mzored · mzored · Sep 6, 2026 · Sep 6, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -31,7 +31,7 @@ The always-loaded kernel regains the duties an independent audit found weakened
 
 This is a minor release. The kernel widens what a run does within existing authority: it stops and hands over one batch when the result waits on the owner, reads `delegation` before dispatching, and names the permission it lacks. The delegation playbook adds host mechanics. No authority boundary, public skill name, or record format changes, and existing grants and restrictions survive the upgrade.
 
-Every behavioral consequence is `UNVERIFIED`; acceptance is static. The experiments the audit designed, a three-mechanism Claude activation comparison, a refused-command capture test on Codex, a fixture at the drift point for the direction rule, a fixed known-bad candidate for the revised reviewer, and a Codex writer lane, need the owner's grant and are recorded with their designs in [docs/evidence.md](docs/evidence.md). Host receipts for the exact 4.3.0 package are recorded in `evals/host-smoke.json` when they exist; until then every row there is `UNVERIFIED` and the 4.2.0 receipts remain at their immutable source.
+Every behavioral consequence is `UNVERIFIED`; acceptance is static. The experiments the audit designed, a three-mechanism Claude activation comparison, a refused-command capture test on Codex, a fixture at the drift point for the direction rule, a fixed known-bad candidate for the revised reviewer, and a Codex writer lane, need the owner's grant and are recorded with their designs in [docs/evidence.md](docs/evidence.md). On the exact 4.3.0 package, Claude Code 2.1.263 installed and uninstalled the seventeen files in an empty configuration directory, and Codex CLI 0.153.0 installed them byte-identically from the approved Git source into an isolated home and removed them; those four cells of `evals/host-smoke.json` are `PASS` with receipts in `evals/receipts/host-validation-430-20260906/`, every other cell is `UNVERIFIED`, and the 4.2.0 receipts remain at their immutable source.
 
 ## 4.2.0 (2026-09-06)
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -15,7 +15,7 @@ services keep their own security policies.
 
 ## Package validation, 2026-09-06
 
-Version 4.3.0 is validated per capability in [`evals/host-smoke.json`](evals/host-smoke.json); every row there is `UNVERIFIED` until a receipt made on the exact 4.3.0 package is recorded, and the 4.2.0 receipts remain at their [immutable source](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json): Claude Code 2.1.261 clean install and uninstall, and Codex CLI 0.153.0 clean install from the approved Git source, uninstall, persistent setup, explicit fallback, and playbook load each carried one for 4.2.0. The [dated support summary](docs/evidence.md#support-summary-as-of-2026-09-06) states what each host has shown for each package it names. The previous 4.1.1 receipts remain in `evals/receipts/host-validation-411-20260905/`; the September 5 isolated Codex diagnostics remain 4.1.0 observations, and the [September 6 diagnostics](evals/receipts/isolated-host-420-20260906/README.md) are separate 4.2.0 observations.
+Version 4.3.0 is validated per capability in [`evals/host-smoke.json`](evals/host-smoke.json); Claude Code 2.1.263 clean install and uninstall, and Codex CLI 0.153.0 clean install from the approved Git source and uninstall, each carry one receipt on the exact 4.3.0 package in [`evals/receipts/host-validation-430-20260906/`](evals/receipts/host-validation-430-20260906/); every other row is `UNVERIFIED` until a receipt made on 4.3.0 is recorded, and the 4.2.0 receipts, including persistent setup, explicit fallback, and playbook load, remain at their [immutable source](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json). The [dated support summary](docs/evidence.md#support-summary-as-of-2026-09-06) states what each host has shown for each package it names. The previous 4.1.1 receipts remain in `evals/receipts/host-validation-411-20260905/`; the September 5 isolated Codex diagnostics remain 4.1.0 observations, and the [September 6 diagnostics](evals/receipts/isolated-host-420-20260906/README.md) are separate 4.2.0 observations.
 
 The historical 4.1.0 candidate passed both host schema validators. Claude Code 2.1.261
 installed all fifteen regular files byte for byte and uninstalled them in a
@@ -74,7 +74,7 @@ page under `learn.chatgpt.com`; the redirect target is the page actually read.
 | Per-agent read-only controls | Subagent frontmatter takes a `tools` allowlist, `disallowedTools`, and `permissionMode`, whose values include `plan` for read-only exploration. `permissionMode` is ignored for plugin subagents and overridden by a parent in bypass, accept-edits, or auto mode, so only a `tools` allowlist checked to have applied is a read-only boundary. | [Subagents](https://code.claude.com/docs/en/sub-agents) | 2026-09-06 | none | `UNVERIFIED` (documented) |
 | Worktree isolation | `isolation: worktree` runs a subagent in a temporary git worktree. | [Subagents](https://code.claude.com/docs/en/sub-agents) | 2026-09-04 | none | `UNVERIFIED` (documented) |
 | Plugin validation | Manifest `.claude-plugin/plugin.json`; `claude plugin validate <path>` validates it and `--strict` treats warnings as errors. | [Plugins](https://code.claude.com/docs/en/plugins) | 2026-09-04 | 2.1.259 | `PASS` (`scripts/check_hosts.py`, 2026-09-04) |
-| Clean installation | `claude plugin marketplace add`, `claude plugin install --scope user`, `claude plugin uninstall --scope user`; `CLAUDE_CONFIG_DIR` points the host at a scratch home. | [Discover plugins](https://code.claude.com/docs/en/discover-plugins), [Skills](https://code.claude.com/docs/en/skills) | 2026-09-06 | 2.1.261 | `PASS` (`scripts/check_hosts.py --smoke`: clean home, install, 17 regular files matching exact 4.2.0 payload `5bcd09d1…`, uninstall verified; [4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json)) |
+| Clean installation | `claude plugin marketplace add`, `claude plugin install --scope user`, `claude plugin uninstall --scope user`; `CLAUDE_CONFIG_DIR` points the host at a scratch home. | [Discover plugins](https://code.claude.com/docs/en/discover-plugins), [Skills](https://code.claude.com/docs/en/skills) | 2026-09-06 | 2.1.263 | `PASS` (`scripts/check_hosts.py --smoke`: clean home, install, 17 regular files matching exact 4.3.0 payload `a0901a39…`, uninstall verified; [ledger](evals/host-smoke.json)) |
 
 ### Codex CLI
 
@@ -85,7 +85,7 @@ page under `learn.chatgpt.com`; the redirect target is the page actually read.
 | Per-agent read-only controls | Custom agents are TOML files in the Codex home `agents/` directory or the project `.codex/agents/` and the page says they may set `sandbox_mode` per agent, naming a read-only agent as the example, and that subagents otherwise inherit the parent's sandbox policy and permission mode. In the `rust-v0.153.0` source, `core/src/agent/role.rs` applies developer instructions, model, reasoning effort and summary, verbosity, personality, service tier, features, and skills, and not `sandbox_mode`; `role_tests.rs` asserts a role cannot expand the parent's permissions. | [Subagents](https://developers.openai.com/codex/subagents), [openai/codex `role.rs`](https://github.com/openai/codex/blob/rust-v0.153.0/codex-rs/core/src/agent/role.rs) | 2026-09-06 | none | `UNVERIFIED` (documented; not applied in source as of 2026-09-06, so a subagent inherits the parent's sandbox) |
 | Worktree isolation | The subagents page documents no worktree or separate-checkout option for a subagent, and `spawn_agent` takes an agent type, the message, and where exposed `model` and `reasoning_effort`, with no working directory, worktree, or sandbox parameter. | [Subagents](https://developers.openai.com/codex/subagents), [openai/codex `multi_agents_spec.rs`](https://github.com/openai/codex/blob/rust-v0.153.0/codex-rs/core/src/tools/handlers/multi_agents_spec.rs) | 2026-09-06 | none | `UNVERIFIED` (no per-delegate directory or sandbox exists in this version; a separate-checkout writer lane is untried) |
 | Plugin validation | Manifest `.codex-plugin/plugin.json`. There is no `codex plugin validate` subcommand; validation runs the `validate_plugin.py` script shipped with the plugin-creator system skill in the Codex repository, which CI checks out at a pinned commit. | [openai/codex plugin-creator scripts](https://github.com/openai/codex/tree/333beecd41281b1350688b417a2f20c66e2a743e/codex-rs/skills/src/assets/samples/plugin-creator/scripts) | 2026-09-04 | none locally | `UNVERIFIED` locally (validator not on this machine); required to `PASS` in CI |
-| Clean installation | `codex plugin marketplace add`, `codex plugin add`, `codex plugin list --json`, `codex plugin remove` exist in `codex plugin --help`; `CODEX_HOME` relocates the host home. The plugins page documents the plugin browser and uninstall but none of these commands. | [Plugins](https://developers.openai.com/codex/plugins), `codex plugin --help` 0.153.0 | 2026-09-06 | 0.153.0 | `PASS` for exact 4.2.0 from the approved Git source in an isolated home: 17 regular files byte-identical to the committed package, then removed ([4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json)); the release runner's local marketplace is still refused by the managed `/etc/codex/requirements.toml` source policy |
+| Clean installation | `codex plugin marketplace add`, `codex plugin add`, `codex plugin list --json`, `codex plugin remove` exist in `codex plugin --help`; `CODEX_HOME` relocates the host home. The plugins page documents the plugin browser and uninstall but none of these commands. | [Plugins](https://developers.openai.com/codex/plugins), `codex plugin --help` 0.153.0 | 2026-09-06 | 0.153.0 | `PASS` for exact 4.3.0 from the approved Git source in an isolated home: 17 regular files byte-identical to the committed package, then removed ([ledger](evals/host-smoke.json)); the release runner's local marketplace is still refused by the managed `/etc/codex/requirements.toml` source policy |
 
 ### Codex surfaces
 

diff --git a/docs/evidence.md b/docs/evidence.md
@@ -92,12 +92,12 @@ marketplace-source policy before installation, so Codex clean install remains
 
 ## Support summary as of 2026-09-06
 
-This is the one dated statement of what each host has shown. Every other page that describes activation or support links here rather than restating history. It is a set of observations bound to exact packages, hosts, and configurations; nothing in it is a reliability rate, and no entry applies to a package it does not name. The current package is 4.3.0; no receipt exists on it yet, and the newest receipts below are on 4.2.0, retained at the [immutable 4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json).
+This is the one dated statement of what each host has shown. Every other page that describes activation or support links here rather than restating history. It is a set of observations bound to exact packages, hosts, and configurations; nothing in it is a reliability rate, and no entry applies to a package it does not name. The current package is 4.3.0; its only receipts are the clean install and uninstall checks in the package-validation column, and every behavioral row below is on 4.2.0 or older, retained at the [immutable 4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json).
 
 | Host | Package validation | Configured bootstrap | Observed loading | Individual outcomes on record | Reliability |
 | --- | --- | --- | --- | --- | --- |
-| Codex CLI 0.153.0 | Exact 4.2.0 installed from the approved Git source into an isolated home, all seventeen files byte-identical to the committed package, and removed afterwards; recorded in the [4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json). Schema validation runs in CI. | Deterministic, and observed once: asked by name to enable itself, the agent ran the packaged helper, which resolved a non-empty `AGENTS.override.md` over `AGENTS.md`, previewed, asked once, and wrote one owned block there. Asked to disable, it removed exactly that block. | From the persistent block, twice: once on 4.1.0 from an `AGENTS.md` block in a home whose fixture lived beside operator artifacts, and once on 4.2.0 from an `AGENTS.override.md` block on a clean fixture, the kernel loading before any edit. Explicit `$skiphow` invocation loaded it in the 4.2.0 enable and disable sessions, and on 4.1.0 the kernel was in context again after a native resume and after a native compaction; the [per-claim table](#3x-and-4x-observed-behavior) lists each loading row and the two unrelated requests where it correctly did not load. | 4.1.0: four correct repairs delivered to a synthetic remote, read-only analysis, unrelated requests unloaded, native resume and compaction. 4.2.0: four correct repairs delivered to `fix/catalog` on a synthetic remote and verified from a fresh clone, foreign work preserved, no publication; the [4.2.0 receipts](../evals/receipts/isolated-host-420-20260906/README.md) list the deviations. | Unknown. |
-| Claude Code 2.1.261 | Schema validation passed and the exact 4.2.0 package installed all seventeen files byte for byte and uninstalled cleanly in an empty configuration directory; recorded in the [4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json). | Deterministic: the helper resolves `CLAUDE.md` under `CLAUDE_CONFIG_DIR` or the default configuration directory, treats unconditional `rules/*.md` files as read, and consolidates duplicate copies it can edit. | Never with persistent configuration. Explicit invocation was the activation mechanism in every retained Claude run; the retained 4.1.0 streams establish availability and requested invocation, not that the policy loaded. One bare-prompt pilot did not select it. Isolated authentication is unavailable, so this stays `UNVERIFIED`. | 4.1.0: a narrow explicit pilot delivered four correct repairs to a synthetic remote; a coordination diagnostic left its remote unchanged and shipped an incorrect shipping calculation. | Unknown. |
+| Codex CLI 0.153.0 | Exact 4.3.0 installed from the approved Git source into an isolated home, all seventeen files byte-identical to the committed package, and removed afterwards; recorded in the [ledger](../evals/host-smoke.json), as 4.2.0 was in the [4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json). Schema validation runs in CI. | Deterministic, and observed once: asked by name to enable itself, the agent ran the packaged helper, which resolved a non-empty `AGENTS.override.md` over `AGENTS.md`, previewed, asked once, and wrote one owned block there. Asked to disable, it removed exactly that block. | From the persistent block, twice: once on 4.1.0 from an `AGENTS.md` block in a home whose fixture lived beside operator artifacts, and once on 4.2.0 from an `AGENTS.override.md` block on a clean fixture, the kernel loading before any edit. Explicit `$skiphow` invocation loaded it in the 4.2.0 enable and disable sessions, and on 4.1.0 the kernel was in context again after a native resume and after a native compaction; the [per-claim table](#3x-and-4x-observed-behavior) lists each loading row and the two unrelated requests where it correctly did not load. | 4.1.0: four correct repairs delivered to a synthetic remote, read-only analysis, unrelated requests unloaded, native resume and compaction. 4.2.0: four correct repairs delivered to `fix/catalog` on a synthetic remote and verified from a fresh clone, foreign work preserved, no publication; the [4.2.0 receipts](../evals/receipts/isolated-host-420-20260906/README.md) list the deviations. | Unknown. |
+| Claude Code 2.1.263 | Schema validation passed and the exact 4.3.0 package installed all seventeen files byte for byte and uninstalled cleanly in an empty configuration directory; recorded in the [ledger](../evals/host-smoke.json), as 4.2.0 was on 2.1.261 in the [4.2.0 ledger](https://github.com/mzored/SkipHow/blob/f684eb2f3d2e7baf8b8488e8efb5ac4703d67cff/evals/host-smoke.json). | Deterministic: the helper resolves `CLAUDE.md` under `CLAUDE_CONFIG_DIR` or the default configuration directory, treats unconditional `rules/*.md` files as read, and consolidates duplicate copies it can edit. | Never with persistent configuration. Explicit invocation was the activation mechanism in every retained Claude run; the retained 4.1.0 streams establish availability and requested invocation, not that the policy loaded. One bare-prompt pilot did not select it. Isolated authentication is unavailable, so this stays `UNVERIFIED`. | 4.1.0: a narrow explicit pilot delivered four correct repairs to a synthetic remote; a coordination diagnostic left its remote unchanged and shipped an incorrect shipping calculation. | Unknown. |
 
 Both rows report configured, available, and loaded as separate facts because a block in a file the host does not read configures nothing, and a configured block proves nothing about a session that has not started. Managed policy files on this machine restrict Codex marketplace sources; the helper reports such files and does not evaluate or bypass them.