skalpel 4.0.46 → 4.0.47

package/catches.mjs

@@ -39,6 +39,10 @@ import {
   classifyOutcome,
   extractFailCount,
 } from "./verify-shadow.mjs";
+// ONE normalizer, never two: the Codex rollout → Claude-shape translation lives in codex-normalize.mjs and
+// is shared verbatim with the LIVE verify-shadow worker, so the retroactive scan and the live catch can
+// never drift. (This module keeps only the Claude-native loader below.)
+import { loadCodexEntries } from "./codex-normalize.mjs";
 import { recordInsight } from "./insights.mjs";
 
 const HOME = homedir();
@@ -113,76 +117,10 @@ export function loadClaudeEntries(file) {
   return entries;
 }
 
-// Codex output wrapper always carries "Process exited with code N" — the recorded exit status, which is
-// exactly the ground truth we need (no re-run). Returns { exitCode:number|null, body:string }.
-function parseCodexOutput(output) {
-  const s = typeof output === "string" ? output : "";
-  const m = s.match(/Process exited with code\s+(-?\d+)/i);
-  const exitCode = m ? parseInt(m[1], 10) : null;
-  // Prefer the text AFTER "Output:" as the evidence body (drops the Command/Chunk/Wall-time header).
-  const oi = s.indexOf("\nOutput:\n");
-  const body = oi >= 0 ? s.slice(oi + "\nOutput:\n".length) : s;
-  return { exitCode, body };
-}
-
-// Normalize one Codex rollout file into Claude-shaped entries. exec_command → a Bash tool_use; its
-// function_call_output → a tool_result carrying the recorded exit code; assistant messages → text.
-export function loadCodexEntries(file) {
-  const entries = [];
-  for (const line of tailLines(file, SESSION_TAIL_BYTES)) {
-    let e;
-    try {
-      e = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (e.type !== "response_item") continue;
-    const p = e.payload || {};
-    if (p.type === "message") {
-      const role = p.role === "assistant" ? "assistant" : "user";
-      const text = Array.isArray(p.content)
-        ? p.content.map((b) => (b && typeof b.text === "string" ? b.text : "")).join("")
-        : "";
-      if (text.trim())
-        entries.push({ type: role, message: { role, content: [{ type: "text", text }] } });
-    } else if (p.type === "function_call" && p.name === "exec_command" && p.call_id) {
-      let cmd = "";
-      let workdir = null;
-      try {
-        const a = JSON.parse(p.arguments || "{}");
-        cmd = typeof a.cmd === "string" ? a.cmd : Array.isArray(a.cmd) ? a.cmd.join(" ") : "";
-        workdir = typeof a.workdir === "string" ? a.workdir : null;
-      } catch {
-        /* unparseable args — leave cmd empty (no proof) */
-      }
-      if (cmd)
-        entries.push({
-          cwd: workdir,
-          message: {
-            role: "assistant",
-            content: [{ type: "tool_use", name: "Bash", id: p.call_id, input: { command: cmd } }],
-          },
-        });
-    } else if (p.type === "function_call_output" && p.call_id) {
-      const { exitCode, body } = parseCodexOutput(p.output);
-      entries.push({
-        message: {
-          role: "user",
-          content: [
-            {
-              type: "tool_result",
-              tool_use_id: p.call_id,
-              is_error: typeof exitCode === "number" ? exitCode !== 0 : false,
-              exit_code: exitCode,
-              content: body,
-            },
-          ],
-        },
-      });
-    }
-  }
-  return entries;
-}
+// Codex rollout normalization (loadCodexEntries / parseCodexOutput) now lives in ./codex-normalize.mjs and
+// is imported above — ONE normalizer shared with the live verify-shadow worker (deleted here to avoid a
+// second, drifting copy). The retroactive scan still reads the RECORDED exit code those entries carry
+// (exit_code / is_error) instead of re-running.
 
 // ---------- (3) index the recorded proof results (no re-run) ----------
 function resultTextOf(block) {
@@ -318,7 +256,10 @@ export function runScan() {
   for (const s of sessions) {
     let entries;
     try {
-      entries = s.tool === "codex" ? loadCodexEntries(s.file) : loadClaudeEntries(s.file);
+      entries =
+        s.tool === "codex"
+          ? loadCodexEntries(s.file, SESSION_TAIL_BYTES)
+          : loadClaudeEntries(s.file);
     } catch {
       continue; // unreadable file — skip (read-only, fail-open)
     }

package/codex-normalize.mjs

@@ -0,0 +1,216 @@
+// codex-normalize.mjs — the ONE Codex-rollout → Claude-transcript normalizer, shared by the retroactive
+// scanner (catches.mjs) AND the LIVE claim-verification worker (verify-shadow.mjs). Codex records a session
+// as a JSONL "rollout" of `response_item` events; Claude records `message.content[]` blocks. verify-shadow's
+// whole engine — claim detection, proof reconstruction, allowlist, classifyOutcome, flake-confirm — speaks
+// the Claude shape. Rather than teach every one of those functions a second dialect, we translate the
+// rollout INTO the Claude shape ONCE, here, and everything downstream is unchanged. A single normalizer
+// means the live catch and the retroactive catch can never drift.
+//
+// RED LINES (inherited, enforced by construction):
+//   • READ-ONLY + fail-open. This only PARSES bytes already on disk. Unparseable args / unknown schema /
+//     missing fields → the record is dropped (no proof), never a throw. A crafted rollout can at worst make
+//     us find NOTHING to verify — never make us execute something we shouldn't (the allowlist + execFile
+//     arg-array in verify-shadow still gate every re-run).
+//   • The recorded exit code Codex already wrote ("Process exited with code N") is carried onto the
+//     normalized tool_result (exit_code / is_error). The live worker uses it as CORROBORATING evidence:
+//     a live re-run FAIL is only ever surfaced when Codex's OWN recorded run of that same command also
+//     failed (recorded-exit-code agreement) — so a Codex catch is strictly MORE precision-gated than a
+//     Claude one, and an environment/flake divergence can never cry wolf.
+import { readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { tailLines } from "./transcript.mjs";
+
+// Default per-file tail. Codex rollouts can be multi-GB; a bounded tail keeps normalization constant-time
+// and OOM-proof. Callers pass their own budget (the retroactive scan is generous, the hot live path tighter).
+const DEFAULT_TAIL_BYTES = 4 * 1024 * 1024;
+
+// ---------- detection ----------
+// A Codex rollout is identified by WHERE it lives (under ~/.codex — or $CODEX_HOME) OR by its canonical
+// filename (`rollout-<iso>-<uuid>.jsonl`). Path-based so we never have to read a byte to route. Fail-open:
+// anything ambiguous returns false and the caller treats it as a Claude transcript (the safe default).
+export function isCodexRollout(p) {
+  if (!p || typeof p !== "string") return false;
+  try {
+    const base = p.split(/[/\\]/).pop() || "";
+    if (/^rollout-.*\.jsonl$/.test(base)) return true;
+    const norm = p.replace(/\\/g, "/");
+    if (/(^|\/)\.codex(\/|$)/.test(norm)) return true;
+    const codexHome = process.env.CODEX_HOME;
+    if (codexHome && norm.startsWith(codexHome.replace(/\\/g, "/"))) return true;
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+// The Codex session roots to scan when we must resolve a session ourselves (the hook did not hand us a
+// usable rollout path — see verify-shadow #6). $CODEX_HOME wins; otherwise ~/.codex.
+function codexRoots() {
+  const home = process.env.CODEX_HOME || path.join(homedir(), ".codex");
+  return [path.join(home, "sessions"), path.join(home, "archived_sessions")];
+}
+
+// Bounded newest-first walk for `rollout-*.jsonl`. Used only as the LAST resort when no usable rollout path
+// was provided for a Codex turn. Read-only, fail-open. depth-bounded so a symlink loop can't spin forever.
+function walkRollouts(dir, out, depth = 0) {
+  if (depth > 8) return; // Codex nests sessions/<yyyy>/<mm>/<dd>/ — 8 is plenty and bounds a symlink loop
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const p = path.join(dir, e.name);
+    try {
+      if (e.isDirectory()) walkRollouts(p, out, depth + 1);
+      else if (e.isFile() && /^rollout-.*\.jsonl$/.test(e.name)) out.push(p);
+    } catch {
+      /* one bad entry never aborts the walk */
+    }
+  }
+}
+
+// newestCodexRollout() → absolute path of the most-recently-modified rollout, or null. Fail-open.
+export function newestCodexRollout() {
+  try {
+    const files = [];
+    for (const d of codexRoots()) walkRollouts(d, files);
+    let best = null;
+    let bestMtime = -Infinity;
+    for (const f of files) {
+      try {
+        const m = statSync(f).mtimeMs;
+        if (m > bestMtime) {
+          bestMtime = m;
+          best = f;
+        }
+      } catch {
+        /* vanished mid-scan — skip */
+      }
+    }
+    return best;
+  } catch {
+    return null;
+  }
+}
+
+// ---------- output parsing ----------
+// A Codex exec output wrapper always carries "Process exited with code N" — the recorded exit status, which
+// is exactly the ground truth we need (no re-run to learn it). Returns { exitCode:number|null, body:string }.
+// A sandbox/harness failure ("exec_command failed: CreateProcess …") has no such line → exitCode null →
+// treated downstream as "no failure signal recorded" (never invented as a failure).
+export function parseCodexOutput(output) {
+  const s = typeof output === "string" ? output : "";
+  // Codex records its exit status as a HEADER line, BEFORE the "\nOutput:\n" body (verified against real
+  // ~/.codex rollouts — the status line always precedes the Output body and reads):
+  //   [Command: …\n]Chunk ID: …\nWall time: … seconds\nProcess exited with code N\nOriginal token count: …\nOutput:\n<body>
+  // The command's OWN stdout/stderr (the body, AFTER "Output:") — OR the echoed "Command:" line — can also
+  // contain a "Process exited with code M" substring (a nested runner/CI-supervisor logging a child's exit, a
+  // grep of this very phrase). Neither is Codex's status. Reading the FIRST match can grab the Command echo;
+  // reading the LAST over the WHOLE string can grab the body. So we bind to Codex's OWN status line: scan the
+  // HEADER region only (everything before "\nOutput:\n") and take the LAST match there — the real status line
+  // always follows the Command echo, and the body is excluded outright. This is the recorded exit code the
+  // agreement gate corroborates against; it can no longer be spoofed by command output — closing the
+  // false-catch path. A thinner wrapper with no "\nOutput:\n" degrades to a last-match over the whole string;
+  // no match at all → null (suppressed downstream, never invented as a failure).
+  const oi = s.indexOf("\nOutput:\n");
+  const header = oi >= 0 ? s.slice(0, oi) : s;
+  let exitCode = null;
+  const re = /Process exited with code\s+(-?\d+)/gi;
+  let m;
+  while ((m = re.exec(header)) !== null) exitCode = parseInt(m[1], 10);
+  // Prefer the text AFTER "Output:" as the evidence body (drops the Command/Chunk/Wall-time header).
+  const body = oi >= 0 ? s.slice(oi + "\nOutput:\n".length) : s;
+  return { exitCode, body };
+}
+
+// ---------- normalization ----------
+// Normalize one Codex rollout file into Claude-shaped entries. exec_command → a Bash tool_use; its
+// function_call_output → a tool_result carrying the recorded exit code; assistant/user messages → text.
+// maxBytes bounds the tail read (see DEFAULT_TAIL_BYTES). Never throws.
+export function loadCodexEntries(file, maxBytes = DEFAULT_TAIL_BYTES) {
+  const entries = [];
+  for (const line of tailLines(file, maxBytes)) {
+    let e;
+    try {
+      e = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (e.type !== "response_item") continue;
+    const p = e.payload || {};
+    if (p.type === "message") {
+      const role = p.role === "assistant" ? "assistant" : "user";
+      const text = Array.isArray(p.content)
+        ? p.content.map((b) => (b && typeof b.text === "string" ? b.text : "")).join("")
+        : "";
+      if (text.trim())
+        entries.push({ type: role, message: { role, content: [{ type: "text", text }] } });
+    } else if (p.type === "function_call" && p.name === "exec_command" && p.call_id) {
+      let cmd = "";
+      let workdir = null;
+      try {
+        const a = JSON.parse(p.arguments || "{}");
+        // A STRING cmd is a shell command verify-shadow's tokenizer parses safely. An ARRAY cmd is argv;
+        // joining it back into a string is LOSSY (quoting is lost — `["sh","-c","a b"]` → `sh -c a b`),
+        // so we DROP it (leave cmd empty → no proof) rather than reconstruct a command that differs from
+        // what actually ran. Fail-open on argv-join quoting doubt (RED LINE #4).
+        cmd = typeof a.cmd === "string" ? a.cmd : "";
+        workdir = typeof a.workdir === "string" ? a.workdir : null;
+      } catch {
+        /* unparseable args — leave cmd empty (no proof) */
+      }
+      if (cmd)
+        entries.push({
+          cwd: workdir,
+          message: {
+            role: "assistant",
+            content: [{ type: "tool_use", name: "Bash", id: p.call_id, input: { command: cmd } }],
+          },
+        });
+    } else if (p.type === "function_call_output" && p.call_id) {
+      const { exitCode, body } = parseCodexOutput(p.output);
+      entries.push({
+        message: {
+          role: "user",
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: p.call_id,
+              is_error: typeof exitCode === "number" ? exitCode !== 0 : false,
+              exit_code: exitCode,
+              content: body,
+            },
+          ],
+        },
+      });
+    }
+  }
+  return entries;
+}
+
+// ---------- recorded-exit lookup (the Codex precision lever) ----------
+// The recorded exit code Codex wrote for the tool_use `id` (call_id) of a reconstructed proof. This is the
+// CORROBORATING evidence the live worker demands before it surfaces a Codex catch: a live re-run FAIL is
+// only revealed when Codex's OWN recorded run of that exact command ALSO failed. Returns
+// { exitCode:number|null, isError:bool, found:bool }. Scans newest→oldest so the most recent result wins.
+export function recordedExitFor(entries, toolUseId) {
+  if (!toolUseId || !Array.isArray(entries))
+    return { exitCode: null, isError: false, found: false };
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const c = entries[i]?.message?.content;
+    if (!Array.isArray(c)) continue;
+    for (const b of c) {
+      if (b && b.type === "tool_result" && b.tool_use_id === toolUseId) {
+        return {
+          exitCode: typeof b.exit_code === "number" ? b.exit_code : null,
+          isError: b.is_error === true,
+          found: true,
+        };
+      }
+    }
+  }
+  return { exitCode: null, isError: false, found: false };
+}

package/eval-harness.mjs

@@ -31,6 +31,11 @@ import { fileURLToPath } from "node:url";
 // via an INJECTED exec so every branch runs hermetically (no network, no gh/curl/git/npm needed).
 import { detectShipClaim, resolveShipStatus } from "./verify-shadow.mjs";
 import { reconstructShipTargetV1, shipProbeFamily, SHIP_KIND_PROBE } from "./anchor-shadow.mjs";
+// CODEX LIVE-CATCH PARITY corpus + real-history audit — drives the REAL Codex catch decision
+// (evaluateCodexProof: claim → reconstruct proof → re-run → 2/2 flake-confirm + recorded-exit agreement)
+// over synthetic fixtures (hermetic, injected re-run) AND this machine's real ~/.codex rollouts.
+import { evaluateCodexProof, rerunProof } from "./verify-shadow.mjs";
+import { loadCodexEntries } from "./codex-normalize.mjs";
 
 // ───────────────────────────── tunables (UNCALIBRATED defaults) ─────────────────────────────
 // These thresholds are NOT tuned against a human gold set unless one is supplied via --gold.
@@ -1511,6 +1516,298 @@ function main() {
   console.log("═".repeat(90));
 }
 
+// ═════════════════════ CODEX LIVE-CATCH FIXTURE CORPUS (the publish gate) ═════════════════════
+// Synthetic Codex rollouts exercised END-TO-END against the REAL Codex catch decision
+// (loadCodexEntries → detectCompletionClaim → reconstructProofEntry → recorded-exit lookup →
+// assembleCodexVerdict). Only the LIVE re-run is injected (a stub — hermetic, no process spawned), so the
+// fixtures pin the exact (claim → recorded-exit → live-outcome → confirmed?) contract. The recorded-exit
+// agreement makes a Codex catch strictly more precision-gated than a Claude one; a false Codex red is the
+// #1 death vector, so this corpus is the gate to enabling the reveal.
+async function runCodexSelfTests() {
+  const assert = (cond, msg) => {
+    if (!cond) throw new Error("CODEX-SELFTEST FAIL: " + msg);
+  };
+  console.log("\n" + "═".repeat(96));
+  console.log("CODEX LIVE-CATCH FIXTURE CORPUS — the publish gate (recorded-exit-code agreement)");
+  console.log("═".repeat(96));
+
+  const os = await import("node:os");
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "skalpel-codex-selftest-"));
+
+  // ── rollout event builders (the real Codex `response_item` shapes) ──────────────────────────────────
+  const meta = { timestamp: "t", type: "session_meta", payload: { id: "selftest" } };
+  const execCall = (call_id, cmd) => ({
+    timestamp: "t",
+    type: "response_item",
+    payload: {
+      type: "function_call",
+      name: "exec_command",
+      arguments: JSON.stringify({ cmd, workdir: tmp }),
+      call_id,
+    },
+  });
+  const execCallRaw = (call_id, rawArgs) => ({
+    timestamp: "t",
+    type: "response_item",
+    payload: { type: "function_call", name: "exec_command", arguments: rawArgs, call_id },
+  });
+  const execOut = (call_id, code, body = "") => ({
+    timestamp: "t",
+    type: "response_item",
+    payload: {
+      type: "function_call_output",
+      call_id,
+      output: `Chunk ID: x\nWall time: 0.01 seconds\nProcess exited with code ${code}\nOriginal token count: 1\nOutput:\n${body}`,
+    },
+  });
+  const execOutNoCode = (call_id) => ({
+    timestamp: "t",
+    type: "response_item",
+    payload: {
+      type: "function_call_output",
+      call_id,
+      output: `exec_command failed: CreateProcess { message: "Rejected(\\"No such file\\")" }`,
+    },
+  });
+  const assistant = (text) => ({
+    timestamp: "t",
+    type: "response_item",
+    payload: { type: "message", role: "assistant", content: [{ type: "output_text", text }] },
+  });
+  const writeRollout = (name, lines) => {
+    const f = path.join(tmp, `rollout-2026-01-01T00-00-00-${name}.jsonl`);
+    fs.writeFileSync(f, lines.map((l) => JSON.stringify(l)).join("\n") + "\n");
+    return f;
+  };
+  // Injected LIVE re-run: returns a scripted sequence of outcomes (rerunProof's result shape). No process.
+  const stubRerun = (seq) => {
+    let i = 0;
+    return async () => {
+      const o = seq[Math.min(i, seq.length - 1)];
+      i++;
+      if (o === "FAIL") return { pass: false, outcome: "GENUINE_FAIL", evidence: "2 failed" };
+      if (o === "HARNESS") return { pass: false, outcome: "HARNESS_ERROR", evidence: "boom" };
+      return { pass: true, outcome: "PASS", evidence: "ok" };
+    };
+  };
+
+  let pass = 0;
+  let total = 0;
+  const check = async (label, file, seq, expect) => {
+    total++;
+    const entries = loadCodexEntries(file);
+    const res = await evaluateCodexProof(entries, tmp, stubRerun(seq));
+    if ("claim" in expect)
+      assert(res.claim === expect.claim, `${label}: claim=${res.claim} expected ${expect.claim}`);
+    if (expect.proofNull) assert(res.proof == null, `${label}: expected NO reconstructed proof`);
+    if ("confirmed" in expect)
+      // Compare by TRUTHINESS: a no-proof turn returns `confirmed` absent (undefined) — still a no-catch,
+      // which must satisfy an `expect.confirmed === false` (never a surfaced red).
+      assert(
+        !!res.confirmed === !!expect.confirmed,
+        `${label}: confirmed=${res.confirmed} expected ${expect.confirmed}`,
+      );
+    if ("agreement" in expect)
+      assert(
+        res.agreement === expect.agreement,
+        `${label}: agreement=${res.agreement} expected ${expect.agreement}`,
+      );
+    console.log(
+      `  ✓ ${label}  (claim=${res.claim} proof=${res.proof ? "yes" : "no"} outcome=${res.outcome ?? "-"} recExit=${res.recorded_exit_code ?? "-"} agree=${res.agreement ?? "-"} confirmed=${!!res.confirmed})`,
+    );
+    pass++;
+  };
+
+  // a) done-claim over a RECORDED FAIL, live 2/2 fail → CAUGHT (agreement)
+  await check(
+    "a done-over-recorded-FAIL, live 2/2 fail → CAUGHT",
+    writeRollout("a", [
+      meta,
+      execCall("c1", "pytest"),
+      execOut("c1", 1, "2 failed"),
+      assistant("all tests pass — done"),
+    ]),
+    ["FAIL", "FAIL"],
+    { claim: true, confirmed: true, agreement: "agree" },
+  );
+  // b) recorded PASS but the re-run fails now → SUPPRESSED (recorded-exit disagreement = flake/drift)
+  await check(
+    "b recorded-PASS but re-run fails → SUPPRESSED (disagree)",
+    writeRollout("b", [
+      meta,
+      execCall("c2", "pytest"),
+      execOut("c2", 0, "all passed"),
+      assistant("all tests pass now"),
+    ]),
+    ["FAIL", "FAIL"],
+    { claim: true, confirmed: false, agreement: "disagree" },
+  );
+  // c) unparseable exec arguments → no proof reconstructed → no catch, NO THROW
+  await check(
+    "c unparseable exec args → no proof, no catch, no throw",
+    writeRollout("c", [
+      meta,
+      execCallRaw("c3", "{not valid json"),
+      execOut("c3", 1, "x"),
+      assistant("done, fixed it"),
+    ]),
+    ["FAIL", "FAIL"],
+    { claim: true, proofNull: true, confirmed: false },
+  );
+  // d) live first FAIL then PASS (a flake) → SUPPRESSED (2/2 not met)
+  await check(
+    "d live fail then pass (flake) → SUPPRESSED",
+    writeRollout("d", [
+      meta,
+      execCall("c4", "pytest"),
+      execOut("c4", 1, "2 failed"),
+      assistant("done"),
+    ]),
+    ["FAIL", "PASS"],
+    { claim: true, confirmed: false, agreement: "n/a" },
+  );
+  // e) recorded exit UNKNOWN (sandbox CreateProcess failure, no code) + live 2/2 fail → SUPPRESSED (unknown)
+  await check(
+    "e recorded exit unknown + live 2/2 fail → SUPPRESSED (unknown)",
+    writeRollout("e", [
+      meta,
+      execCall("c5", "pytest"),
+      execOutNoCode("c5"),
+      assistant("all green"),
+    ]),
+    ["FAIL", "FAIL"],
+    { claim: true, confirmed: false, agreement: "unknown" },
+  );
+  // f) recorded FAIL but the re-run PASSES now → not a catch (the agent actually fixed it)
+  await check(
+    "f recorded-FAIL but re-run passes → not a catch",
+    writeRollout("f", [
+      meta,
+      execCall("c6", "pytest"),
+      execOut("c6", 1, "2 failed"),
+      assistant("fixed, all pass"),
+    ]),
+    ["PASS"],
+    { claim: true, confirmed: false },
+  );
+  // g) no completion claim in the last turn → nothing to verify
+  await check(
+    "g no completion claim → nothing to verify",
+    writeRollout("g", [
+      meta,
+      execCall("c7", "pytest"),
+      execOut("c7", 1, "2 failed"),
+      assistant("here is what I found so far"),
+    ]),
+    ["FAIL", "FAIL"],
+    { claim: false },
+  );
+
+  fs.rmSync(tmp, { recursive: true, force: true });
+  console.log("─".repeat(96));
+  console.log(`CODEX-SELFTEST: ${pass}/${total} pass`);
+  return pass === total;
+}
+
+// ═════════════════════ CODEX real-history REPLAY audit ═════════════════════
+// Replays the REAL live Codex worker decision (evaluateCodexProof with the REAL rerunProof) over every
+// rollout under a dir (default ~/.codex). Prints one row per completion-claim turn + a summary, and lists
+// every CONFIRMED catch for hand-audit — the gate is ZERO false catches. Read-only except rerunProof, which
+// only ever re-runs the session's OWN allowlisted, non-mutating test/build/lint command (60s cap each).
+async function runCodexReplay(dir) {
+  const os = await import("node:os");
+  const root = dir || path.join(os.homedir(), ".codex");
+  const files = [];
+  const walk = (d, depth = 0) => {
+    if (depth > 8) return;
+    let ents;
+    try {
+      ents = fs.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of ents) {
+      const p = path.join(d, e.name);
+      try {
+        if (e.isDirectory()) walk(p, depth + 1);
+        else if (e.isFile() && /^rollout-.*\.jsonl$/.test(e.name)) files.push(p);
+      } catch {
+        /* skip one bad entry */
+      }
+    }
+  };
+  walk(root);
+  console.log("\n" + "═".repeat(96));
+  console.log(`CODEX REAL-HISTORY REPLAY — ${files.length} rollout(s) under ${root}`);
+  console.log(
+    "  (live worker decision over your OWN Codex history; every CONFIRMED catch is hand-audited)",
+  );
+  console.log("═".repeat(96));
+
+  let scanned = 0;
+  let claims = 0;
+  let proofs = 0;
+  let liveFail = 0;
+  let harness = 0;
+  let disagree = 0;
+  let unknown = 0;
+  let confirmed = 0;
+  const catches = [];
+  for (const f of files) {
+    scanned++;
+    let entries;
+    try {
+      entries = loadCodexEntries(f);
+    } catch {
+      continue;
+    }
+    if (!entries.length) continue;
+    let res;
+    try {
+      res = await evaluateCodexProof(entries, null, rerunProof);
+    } catch (e) {
+      console.log(
+        `  ! ${path.basename(f)}  evaluate threw (fail-open): ${String(e && e.message).slice(0, 60)}`,
+      );
+      continue;
+    }
+    if (!res.claim) continue;
+    claims++;
+    if (!res.proof) {
+      console.log(`  · ${path.basename(f).slice(0, 52)}  claim ✓  no re-runnable proof`);
+      continue;
+    }
+    proofs++;
+    if (res.outcome === "GENUINE_FAIL") liveFail++;
+    if (res.outcome === "HARNESS_ERROR" || res.outcome === "REFUSED") harness++;
+    if (res.confirmed) {
+      confirmed++;
+      catches.push({ f, res });
+    } else if (res.agreement === "disagree") disagree++;
+    else if (res.agreement === "unknown") unknown++;
+    console.log(
+      `  ${res.confirmed ? "🔴" : "·"} ${path.basename(f).slice(0, 44)}  claim ✓  outcome=${res.outcome}  recExit=${res.recorded_exit_code ?? "-"}  agree=${res.agreement}  confirmed=${res.confirmed}`,
+    );
+  }
+  console.log("─".repeat(96));
+  console.log(
+    `scanned ${scanned} · claims ${claims} · with-proof ${proofs} · live-fail ${liveFail} · harness ${harness} · disagree ${disagree} · unknown ${unknown}`,
+  );
+  console.log(`CONFIRMED CODEX CATCHES (must hand-audit → gate = ZERO false): ${confirmed}`);
+  for (const c of catches) {
+    console.log("  ── catch ──");
+    console.log(`    file:  ${c.f}`);
+    console.log(`    claim: ${String(c.res.claim_text || "").slice(0, 88)}`);
+    console.log(`    proof: ${c.res.proof_command}`);
+    console.log(
+      `    recorded exit: ${c.res.recorded_exit_code}  ·  live outcome: ${c.res.outcome}  ·  agree: ${c.res.agreement}`,
+    );
+    console.log(`    evidence: ${String(c.res.evidence || "").slice(0, 120)}`);
+  }
+  console.log("═".repeat(96));
+  return { scanned, claims, proofs, liveFail, harness, disagree, unknown, confirmed, catches };
+}
+
 // Robust main detection (mirrors verify-shadow.mjs / skalpel-setup.mjs): compare REAL paths via
 // realpathSync, not a hand-built path.resolve(url.pathname). On Windows, `new URL(import.meta.url)
 // .pathname` yields "/C:/Users/..." (a leading slash BEFORE the drive letter); path.resolve() on that
@@ -1537,16 +1834,32 @@ if (isMain) {
         console.error(String((e && e.stack) || e));
         process.exit(1);
       });
+  } else if (a0 === "--codex-selftest") {
+    // CODEX LIVE-CATCH publish gate — the hermetic recorded-exit-agreement fixture corpus.
+    runCodexSelfTests()
+      .then((ok) => process.exit(ok ? 0 : 1))
+      .catch((e) => {
+        console.error(String((e && e.stack) || e));
+        process.exit(1);
+      });
+  } else if (a0 === "--codex-replay") {
+    // CODEX real-history audit — replay the live worker over ~/.codex (or a given dir). Hand-audit output.
+    runCodexReplay(process.argv[3] || null)
+      .then(() => process.exit(0))
+      .catch((e) => {
+        console.error(String((e && e.stack) || e));
+        process.exit(1);
+      });
   } else if (a0 === "--selftest") {
-    // `--selftest` now covers BOTH the intervention machinery AND the ship-status v1 corpus.
+    // `--selftest` now covers the intervention machinery, the ship-status v1 corpus, AND the Codex corpus.
     try {
       runSelfTests();
     } catch (e) {
       console.error(String((e && e.stack) || e));
       process.exit(1);
     }
-    runShipSelfTests()
-      .then((ok) => process.exit(ok ? 0 : 1))
+    Promise.all([runShipSelfTests(), runCodexSelfTests()])
+      .then((oks) => process.exit(oks.every(Boolean) ? 0 : 1))
       .catch((e) => {
         console.error(String((e && e.stack) || e));
         process.exit(1);

package/first-run.mjs

@@ -20,7 +20,7 @@
 //     recorded output tail, the recorded non-zero exit code, real timestamps). No invented minutes.
 //
 // REUSE: the detection + classification ENGINE is verify-shadow's / catches.mjs's, imported unedited —
-//   loadClaudeEntries / loadCodexEntries (catches.mjs) normalize both transcript shapes; detectCompletionClaim,
+//   loadClaudeEntries (catches.mjs) / loadCodexEntries (codex-normalize.mjs) normalize both transcript shapes; detectCompletionClaim,
 //   reconstructProofEntry, classifyOutcome, extractFailCount (verify-shadow.mjs) do claim + proof + verdict.
 // We run a FIRST-RUN-specific loop over those primitives (rather than calling runScan) because the first-run
 // profile (newest ~150 sessions, HARD ~3s budget, a live progress line) and the strict precision gate need
@@ -40,7 +40,10 @@ import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { realpathSync } from "node:fs";
-import { loadClaudeEntries, loadCodexEntries } from "./catches.mjs";
+import { loadClaudeEntries } from "./catches.mjs";
+// ONE normalizer, never two: loadCodexEntries now lives in codex-normalize.mjs (shared with the live
+// verify-shadow worker + the retroactive catches scan). Imported from the canonical source here.
+import { loadCodexEntries } from "./codex-normalize.mjs";
 import {
   detectCompletionClaim,
   reconstructProofEntry,

package/install.mjs

@@ -55,6 +55,7 @@ const RUNTIME_FILES = [
   "insights.mjs", // hooks + statusline + reveal + verify-shadow import ./insights.mjs
   "reveal.mjs", // both prompt/session hooks import ./reveal.mjs
   "transcript.mjs", // skalpel-hook + skalpel-statusline + verify-shadow import ./transcript.mjs (tailLines)
+  "codex-normalize.mjs", // verify-shadow.mjs (staged worker) imports ./codex-normalize.mjs — Codex rollout → Claude-shape normalizer (imports ./transcript.mjs)
   "skalpel-hook.mjs", // UserPromptSubmit entrypoint (wired)
   "skalpel-hook-session.mjs", // SessionStart entrypoint (wired)
   "incremental-ingest.mjs", // skalpel-hook-session-end.mjs imports ./incremental-ingest.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.46",
+  "version": "4.0.47",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/verify-shadow.mjs

@@ -98,6 +98,17 @@ import {
   shipProbeFamily,
   SHIP_KIND_PROBE,
 } from "./anchor-shadow.mjs";
+// CODEX LIVE-CATCH PARITY: the ONE shared Codex-rollout normalizer (also used by the retroactive
+// `skalpel catches` scanner). It translates a Codex rollout into the SAME Claude-shaped entries the whole
+// engine below already speaks, and carries Codex's OWN recorded exit code onto each tool_result so the live
+// worker can corroborate a re-run against it (the Codex precision lever). Staged next to this worker by
+// install.mjs so the detached HOOKS_DIR copy can import it.
+import {
+  isCodexRollout,
+  loadCodexEntries,
+  newestCodexRollout,
+  recordedExitFor,
+} from "./codex-normalize.mjs";
 
 const DIR = join(homedir(), ".skalpel");
 export const VERIFY_LOG_PATH = join(DIR, "verify-shadow.log");
@@ -121,6 +132,15 @@ const CLASSIFY_TAIL_BYTES = 4000;
 const TRANSCRIPT_TAIL_BYTES = 2 * 1024 * 1024;
 const LOCK_STALE_MS = 90_000;
 
+// CODEX REVEAL GATE (dark-ship kill switch). A Codex catch is ALWAYS logged under the shadow, but the
+// user-visible RED reveal for a Codex session is additionally gated here. It was flipped ON only AFTER the
+// real-history audit (eval-harness `--codex-replay` over this machine's ~/.codex history, every catch
+// hand-audited → ZERO false catches; `--codex-selftest` 3/3). The recorded-exit-code agreement below makes
+// a Codex catch strictly more precision-gated than a Claude one; this constant is the belt-and-suspenders
+// switch on top of that + the arming resolver (revealEnabled), so with the arming flag OFF (every real
+// install) the whole feature stays byte-identical-dark regardless of this value.
+const CODEX_REVEAL_ENABLED = true;
+
 // ======================= (1) completion-claim detection =======================
 // A deliberately broad lexicon: this is an INSTRUMENT, and the MISMATCH metric is computed only among
 // turns where a proof actually re-ran, so a loose claim match cannot fabricate a "lie" — it can only
@@ -627,6 +647,42 @@ export function classifyConfirm(firstOutcome, confirmOutcome) {
   return { needsConfirm, confirmedFail, unconfirmedFail };
 }
 
+// ======================= (2c) Codex precision lever (recorded-exit-code agreement) =======================
+// A Codex rollout records the REAL exit code of every command Codex ran. So on top of the SAME 2/2 flake-
+// confirm every catch already clears, a Codex catch demands one more corroboration: the LIVE re-run's
+// confirmed fail must AGREE with Codex's OWN recorded run of that exact command (it too exited non-zero).
+//   • "agree"    — recorded exit is a real non-zero → Codex's own run failed too → the "done" was a lie.
+//   • "disagree" — recorded exit 0 → Codex's run PASSED; our re-run fails only now → environment/flake drift,
+//                  NOT a claim-time lie → SUPPRESS.
+//   • "unknown"  — no recorded exit (sandbox/harness "CreateProcess failed", missing wrapper) → can't
+//                  corroborate → SUPPRESS.
+//   • "n/a"      — the live re-run was not a confirmed 2/2 fail, so agreement is moot.
+// Only "agree" is ever surfaced → a Codex catch is strictly MORE precision-gated than a Claude one. Pure.
+export function codexAgreement(confirmedFail, recordedExitCode) {
+  if (!confirmedFail) return "n/a";
+  if (typeof recordedExitCode === "number" && recordedExitCode !== 0) return "agree";
+  if (recordedExitCode === 0) return "disagree";
+  return "unknown";
+}
+
+// assembleCodexVerdict({outcome, confirmOutcome, recorded}) → the ONE place the Codex catch decision lives
+// (shared by the live worker AND the audit harness so they can never drift). Combines the 2/2 flake-confirm
+// with the recorded-exit agreement. `confirmed` is the only state that may surface a red; every other fail
+// bucket (un-reproduced flake, recorded disagreement, recorded unknown) is logged-not-shown. Pure + total.
+export function assembleCodexVerdict({ outcome, confirmOutcome, recorded }) {
+  const { confirmedFail, unconfirmedFail } = classifyConfirm(outcome, confirmOutcome);
+  const recordedExit = recorded && typeof recorded.exitCode === "number" ? recorded.exitCode : null;
+  const agreement = codexAgreement(confirmedFail, recordedExit);
+  const confirmed = confirmedFail && agreement === "agree";
+  return {
+    confirmedFail,
+    agreement,
+    confirmed,
+    // recorded a suppressed fail (flake OR recorded-exit disagreement/unknown) for the instrument — never shown.
+    unconfirmed_fail: unconfirmedFail || (confirmedFail && !confirmed),
+  };
+}
+
 // ======================= (3) re-run the proof =======================
 // rerunProof({cmd,args,cwd}) -> Promise<{ pass, outcome, evidence, refused? }>
 // outcome ∈ {PASS, GENUINE_FAIL, HARNESS_ERROR, REFUSED}. execFile with an ARGUMENT ARRAY and NO shell.
@@ -701,8 +757,15 @@ export function rerunProof({ cmd, args, cwd }) {
 }
 
 // ======================= (4) wire it: shadow-log a claim turn =======================
+// readEntries(transcriptPath) → the session's entries in the CLAUDE shape. A Codex rollout (path under
+// ~/.codex or a `rollout-*.jsonl` file) is routed through the shared normalizer so it comes back Claude-
+// native — every downstream function (claim detection, proof reconstruction, allowlist, classifyOutcome,
+// strict kind↔probe) is then unchanged. A Claude transcript takes the original tail-parse path, byte for
+// byte. Fail-open on any error → [].
 function readEntries(transcriptPath) {
   try {
+    if (isCodexRollout(transcriptPath))
+      return loadCodexEntries(transcriptPath, TRANSCRIPT_TAIL_BYTES);
     const lines = tailLines(transcriptPath, TRANSCRIPT_TAIL_BYTES);
     const entries = [];
     for (const line of lines) {
@@ -1397,11 +1460,166 @@ async function maybeShipStatusCatch({ text, session, cwd, transcriptPath }) {
   }
 }
 
+// resolveCodexRollout(transcriptPath) → the ACTUAL Codex rollout file to read for THIS turn, or null if
+// this is not a Codex session. The trigger is a PER-SESSION signal from the transcript PATH itself
+// (isCodexRollout: a `rollout-*.jsonl` name, or a path under ~/.codex / $CODEX_HOME) — NEVER the mere
+// presence of $CODEX_HOME in the environment, which would wrongly hijack a CLAUDE session for any user who
+// exports CODEX_HOME globally. If the path is a usable rollout FILE we read it directly; (#6) if it's a
+// Codex context but not a readable rollout (a dir, a session-id path, a non-rollout .codex file) we resolve
+// the NEWEST rollout ourselves — entirely inside this worker, so skalpel-hook.mjs stays untouched.
+// Fail-open → null (→ the Claude path below runs, byte-for-byte unchanged).
+function resolveCodexRollout(transcriptPath) {
+  try {
+    if (!isCodexRollout(transcriptPath)) return null; // not a Codex session → Claude path, unchanged
+    const base = String(transcriptPath).split(/[/\\]/).pop() || "";
+    if (/^rollout-.*\.jsonl$/.test(base)) {
+      try {
+        if (statSync(transcriptPath).isFile()) return transcriptPath; // the handed rollout file, directly
+      } catch {
+        /* named like a rollout but not a readable file — fall through to the newest-rollout resolve */
+      }
+    }
+    return newestCodexRollout(); // #6: a Codex context but no directly-usable rollout → newest rollout
+  } catch {
+    return null;
+  }
+}
+
+// evaluateCodexProof(entries, cwd, rerun=rerunProof) → the PURE Codex catch decision: claim → reconstruct
+// the session's OWN proof → re-run (2/2 flake-confirm) → corroborate against Codex's recorded exit code.
+// No lock, no logging, no reveal — `rerun` is injected so the audit harness can drive every branch
+// hermetically (and the real-history replay uses the real rerunProof). Never throws (rerun is fail-open).
+export async function evaluateCodexProof(entries, cwd, rerun = rerunProof) {
+  const assistantText = lastAssistantText(entries);
+  const { claim, text } = detectCompletionClaim(assistantText);
+  if (!claim) return { claim: false };
+  const found = reconstructProofEntry(entries, cwd);
+  const proof = found ? found.proof : null;
+  if (!proof) return { claim: true, claim_text: text, proof: null };
+  const result = await rerun(proof);
+  const outcome = result.outcome || (result.pass ? "PASS" : "GENUINE_FAIL");
+  // 2/2 flake-confirm: only re-run a SECOND time on a first GENUINE_FAIL (mirrors the Claude live path).
+  const confirm = outcome === "GENUINE_FAIL" ? await rerun(proof) : null;
+  const confirmOutcome = confirm
+    ? confirm.outcome || (confirm.pass ? "PASS" : "GENUINE_FAIL")
+    : null;
+  const recorded = recordedExitFor(entries, found.toolUseId);
+  const v = assembleCodexVerdict({ outcome, confirmOutcome, recorded });
+  return {
+    claim: true,
+    claim_text: text,
+    proof,
+    proof_command: [proof.cmd, ...proof.args].join(" ").slice(0, 200),
+    toolUseId: found.toolUseId,
+    outcome,
+    confirm_outcome: confirmOutcome,
+    recorded_exit_code: recorded.exitCode,
+    agreement: v.agreement,
+    confirmed: v.confirmed,
+    unconfirmed_fail: v.unconfirmed_fail,
+    evidence: String(result.evidence || "").slice(0, 200),
+  };
+}
+
+// recordVerifyShadowCodex({rolloutPath, session, cwd}) — the Codex LIVE test-proof catch. Mirrors the Claude
+// test path (claim → reconstruct proof → re-run → 2/2 flake-confirm) and ADDS the recorded-exit agreement
+// gate. Logs one `harness:"codex"` shadow row; surfaces a red ONLY on a confirmed+agreeing catch (and only
+// when the Codex reveal gate + arming resolver are on). Ship-status is intentionally NOT run for Codex here:
+// the recorded-exit lever has no probe analogue and routing raw rollout text through the URL/PR miner is
+// unproven — honest silence beats a possible false ship-red. LOG ONLY otherwise; never injects, never throws.
+async function recordVerifyShadowCodex({ rolloutPath, session, cwd }) {
+  try {
+    const entries = readEntries(rolloutPath); // normalized Claude shape (Codex detected inside readEntries)
+    if (!entries.length) return;
+    const { claim, text } = detectCompletionClaim(lastAssistantText(entries));
+    if (!claim) return; // no claim this turn → nothing to verify
+    const sig = `codex|${session || ""}|${djb2(text)}`;
+    if (alreadyVerified(sig)) return;
+    const found = reconstructProofEntry(entries, cwd);
+    const proof = found ? found.proof : null;
+    if (!proof) {
+      markVerified(sig);
+      appendShadowLog({
+        ts: new Date().toISOString(),
+        session: session || null,
+        harness: "codex",
+        claim_text: text,
+        proof_command: null,
+        pass_fail: null,
+        mismatch: false,
+        evidence: "",
+      });
+      return;
+    }
+    // A proof exists → re-run it (single-flight, shared with the Claude/ship paths). touchLock refreshes our
+    // own lock mtime between the two 2/2 re-runs so it isn't read as stale mid-confirm.
+    if (!acquireLock()) return;
+    let result;
+    let confirm = null;
+    try {
+      result = await rerunProof(proof);
+      if ((result.outcome || (result.pass ? "PASS" : "GENUINE_FAIL")) === "GENUINE_FAIL") {
+        touchLock();
+        confirm = await rerunProof(proof);
+      }
+    } finally {
+      releaseLock();
+    }
+    markVerified(sig);
+    const outcome = result.outcome || (result.pass ? "PASS" : "GENUINE_FAIL");
+    const confirmOutcome = confirm
+      ? confirm.outcome || (confirm.pass ? "PASS" : "GENUINE_FAIL")
+      : null;
+    const recorded = recordedExitFor(entries, found.toolUseId);
+    const v = assembleCodexVerdict({ outcome, confirmOutcome, recorded });
+    const pass_fail =
+      outcome === "PASS" ? "PASS" : outcome === "GENUINE_FAIL" ? "FAIL" : "HARNESS_ERROR";
+    const row = {
+      ts: new Date().toISOString(),
+      session: session || null,
+      harness: "codex",
+      claim_text: text,
+      proof_command: [proof.cmd, ...proof.args].join(" ").slice(0, 200),
+      pass_fail,
+      outcome,
+      confirm_outcome: confirmOutcome,
+      // Codex's OWN recorded exit for this exact command — the corroboration the reveal requires.
+      recorded_exit_code: recorded.exitCode,
+      codex_agreement: v.agreement,
+      // THE money metric for Codex: 2/2 live GENUINE_FAIL AND recorded-exit agreement.
+      mismatch: v.confirmed,
+      // logged-not-shown: a flake OR a recorded-exit disagreement/unknown.
+      unconfirmed_fail: v.unconfirmed_fail,
+      evidence: String(result.evidence || "").slice(0, 200),
+    };
+    appendShadowLog(row);
+    // Surface a red ONLY on a confirmed+agreeing Codex catch, and only when the Codex reveal gate is on.
+    // maybeSurfaceReveal still enforces the arming resolver + suppression + auto-darken, so this stays
+    // byte-identical-dark by default. A corroborated PASS retracts any stale Codex red (no green verdict in
+    // v1 — the earned-green surface stays Claude-only).
+    if (v.confirmed && CODEX_REVEAL_ENABLED) {
+      maybeSurfaceReveal(row);
+    } else if (outcome === "PASS" && recorded.exitCode === 0 && revealEnabled(process.env)) {
+      clearReveal(session || null);
+    }
+  } catch {
+    /* SHADOW: any failure is swallowed — this must never affect the hook or the turn */
+  }
+}
+
 // recordVerifyShadow({transcriptPath, session, cwd}) — the wired entry. On (claim + reconstructable
 // proof) it re-runs the proof and appends one shadow row. LOG ONLY. Never injects, never throws.
 export async function recordVerifyShadow({ transcriptPath, session, cwd }) {
   try {
     if (!transcriptPath) return;
+    // CODEX LIVE-CATCH PARITY: a Codex session takes its own precision-gated path (recorded-exit agreement)
+    // and returns; the Claude path below is unchanged. resolveCodexRollout also covers the #6 fallback
+    // (resolve the newest ~/.codex rollout when the handed path isn't a usable rollout) — hook untouched.
+    const codexRollout = resolveCodexRollout(transcriptPath);
+    if (codexRollout) {
+      await recordVerifyShadowCodex({ rolloutPath: codexRollout, session, cwd });
+      return;
+    }
     const entries = readEntries(transcriptPath);
     if (!entries.length) return;
     const assistantText = lastAssistantText(entries);
@@ -1515,8 +1733,11 @@ export function renderVerifyReport() {
   // The test-proof instrument counts ONLY test rows (no `category`). Ship-status rows (category:"ship")
   // are a separate proof-category with their own probe verbs, reported in their own section below — so
   // adding them never perturbs the pre-existing test numbers on old logs.
-  const testRows = rows.filter((r) => r.category !== "ship");
+  // Codex catch rows carry `harness:"codex"` and get their OWN section below — excluded here so they never
+  // perturb the Claude test numbers (a pure-Claude log has no such rows → this filter is a no-op there).
+  const testRows = rows.filter((r) => r.category !== "ship" && r.harness !== "codex");
   const shipRows = rows.filter((r) => r.category === "ship");
+  const codexRows = rows.filter((r) => r.harness === "codex");
 
   const claims = testRows.length;
   const withProof = testRows.filter((r) => r.proof_command).length;
@@ -1651,6 +1872,47 @@ export function renderVerifyReport() {
     }
   }
 
+  // CODEX LIVE-CATCH PARITY — the test-proof catch over a Codex session. Same 2/2 flake-confirm as Claude
+  // PLUS a recorded-exit-code agreement gate (a live fail is a catch ONLY when Codex's OWN recorded run of
+  // that command also failed), so a Codex catch is strictly more precision-gated. Its own section so it
+  // never perturbs the Claude test numbers above.
+  if (codexRows.length) {
+    const cReran = codexRows.filter((r) => r.pass_fail === "PASS" || r.pass_fail === "FAIL").length;
+    const cWithProof = codexRows.filter((r) => r.proof_command).length;
+    const cCaught = codexRows.filter((r) => r.mismatch === true).length;
+    const cSuppressed = codexRows.filter((r) => r.unconfirmed_fail === true).length;
+    const cDisagree = codexRows.filter((r) => r.codex_agreement === "disagree").length;
+    const cUnknown = codexRows.filter((r) => r.codex_agreement === "unknown").length;
+    L.push("");
+    L.push("─".repeat(72));
+    L.push("  CODEX catch (Codex session · 2/2 flake-confirm + recorded-exit-code agreement)");
+    L.push(`  codex claims logged                ${codexRows.length}`);
+    L.push(
+      `  (C1) proof-reconstruction rate     ${pct(cWithProof, codexRows.length)}   ${cWithProof}/${codexRows.length} claims had a re-runnable proof`,
+    );
+    L.push(
+      `  (C2) CODEX-MISMATCH rate           ${pct(cCaught, cReran)}   ${cCaught}/${cReran} re-run proofs failed 2/2 AND agreed with Codex's recorded exit`,
+    );
+    L.push(
+      `      (suppressed: ${cSuppressed} fail(s) never shown — ${cDisagree} recorded-exit disagreement + ${cUnknown} unknown + flakes)`,
+    );
+    const recentCodex = codexRows
+      .filter((r) => r.mismatch)
+      .slice(-3)
+      .reverse();
+    if (recentCodex.length) {
+      L.push("");
+      L.push("  recent codex catches:");
+      for (const r of recentCodex) {
+        L.push(`    • claim: ${String(r.claim_text || "").slice(0, 68)}`);
+        L.push(
+          `      proof: ${String(r.proof_command || "").slice(0, 68)}  → FAIL (recorded exit ${r.recorded_exit_code})`,
+        );
+        if (r.evidence) L.push(`      ${String(r.evidence).slice(0, 68)}`);
+      }
+    }
+  }
+
   for (const l of fieldProofLines(mismatches)) L.push(l);
 
   L.push("");