Specify native DING and Codex app-server delivery

[myobie]

Summary

• fold Specify declared native DING delivery #229 and docs(vrs): specify Codex native DING delivery #233 into one reviewable native-delivery specification
• define explicit deliver "mcp" and deliver "app-server" selection while preserving legacy ding
• define durable inbox, retry, compatibility, and Doctor boundaries shared by maintained transports
• define Codex controlled launch, thread ownership, exact idle/active delivery, typed receipt, and fail-closed states
• align the Codex contract with feat(message): deliver bounded inbox bodies #239's bounded complete-body FIFO view without making delivery a settlement operation
• define measurable per-delivered-message efficiency requirements for inference count, model-tool crossings, and four separate token classes
• make missing measurements unknown and cross-transport results incomparable; no numeric threshold is invented
• state the current implementation gap plainly: deliver "mcp" parses but has no production Claude adapter or legacy sidecar and must not be deployed
• require exact Codex-version admission: schema comparison plus live remote-TUI acceptance before extending the finite allowlist
• state that v1 duplicate-control state is deliberately not a post-archive audit log, with any bounded audit left as an explicit design question
• require app-server and the remote TUI to share authored config/feature/strictness inputs while keeping TUI-only arguments isolated
• require a bounded current-run wrapper trace that distinguishes socket setup from thread binding without retaining authored values or message content
• require typed TUI-loaded inventory evidence before the redundant control resume, then bind ownership from that exact successful response; process start and control bind alone do not prove resumed-TUI startup
• define a bounded typed hook-trust preflight and session-only exact-hash projection for persistent remote resume without persisted trust

Review order

The fifteen commits preserve the original specification history and add ten isolated corrections:

1. declared native DING delivery
2. compatibility correction
3. ontology alignment
4. Codex app-server transport contract
5. bounded FIFO integration correction
6. measurable delivery efficiency
7. missing Claude production-adapter status
8. exact Codex protocol-version admission
9. deliberate post-settlement observability boundary
10. shared authored configuration for app-server and remote TUI
11. bounded current-run wrapper diagnostics
12. response-driven resumed-thread binding
13. TUI-first loaded-thread gate and separate prompt/hook acceptance
14. provider-specific timeout ordering before the outer binding wait
15. transient exact-hash hook trust for persistent remote resume

This additive branch starts at current main. #232 remains separate and unchanged because it specifies and probes the Claude channel; it is not the production adapter.

Validation

At exact head 490827a:

• the first five commits preserve the corrected docs(vrs): specify Codex native DING delivery #233 tree at 37a14da
• git diff --check origin/main..HEAD
• cargo test --locked --test invariants: 1 passed
• exact 0.145.0 and 0.146.0 app-server schema sets were compared for every request, response, and event path consumed by the Codex adapter

The prior 9c86a40 head passed hosted Nix in run 31534268653. The corrected shared-config head bb359f9 passed hosted Nix in run 31538410811 (11m 20s). The diagnostic head 52dbccf passed hosted Nix in run 31540402056 (11m 36s). Exact-head 29f6c07 passed hosted Nix in run 31542577050 (8m 34s; job 93948099905, 2026-08-11 22:28:44Z–22:37:18Z). Exact-head f853e20 passed hosted Nix in run 31544695285 (11m 30s; job 93954572200, 2026-08-11 22:59:43Z–23:11:13Z). Exact-head e6ecc84 passed hosted Nix in run 31546505708 (11m 40s; job 93960059074, 2026-08-11 23:26:55Z–23:38:35Z). Exact-head 490827a passed hosted Nix in run 31548735128 (8m 24s; job 93966613091, 2026-08-12 00:02:14Z–00:10:38Z). The live Codex 0.146 scratch proved real native reconcile, idle wake, behavioral busy-window delivery without visible corruption, agent-owned archive settlement, and checked teardown with legacy controls unchanged. The first capture inspected the PTY record instead of the adapter's hash-keyed state directory, so exact same-turn identity and its client receipt remain an open provider evidence gate. Codex also disabled project-local hooks because app-server did not receive the authored project-trust override; native transport does not depend on those hooks. The corrected r2 scratch then timed out after publishing its runtime incarnation and before thread binding, restored the original declaration, and preserved all controls. The exact diagnostic trace then proved resumeSelected=true, a connected and initialized control socket, a started TUI, and a fixed 30-second expiry only at resumed-thread binding. This head now requires the initialized control client to resume the recorded thread after TUI spawn and bind only from that exact successful response; it must not wait for a provider notification that resume does not promise. Representative hook loading and exact same-turn/client capture remain the provider gate. External catalog synchronization later rematerialized only the inert scratch declaration after a local move; no process or runnable Silber task returned, and sync-aware cleanup remains separate.

R3 proved that the response-driven control resume can bind the preserved thread to the new runtime incarnation, but READY-BOOT and the SessionStart canary were absent. Exact provider source rejects the proposed interpretation that resume intentionally skips the prompt and hook. This head therefore requires a typed thread/loaded/list observation before control resume and separately requires live proof that the resumed TUI consumed its authored prompt and ran its SessionStart resume hook. R4 then showed that equal 30-second inner and outer deadlines let the generic outer binding error mask the provider-specific loaded-thread result. Its clean restore and zero-byte app-server log change do not establish provider or trust behavior. This head requires the inner result to reach the wrapper trace first. R5 proved that correction and exposed the real blocker: Codex 0.146 displayed an interactive hook-review prompt before its own remote resume. Exact provider source intentionally suppresses hook-trust bypass for persistent remote resume, independent of argv placement; current upstream main retains that rule. Startup-only R6 at implementation head 2b06652 then passed the contract: preflight projected four hooks and exited before final launch; the TUI did not stop at hook review; tuiThreadLoaded, threadBound, READY-BOOT, and the SessionStart canary all appeared; the preserved thread bound one new subscribed incarnation; and user configuration remained byte-identical with no persisted hook trust. The packet's later hold crossed teardown after the pass. A post-release implementation walk found an overbroad detector for a different prompt-after--- shape. The tested declaration genuinely authored the root flag, so the pass remains valid for this contract. Final implementation head b97ea8f narrows authorization to parsed root options, adds a rejecting regression, and is exact-head hosted-green. C2 and production stay held.

This pull request remains draft for Nathan's review.

[myobie]

Closing. Native DING delivery shipped and every agent on the fleet runs on it, so this draft specifies a decision that is already made and in production. Closed by Silber.cos on Nathan's word, 2026-08-24. Reopen if the spec is wanted as documentation.