feat: bind Issue #62 runtime inventory to Codex 0.146

[NOirBRight]

Refs #62

Exact candidate head: b88cf5c

Summary

• Preserve the historical Desktop capture and wire provenance: Codex CLI 0.144.0-alpha.4, source commit 9e552e9d15ba52bed7077d5357f3e18e330f8f38, captured at 2026-07-12T14:57:55+08:00.
• Add codex-0.146-source-contract.json for the source-attested CLI 0.146.0 (rust-v0.146.0, commit e363b08c9175ac1cbe5893615dd2cb9ddf95043b, candidate revision and binary SHA-256), explicitly capture_status=not_observed and qualification_status=unqualified.
• Bind structural declaration families and representative request/call/result/history/stream shapes to the source contract, with terminal/error/loss classification, reconciled IDs, and exact family SSE ordering. Client-executed tool discovery is exactly response.output_item.done then response.completed, with no text delta or item-added event.
• Enforce a canonical per-family schema for runtime/wire names, declaration/call/result types, owner fields, IDs, namespace tools, hosted-provider scope, and unknown sentinels in Python and PowerShell reconciliation.
• Close nested declaration/call/result/history/streaming/terminal/error schemas, fixed status/value sentinels, exact response item-type arrays, and matching Python/PowerShell negative replays; retained source-contract evidence remains unobserved/unqualified and does not unlock 0.1.8 Beta2: Define tool-type compatibility rules for custom Responses endpoints #65.
• Bind Python and PowerShell reconciliation to all four evidence artifacts and regenerate the inventory/documentation. The historical wire fixture no longer embeds an untruthful 0.146 runtime-surface block.
• Make the documented read-only sanitizer accept --source-contract, emit exact 0.146 not_observed provenance plus nested historical 0.144 metadata, and fail closed on source-contract capture claims or historical provenance drift.
• Harden standalone in-memory reconciliation: retained candidate/evidence basenames are canonical, observed-family and legacy beta.1 readiness flips fail closed, and readiness cannot self-escalate without bound evidence; bound-evidence reconciliation remains bound to the retained unobserved source contract; no future observed-source-contract admissibility is claimed.

Evidence boundary

No real 0.146 runtime capture is claimed. qualification.ready_for_beta2 remains false; planner completeness, clean current-binding cold start, independently fingerprinted full pre/post request and response bodies, non-streaming/terminal/error/hosted/unknown controls, and wire replay evidence remain incomplete. This PR does not qualify or unlock #65 and does not mutate shared Desktop/Gateway/config/catalog state.

Verification

• Focused Issue 0.1.8 Beta2: Inventory Codex CLI 0.146 tool types and representative Responses lifecycles #62 reconciliation suite (161 passed across inventory, trace, audit, control-manifest, and bounded-phase tests)
• Full Issue 0.1.8 Beta2: Inventory Codex CLI 0.146 tool types and representative Responses lifecycles #62 suite including live-evidence sidecar tests (198 tests collected; focused 161 passed)
• Python inventory --check-drift
• PowerShell identity reconciliation and negative inventory replay controls
• python -m py_compile scripts/audit_issue_62_runtime_artifacts.py scripts/build_issue_62_runtime_inventory.py
• git diff --check

Final replay hardening (e48478c)

• Standalone reconcile_inventory(..., evidence_root=None) now compares evidence-binding basenames/hashes and the manifest against the retained Issue 0.1.8 Beta2: Inventory Codex CLI 0.146 tool types and representative Responses lifecycles #62 package identity. It also pins the retained unobserved terminal classifications, gate map, blocking lists, unknown-tag count, and ready_for_beta2=false; self-consistent edits cannot self-qualify.
• Source-contract validators now close the top-level, runtime_wire_surface, request_shape, and response_shape schemas (including regenerated nested maps) in the inventory generator, audit sanitizer, and PowerShell reconciliation.
• The retained source contract and runtime artifact remain capture_status=not_observed / qualification_status=unqualified; no 0.146 runtime capture or 0.1.8 Beta2: Define tool-type compatibility rules for custom Responses endpoints #65 unlock is claimed. This branch intentionally validates only that versioned unobserved source contract; a future observed source contract requires a deliberate schema/version transition and is not claimed admissible here.

Latest exact-head verification: 161 passed across the focused inventory, trace, audit, control-manifest, and bounded-phase suite; generator --check-drift, Python compile, PowerShell parse/identity replay, and diff checks passed.

[NOirBRight]

Orchestrator delivery update (exact head b88cf5c)

Nested strict-schema hardening is now included:

• Python and PowerShell reject unknown nested fields in declaration/call/result/history/streaming/terminal/error family objects and response item-type arrays.
• Standalone and bound replay negative tests cover nested observation/status/extra-field mutations.
• Focused Issue 0.1.8 Beta2: Inventory Codex CLI 0.146 tool types and representative Responses lifecycles #62 files: 161 passed (83 inventory, 30 trace, 25 audit, 15 manifest, 8 bounded).
• Current source contract remains intentionally unobserved-only: no real 0.146 capture, no qualification, and no 0.1.8 Beta2: Define tool-type compatibility rules for custom Responses endpoints #65 unlock.
• A future observed source contract requires a deliberate schema/version transition and is not claimed admissible by this PR.

Fresh exact-SHA Spec/Quality review and Hosted CI / gate are still required.

[NOirBRight]

Final parity delivery update (exact head 69f6cce)

The latest slice adds:

• concrete request_shape and non_streaming value invariants in Python inventory, Python audit, and PowerShell;
• strict parity for nested family schemas, response item arrays, and standalone inventory container keys;
• 11 request/non-streaming mutation negatives per validator, 12 audit nested-schema negatives, and 9 standalone-container negative cases.

Verification on this exact head: focused audit/inventory/trace suite 192 passed; full Issue #62 suite 244 passed; generator drift, PowerShell identity/replay negatives, py_compile, and diff checks pass. The source contract remains intentionally unobserved/unqualified; no #65 unlock or real 0.146 capture is claimed.