skalpel 4.0.45 → 4.0.47

package/anchor-shadow.mjs

@@ -438,6 +438,434 @@ export async function runProbe(rawTarget) {
   return { pass: null, evidence: "unknown target kind" };
 }
 
+// ===================================================================================================
+// SHIP-STATUS v1 ("Remote-Truth"): STRICT kind↔probe reconstruction + read-only probes.
+//
+// Distinct from the doubt-spiral reconstructTarget/runProbe above (which allow claim-FAMILY fallbacks
+// to resolve a user's re-verify spiral): the ship-status CATCH must be precision-first. So here EACH
+// ship claim kind maps to EXACTLY ONE probe family, with NO cross-kind fallback — a `pushed` claim can
+// NEVER fall back to a PR probe (the cross-kind false-gotcha that fires "PR #n is OPEN" against a TRUE
+// push). No target of the RIGHT kind → null → the caller stays honestly silent (NO_TARGET, never a red).
+//
+// Every probe is READ-ONLY, execFile arg-array (never a shell), args re-validated against strict
+// whitelists, bounded timeout, fail-open (any error → UNKNOWN, never a lie). The `pushed` probe is the
+// new REMOTE-TRUTH read: one `git ls-remote` (the ONLY network read) resolves the REAL remote tip, then
+// a purely-local `git merge-base --is-ancestor` decides reachability — so a push that never left the
+// machine is caught, while a legitimate feature-branch push is never false-accused.
+// ===================================================================================================
+
+// The 1:1 map the caller asserts: each ship claim kind → its single allowed probe FAMILY. `live` &
+// `deployed` share the URL probe; `released` & `published` share the registry/tag family; the rest are
+// unique. reconstructShipTargetV1 ALWAYS returns a target whose family is SHIP_KIND_PROBE[claim], or null.
+export const SHIP_KIND_PROBE = {
+  pushed: "git-remote",
+  merged: "pr",
+  live: "url",
+  deployed: "url",
+  released: "registry",
+  published: "registry",
+  ci: "gh-checks",
+};
+
+// shipProbeFamily(targetKind) → the probe FAMILY a concrete target belongs to (npm & git-tag are both
+// the registry/tag family). Used to assert reconstruction never crosses kinds.
+export function shipProbeFamily(kind) {
+  if (kind === "npm" || kind === "git-tag") return "registry";
+  return kind; // git-remote | pr | url | gh-checks
+}
+
+// Strict arg whitelists (defense in depth — execFile already means no shell).
+const SHIP_SAFE_REF = /^[A-Za-z0-9._@/+-]{1,120}$/; // git remote/branch/tag name
+const SHIP_SHA_RE = /^[0-9a-f]{7,40}$/;
+const SHIP_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const SHIP_NPM_NAME_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
+const SHIP_NET_TIMEOUT_MS = 10000; // network probes (ls-remote / npm view / gh) get a touch more than 5s
+
+// findPushBranch(text) → the LAST `git push [<remote>] [<branch>]` seen in context, as {remote, branch}
+// (either may be null). Used ONLY to name the branch/remote whose remote tip the `pushed` probe reads —
+// never executed. A refspec `local:remote` keeps the remote-side ref. Both fields strictly validated.
+function findPushBranch(text) {
+  const re = /\bgit\s+push\b([^\n;&|]*)/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const pos = m[1]
+      .trim()
+      .split(/\s+/)
+      .filter((t) => t && !t.startsWith("-"));
+    if (pos.length >= 2) last = { remote: pos[0], branch: pos[1] };
+    else if (pos.length === 1) last = { remote: pos[0], branch: null };
+    else last = { remote: null, branch: null };
+  }
+  if (!last) return null;
+  let branch = last.branch;
+  if (branch && branch.includes(":")) branch = branch.split(":").pop(); // refspec local:remote → remote
+  const remote = last.remote && SHIP_SAFE_REF.test(last.remote) ? last.remote : null;
+  branch = branch && SHIP_SAFE_REF.test(branch) ? branch : null;
+  return { remote, branch };
+}
+
+// findTag(text) → a release tag (vX.Y.Z or a `git tag <t>` / `git push origin <t>` mention). Validated.
+function findTag(text) {
+  const near = /\bgit\s+(?:tag|push[^\n;&|]*?)\s+(v?\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/i.exec(text);
+  if (near && SHIP_SAFE_REF.test(near[1])) return near[1];
+  const m = /\b(v\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/.exec(text);
+  return m && SHIP_SAFE_REF.test(m[1]) ? m[1] : null;
+}
+
+// findNpmVersion(text) → a semver version string near a publish/version mention (strict semver). The
+// npm target's NAME is read from the session's own package.json — never from claim/prompt content.
+function findNpmVersion(text) {
+  const near =
+    /\b(?:publish|version|v)\s*@?\s*(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/i.exec(
+      text,
+    ) || /@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/.exec(text);
+  if (near && SHIP_SEMVER_RE.test(near[1])) return near[1];
+  const m = /\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/.exec(text);
+  return m && SHIP_SEMVER_RE.test(m[1]) ? m[1] : null;
+}
+
+// readPkgName(repoDir) → the "name" field of the session's own package.json, validated against npm's
+// package-name rules, or null. This is the ONLY source of the published package name (never the claim).
+function readPkgName(repoDir) {
+  try {
+    if (!repoDir) return null;
+    const name = JSON.parse(readFileSync(join(repoDir, "package.json"), "utf8"))?.name;
+    return typeof name === "string" && SHIP_NPM_NAME_RE.test(name) ? name : null;
+  } catch {
+    return null;
+  }
+}
+
+// reconstructShipTargetV1(claim, contextText, payload) → the STRICT, single-family target for a ship
+// claim, or null. NO cross-kind fallback: a kind that can't reconstruct ITS OWN target returns null.
+export function reconstructShipTargetV1(claim, contextText, payload) {
+  const text = String(contextText || "");
+  const repoDir = repoDirOf(payload);
+  const family = SHIP_KIND_PROBE[claim];
+  if (!family) return null;
+  switch (family) {
+    case "git-remote": {
+      // pushed → REMOTE-TRUTH. Needs the claimed sha + a repo. The branch (from the session's own
+      // `git push`, else resolved at probe time from the upstream) is optional here; ambiguity that
+      // can't be resolved becomes UNKNOWN in the probe, never a false red.
+      const sha = findSha(text);
+      if (!sha || !repoDir) return null;
+      const pb = findPushBranch(text) || {};
+      return {
+        kind: "git-remote",
+        sha,
+        remote: pb.remote || null,
+        branch: pb.branch || null,
+        repoDir,
+      };
+    }
+    case "pr": {
+      // merged → the PR probe ONLY. No PR number in context → null (never a git/url fallback).
+      const n = findPr(text);
+      return n != null ? { kind: "pr", n, repoDir } : null;
+    }
+    case "url": {
+      // live/deployed → the URL probe ONLY.
+      const url = findUrl(text);
+      return url ? { kind: "url", url } : null;
+    }
+    case "registry": {
+      // released/published → the registry/tag family ONLY. Prefer npm when the session actually ran
+      // `npm publish` AND both the package name (from package.json) and a semver version reconstruct;
+      // else a git tag if one is present. Neither → null.
+      if (/\bnpm\s+publish\b/i.test(text)) {
+        const name = readPkgName(repoDir);
+        const version = findNpmVersion(text);
+        if (name && version) return { kind: "npm", name, version };
+      }
+      const tag = findTag(text);
+      if (tag && repoDir) {
+        const pb = findPushBranch(text) || {};
+        return { kind: "git-tag", tag, remote: pb.remote || "origin", repoDir };
+      }
+      return null;
+    }
+    case "gh-checks": {
+      // "CI green/passing" → gh checks ONLY (a PR's checks, else a commit's runs).
+      const n = findPr(text);
+      if (n != null) return { kind: "gh-checks", n, repoDir };
+      const sha = findSha(text);
+      if (sha) return { kind: "gh-checks", sha, repoDir };
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+// validateShipTargetV1(t) → re-validate every field of a ship-v1 target before it is passed to execFile
+// (defense in depth). Returns a normalized target or null. Never throws.
+function validateShipTargetV1(t) {
+  if (!t || typeof t !== "object") return null;
+  switch (t.kind) {
+    case "url":
+      return isSafeUrl(t.url) ? { kind: "url", url: t.url } : null;
+    case "pr": {
+      const n = Number(t.n);
+      if (!Number.isInteger(n) || n <= 0 || n >= 1e7) return null;
+      return { kind: "pr", n, repoDir: validDir(t.repoDir) };
+    }
+    case "git-remote": {
+      if (!SHIP_SHA_RE.test(String(t.sha || ""))) return null;
+      const repoDir = validDir(t.repoDir);
+      if (!repoDir) return null;
+      const remote = t.remote && SHIP_SAFE_REF.test(t.remote) ? t.remote : "origin";
+      const branch = t.branch && SHIP_SAFE_REF.test(t.branch) ? t.branch : null;
+      return { kind: "git-remote", sha: String(t.sha).toLowerCase(), remote, branch, repoDir };
+    }
+    case "npm": {
+      if (
+        !SHIP_NPM_NAME_RE.test(String(t.name || "")) ||
+        !SHIP_SEMVER_RE.test(String(t.version || ""))
+      )
+        return null;
+      return { kind: "npm", name: t.name, version: t.version };
+    }
+    case "git-tag": {
+      const repoDir = validDir(t.repoDir);
+      if (!repoDir || !SHIP_SAFE_REF.test(String(t.tag || ""))) return null;
+      const remote = t.remote && SHIP_SAFE_REF.test(t.remote) ? t.remote : "origin";
+      return { kind: "git-tag", tag: t.tag, remote, repoDir };
+    }
+    case "gh-checks": {
+      const repoDir = validDir(t.repoDir);
+      const n = t.n != null ? Number(t.n) : null;
+      const sha = t.sha ? String(t.sha).toLowerCase() : null;
+      if (n != null && Number.isInteger(n) && n > 0 && n < 1e7)
+        return { kind: "gh-checks", n, repoDir };
+      if (sha && SHIP_SHA_RE.test(sha)) return { kind: "gh-checks", sha, repoDir };
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+// classifyHttpVerdict(code) → the Defect-3 HTTP precision map. A responding server is REACHABLE; only a
+// genuine "gone" (404/410) is a FAIL CANDIDATE (never an immediate red — the caller confirm-reprobes).
+// 401/403/405 (auth-walled), 429 (rate-limit), 5xx (transient), and any other response → UNKNOWN.
+export function classifyHttpVerdict(code) {
+  if (!Number.isFinite(code) || code === 0) return "UNKNOWN";
+  if (code >= 200 && code < 400) return "PASS";
+  if (code === 404 || code === 410) return "FAIL_CANDIDATE";
+  return "UNKNOWN";
+}
+
+// parseLsRemoteTip(stdout, branch) → the 40-hex tip sha for refs/heads/<branch> (or the sole ref line),
+// else null. `git ls-remote <remote> <branch>` prints `<sha>\t<ref>` lines.
+function parseLsRemoteTip(stdout, branch) {
+  const lines = String(stdout || "").split("\n");
+  for (const line of lines) {
+    const mm = line.match(/^([0-9a-f]{40})\s+(\S+)/i);
+    if (mm && (mm[2] === `refs/heads/${branch}` || mm[2] === "HEAD")) return mm[1].toLowerCase();
+  }
+  const first = String(stdout || "").match(/^([0-9a-f]{40})\b/im);
+  return first ? first[1].toLowerCase() : null;
+}
+
+// runShipProbeV1(target, exec) → ONE read-only probe for the strict target. Returns
+// { verdict, evidence } where verdict ∈ PASS | FAIL | FAIL_CANDIDATE | UNKNOWN. `exec` is injectable
+// (defaults to the real read-only `run`) purely so the eval harness can drive it hermetically. Never throws.
+export async function runShipProbeV1(rawTarget, exec = run) {
+  const t = validateShipTargetV1(rawTarget);
+  if (!t) return { verdict: "UNKNOWN", evidence: "rejected: target failed validation" };
+  try {
+    if (t.kind === "url") {
+      // curl -sS -m 5 -o /dev/null -w "%{http_code}" <url>  (READ-ONLY). curl exits 0 on ANY HTTP
+      // status; a non-zero exit is a transport error (6=NXDOMAIN, 7=refused → fail candidate; else unknown).
+      const { err, stdout } = await exec(
+        "curl",
+        ["-sS", "-m", "5", "-o", "/dev/null", "-w", "%{http_code}", t.url],
+        { timeout: SHIP_NET_TIMEOUT_MS },
+      );
+      if (err) {
+        const c = err.code;
+        if (c === 6)
+          return { verdict: "FAIL_CANDIDATE", evidence: "curl: could not resolve host (NXDOMAIN)" };
+        if (c === 7) return { verdict: "FAIL_CANDIDATE", evidence: "curl: connection refused" };
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`curl error: ${err.killed ? "timeout" : err.message || c}`),
+        };
+      }
+      const code = parseInt(stdout, 10);
+      const verdict = classifyHttpVerdict(code);
+      const evidence =
+        Number.isFinite(code) && code !== 0 ? `http_code=${code}` : clip(`no http code: ${stdout}`);
+      return { verdict, evidence };
+    }
+    if (t.kind === "pr") {
+      // gh pr view <n> --json state,mergedAt  (READ-ONLY, DECISIVE)
+      const opts = t.repoDir ? { cwd: t.repoDir } : {};
+      const { err, stdout } = await exec(
+        "gh",
+        ["pr", "view", String(t.n), "--json", "state,mergedAt"],
+        opts,
+      );
+      if (err)
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`gh error: ${err.killed ? "timeout" : err.message}`),
+        };
+      let j;
+      try {
+        j = JSON.parse(stdout);
+      } catch {
+        return { verdict: "UNKNOWN", evidence: clip(`gh non-json: ${stdout}`) };
+      }
+      const merged = j.state === "MERGED" || !!j.mergedAt;
+      return {
+        verdict: merged ? "PASS" : "FAIL",
+        evidence: clip(`state=${j.state} mergedAt=${j.mergedAt || "null"}`),
+      };
+    }
+    if (t.kind === "git-remote") {
+      // REMOTE-TRUTH. Resolve the branch (from the push, else the upstream / current branch), read the
+      // REAL remote tip with ONE `git ls-remote`, then decide reachability locally with merge-base.
+      const remote = t.remote || "origin";
+      let branch = t.branch;
+      if (!branch) {
+        const up = await exec(
+          "git",
+          ["-C", t.repoDir, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"],
+          { timeout: SHIP_NET_TIMEOUT_MS },
+        );
+        if (!up.err) {
+          const ref = String(up.stdout || "").trim(); // e.g. origin/feat-x
+          const idx = ref.indexOf("/");
+          if (idx > 0) branch = ref.slice(idx + 1);
+        }
+        if (!branch) {
+          const cur = await exec("git", ["-C", t.repoDir, "symbolic-ref", "--short", "HEAD"], {
+            timeout: SHIP_NET_TIMEOUT_MS,
+          });
+          if (!cur.err) branch = String(cur.stdout || "").trim() || null;
+        }
+        if (!branch || !SHIP_SAFE_REF.test(branch))
+          return { verdict: "UNKNOWN", evidence: "git-remote: branch unresolved (ambiguous)" };
+      }
+      const ls = await exec("git", ["-C", t.repoDir, "ls-remote", remote, branch], {
+        timeout: SHIP_NET_TIMEOUT_MS,
+      });
+      if (ls.err)
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`ls-remote error: ${ls.err.killed ? "timeout" : ls.err.message}`),
+        };
+      const tip = parseLsRemoteTip(ls.stdout, branch);
+      if (!tip)
+        return { verdict: "UNKNOWN", evidence: clip(`no remote tip for ${remote}/${branch}`) };
+      const mb = await exec("git", ["-C", t.repoDir, "merge-base", "--is-ancestor", t.sha, tip], {
+        timeout: SHIP_NET_TIMEOUT_MS,
+      });
+      const evid = `sha=${t.sha.slice(0, 12)} branch=${remote}/${branch} remoteTip=${tip.slice(0, 12)}`;
+      // exit 0 → reachable (PASS). exit 1 → both objects known AND not reachable (DECISIVE FAIL — it
+      // never left the machine). Any other exit → a commit is unknown locally → UNKNOWN (never a lie).
+      if (!mb.err) return { verdict: "PASS", evidence: clip(`${evid} ancestor`) };
+      if (mb.err.code === 1) return { verdict: "FAIL", evidence: clip(`${evid} not-ancestor`) };
+      return {
+        verdict: "UNKNOWN",
+        evidence: clip(`${evid} merge-base indeterminate (tip/sha unknown locally)`),
+      };
+    }
+    if (t.kind === "npm") {
+      // npm view <name>@<version> version  (READ-ONLY registry read, DECISIVE)
+      const { err, stdout, stderr } = await exec(
+        "npm",
+        ["view", `${t.name}@${t.version}`, "version"],
+        {
+          timeout: SHIP_NET_TIMEOUT_MS,
+        },
+      );
+      if (!err) {
+        return String(stdout || "").trim()
+          ? {
+              verdict: "PASS",
+              evidence: clip(`npm ${t.name}@${t.version} = ${String(stdout).trim()}`),
+            }
+          : { verdict: "UNKNOWN", evidence: clip(`npm empty for ${t.name}@${t.version}`) };
+      }
+      const combined = `${stderr || ""} ${stdout || ""}`;
+      if (/E404|No match found|is not in (?:this|the)/i.test(combined))
+        return { verdict: "FAIL", evidence: clip(`npm: ${t.name}@${t.version} not on registry`) };
+      return {
+        verdict: "UNKNOWN",
+        evidence: clip(`npm error: ${err.killed ? "timeout" : err.message}`),
+      };
+    }
+    if (t.kind === "git-tag") {
+      // git -C <repo> ls-remote --tags <remote> <tag>  (READ-ONLY, DECISIVE)
+      const { err, stdout } = await exec(
+        "git",
+        ["-C", t.repoDir, "ls-remote", "--tags", t.remote, t.tag],
+        {
+          timeout: SHIP_NET_TIMEOUT_MS,
+        },
+      );
+      if (err)
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`ls-remote --tags error: ${err.killed ? "timeout" : err.message}`),
+        };
+      const esc = t.tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const has = new RegExp(`\\brefs/tags/${esc}(?:\\^\\{\\})?$`, "m").test(String(stdout || ""));
+      return has
+        ? { verdict: "PASS", evidence: clip(`tag ${t.remote}/${t.tag} present`) }
+        : { verdict: "FAIL", evidence: clip(`tag ${t.tag} not on ${t.remote}`) };
+    }
+    if (t.kind === "gh-checks") {
+      // gh pr checks <n> --json ...  /  gh run list --commit <sha> --json ...  (READ-ONLY). gh prints
+      // JSON even on a non-zero exit (failing/pending), so we parse stdout regardless of err.
+      const opts = t.repoDir ? { cwd: t.repoDir } : {};
+      let err, stdout;
+      if (t.n != null) {
+        ({ err, stdout } = await exec(
+          "gh",
+          ["pr", "checks", String(t.n), "--json", "state,bucket"],
+          opts,
+        ));
+      } else {
+        ({ err, stdout } = await exec(
+          "gh",
+          ["run", "list", "--commit", t.sha, "--json", "conclusion,status"],
+          opts,
+        ));
+      }
+      const out = String(stdout || "");
+      if (err && !out.trim())
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`gh checks error: ${err.killed ? "timeout" : err.message}`),
+        };
+      let arr;
+      try {
+        arr = JSON.parse(out);
+      } catch {
+        return { verdict: "UNKNOWN", evidence: clip(`gh checks non-json: ${out}`) };
+      }
+      if (!Array.isArray(arr) || !arr.length)
+        return { verdict: "UNKNOWN", evidence: "gh checks: none reported" };
+      const norm = arr.map((c) =>
+        String((c && (c.bucket || c.conclusion || c.state || c.status)) || "").toLowerCase(),
+      );
+      if (norm.some((s) => /fail|error|cancel|timed_out|action_required/.test(s)))
+        return { verdict: "FAIL", evidence: clip(`checks: ${norm.join(",")}`) };
+      if (norm.some((s) => s === "" || /pending|queued|in_progress|waiting|requested/.test(s)))
+        return { verdict: "UNKNOWN", evidence: clip(`checks pending: ${norm.join(",")}`) };
+      return { verdict: "PASS", evidence: clip(`checks: ${norm.join(",")}`) };
+    }
+  } catch (e) {
+    return { verdict: "UNKNOWN", evidence: clip(`probe threw: ${e}`) };
+  }
+  return { verdict: "UNKNOWN", evidence: "unknown ship target kind" };
+}
+
 // ---------------------------------------------------------------------------------------------------
 // Logging — the ONLY side effect. Append-only NDJSON at ~/.skalpel/anchor-shadow.log. Never throws.
 // ---------------------------------------------------------------------------------------------------

package/catches.mjs

@@ -39,6 +39,10 @@ import {
   classifyOutcome,
   extractFailCount,
 } from "./verify-shadow.mjs";
+// ONE normalizer, never two: the Codex rollout → Claude-shape translation lives in codex-normalize.mjs and
+// is shared verbatim with the LIVE verify-shadow worker, so the retroactive scan and the live catch can
+// never drift. (This module keeps only the Claude-native loader below.)
+import { loadCodexEntries } from "./codex-normalize.mjs";
 import { recordInsight } from "./insights.mjs";
 
 const HOME = homedir();
@@ -113,76 +117,10 @@ export function loadClaudeEntries(file) {
   return entries;
 }
 
-// Codex output wrapper always carries "Process exited with code N" — the recorded exit status, which is
-// exactly the ground truth we need (no re-run). Returns { exitCode:number|null, body:string }.
-function parseCodexOutput(output) {
-  const s = typeof output === "string" ? output : "";
-  const m = s.match(/Process exited with code\s+(-?\d+)/i);
-  const exitCode = m ? parseInt(m[1], 10) : null;
-  // Prefer the text AFTER "Output:" as the evidence body (drops the Command/Chunk/Wall-time header).
-  const oi = s.indexOf("\nOutput:\n");
-  const body = oi >= 0 ? s.slice(oi + "\nOutput:\n".length) : s;
-  return { exitCode, body };
-}
-
-// Normalize one Codex rollout file into Claude-shaped entries. exec_command → a Bash tool_use; its
-// function_call_output → a tool_result carrying the recorded exit code; assistant messages → text.
-export function loadCodexEntries(file) {
-  const entries = [];
-  for (const line of tailLines(file, SESSION_TAIL_BYTES)) {
-    let e;
-    try {
-      e = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (e.type !== "response_item") continue;
-    const p = e.payload || {};
-    if (p.type === "message") {
-      const role = p.role === "assistant" ? "assistant" : "user";
-      const text = Array.isArray(p.content)
-        ? p.content.map((b) => (b && typeof b.text === "string" ? b.text : "")).join("")
-        : "";
-      if (text.trim())
-        entries.push({ type: role, message: { role, content: [{ type: "text", text }] } });
-    } else if (p.type === "function_call" && p.name === "exec_command" && p.call_id) {
-      let cmd = "";
-      let workdir = null;
-      try {
-        const a = JSON.parse(p.arguments || "{}");
-        cmd = typeof a.cmd === "string" ? a.cmd : Array.isArray(a.cmd) ? a.cmd.join(" ") : "";
-        workdir = typeof a.workdir === "string" ? a.workdir : null;
-      } catch {
-        /* unparseable args — leave cmd empty (no proof) */
-      }
-      if (cmd)
-        entries.push({
-          cwd: workdir,
-          message: {
-            role: "assistant",
-            content: [{ type: "tool_use", name: "Bash", id: p.call_id, input: { command: cmd } }],
-          },
-        });
-    } else if (p.type === "function_call_output" && p.call_id) {
-      const { exitCode, body } = parseCodexOutput(p.output);
-      entries.push({
-        message: {
-          role: "user",
-          content: [
-            {
-              type: "tool_result",
-              tool_use_id: p.call_id,
-              is_error: typeof exitCode === "number" ? exitCode !== 0 : false,
-              exit_code: exitCode,
-              content: body,
-            },
-          ],
-        },
-      });
-    }
-  }
-  return entries;
-}
+// Codex rollout normalization (loadCodexEntries / parseCodexOutput) now lives in ./codex-normalize.mjs and
+// is imported above — ONE normalizer shared with the live verify-shadow worker (deleted here to avoid a
+// second, drifting copy). The retroactive scan still reads the RECORDED exit code those entries carry
+// (exit_code / is_error) instead of re-running.
 
 // ---------- (3) index the recorded proof results (no re-run) ----------
 function resultTextOf(block) {
@@ -318,7 +256,10 @@ export function runScan() {
   for (const s of sessions) {
     let entries;
     try {
-      entries = s.tool === "codex" ? loadCodexEntries(s.file) : loadClaudeEntries(s.file);
+      entries =
+        s.tool === "codex"
+          ? loadCodexEntries(s.file, SESSION_TAIL_BYTES)
+          : loadClaudeEntries(s.file);
     } catch {
       continue; // unreadable file — skip (read-only, fail-open)
     }