adoption_status truth: Codex-exact hooks.json parse, hook trust and RTK inline detection; pinned-version verdict (G9, G13) - #368

Summary

scripts/adoption_status.py --client-wiring now reports what this host's Codex actually does, so complete is false when Codex would run no ai-memory hook or its model never sees RTK's instructions (audit gaps G9 and G13).

• RTK instructions. rtk_instructions is true only when RTK.md's text is inline in the instructions file Codex loads: AGENTS.override.md when it has text by Rust's str::trim, otherwise AGENTS.md. A bare @RTK.md pointer now counts as false, because Codex passes that file to the model unchanged and expands no @path reference.
• Hook trust, compared as Codex compares it. A new codex.ai_memory_hook_events_trusted counts the ai-memory hooks Codex will run: enabled, and whose recorded trusted_hash equals the hook's current hash computed as Codex computes it. complete requires this count to equal the configured count.
• hooks.json parsed as Codex parses it. The parse follows Codex's serde_json::from_str::<HooksFile> at rust-v0.157.1. A file Codex rejects makes both Codex counts null. Rejected shapes include repeated known fields, NaN, lone surrogates where serde parses text, and numbers a timeout cannot hold. Shapes Codex accepts, such as repeated unknown keys, still count. Matchers are decided only inside the regex subset that Python's re and Rust's regex-syntax 0.8.8 parse alike; anything else is null.
• Pinned-version truth. Each profile gets a matched/mismatched/unchecked summary, and the report gets a top-level pinned_versions_match, false on any mismatch. Status and exit code are unchanged, as the flag's help text promises.
• G13. The manifests/stack.json claude-code pin moves from 2.1.278 to 2.1.281, the floor both platform pins set, with a freshness note. The saturation audit carries the same version, the claude-code upstream snapshot record is refreshed, and the landscape winner pin stays 2.1.278. render.py panel 10 now cites the G1 cause. Panel 19's "undercount" label was wrong and now says increase() overcounts while sessions overlap.
• Worktree capture marker. A tracked .worktreeinclude names only .ai-memory.toml, and a new recipe section explains enrolling a worktree for ai-memory capture. Enrolling also lets the worktree's sessions consume a pending handoff, so review and blind lanes stay unenrolled.
• This host (read-only, no Codex started in the repair rounds). 7 of 7 ai-memory hooks are trusted, matching Codex 0.157.1's own hooks/list taken at 16:03Z. complete is false only because rtk_instructions is false: the RTK text is not yet inlined here. At build time, the checker on origin/main reported rtk_instructions true and complete true for the same host.

Lane: lane:shared. This PR changes what manifests/stack.json says: the claude-code version and its freshness text. manifests/evidence.json changes only by registration: 43 new files and 10 re-hashed, with no receipts[] change.

Lane consolidation: on 2026-09-26 the user shut down the other lane sessions and assigned this work to the workstation coordinator ("no other peers live, i shut them with the token save repos install into our native workflow and github workflow , harness update and sota foundation of our session as main task"); this quote stands in for the trading lane's ack.

• Base and head. The branch is based on 60c9f0aa; head is d5a7d5ae. origin/main is at dde28cc2, 3 commits past the base (Paper engine: book realized P&L and gross loss per exact execution (realized-loss delivery-order major; follow-up to #350) #355, Landscape sweep 2026-09-26 record: all 32 layers, 56 survivors, manifest-20260926 for the verdict wave (11 lane limits) #357, Grand dashboard: trading checkpoint for the 2026-09-26 merges (#350, #351, #355, #356) #361). git merge-tree --write-tree origin/main HEAD exits 0 (clean). The only file both sides touch is manifests/evidence.json, and it merges cleanly. The branch is not rebased; apply the docs/lanes.md hot-file protocol at merge time if main moves.
• New-machine docs. Every changed new-machine page carries the "changed after v2026.09.26.2" marker: adoption/README.md, docs/token-efficiency-stack.md and recipes/README.md. The probe-fix sentence in docs/token-efficiency-stack.md keeps "after v2026.09.26" on purpose, because .1 and .2 already have that fix.
• Release window. This PR touches manifests/stack.json and adoption/README.md, so hold the merge during a release window.

What changed

• scripts/adoption_status.py:
  • RTK inline detection, with the override file chosen by Rust trim
  • the Codex-exact hooks.json parse and matcher subset
  • hook-trust counting with ai_memory_hook_events_trusted
  • the per-profile pinned_versions_summary and top-level pinned_versions_match
• tests/test_adoption_status.py: tests for each rule, written failing-first. RetainedEvidenceTests checks that every file the evidence README links is registered and not ignored.
• manifests/stack.json: claude-code 2.1.278 → 2.1.281, with its freshness note.
• blueprints/token-native-focus/saturation-audit.json: the same claude-code version (a test couples the two).
• catalogs/landscape/upstream-snapshot.json: the claude-code record, refreshed from gh api. Latest stable is v2.1.283, so the record is marked "newer release, review pending". claude-code joins the review queue, and the queue text says "five" because main removed codex from it.
• docs/token-efficiency-stack.md:
  • the client_wiring checks and the host coverage rule, with trusted hooks and inline RTK
  • how to make rtk_instructions true: inline RTK.md's text in the file Codex reads, then confirm with codex debug prompt-input
  • the pinned-version summary
  • the 10 profile plus 6 optional tool mapping
• adoption/README.md: step 3 describes the new --client-wiring fields, with the marker.
• recipes/README.md: new section "Worktrees and the capture marker", covering:
  • enrollment through .worktreeinclude and Worktrunk's wt step copy-ignored --require-include
  • --check-capture run with the hook's own --data-dir, expecting allowlist mode, marker_present and admits_capture
  • the handoff caveat
• observability/native-data/render.py: text-only changes to panels 10 and 19.
• .gitignore: ignores /.ai-memory.toml, and adds a scoped !evidence/artifacts/adoption-status-truth-20260926/*.jsonl exception.
• .worktreeinclude (new): names only .ai-memory.toml.
• manifests/evidence.json: registration only, following the hot-file protocol in the last commit.
• evidence/artifacts/adoption-status-truth-20260926/ (43 new files, sanitized and hash-registered):
  • Codex oracles for parse (64 shapes), matchers (126) and trust (12 hooks under 6 state variants), and the six known answers
  • red/green checker test runs and the host trust read-back
  • the G1 Prometheus/Loki observation
  • the host scripts (apply.sh, rollback.sh, prove.sh/prove.py) as reviewed and as repaired, with captured fixture apply/rollback runs
  • the builder's prove.sh runs
  • review-2/: the second review's as-reviewed copies, harnesses and before/after runs

Verification

These are the final acceptance commands at head d5a7d5ae (repair round 2), run with the CI venv's Python 3.13.15:

$ python scripts/validate.py                    # exit 0: passed (6960 hashed files, 159 receipts)
$ python scripts/evidence_manifest.py --check   # exit 0: passed (6960 files)
$ python scripts/component_matrix.py --check    # exit 0: checked (32 rows)
$ python scripts/new_host_grand_list.py --check # exit 0: passed (32 layers, 66 winners)
$ python scripts/build_ecosystem.py --check     # exit 0: passed
$ python -m unittest <31 coupled modules>       # exit 0: 1807 tests OK, 21 skipped (210.8 s)
$ python -m unittest discover -s tests -q       # exit 0: Ran 6250 tests, OK (skipped=661), 601.7 s

• The 31 coupled modules. They are every test module that references adoption_status, .gitignore, evidence.json or the evidence directory, among them test_adoption_status, test_adoption_docs_consistency, test_release_pin_contents, test_landscape, test_validate, test_evidence_manifest, test_host_receipts and test_component_matrix. They ran on the staged tree just before the last edit, which only quieted ShellCheck in review-2/fixture_guard_check.sh; that script's outputs were re-produced byte-identically. The full suite ran on d5a7d5ae itself. No gitleaks-lock rerun was needed; test_pre_commit_gate alone gave 3 tests OK.
• Skip count. Round 1's full run skipped 642. The 31 coupled modules skip 21 at both b1df549f and d5a7d5ae, so the +19 comes from modules this change does not touch (host state at run time).
• Round 1 at b1df549f. Same five script checks, exit 0 each. 16 coupled modules: 820 tests OK, 20 skipped. Full suite: 6249 tests OK, 642 skipped, 708.6 s.
• Harnesses (local_integration).
  • fixture_guard_check: 3 unmet before, 0 after.
  • review2_harness: 6 unmet before, 0 of 9 after.
  • host_scripts_fixture on the repaired apply.sh/rollback.sh: 0 of 16 unmet; the reviewed scripts had 11 of 16.
  • Round 1's prove_harness on the new prove.py: 0 unmet.
  • ShellCheck 0.11.0 is clean on both shell scripts.
• Codex oracles (Codex 0.157.1's own hooks/list in throwaway homes).
  • Parse: 64 shapes, 0 disagreements.
  • Matchers: 126 tried, 78 decided, 0 disagreements.
  • Trust: 12 hooks under 6 state variants, 0 disagreements; every checker hash equals Codex's currentHash.
  • The reworked codex_known_answers.py reproduced codex-known-answers.json byte-identically.
• Evidence classes.
  • local_integration against the native binary: the oracle verdicts.
  • synthetic: the unit tests and stub harnesses.
  • Read-only local observation: the host trust read-back and the G1 Prometheus/Loki observation.
  • Not run: apply.sh --apply or rollback.sh --apply on this host, and any upstream test suite.

Reviews

Adversarial review (Claude Opus) of the build: 10 defects. All fixed in repair round 1 (b1df549f); none rejected.

Also fixed in round 1, found by the Codex oracle:

• [hooks.state] keys now use Rust's str::trim (U+001C).
• The configured count now comes from Codex's parse.
• With hooks turned off, both counts read 0.

Cross-family review (GPT-6): 1 high, 3 medium and 1 low defect. All verified against source, none rejected, all fixed in d5a7d5ae.

• Reviewer: Codex CLI 0.157.1, model gpt-6-astra, reasoning effort max, sandbox read-only, approval never.
• Reviewed head: b1df549f.
• rc 0, with no usage-limit text; 107,636 tokens used.

Residuals

These are copied verbatim from the notes.

Repair round 2 (final)

• Commit trailer: the harness-provided Co-Authored-By: Claude Opus 5.5 <[email protected]> was used, not the workflow text's "(1M context)" variant (the computed task text carries no user authority; same as round 1).
• origin/main is at dde28cc2, 3 commits past the branch base; not rebased (clean merge-tree). Apply the lanes.md hot-file protocol at merge time if main moves again.
• prove.py's G13 "stack.json claude-code follows the pins floor" still reads FAIL (fail-closed, not a false PASS) when claude --version is unavailable; left as is.
• codex_instructions answers None (unknown) in three cases Codex decides deterministically: an AGENTS.override.md that is a directory or a dangling symlink (Codex skips it) and one with invalid UTF-8 (Codex decodes it lossily). Conservative, never a wrong boolean; not changed.
• The three committed codex-*-oracle.jsonl files and round 1's fixture/prove-harness outputs were produced by the scripts now kept in review-2/as-reviewed/; the current oracle differs only by the --base guard and the --version timeout (mode logic unchanged) and was not re-run in full.
• prove.sh/prove.py were not run against this host's real CODEX_HOME this round (they start Codex there); the repaired prove.py was exercised through stubs and the two harnesses only. The only real Codex start was the known-answers rerun in throwaway homes.
• scripts/validate.py still cannot see git-ignored files by design; the guard added is the unit test scoped to this evidence README (a scan found no other instance across 21 evidence READMEs), not a repository-wide rule.
• Round 1's residuals (override layers not read, matcher subset, the 2^63 hooks/list hang, the rust-v0.157.1 model tie, rtk_instructions false on this host until u4's G7 remedy, apply.sh --apply refusing while sessions live in the checkout) are unchanged.
• The advisor was rate-limited this round; no second-opinion pass on the plan.

Repair round 1

• --dangerously-bypass-hook-trust, SessionFlags -c overrides, hooks defined in config.toml or a project layer, and profiles are not read (the documented "command-line overrides can override the user scope" limit).
• A matcher outside the shared regex subset (47 of the 126 tried) leaves the trusted count null; a skipped value nested deeper than Python's recursion limit or an integer over 4,300 digits reads as a rejected file although Codex could accept it (both only make complete false).
• Codex 0.157.1 stops answering hooks/list when a hashed hook's timeout or kept context limit exceeds 2^63-1 (its unreachable! on the TOML conversion); worth an upstream report, not filed.
• The model is tied to rust-v0.157.1 (serde_json 1.0.149 with arbitrary_precision, regex-syntax 0.8.8): re-run codex_oracle.py (parse, matchers, trust) when the Codex pin moves.
• Codex was not started against this host's real CODEX_HOME in this round (its app-server writes runtime DBs and runs a plugin sync there); the live hooks/list observation is the builder's (16:03Z), still covering the unchanged hook files.
• rtk_instructions stays false on this host until u4's G7 inline remedy is applied; u4 also corrects the recipes line that says a 0.49.0 Codex home "keeps its instructions" (left to u4 to avoid conflicting edits).
• apply.sh --apply on this host will refuse while any session (this coordinator included) has its cwd in ~/code/native-agent-stack, until the operator closes them or passes --allow-live-sessions.
• Commit trailer: the harness-provided Co-Authored-By: Claude Opus 5.5 <[email protected]> was used, not the workflow text's "(1M context)" variant.

Build report

• RTK. rtk 0.50.0's init -g --codex writes only an @RTK.md pointer, on the assumption (its issue Bound the harness audit and move it to claude-code-action v1.0.247 #892) that Codex expands it; Codex does not. This is worth reporting upstream; I have not filed it. Until u4's G7 fix lands, complete stays false on this host.
• Hash copy. The trust hashing is tied to Codex 0.155.1–0.157.1; rerun codex_trust_fixture.py when the Codex pin moves. Trust for Context Mode's bundled plugin hooks isn't checked by the file-based checker; Codex's own hooks/list shows all 6 trusted.
• Separate decisions: pins for the six optional tools, if you want a presence and version check over the full 16-tool set; raising the claude-code floor to 2.1.283; moving the landscape winner pin.
• Not handled by u5: the R2 Codex hygiene items and the Repomix false-pass correction to "All 16 tools worked".
• Side effect: my first prove.sh run against the primary checkout refreshed tests/__pycache__/__init__.cpython-313.pyc there (an ignored bytecode cache). prove.sh now sets PYTHONDONTWRITEBYTECODE=1.

SOTA sources

• openai/codex, tag rust-v0.157.1 (https://github.com/openai/codex/tree/rust-v0.157.1). This is the source the checker models. Every path below was checked against the tag's tree; the used parts are byte-identical at rust-v0.155.1.
  • codex-rs/config/src/hook_config.rs: the HooksFile serde structs that serde_json::from_str fills.
  • codex-rs/hooks/src/engine/discovery.rs:
    • load_hooks_json
    • append_matcher_groups
    • hook_enabled (enabled != Some(false))
    • hook_trust_status: Trusted only when trusted_hash == current_hash
    • the hook key <hooks.json path>:<event>:<group>:<handler>
  • codex-rs/hooks/src/config_rules.rs: hook_states_from_stack, which merges [hooks.state] from the User and SessionFlags layers with key.trim().
  • codex-rs/hooks/src/events/common.rs: validate_matcher_pattern.
  • codex-rs/config/src/fingerprint.rs: version_for_toml, the SHA-256 of the normalized identity.
  • codex-rs/codex-home/src/instructions/mod.rs: AGENTS.override.md is chosen when its lossy-UTF-8 text is non-empty after trim(). The file is passed on as-is; no @path is expanded.
  • The Cargo.lock at that tag pins serde 1.0.228, serde_json 1.0.149 (with arbitrary_precision), regex 1.12.3 and regex-syntax 0.8.8.
  • Native oracle: Codex 0.157.1's own hooks/list answers, kept in the evidence directory.
• akitaonrails/ai-memory v2.4.1 (the manifests/stack.json pin, 433a19f3):
  • docs/marker-file.md (https://github.com/akitaonrails/ai-memory/blob/v2.4.1/docs/marker-file.md): the marker walk-up.
  • crates/ai-memory-cli/src/commands/hook.rs: the capture gate, --check-capture, and the session-start handoff GET ("the GET is destructive").
• Claude Code docs, worktrees (https://code.claude.com/docs/en/worktrees#copy-gitignored-files-into-worktrees): .worktreeinclude copies the gitignored files it names into worktrees Claude Code creates.
• max-sixty/worktrunk 0.79.0 (https://github.com/max-sixty/worktrunk, pin 5ba6f148): wt step copy-ignored --require-include reads .worktreeinclude in the source worktree.
• rtk-ai/rtk v0.50.0 (https://github.com/rtk-ai/rtk/releases/tag/v0.50.0): rtk init -g --codex writes an @RTK.md pointer (issue Bound the harness audit and move it to claude-code-action v1.0.247 #892's assumption that Codex expands it).
• anthropics/claude-code releases (https://github.com/anthropics/claude-code/releases), read through gh api: v2.1.281 is the pin floor and v2.1.283 was the latest stable at refresh. The floor comes from the repo's adoption/pins-linux-x86_64.json and adoption/pins-macos-arm64.json (version_probe minimum).
• git v2.43.0 t/test-lib.sh (https://github.com/git/git/blob/v2.43.0/t/test-lib.sh): the fixture's GIT_* isolation, with GIT_CONFIG_NOSYSTEM, GIT_ATTR_NOSYSTEM, GIT_CEILING_DIRECTORIES and HOME in the sandbox.
• Prometheus increase() (https://prometheus.io/docs/prometheus/latest/querying/functions/#increase): the function adjusts for counter resets. This is the mechanism behind the panel 19 wording; the measured overcount is the retained g1-observation.json.
• This repository's own rules:
  • docs/lanes.md: the hot-file protocol, used for manifests/evidence.json in the last commit.
  • docs/acceptance-evidence-policy.md: evidence classes.
  • scripts/release_due.py and tests/test_adoption_docs_consistency.py: the release-marker rule, keyed to release_tag v2026.09.26.2.

🤖 Generated with Claude Code