[abruption]

Problem and behavior

Codex submission inspected only the selected home config even though native loaders can use system, requirements, managed preferences and project contexts. This change classifies the source-qualified local layers, retains the selected binary and consumer/store evidence, and refuses before submission when those inputs are unsupported, conflicting or change across validation. Final synchronous checks run after asynchronous work and directly before the native spawn or RPC attempt marker.

Closes #166. Closes #167. Closes #168.

Storage guards

• Share bounded fatal-UTF8/TOML classification between doctor and dispatch for exact native loader versions 0.160.1 / 0.162.1 / 0.165.0. Preserve malformed/escaped-key refusal and stripping inherited storage overrides.
• Inspect physical queue and persisted/live consumer cwd, original writer identity, opened state/queue inodes, configuration evidence and executable continuity. Reuse the selected canonical executable for qualification, fallback and owned submission; use a TOML-safe explicit storage pin.
• Select the actual ordinary/owned route before returning dry-run metadata. Doctor/dry-run do not execute the agent binary; the internal handoff helper also preserves this invariant for invalid delivery/dry-run requests (the CLI already rejects those combinations).
• Preserve original deadlines, effect fencing, typed pre-submit storage faults and unknown/no-resend semantics. No config edits, credential reads, automatic migration, new ledger authority or new RPC operation.

Availability limits: Windows Codex dispatch is unqualified and refuses before agent execution. Ordinary signed-in file-auth homes (auth.json metadata), keyring/auto or otherwise cloud-unclassifiable contexts also refuse without reading credentials/cache contents. A separately qualified owned stdio route requires actual opened-storage binding. Missing saved cwd, config symlinks, unknown daemon/remote context or missing trusted system metadata tools can refuse. Conservative project/selector supersets may reject otherwise unused settings. These restrictions are documented in the API and all four README/guide variants; no new native/platform/ACK qualification is claimed.

Current parity and scoped version maintenance

• Add a dated matrix pinned to published TS 90481b1 / Python f5e7c49 (source VERSION 1.3.2), with shipped/partial/intentional difference/not-planned/undecided states and explicit defer decisions for presets/addresses, explain, explicit trusted SSH config and persistent per-version dismissal.
• Preserve the ordinary Python 1.1.0 oracle and all frozen handoff/native/skill evidence. Current-source display is separate from immutable comparison dates/pins; all four guides link the matrix.
• Add npm run version:check / version:update and a closed 12-file, 105-line inventory (115 version spans). Only exact registered {{version}} spans change. Non-mutating CI checks remain alongside existing metadata, language, link and anchor gates. Historical records, supported-policy text, compatibility rows and independent pins are not generated.

Verification

• Full local suite on f57a808: 489 tests, 477 pass, 0 fail, 11 platform skips, 1 existing TODO, using the exact pinned ordinary Python oracle.
• Real package smoke repeated after the final test-only changes: reproducible 79-file archive, clean isolated installation, native binding load, public types, shorthand lifecycle and uninstall pass; 18 packaged Markdown files retained.
• Synthetic copy: change package/lock to 0.5.2 with npm version --no-git-tag-version --ignore-scripts, run scoped update/check, repository checks, build, actual package smoke, and second update. All eight commands pass; second update changes zero bytes; 30 protected history/pin/policy files remain identical. The copy matched 5a0e0d8; no repository version/tag/publication change was made.
• Final follow-up deltas strengthen common Korean template particle validation, precisely document its limited lint scope, and add invalid/valid template tests: current-version tests 9/9, types, version check, repository structure/four-language links/anchors and git diff --check pass.
• Deterministic ordinary/fallback/owned fixtures cover last-await mutations, deadline exhaustion, canonical binary retention, direct API dry-run refusal, signed-in cloud refusal and opened-store qualification. Three late queue/WAL/SHM identity changes fail against the previous runtime and refuse before the effect RPC with the new runtime.
• Loader coverage is source-pinned to native commits d27764b (0.160.1), 092d3ac (0.162.1), and 360319d (0.165.0). Actual macOS preferences adapter ran read-only with no forced entries. This is not new native submission, positive MDM, remote/platform or ACK qualification.

Independent CLI review

Claude Code 2.1.312 / claude-opus-5-5 (actual model confirmed in response metadata) and Codex CLI 0.165.0 (isolated default model; actual model not reported) reviewed identical frozen inputs in fresh non-interactive parallel processes. Tools were disabled for Claude; Codex used read-only sandbox, ephemeral session and ignored user configuration. Both returned substantive successful responses; input/source hashes stayed unchanged, and the Codex streams contained only agent messages, with no tool execution.

Broad reviews and focused follow-ups found issues in canonical executable retention, post-await effect guards, actual-route diagnostics, direct API dry-run behavior, final queue/sidecar identity proof and Korean generated wording. These were checked against source and regression evidence and corrected. Final queue-proof review found no remaining mandatory runtime defect. The final version-lint review disagreed about universal grammar coverage: common formatting bypasses were fixed; the later claim of a universal grammar guarantee was removed rather than expanding this scoped updater into a language parser. Root added valid fixed-noun/parenthesis tests and explicitly documented HTML/link/inflected-form editorial limits. No reviewer test/native execution is claimed.

Scope

Source/package VERSION remains 0.5.1 pending separate release preparation. Dependencies, finite compatibility rows, SDK exports, frozen handoff wire/schema, native observation profiles, Python oracle and installation pins are unchanged. CLI diagnostics gain bounded storage classification metadata. This is an implementation PR for milestone 0.5.2, not publication or rollout. No merge, release, package publication, global/fleet installation, live Codex queue/user-session/host experiment or automatic Codex review mention was performed. Existing experimental/deferred PRs remain separate.

Current-head GitHub checks

Final head 76f556cca869da95ad4368af914bad6f0f43af3d: 12/12 checks pass, including macOS and Ubuntu Node 22/24, Windows Node 22/24, repository policy, release gate, CodeQL and GitGuardian. CI run 40905547974 and CodeQL run 40905538399 both use this head.

The macOS Node 24 job was cancelled before execution because GitHub could not acquire a hosted arm64 runner. A normal retry of that job and its dependent release gate on the same head passed. No code, CI setting, timeout or expectation was relaxed for the retry.

One earlier macOS Node 24 run returned a pre-effect refusal in the response-loss fixture instead of reaching the intended unknown-after-write case; the original cause remains unconfirmed. The final Node 22 and Node 24 runs both pass that exact case with full-result assertion diagnostics retained. This does not establish a root cause for the earlier failure.

GitHub automatic code/security review completed on 0ac7fae; code-review metadata reports no findings, while security-review metadata reports completed without a structured findings value. Later commits change tests only and are not covered by that exact-head automatic review record. Independent CLI review scope and root validation are recorded above. No manual review mention was added.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T15:43:30.202758Z	0ac7fae	PR opened
🔒 Security Review	✅ Completed 2026-10-29T15:44:42.049129Z	0ac7fae	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.