stacktrace-cli 0.13.0__py3-none-any.whl → 0.15.0__py3-none-any.whl

stacktrace/__init__.py

@@ -2,7 +2,7 @@
 
 import logging as _logging
 
-__version__ = "0.13.0"
+__version__ = "0.15.0"
 
 # Only the daemon attaches a handler (ADR-0048). Without this one, a WARNING
 # logged in any other process would reach Python's last-resort handler and

stacktrace/cost/measures.py

@@ -127,8 +127,8 @@ def repeats(
     most repeated first.
 
     A call that recorded a failure takes no part in any cost measure
-    (cost-phase-1 §1): a denied one reached nothing, and a failing one is
-    `tool-retry-storm`'s. A call in `skip` was already cited by another rule.
+    (cost-phase-1 §1): a denied one reached nothing, and a failing one returned
+    no result to repeat. A call in `skip` was already cited by another rule.
     """
     seen: dict[tuple[str | None, str, str, str], list[ToolCallLike]] = {}
     for call in calls:

stacktrace/cost/rules.py

@@ -244,7 +244,7 @@ class Context:
     zone: tzinfo
     snapshot: Snapshot | None = None
     #: Spans another rule already cited, which the repeats reason leaves out
-    #: (`tool-retry-storm`, `blocked-*`): one event is never reported twice.
+    #: (`blocked-*`): one event is never reported twice.
     cited: frozenset[str] = frozenset()
     #: What correlation placed each call on, by span. A call it does not name
     #: gets a label of ours (`cost/components.py`).

stacktrace/daemon/config.py

@@ -32,6 +32,10 @@ SETTINGS: tuple[tuple[str, str, str], ...] = (
     # already inherits TYPESAFE_API_KEY -- by setting the environment
     # variable before forking, not by re-typing the flag.
     ("reasoning", "STACKTRACE_REASONING", "false"),
+    # ADR-0151: off unless a gateway on this host asks the daemon. Set only
+    # through the environment; `daemon run` gains no flag for it.
+    ("gateway_listen", "STACKTRACE_GATEWAY_LISTEN", "off"),
+    ("gateway_mode", "STACKTRACE_GATEWAY_MODE", "enforce"),
 )
 
 _UNITS: dict[str, int] = {"s": 1, "m": 60, "h": 3600, "d": 86400}
@@ -131,6 +135,22 @@ def parse_reasoning(value: str) -> bool:
     return normalized == "true"
 
 
+def parse_listen(value: str) -> tuple[str, int] | None:
+    """`off`, or `host:port` for the gateway listener (ADR-0151)."""
+    if value == "off":
+        return None
+    host, _, port = value.rpartition(":")
+    if not host or not port.isdigit() or not 0 <= int(port) <= 65535:
+        raise ValueError(f"gateway listen address must be 'off' or host:port, not {value!r}")
+    return host, int(port)
+
+
+def parse_gateway_mode(value: str) -> str:
+    if value not in ("enforce", "observe"):
+        raise ValueError(f"gateway mode must be 'enforce' or 'observe', not {value!r}")
+    return value
+
+
 @dataclass(frozen=True)
 class Setting:
     """One resolved value, the text it was resolved from, and where that came from."""
@@ -150,6 +170,8 @@ class DaemonConfig:
     webhook_interval: Setting
     bom_interval: Setting
     reasoning: Setting
+    gateway_listen: Setting
+    gateway_mode: Setting
 
     @property
     def scan_interval_seconds(self) -> float:
@@ -249,6 +271,8 @@ class DaemonConfig:
             "webhook_interval": webhook_interval,
             "bom_interval": bom_interval,
             "reasoning": None if reasoning is None else ("true" if reasoning else "false"),
+            "gateway_listen": None,
+            "gateway_mode": None,
         }
         resolved: dict[str, Setting] = {}
         for name, variable, default in SETTINGS:
@@ -274,6 +298,8 @@ class DaemonConfig:
             config.webhook_interval_seconds,
             config.bom_interval_seconds,
             config.reasoning_enabled,
+            parse_listen(config.gateway_listen.value),
+            parse_gateway_mode(config.gateway_mode.value),
         )
         if not config.kinds:
             raise ValueError("--agent-kind must name at least one agent kind")

stacktrace/daemon/costs.py

@@ -460,9 +460,9 @@ def summaries_from_rows(rows: Iterable[Mapping[str, Any]]) -> list[Summary]:
     ]
 
 
-#: Rules whose citations the repeats reason leaves out: `tool-retry-storm` and
-#: every `blocked-*` rule, which together are the reliability family. One
-#: event, one report (cost-phase-1 §1).
+#: Rules whose citations the repeats reason leaves out: every `blocked-*` rule,
+#: which together are the reliability family. One event, one report
+#: (cost-phase-1 §1).
 _LOOP_CITERS = RELIABILITY_RULES
 
 
@@ -651,7 +651,7 @@ class CostPass:
         self._log(misses)
 
     def _cited(self, runs: Sequence[Run[Any]]) -> frozenset[str]:
-        """Spans `tool-retry-storm` and the `blocked-*` rules cite, which the
+        """Spans the `blocked-*` rules cite, which the
         repeats reason leaves out: worked out from each changed session this
         tick, and whatever the store already holds for each run's main
         session."""

stacktrace/daemon/fleet.py

@@ -24,6 +24,7 @@ from contextlib import suppress
 from dataclasses import dataclass
 from datetime import UTC, datetime
 from typing import Any, Protocol
+from urllib.parse import urlsplit
 
 import httpx
 
@@ -156,6 +157,17 @@ class DrainReport:
     stopped: str | None = None
 
 
+def _console_origin(url: object) -> str | None:
+    """The scheme and host of Fleet's `dashboard_url`, or None for anything
+    that is not an http(s) URL with a host."""
+    if not isinstance(url, str):
+        return None
+    parts = urlsplit(url)
+    if parts.scheme not in ("http", "https") or not parts.netloc:
+        return None
+    return f"{parts.scheme}://{parts.netloc}"
+
+
 class FleetSubscriber:
     """Drain `records` by cursor, one request per agent kind."""
 
@@ -223,6 +235,7 @@ class FleetSubscriber:
         config = load_remote_config(config_path)
         if config.token is None:
             self.store.clear_cursors()
+            self.store.clear_fleet_console()
             return DrainReport(stopped="not configured")
         if not self.store.has_queued_rows():
             # `partitions()` stays non-empty long after its backlog has fully
@@ -247,6 +260,7 @@ class FleetSubscriber:
             config = load_remote_config(config_path)
             if config.token is None:
                 self.store.clear_cursors()
+                self.store.clear_fleet_console()
                 return DrainReport(stopped="not configured")
             token = config.token
             config = _recover_interrupted_asset_transition(config=config, config_path=config_path)
@@ -272,6 +286,11 @@ class FleetSubscriber:
             if asset_id != config.asset_id:
                 # No separate lock needed — this whole span already holds it.
                 _advance_asset_id(config=config, config_path=config_path, asset_id=asset_id)
+                # A new asset id means a new registration — first-ever, or a
+                # tenant switch — and either way any cached console address
+                # named a prior tenant's Fleet. The next successful upload
+                # replaces it; until then, no webhook alert should link to one.
+                self.store.clear_fleet_console()
 
             uploaded = 0
             parked = 0
@@ -388,7 +407,10 @@ class FleetSubscriber:
             self._run_names[run_id] = self.store.run_names(agent_kind, run_id)
         names = self._run_names[run_id]
         if names is None:
-            return None, None, None, None
+            # A gateway run has no usage row; its finding names the account
+            # the gateway verified, whose card the store keeps (ADR-0153).
+            account = session.get("account") if isinstance(session, dict) else None
+            return None, None, account if isinstance(account, str) and account else None, None
         signed = self._signed_in
         same = signed is not None and names.account is not None and names.account == signed[0]
         person = signed[1] if same and signed is not None else None
@@ -602,6 +624,12 @@ class FleetSubscriber:
         except RemoteClientError as error:
             raise DrainStopped(f"upload rejected: {error}") from error
         else:
+            # Where Fleet's console is, for the link a webhook alert carries
+            # (ADR-0147). Fleet names it on every upload; the origin is all
+            # that is kept.
+            origin = _console_origin(getattr(result, "dashboard_url", None))
+            if origin is not None:
+                self.store.set_fleet_console(origin)
             sent = len(payload["detections"])
             kept = int(getattr(result, "detections_ingested", sent))
             if kept < sent:

stacktrace/daemon/gateway.py

@@ -0,0 +1,153 @@
+"""The daemon's gateway listener: ADR-0119's contract, answered by the daemon (ADR-0151).
+
+A gateway on this host (the LiteLLM guardrail, the Envoy Lua filter) asks the
+same `/v1/evaluate` and `/v1/observe` it asks `stacktrace guard serve`. The
+rules, the fail-open behaviour and the reply are the guard's own. What changes
+is where a finding goes: into the daemon's `FindingStore`, so the Fleet drain
+uploads it and the notification sinks hear of it, as for a transcript finding.
+
+Off unless `STACKTRACE_GATEWAY_LISTEN` names an address. The private Unix
+socket and its `authorize` message are untouched: a gateway turn is far larger
+than that socket's frame and carries the arguments its contract excludes.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from collections.abc import Callable
+from datetime import UTC, datetime
+from http.server import ThreadingHTTPServer
+
+from stacktrace.cost.usage import AccountCard
+from stacktrace.detector.finding import Detection
+from stacktrace.detector.render import detection_json
+from stacktrace.gateway.analyzer import PolicyCheck
+from stacktrace.gateway.principal import Principal, session_key_id
+from stacktrace.gateway.service import Guard, loopback, make_server, serve_in_thread
+from stacktrace.gateway.sink import Recorder, Stamp
+
+from .accounts import email_digest
+from .config import DaemonConfig, parse_listen
+from .store import FindingStore, Notification, SessionKey
+from .usage import person_name
+
+__all__ = ["parse_listen", "start_gateway"]
+
+logger = logging.getLogger(__name__)
+
+
+class _LogSink:
+    """Verdict, fallback and call records go to the daemon's log; they are content-free."""
+
+    def write(self, record: dict[str, object]) -> None:
+        logger.info("gateway %s", json.dumps(record))
+
+
+def _qualify_spans(payload: dict[str, object], agent_kind: str, bare: str, keyed: str) -> str:
+    """Rename the client's bare session to `agent_kind:keyed` everywhere the finding names it.
+
+    Fleet refuses a finding whose evidence span, or whose target's session or
+    span, addresses another session than its own, so renaming only
+    `session.session_id` costs every gateway finding a 422.
+    """
+    qualified = f"{agent_kind}:{keyed}"
+
+    def span(value: object) -> object:
+        if isinstance(value, str) and value.rsplit(":", 2)[0] == bare:
+            return qualified + value[len(bare) :]
+        return value
+
+    for key in ("evidence", "finding_targets"):
+        rows = payload.get(key)
+        for row in rows if isinstance(rows, list) else ():
+            if not isinstance(row, dict):
+                continue
+            if "span" in row:
+                row["span"] = span(row["span"])
+            if row.get("session_id") == bare:
+                row["session_id"] = qualified
+    return qualified
+
+
+def _card(principal: Principal) -> AccountCard:
+    """The card a gateway principal travels with (ADR-0153). An email keeps
+    ADR-0112's digest and name, so its person key is a laptop run's; any
+    other id has no address, so no key and no name."""
+    email = principal.email()
+    name = person_name(None, email)
+    return AccountCard(
+        account=principal.account_id(),
+        email_digest=email_digest(email),
+        display_name=name,
+        plan=None,
+        seen_at=datetime.now(UTC).isoformat(),
+        name_from="email" if name else None,
+    )
+
+
+def _store_finding(
+    store: FindingStore,
+    publish: Callable[[Notification], None],
+    on_commit: Callable[[], None],
+) -> Callable[[Detection, Stamp], None]:
+    def write(detection: Detection, stamp: Stamp) -> None:
+        kind = detection.session.agent_kind
+        # Keyed by agent kind, session id and principal (ADR-0151), so two
+        # people's sessions never merge in the store or in Fleet.
+        session = SessionKey(kind, session_key_id(detection.session.session_id, stamp.principal))
+        payload = detection_json(detection)
+        # The store names a session by the qualified id a transcript's
+        # findings carry; a gateway session's id is the client's bare one.
+        document = payload["session"]
+        assert isinstance(document, dict)
+        document["session_id"] = _qualify_spans(
+            payload, kind, detection.session.session_id, session.session_id
+        )
+        payload["actor"] = stamp.actor
+        payload["action"] = stamp.action
+        payload["decided_by"] = stamp.decided_by
+        if stamp.principal is not None:
+            # The run's account and its card, as a laptop run's sign-in has
+            # them, so Fleet names the person with no new field (ADR-0153).
+            document["account"] = stamp.principal.account_id()
+            store.put_account_card(kind, _card(stamp.principal))
+        notifications = store.record(session, (payload,), underbuilt=None)
+        # As a scan commit does, so the finding leaves before the next drain interval.
+        on_commit()
+        for notification in notifications:
+            publish(notification)
+
+    return write
+
+
+def start_gateway(
+    config: DaemonConfig,
+    store: FindingStore,
+    publish: Callable[[Notification], None],
+    *,
+    token: str | None = None,
+    on_commit: Callable[[], None] = lambda: None,
+    policy: PolicyCheck | None = None,
+) -> ThreadingHTTPServer | None:
+    """Serve the guard contract on the configured address, or nothing when it is off."""
+    address = parse_listen(config.gateway_listen.value)
+    if address is None:
+        return None
+    if token is None and not loopback(address[0]):
+        logger.error("gateway listener not started: %s needs STACKTRACE_GUARD_TOKEN", address[0])
+        return None
+    mode = "observe" if config.gateway_mode.value == "observe" else "enforce"
+    recorder = Recorder(
+        [_LogSink()], on_finding=_store_finding(store, publish, on_commit), verdicts=True
+    )
+    try:
+        server = make_server(Guard(recorder=recorder, mode=mode, policy=policy), *address, token)
+    except OSError as error:
+        # The gateway fails open without us; scans and hooks must not stop too.
+        logger.error("gateway listener not started on %s:%s: %s", *address, error)
+        return None
+    serve_in_thread(server)
+    host, port = server.server_address[:2]
+    logger.info("gateway listener: %s on %s:%s", mode, host, port)
+    return server

stacktrace/daemon/gateway_policy.py

@@ -0,0 +1,161 @@
+"""Fleet policy at the gateway: the calls in a model response, judged by name (ADR-0151).
+
+The hook path resolves a component from local evidence. A gateway sees only the
+names the model sees, so this maps each pending call to a policy subject by
+name, through each agent kind's own naming map, and asks the same `decide`
+the hook path asks for a subject it could not resolve.
+
+- A plugin the policy names by `plugin@marketplace` matches its name alone:
+  the gateway sees no marketplace. A name both allowed and blocked is
+  ambiguous and is not blocked (ADR-0135 decision 4).
+- An MCP server rule names a command or a URL, never a name, so no MCP server
+  rule matches at the gateway. Only its category default can.
+- A subject the policy does not name passes, unless the organization turned
+  category defaults on for gateways.
+- No policy, or one older than its time to live, passes and is a fallback.
+
+Matching by name lets a server renamed in the user's own configuration pass.
+The hooks stay the authority for components; this is the backstop.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+
+from stacktrace.gateway.analyzer import PolicyVerdict
+from stacktrace.hooks.claude import policy_message
+from stacktrace.policy_display import policy_rows
+from stacktrace.sessions.access import GatewayToolCall
+
+# `Policy` through the runtime, which is this package's one OpenACA policy importer.
+from .policy_runtime import REFRESH_INTERVAL, Policy, PolicyRuntime, Result, Subject, decide
+
+#: How old a fetched policy may be before the gateway stops enforcing it. The
+#: daemon polls Fleet at most every 60 s; an hour is the hook path's evidence
+#: refresh interval, so both paths stop trusting what they hold together.
+POLICY_TTL_S = REFRESH_INTERVAL
+
+#: The gateway cannot see which of user, project or local configured a server.
+#: All three are standalone servers under `admission.mcps`, so this one selects
+#: the same category default as the others.
+_STANDALONE = "user"
+
+
+@dataclass(frozen=True)
+class Inputs:
+    """The policy as the daemon holds it now."""
+
+    policy: Policy | None
+    revision: int | None
+    #: Seconds since the last successful Fleet fetch; None before one.
+    age_s: float | None
+
+
+def claude_code_subject(call: GatewayToolCall) -> Subject | None:
+    """Claude Code's naming map. Built-in tools are not policy subjects."""
+    server = call.mcp_server
+    if server is not None:
+        # `mcp__plugin_<plugin>_<server>__<tool>` and `mcp__claude_ai_<name>__<tool>`
+        # (code.claude.com/docs/en/mcp, /permissions).
+        if server.startswith("plugin_"):
+            return Subject("mcp_tool", server.removeprefix("plugin_"), "plugin")
+        if server.startswith("claude_ai_"):
+            return Subject("mcp_tool", server, "claudeai")
+        return Subject("mcp_tool", server, _STANDALONE)
+    if call.tool_name == "Skill":
+        skill = call.arguments.get("skill")
+        return Subject("skill", skill, "") if isinstance(skill, str) and skill else None
+    if call.tool_name in ("Task", "Agent"):
+        agent = call.arguments.get("subagent_type")
+        if isinstance(agent, str) and ":" in agent:
+            return Subject("plugin_agent", agent, "")
+    return None
+
+
+#: Each agent kind names its tools its own way. Claude Code ships first.
+SUBJECTS: dict[str, Callable[[GatewayToolCall], Subject | None]] = {
+    "claude-code": claude_code_subject,
+}
+
+
+def _sanitized(plugin: str) -> str:
+    """A plugin name as Claude Code spells it inside an MCP tool name."""
+    return "".join(c if c.isalnum() or c in "_-" else "_" for c in plugin)
+
+
+def _owned_by(subject: Subject, plugin: str) -> bool:
+    if subject.kind == "mcp_tool":
+        return subject.source == "plugin" and subject.name.startswith(_sanitized(plugin) + "_")
+    return ":" in subject.name and subject.name.partition(":")[0] == plugin
+
+
+def _by_name(subject: Subject, policy: Policy, revision: int | None) -> Result | None:
+    """The plugin rule that names this subject's plugin, or None when none does, or two disagree."""
+    matches: dict[str, str] = {}
+    for state, targets in (
+        ("allowed", policy.plugins.allowed),
+        ("blocked", policy.plugins.blocked),
+    ):
+        for index, target in enumerate(targets):
+            plugin = getattr(target, "plugin", None)
+            if plugin is not None and _owned_by(subject, plugin.rpartition("@")[0]):
+                matches.setdefault(state, f"admission.plugins.{state}[{index}]")
+    if len(matches) != 1:
+        return None
+    ((state, rule),) = matches.items()
+    if state == "allowed":
+        return Result("allow", "policy_allowed", revision, rule)
+    return Result("deny", "policy_blocked", revision, rule, dict(policy_rows(policy))[rule])
+
+
+class GatewayPolicy:
+    """The `PolicyCheck` the daemon's listener runs on each turn's pending calls."""
+
+    def __init__(
+        self,
+        read: Callable[[], Inputs],
+        *,
+        category_defaults: bool = False,
+        ttl_s: float = POLICY_TTL_S,
+    ) -> None:
+        self._read = read
+        #: The organization's opt-in to category defaults at gateways. Fleet
+        #: has no such setting yet, so the daemon passes False.
+        self.category_defaults = category_defaults
+        self._ttl_s = ttl_s
+
+    def __call__(self, calls: tuple[GatewayToolCall, ...], agent_kind: str | None) -> PolicyVerdict:
+        naming = SUBJECTS.get(agent_kind or "")
+        subjects = [s for s in map(naming, calls) if s is not None] if naming else []
+        if not subjects:
+            return PolicyVerdict()
+        inputs = self._read()
+        if inputs.policy is None:
+            return PolicyVerdict(revision=inputs.revision, fallback="policy_unavailable")
+        if inputs.age_s is None or inputs.age_s > self._ttl_s:
+            return PolicyVerdict(revision=inputs.revision, fallback="policy_stale")
+        for subject in subjects:
+            result = _by_name(subject, inputs.policy, inputs.revision)
+            if result is None and self.category_defaults:
+                result = decide(subject, inputs.policy, inputs.revision)
+            if result is not None and result.outcome == "deny":
+                return PolicyVerdict(
+                    deny=True,
+                    message=policy_message(result.rule, result.detail),
+                    revision=inputs.revision,
+                    rule=result.rule,
+                )
+        return PolicyVerdict(revision=inputs.revision)
+
+
+def runtime_inputs(runtime: PolicyRuntime) -> Callable[[], Inputs]:
+    """Read the policy the daemon's runtime holds, as the gateway needs it."""
+
+    def read() -> Inputs:
+        with runtime.cache.guard:
+            policy, revision = runtime.cache.policy, runtime.cache.state.desired_revision
+        refreshed = runtime.refreshed_at
+        return Inputs(policy, revision, None if refreshed is None else runtime.clock() - refreshed)
+
+    return read

stacktrace/daemon/policy_collect.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import contextlib
 import hashlib
+import inspect
 import json
 import os
 import signal
@@ -29,8 +30,11 @@ MAX_BUNDLE_BYTES = 2 * 1024 * 1024
 COLLECT_TIMEOUT = 45
 
 
-def collector_available() -> bool:
-    return callable(getattr(openaca.core, "collect_policy_evidence", None))
+def collector_available(agent_kind: str = "claude-code") -> bool:
+    collector = getattr(openaca.core, "collect_policy_evidence", None)
+    if not callable(collector):
+        return False
+    return agent_kind != "codex" or "agent_kind" in inspect.signature(collector).parameters
 
 
 def _source(ref: ComponentRef, scope: Scope) -> str | None:
@@ -90,11 +94,24 @@ def evaluate_bundle(policy: Policy, evidence: Any, scope: Scope) -> tuple[Entry,
             name = path[-1].get("name")
         if not isinstance(name, str) or not name or len(name) > 4096:
             continue
+        if scope.agent_kind == "codex":
+            from stacktrace.hooks.codex import namespace_for_server
+
+            if component_type != "mcp_server" or ref.extra.get("enabled") is False:
+                continue
+            # Codex exposes the server namespace for both direct and plugin MCPs.
+            # Keep normalized collisions: DecisionCache applies category defaults.
+            name = namespace_for_server(name)
+            if name is None:
+                continue
         blocked = decision.blocked
         rule = next(iter(getattr(decision, "rule_paths", ())), None) if blocked else None
         detail = descriptions.get(rule) if rule is not None else None
         if detail is not None and len(detail) > MAX_RULE_DETAIL:
             detail = detail[: MAX_RULE_DETAIL - 3] + "..."
+        if scope.agent_kind == "codex":
+            entries.append((Entry("mcp_tool", name, "codex", blocked, rule, detail), 0))
+            continue
         owner = decision.subject.ref.name if decision.controlled_by_plugin else None
         source = "plugin" if owner else _source(ref, scope)
         rank = 1 if source in {"project", "local"} and not owner and ":" not in name else 0
@@ -154,6 +171,7 @@ def collect_bounded(document: dict[str, object], scope: Scope) -> Collected:
     request = json.dumps(
         {
             "document": document,
+            "agent_kind": scope.agent_kind,
             "config_root": scope.config_root,
             "project_root": scope.project_root,
             "global_config": scope.global_config,
@@ -188,9 +206,14 @@ def collect_bounded(document: dict[str, object], scope: Scope) -> Collected:
         "inventory_digest",
         "vulnerability_run_id",
         "posture_run_id",
+        "inventory_gap_count",
     }:
         raise ValueError("policy_evidence_invalid")
     for name, value in identifiers.items():
+        if name == "inventory_gap_count":
+            if type(value) is not int or not 0 <= value < 2**31:
+                raise ValueError("policy_evidence_invalid")
+            continue
         if value is None and name != "inventory_digest":
             continue
         if (
@@ -240,12 +263,21 @@ def main() -> int:
         if len(raw) > MAX_BUNDLE_BYTES:
             return 1
         request = json.loads(raw)
-        scope = Scope(request["config_root"], request["project_root"], request["global_config"])
+        scope = Scope(
+            request["config_root"],
+            request["project_root"],
+            request["global_config"],
+            request.get("agent_kind", "claude-code"),
+        )
         # This child owns its environment. Select the same native global file
         # as the launching host, without mutating the resident daemon's env.
         root = Path(scope.config_root)
         target: Path | None = root
-        if Path(scope.global_config) == (root / ".claude.json").resolve():
+        if scope.agent_kind == "codex":
+            if Path(scope.global_config) != (root / "config.toml").resolve():
+                raise ValueError("invalid_global_config")
+            os.environ["CODEX_HOME"] = str(root)
+        elif Path(scope.global_config) == (root / ".claude.json").resolve():
             os.environ["CLAUDE_CONFIG_DIR"] = str(root)
         elif (
             root == (Path.home() / ".claude").resolve()
@@ -265,7 +297,14 @@ def main() -> int:
             os.dup2(quiet.fileno(), 1)
             os.dup2(quiet.fileno(), 2)
             policy = parse_policy(request["document"])
-            evidence: Any = collector(policy, target=target, project=Path(scope.project_root))
+            options: dict[str, Any] = (
+                {"agent_kind": scope.agent_kind} if scope.agent_kind == "codex" else {}
+            )
+            if "allow_partial_inventory" in inspect.signature(collector).parameters:
+                options["allow_partial_inventory"] = True
+            evidence: Any = collector(
+                policy, target=target, project=Path(scope.project_root), **options
+            )
             digest = inventory_digest(evidence)
             # Both gates use this exact owned bundle. The facade exposes no
             # advisory database revision; never invent one from a timestamp.
@@ -274,6 +313,7 @@ def main() -> int:
                 digest,
                 run_id if policy.risk_gates.vulnerabilities is not None else None,
                 run_id if policy.risk_gates.posture_rule_ids else None,
+                len(getattr(evidence, "inventory_gaps", ())),
             )
             paths = sorted(
                 {