {@link CovenantInput} by path mention (pure).
  *
  * A registration matches when any of its `protectedPaths` is an ancestor/descendant/equal of
- * a path candidate extracted from any string value reachable at any depth inside
- * `input.toolCalls[].args`; candidates are quote-aware tokenizer words, so a quote-split
- * write still routes. An unread span with a non-empty `protectedPaths` routes fail-closed
- * (the registration matches on its first protected path) rather than silently miss.
- * `subagentSpawns` and `userMessages` never participate. `mentionedPath` is the first
- * protected path (in array order) that mentions. Result preserves registration order, at most
- * one entry per registration.
+ * a path candidate. Candidates come from two places: every string value reachable at any
+ * depth inside `input.toolCalls[].args`, read as quote-aware tokenizer words so a
+ * quote-split write still routes, and each call's proven `fileChange` path, taken whole
+ * because an adapter already resolved it. A call carrying only the latter is the ordinary
+ * shape where a host names its target in a form the adapter must parse — the patch text of
+ * one edit rather than a path argument. An unread span with a non-empty `protectedPaths`
+ * routes fail-closed (the registration matches on its first protected path) rather than
+ * silently miss. `subagentSpawns` and `userMessages` never participate. `mentionedPath` is
+ * the first protected path (in array order) that mentions. Result preserves registration
+ * order, at most one entry per registration.
  *
  * A registration carrying a `matches` predicate routes on it exclusively, path mention
  * skipped for it: non-null return → included with that string as `mentionedPath`; null →

package/dist/covenant/dispatch.js

@@ -9,7 +9,7 @@
  */
 import { appendRecordFailOpen, EXIT_BREAK_BLOCKING, EXIT_UPHOLD, noopTranscript, parseInput, } from '@polydeukes/core';
 import { tokenizeCommandLine } from './bash-line.js';
-import { pathCandidates, pathMatchesProtected } from './mention.js';
+import { pathCandidates, pathMatchesProtected, provenChangePath } from './mention.js';
 import { runCovenant } from './run-covenant.js';
 /**
  * Collect path candidates from every string value inside `value`. Each string is tokenized
@@ -55,13 +55,16 @@ function collectPathCandidates(value) {
  * Match registrations against a {@link CovenantInput} by path mention (pure).
  *
  * A registration matches when any of its `protectedPaths` is an ancestor/descendant/equal of
- * a path candidate extracted from any string value reachable at any depth inside
- * `input.toolCalls[].args`; candidates are quote-aware tokenizer words, so a quote-split
- * write still routes. An unread span with a non-empty `protectedPaths` routes fail-closed
- * (the registration matches on its first protected path) rather than silently miss.
- * `subagentSpawns` and `userMessages` never participate. `mentionedPath` is the first
- * protected path (in array order) that mentions. Result preserves registration order, at most
- * one entry per registration.
+ * a path candidate. Candidates come from two places: every string value reachable at any
+ * depth inside `input.toolCalls[].args`, read as quote-aware tokenizer words so a
+ * quote-split write still routes, and each call's proven `fileChange` path, taken whole
+ * because an adapter already resolved it. A call carrying only the latter is the ordinary
+ * shape where a host names its target in a form the adapter must parse — the patch text of
+ * one edit rather than a path argument. An unread span with a non-empty `protectedPaths`
+ * routes fail-closed (the registration matches on its first protected path) rather than
+ * silently miss. `subagentSpawns` and `userMessages` never participate. `mentionedPath` is
+ * the first protected path (in array order) that mentions. Result preserves registration
+ * order, at most one entry per registration.
  *
  * A registration carrying a `matches` predicate routes on it exclusively, path mention
  * skipped for it: non-null return → included with that string as `mentionedPath`; null →
@@ -70,6 +73,16 @@ function collectPathCandidates(value) {
  */
 export function matchRegistrations(input, registrations) {
     const { candidates, failed } = collectPathCandidates(input.toolCalls.map((call) => call.args));
+    // A proven change path joins the candidates directly, untokenized: it is a path the
+    // adapter already resolved, not a line to be read for one, and tokenizing it would split
+    // a path containing a space into words that name nothing. Without this a call whose only
+    // evidence is its `fileChange` routes nowhere — the judge bodies read that evidence, so
+    // the input would be refused before the layer that can settle it.
+    for (const call of input.toolCalls) {
+        const proven = provenChangePath(call);
+        if (proven !== null)
+            candidates.push(proven);
+    }
     const matches = [];
     for (const registration of registrations) {
         if (registration.matches !== undefined) {

package/dist/covenant/shell-mod.d.ts

@@ -4,7 +4,7 @@
  * Analyzes the command-line strings of *shell* tool calls (names and arg keys are injected
  * values, never source literals) per simple command: the fixed detection rules catch writes
  * to a protected path, undecidable structures (opaque mentions, opaque write targets) fail
- * closed, the read-only allowlist absolves proven reads, and every other protected-path
+ * closed, read-only proof absolves safe reads, and every other protected-path
  * mention breaks — "mention + unproven = block". It judges only its own axis: a non-shell
  * tool call is upheld, since the tool axis belongs to the self-mod meta-covenant and
  * run-all co-existence depends on that boundary.
@@ -18,7 +18,7 @@ import type { CovenantRegistration, MetaCovenantRegistration } from './dispatch.
  * `protectedPaths` are literal path strings; `shellToolNames` are the tool names whose
  * calls carry shell lines; `commandArgNames` are the `args` keys those lines live under;
  * `readOnlyCommands` are allowlist entries — space-separated word sequences (`'cat'`,
- * `'git diff'`). Empty-string entries in every list are ignored (an unguarded `''` would
+ * `'git status'`). Empty-string entries in every list are ignored (an unguarded `''` would
  * match every path / tool / arg / command).
  */
 export type ShellModificationSpec = {
@@ -38,6 +38,16 @@ export type ShellModificationSpec = {
  * redirect-free truncating write. `git status`/`git grep` reject `--output`, so they stay.
  */
 export declare const DEFAULT_READ_ONLY_COMMANDS: string[];
+/**
+ * True when a configured allowlist has the same effective entries as the shipped default.
+ * Conditional readers belong to that default contract and stay disabled for replacements.
+ */
+export declare function usesDefaultReadOnlyCommands(commands: string[]): boolean;
+/**
+ * Prove the finite argument-sensitive readers that cannot be represented by a leading-word
+ * allowlist. Every word must be transparent because these readers inspect their later words.
+ */
+export declare function matchesConditionalReadOnlyCommand(command: SimpleCommand): boolean;
 /**
  * True when the command's leading words match the allowlist entry's word sequence. Exported
  * so the transcript judge's allowlist clause absolves reads by this exact comparison instead
@@ -59,8 +69,9 @@ export declare function judgeShellModification(input: CovenantInput, spec: Shell
 /**
  * `ShellModRegistrationSpec` — the assembly values baked into the registration. The call
  * set is not among them: the dispatcher supplies it to the judge at call time.
- * `readOnlyCommands` REPLACES {@link DEFAULT_READ_ONLY_COMMANDS} when given — no merge,
- * since an assembly wanting to extend the default spreads the constant.
+ * `readOnlyCommands` REPLACES {@link DEFAULT_READ_ONLY_COMMANDS} when given — no merge.
+ * Any replacement, including a superset made by spreading the default, disables the finite
+ * argument-sensitive readers because their proof belongs to the exact shipped default.
  */
 export type ShellModRegistrationSpec = {
     protectedPaths: string[];

package/dist/covenant/shell-mod.js

@@ -4,7 +4,7 @@
  * Analyzes the command-line strings of *shell* tool calls (names and arg keys are injected
  * values, never source literals) per simple command: the fixed detection rules catch writes
  * to a protected path, undecidable structures (opaque mentions, opaque write targets) fail
- * closed, the read-only allowlist absolves proven reads, and every other protected-path
+ * closed, read-only proof absolves safe reads, and every other protected-path
  * mention breaks — "mention + unproven = block". It judges only its own axis: a non-shell
  * tool call is upheld, since the tool axis belongs to the self-mod meta-covenant and
  * run-all co-existence depends on that boundary.
@@ -39,6 +39,58 @@ export const DEFAULT_READ_ONLY_COMMANDS = [
     'git status',
     'git grep',
 ];
+const FIND_WRITE_OR_EXECUTE_ACTIONS = new Set([
+    '-delete',
+    '-exec',
+    '-execdir',
+    '-ok',
+    '-okdir',
+    '-fprint',
+    '-fprint0',
+    '-fprintf',
+    '-fls',
+]);
+function normalizedReadOnlyCommands(commands) {
+    return [
+        ...new Set(commands
+            .map((entry) => entry
+            .split(/\s+/)
+            .filter((word) => word !== '')
+            .join(' '))
+            .filter((entry) => entry !== '')),
+    ].sort();
+}
+/**
+ * True when a configured allowlist has the same effective entries as the shipped default.
+ * Conditional readers belong to that default contract and stay disabled for replacements.
+ */
+export function usesDefaultReadOnlyCommands(commands) {
+    const configured = normalizedReadOnlyCommands(commands);
+    const shipped = normalizedReadOnlyCommands(DEFAULT_READ_ONLY_COMMANDS);
+    return (configured.length === shipped.length && configured.every((entry, i) => entry === shipped[i]));
+}
+/**
+ * Prove the finite argument-sensitive readers that cannot be represented by a leading-word
+ * allowlist. Every word must be transparent because these readers inspect their later words.
+ */
+export function matchesConditionalReadOnlyCommand(command) {
+    if (command.words.length === 0 || command.words.some((word) => word.opaque))
+        return false;
+    const name = commandBasename(command.words[0]);
+    if (name === 'git')
+        return command.words[1]?.text === 'ls-files';
+    if (name === 'find') {
+        return !command.words.some((word) => FIND_WRITE_OR_EXECUTE_ACTIONS.has(word.text));
+    }
+    if (name !== 'sed')
+        return false;
+    const script = command.words[2]?.text;
+    return (command.words[1]?.text === '-n' &&
+        script !== undefined &&
+        /^\d+(?:,\d+)?p$/.test(script) &&
+        command.words.length > 3 &&
+        command.words.slice(3).every((word) => !word.text.startsWith('-')));
+}
 // The rule set is fixed, not injectable: dropping a rule from an assembly would be a
 // detection hole, and no consumer needs a subset.
 const MUTATION_RULES = [redirectWriteRule, teeRule, sedInPlaceRule];
@@ -65,9 +117,9 @@ export function matchesReadOnlyEntry(command, entry) {
  * Judge one simple command. Returns the break reason, or null when the command contributes
  * to uphold. The clause order below is normative: each clause exists to be reached before
  * the next one can absolve. `lineFullyRead` is false when the line carried a span the
- * tokenizer could not read, which withholds the allowlist clause.
+ * tokenizer could not read, which withholds read-only proof.
  */
-function judgeCommand(command, protectedPaths, readOnlyEntries, lineFullyRead) {
+function judgeCommand(command, protectedPaths, readOnlyEntries, conditionalReadersEnabled, lineFullyRead) {
     // (a) Precise rules: a detected mutation whose target carries a protected path breaks.
     for (const rule of MUTATION_RULES) {
         for (const target of rule.detect(command)) {
@@ -100,16 +152,18 @@ function judgeCommand(command, protectedPaths, readOnlyEntries, lineFullyRead) {
     if (command.redirects.some((r) => r.operator.includes('>') && r.target.opaque)) {
         return `opaque redirect target alongside protected path ${mentioned}`;
     }
-    // (e) Read-only allowlist: a proven read absolves the mention — but a nested shell
-    // (`eval`/`sh -c …`) re-parses its string args, so it can never be proven read-only even
-    // if it was injected into the allowlist. Its mention falls through to the backstop. A line
+    // (e) Read-only proof: the allowlist or a finite argument-sensitive reader absolves the
+    // mention. A nested shell (`eval`/`sh -c …`) re-parses its string args, so it can never be
+    // proven read-only even if it was injected into the allowlist. Its mention falls through
+    // to the backstop. A line
     // carrying an unread span is refused the same way: what the scanner never read could be
     // anything, so no head vouches for it.
     const first = command.words[0];
     const firstBasename = first !== undefined ? commandBasename(first) : '';
     if (lineFullyRead &&
         !isNestedShellCommand(firstBasename) &&
-        readOnlyEntries.some((entry) => matchesReadOnlyEntry(command, entry))) {
+        (readOnlyEntries.some((entry) => matchesReadOnlyEntry(command, entry)) ||
+            (conditionalReadersEnabled && matchesConditionalReadOnlyCommand(command)))) {
         return null;
     }
     // (f) Backstop — mention + unproven = block.
@@ -133,6 +187,7 @@ export function judgeShellModification(input, spec) {
     const readOnlyEntries = spec.readOnlyCommands
         .map((entry) => entry.split(/\s+/).filter((word) => word !== ''))
         .filter((entry) => entry.length > 0);
+    const conditionalReadersEnabled = usesDefaultReadOnlyCommands(spec.readOnlyCommands);
     for (const call of input.toolCalls) {
         if (!shellToolNames.includes(call.name)) {
             continue;
@@ -167,7 +222,7 @@ export function judgeShellModification(input, spec) {
                 }
             }
             for (const command of commands) {
-                const reason = judgeCommand(command, protectedPaths, readOnlyEntries, unread.length === 0);
+                const reason = judgeCommand(command, protectedPaths, readOnlyEntries, conditionalReadersEnabled, unread.length === 0);
                 if (reason !== null)
                     return { upheld: false, reason };
             }

package/dist/covenant/transcript-mod.js

@@ -13,7 +13,7 @@ import { isNestedShellCommand, tokenizeCommandLine } from './bash-line.js';
 import { pathCandidates, pathSegments, provenChangePath, resolveDotSegments, someStringValue, untokenizableLineCandidates, } from './mention.js';
 import { commandBasename, redirectWriteRule, sedInPlaceRule, teeRule } from './mutation-rules.js';
 import { outcomeFromVerdict, UNJUDGEABLE_OUTCOME } from './run-covenant.js';
-import { DEFAULT_READ_ONLY_COMMANDS, matchesReadOnlyEntry } from './shell-mod.js';
+import { DEFAULT_READ_ONLY_COMMANDS, matchesConditionalReadOnlyCommand, matchesReadOnlyEntry, usesDefaultReadOnlyCommands, } from './shell-mod.js';
 // The rule set is fixed, assembled exactly as shell-mod assembles it: dropping one would be
 // a detection hole, and the two judges must not diverge on what counts as a write.
 const MUTATION_RULES = [redirectWriteRule, teeRule, sedInPlaceRule];
@@ -55,6 +55,7 @@ function resolveTranscript(spec) {
         readOnlyEntries: spec.readOnlyCommands
             .map((entry) => entry.split(/\s+/).filter((word) => word !== ''))
             .filter((entry) => entry.length > 0),
+        conditionalReadersEnabled: usesDefaultReadOnlyCommands(spec.readOnlyCommands),
     };
 }
 /**
@@ -96,7 +97,7 @@ function argsNameTranscript(value, transcript) {
  * it has to break before the allowlist gets a chance to absolve it. The letters skip `(c)`
  * because this ladder has no opaque-mention clause, matching the shell ladder's numbering
  * rather than closing the gap. `lineFullyRead` is false when the line carried a span the
- * tokenizer could not read, which withholds the allowlist clause.
+ * tokenizer could not read, which withholds read-only proof.
  */
 function judgeCommand(command, transcript, lineFullyRead) {
     // (a) Precise rules: a detected mutation whose target is the transcript breaks.
@@ -118,15 +119,17 @@ function judgeCommand(command, transcript, lineFullyRead) {
     if (command.redirects.some((r) => r.operator.includes('>') && r.target.opaque)) {
         return `opaque redirect target alongside the session transcript ${transcript.path}`;
     }
-    // (e) Read-only allowlist: a proven read absolves the mention, in every spelling — but a
-    // nested shell (`eval`/`sh -c …`) re-parses its string args, so it is never provably a read.
+    // (e) Read-only proof: the allowlist or a finite argument-sensitive reader absolves the
+    // mention in every spelling. A nested shell (`eval`/`sh -c …`) re-parses its string args,
+    // so it is never provably a read.
     // A line carrying an unread span is refused the same way: reading the session is free, but
     // only on a line we finished reading.
     const first = command.words[0];
     const firstBasename = first !== undefined ? commandBasename(first) : '';
     if (lineFullyRead &&
         !isNestedShellCommand(firstBasename) &&
-        transcript.readOnlyEntries.some((entry) => matchesReadOnlyEntry(command, entry))) {
+        (transcript.readOnlyEntries.some((entry) => matchesReadOnlyEntry(command, entry)) ||
+            (transcript.conditionalReadersEnabled && matchesConditionalReadOnlyCommand(command)))) {
         return null;
     }
     // (f) Backstop — mention + unproven = block.

package/dist/covenant-check.d.ts

@@ -13,7 +13,7 @@
 import { type CanonicalTranscript, type CovenantInput } from '@polydeukes/core';
 import type { CovenantRegistration } from './covenant/dispatch.ts';
 import { type CovenantModule } from './covenant/module.ts';
-import { loadConfig } from './load-config.ts';
+import { type LoadedConfig } from './load-config.ts';
 /** {@link runCovenantCheck} result — the exit code the check process leaves with. */
 export type CovenantCheckOutcome = {
     exitCode: 0 | 2;
@@ -57,7 +57,7 @@ export type CovenantCheckSpec = {
 };
 /** {@link assembleCheckRegistrations} input — what this runner's assembly needs. */
 export type CheckAssemblySpec = {
-    config: ReturnType<typeof loadConfig>['config'];
+    config: LoadedConfig['config'];
     rootDir: string;
     /**
      * The judge module the registrations are built from, so what judges a change and what

package/dist/covenant-check.js

@@ -10,14 +10,16 @@
  * own `world` exits 2 with one blocked record. An input with no toolCalls is an explicit pass
  * with no records.
  */
+import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { appendRecordFailOpen, DEFAULT_TELEMETRY_LOG_PATH, isPlainObject, normalizeProtectedPaths, transcriptFromSession, } from '@polydeukes/core';
 import { compareBaseline, updateBaseline } from './baseline.js';
+import { relativizeForScope } from './covenant/discipline.js';
 import { covenantModule } from './covenant/module.js';
 import { ttlWitness } from './covenant/ttl-witness.js';
 import { STAGED_DELETE, STAGED_WRITE } from './diff-ir.js';
-import { loadConfig } from './load-config.js';
+import { discoverConfigPath, parseConfigSource } from './load-config.js';
 import { sessionPreStateReader, unobservedPreStateReader } from './pre-state-reader.js';
 import { worktreeReader } from './worktree-reader.js';
 /**
@@ -115,21 +117,38 @@ export function assembleCheckRegistrations(spec) {
  * `surface: 'changeSet'` and neither IR key.
  */
 export const assembleChangeSetRegistrations = assembleCheckRegistrations;
-/** One stage's failure disposition: the stderr line, the recorded row, and exit 2. */
-function failClosed(telemetryPath, error) {
-    process.stderr.write(`covenant check failed closed: ${error instanceof Error ? error.message : String(error)}\n`);
+/** The message a thrown value carries, for a stderr line. */
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * One stage's failure disposition: the stderr line, the recorded row, and exit 2. `suffix`
+ * is appended to the message, for a caller that can name the one call which would clear the
+ * failure.
+ */
+function failClosed(telemetryPath, error, suffix) {
+    process.stderr.write(`covenant check failed closed: ${messageOf(error)}${suffix ?? ''}\n`);
     recordFailClosed(telemetryPath);
     return { exitCode: 2 };
 }
+/** The observation, from the caller's value or from the thunk that produces it. */
+function readInput(spec) {
+    return typeof spec.input === 'function' ? spec.input() : spec.input;
+}
 /**
  * Settle the telemetry path and load the config once, or fail closed. The provisional
  * path is settled before the load so a config that never loads still has somewhere to
  * write its blocked row; both terms use `resolve` so a relative `repoRoot` cannot send
  * them to different files. The provisional term sits inside the try because `resolve`
  * throws on a non-string `repoRoot`.
+ *
+ * The load runs as its three steps rather than through `loadConfig`, so a failure carries
+ * how far it got: which file was discovered, and the bytes that file held.
  */
 function settleConfig(spec) {
     let telemetryPath;
+    let configPath;
+    let source;
     try {
         // The environment variable sits between the caller's path and the config's, matching
         // what the baseline comparison in this same process already resolves — the two write
@@ -138,13 +157,21 @@ function settleConfig(spec) {
         const envPath = process.env.POLYDEUKES_TELEMETRY_PATH;
         telemetryPath =
             spec.telemetryPath ?? envPath ?? resolve(spec.repoRoot, DEFAULT_TELEMETRY_LOG_PATH);
-        const { config } = loadConfig({ rootDir: spec.repoRoot });
+        configPath = discoverConfigPath({ rootDir: spec.repoRoot });
+        source = readFileSync(join(spec.repoRoot, configPath), 'utf-8');
+        const { config } = parseConfigSource({ source, configPath });
         telemetryPath =
             spec.telemetryPath ?? envPath ?? resolve(spec.repoRoot, config.telemetry.logPath);
         return { settled: true, telemetryPath, config };
     }
     catch (error) {
-        return { settled: false, ...failClosed(telemetryPath, error) };
+        return {
+            settled: false,
+            telemetryPath,
+            error,
+            ...(configPath === undefined ? {} : { configPath }),
+            ...(source === undefined ? {} : { source }),
+        };
     }
 }
 /**
@@ -312,6 +339,83 @@ function assertJudgeableShape(input) {
         throw new Error('input carries a session.channels.sidecar that is not text');
     }
 }
+/**
+ * The disposition of a run whose config never loaded.
+ *
+ * While the one discovered file does not load there is no assembly to judge against, so the
+ * session surface admits exactly one shape: a single tool call whose file-change evidence
+ * modifies that file, starting from the bytes the loader read, and whose `post` is a text the
+ * loader accepts. That call is judged — its result loads — and lands as one `advised` row
+ * naming the config path, so the next call's baseline comparison reads the change as
+ * explained. Everything else fails closed, and where a single file was discovered the line
+ * says which call would repair it.
+ *
+ * This branch reads no posture: the session hook always spawns with `--enforce block`, so a
+ * repair that blocked under that posture would never run anywhere.
+ */
+function settleLoadFailure(spec, failure) {
+    const { telemetryPath, error, configPath } = failure;
+    if (configPath === undefined || spec.surface !== 'session') {
+        return failClosed(telemetryPath, error);
+    }
+    let input;
+    try {
+        input = readInput(spec);
+    }
+    catch (inputError) {
+        return failClosed(telemetryPath, inputError);
+    }
+    const loaded = repairs(input, failure, spec.repoRoot);
+    if (loaded !== null) {
+        // The repaired config's own log path, under the precedence `settleConfig` uses, so the
+        // next call's baseline comparison reads this row where it looks for it.
+        const rowPath = spec.telemetryPath ??
+            process.env.POLYDEUKES_TELEMETRY_PATH ??
+            resolve(spec.repoRoot, loaded.config.telemetry.logPath);
+        appendRecordFailOpen(rowPath, {
+            event: 'advised',
+            label: 'covenant-check',
+            subject: configPath,
+        });
+        process.stderr.write(`covenant check: ${configPath} does not load (${messageOf(error)}) — this call rewrites it into one that does; advised, not judged\n`);
+        return { exitCode: 0 };
+    }
+    return failClosed(telemetryPath, error, ` — fix ${configPath} in one Edit or Write whose result loads; every other call stays blocked until it does`);
+}
+/**
+ * The loaded config a single call would leave behind, or null when this observation is not
+ * that call: exactly one call carrying a plain object, its evidence a modification of the
+ * discovered config file (relativized against the root, since a host names its paths
+ * absolutely), starting from the bytes the loader read, and leaving a `post` the loader
+ * accepts. Requiring the pre to be those bytes keeps a partial view of the file — one
+ * notebook cell, or evidence a caller composed — out of the branch.
+ */
+function repairs(input, failure, repoRoot) {
+    const { configPath, source } = failure;
+    if (configPath === undefined || source === undefined)
+        return null;
+    if (!Array.isArray(input.toolCalls) || input.toolCalls.length !== 1)
+        return null;
+    const call = input.toolCalls[0];
+    if (!isPlainObject(call))
+        return null;
+    const { fileChange } = call;
+    if (fileChange === undefined || fileChange.kind !== 'modify')
+        return null;
+    if (relativizeForScope(fileChange.path, repoRoot) !== configPath)
+        return null;
+    if (fileChange.pre !== source)
+        return null;
+    const post = fileChange.post;
+    if (typeof post !== 'string')
+        return null;
+    try {
+        return parseConfigSource({ source: post, configPath });
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Judge one observation of `repoRoot` exactly as the session surface would, from the IR the
  * caller hands in. Async because the dispatcher spawns covenant bodies. An input with no
@@ -326,11 +430,11 @@ function assertJudgeableShape(input) {
 export async function runCovenantCheck(spec) {
     const settlement = settleConfig(spec);
     if (!settlement.settled)
-        return { exitCode: settlement.exitCode };
+        return settleLoadFailure(spec, settlement);
     const { telemetryPath, config } = settlement;
     let input;
     try {
-        input = typeof spec.input === 'function' ? spec.input() : spec.input;
+        input = readInput(spec);
         // The world axis is this root's to fill. An input that supplies its own would let a
         // caller choose the files the judge reads.
         if ('world' in input) {

package/dist/docs/README.ko.md

@@ -10,7 +10,7 @@
 | 하려는 것 | 읽을 문서 |
 |---|---|
 | 첫 눈에 보이는 판정을 보고 싶다 | [첫 판정](./tutorials/first-judgment.ko.md) — 설치하고 Claude Code를 배선한 뒤 보호된 편집이 판정되는 모습을 봅니다 |
-| Claude Code, Grok, git을 연결하고 싶다 | [표면 연결하기](./how-to/connect-surfaces.ko.md) — 세션과 커밋 배선, Grok 포함 |
+| Claude Code, Grok, Codex, git을 연결하고 싶다 | [표면 연결하기](./how-to/connect-surfaces.ko.md) — 세션과 커밋 배선, Grok와 Codex 포함 |
 | 프로젝트 설정을 다듬고 싶다 | [프로젝트 설정하기](./how-to/configure-project.ko.md) — 발견, IDE 지원, advise와 block의 선택 |
 | 실제 규율을 쓰고 싶다 | [규율 작성하기](./how-to/write-disciplines.ko.md) — 실전 선언 예제, 특히 locale key pairing |
 | 차단이나 건너뜀에서 회복하고 싶다 | [문제 해결](./troubleshooting.ko.md) — fail-closed 상태, 증인 밸브, 로그 |
@@ -29,6 +29,7 @@
 | [`@polydeukes/core`](./reference/packages/core.ko.md) | 프로토콜, 입력 IR, 설정 스키마, 텔레메트리 |
 | [`@polydeukes/adapter-claude-code`](./reference/packages/adapter-claude-code.ko.md) | Claude Code 세션 표면입니다. 훅 페이로드에서 입력 IR로 |
 | [`@polydeukes/adapter-grok`](./reference/packages/adapter-grok.ko.md) | Grok 세션 표면입니다. 훅 페이로드에서 입력 IR로 |
+| [`@polydeukes/adapter-codex`](./reference/packages/adapter-codex.ko.md) | Codex 세션 표면입니다. 훅 페이로드에서 입력 IR로, 패치가 건드리는 파일마다 원소 하나 |
 
 <a id="shape-of-the-thing"></a>
 ## 한 페이지로 보는 구조
@@ -52,7 +53,7 @@
 
 | 표면 | 판정 대상 | 배선 방법 | 대상 |
 |---|---|---|---|
-| **세션** | 도구 호출, 실행되기 전에 | `pdks-claude-code init` 또는 `pdks-grok init` | AI 파트너와 함께 개발하는 프로젝트 |
+| **세션** | 도구 호출, 실행되기 전에 | `pdks-claude-code init`, `pdks-grok init`, 또는 `pdks-codex init` | AI 파트너와 함께 개발하는 프로젝트 |
 | **커밋** | stdin의 unified diff — 스테이징 영역, 작업 트리, ref 범위 | `git diff --cached`를 파이프로 넘기는 pre-commit 훅, 또는 필요할 때 직접 실행 | 혼자 개발하는 사람, 그리고 CI |
 
 커밋 판정기는 필요할 때 직접 실행할 수도 있습니다. 작업 후에는 `git diff HEAD | pdks covenant check --diff`,

package/dist/docs/README.md

@@ -11,7 +11,7 @@ question is.
 | If you want to | Read |
 |---|---|
 | Get to a first visible judgment | [First judgment](./tutorials/first-judgment.md) — install, wire Claude Code, and watch one protected edit get judged |
-| Connect Claude Code, Grok, or git | [Connect the surfaces](./how-to/connect-surfaces.md) — session and commit setup, including Grok |
+| Connect Claude Code, Grok, Codex, or git | [Connect the surfaces](./how-to/connect-surfaces.md) — session and commit setup, including Grok and Codex |
 | Shape the project config | [Configure the project](./how-to/configure-project.md) — discovery, IDE support, and advise versus block |
 | Write a real discipline | [Write disciplines](./how-to/write-disciplines.md) — worked declarations, especially locale key pairing |
 | Recover from a block or skip | [Troubleshooting](./troubleshooting.md) — the fail-closed states, the witness valve, and the log |
@@ -31,6 +31,7 @@ is aspirational.
 | [`@polydeukes/core`](./reference/packages/core.md) | The protocol, the input IR, the config schema, telemetry |
 | [`@polydeukes/adapter-claude-code`](./reference/packages/adapter-claude-code.md) | Claude Code session surface — hook payloads become the input IR |
 | [`@polydeukes/adapter-grok`](./reference/packages/adapter-grok.md) | Grok session surface — hook payloads become the input IR |
+| [`@polydeukes/adapter-codex`](./reference/packages/adapter-codex.md) | Codex session surface — hook payloads become the input IR, one element per file the patch touches |
 
 <a id="shape-of-the-thing"></a>
 ## The shape of the thing, in one page
@@ -56,7 +57,7 @@ in the whitepaper, which were all found by counting rows rather than by reading
 
 | Surface | Judges | Wired by | For |
 |---|---|---|---|
-| **Session** | A tool call, before it runs | `pdks-claude-code init` or `pdks-grok init` | A project developed with an AI partner |
+| **Session** | A tool call, before it runs | `pdks-claude-code init`, `pdks-grok init`, or `pdks-codex init` | A project developed with an AI partner |
 | **Commit** | A unified diff on stdin — staged, the working tree, or a ref range | A pre-commit hook piping `git diff --cached`, or run on demand | A human developing alone, and CI |
 
 The commit judge also answers on demand: `git diff HEAD | pdks covenant check --diff` after a task,

package/dist/docs/catalog.json

@@ -266,6 +266,22 @@
         "summary": "Grok 세션 표면을 설치하고, 어댑터 패키지의 계약과 한계를 확인합니다."
       }
     },
+    {
+      "id": "package-adapter-codex",
+      "category": "reference",
+      "order": 17,
+      "bundled": true,
+      "en": {
+        "path": "reference/packages/adapter-codex.md",
+        "title": "`@polydeukes/adapter-codex`",
+        "summary": "Install the Codex session surface, and consult how patch text becomes file-change evidence."
+      },
+      "ko": {
+        "path": "reference/packages/adapter-codex.ko.md",
+        "title": "`@polydeukes/adapter-codex`",
+        "summary": "Codex 세션 표면을 설치하고, 패치 텍스트가 파일 변경 증거가 되는 방식을 확인합니다."
+      }
+    },
     {
       "id": "package-sdk-ts",
       "category": "reference",
@@ -425,6 +441,22 @@
         "title": "<!--",
         "summary": "당시의 개발 기록이며 현재 사용법을 설명하는 참조 문서는 아닙니다."
       }
+    },
+    {
+      "id": "post-8",
+      "category": "history",
+      "order": 25,
+      "bundled": false,
+      "en": {
+        "path": "build-in-public/2026-09-v0.7-entrypoint-reshape.md",
+        "title": "<!--",
+        "summary": "Historical development account; not a current usage reference."
+      },
+      "ko": {
+        "path": "build-in-public/2026-09-v0.7-entrypoint-reshape.ko.md",
+        "title": "<!--",
+        "summary": "당시의 개발 기록이며 현재 사용법을 설명하는 참조 문서는 아닙니다."
+      }
     }
   ],
   "topics": {