Document source-scoped cooperation checks - #763

Scope

Document two version-bound cooperation checks: conditional project-trust persistence during Codex exec fixtures, and semantic gateway-error classification. The recipe preserves its recorded examples and gives each added condition a pinned primary reference.

• Base commit: ecfa112764c664d35377dd66b8cfcb67e5a94d60.
• Lane: lane:foundation.
• Owned paths: recipes/claude-codex-cooperation-lanes.md; its integrity entry in the registry-last commit.

SOTA sources

• openai/codex@a956835d thread_processor.rs:1350–1378, trust setter:2412–2424, fresh exec cwd:1369–1382, Git-presence guard:975–982.

• diegosouzapw/OmniRoute@c1e30b76 authTerminalStatus.ts:49–115.

• All files reread at the exact pins. Repository integration sources: native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:docs/acceptance-evidence-policy.md:24-40, docs/lanes.md:94, recipes/README.md:69,95.

• Codex0.160.0 projectless discovery/classification and state contract; OmniRoute credit-exhaustion helper, primary sources reread.

Evidence-class table

Local commands run

python3 scripts/validate.py
exit 0: 69 components, 10272 hashed files, 4 profiles, 212 receipts
python3 -m unittest tests.test_install_claude_profile tests.test_stack_lifecycle tests.test_foundation_stack_pins tests.test_adoption_bootstrap_macos tests.test_adoption_docs_consistency tests.test_codex_agents
exit 0: 334 tests, 20 skipped
python3 scripts/build_ecosystem.py --check
exit 0: guide paths and rendering consistency checked
gitleaks git --pre-commit --staged --redact=100 --no-banner --no-color --config .gitleaks.toml --report-format json --report-path <owned-report> .
exit 0: 3083 staged bytes scanned, no findings
added-text/body login-name, host-path, private-identifier and internal-reference scans
zero matches
git diff --check
exit 0

Heavy local checks ran sequentially at niceness 19 with owned temporary storage. No native fixture, account mutation or provider acceptance is inferred from these source and doc checks.

Decision record

The prior six modules did not read this recipe. This revision selects six repository non-regression modules; their passing results do not establish the recipe content. The registry validator checks its exact bytes, and the ecosystem generator includes its guide path; the final check results are reported separately. Fixture placement is checked by preserving the original headless-review bullets and their command adjacency.

Source-reviewed operating lessons. Re-read the cited branch when the client or gateway revision changes; unsupported historical workflow-mode and message-loop claims remain unpublished.

Host evidence

No host receipt or platform-status promotion.

GitHub checks

The original review-head OSV scan reported five advisory identities across five unchanged base lockfiles (native scan):

Ordinary and frozen-macOS scans both exited 1. Dependency repair remains separately owned; green checks on a refreshed base are required after it lands. The prior body omitted three advisories; this table corrects that incomplete summary.

Checklist

• No workflow or GitHub Actions change.
• Added material contains no credential value, private host identity/path or user quotation.
• No new billing surface.
• Separate owned worktree and preserved peer content.
• Registry committed last; draft for independent exact-head review.