[abruption]

Summary

Extends the approved #324 route-preset slice with a separate, opt-in saved-recipient address book for ordinary Mac/Linux local/SSH Claude Code and Codex workflows. Existing route-only destinations.json, schema 1 and dp1 revisions retain their meaning; saved recipients use a separate addresses.json store.

• Adds address resolve/add/list/show/discover/reselect/remove and send --address.
• resolve observes only explicitly selected metadata. Saving/reselecting requires the matching as1 observation; an actual send requires the current ab1 address revision and the exact canonical --confirm-target.
• A fresh binding UUID is minted for each add/reselect, including restoration of identical route/recipient values. CAS protects reselect/remove. This is not authentication, rollback protection against the same account/root, or receiver deduplication.
• Each use checks the current preset route/revision and saved recipient evidence before body input or submission. Claude uses its existing target-generation guard. Codex keeps generation unsupported and compares a bounded writer-observation digest, then repeats existing writer checks immediately before queue submission. These are not atomic incarnation or storage-attestation guarantees.
• SSH observes the actual metadata connection's verified host-key fingerprint and pins it for submission. No keyscan, implicit trust enrollment, installed-version probe, account scan or alternate-route fallback is introduced.
• address discover accepts at most 16 explicitly named saved entries, groups identical route/home/key queries, and preserves successful rows on partial failure. list/show read saved configuration only.
• Management and selection errors are sanitized. Unknown results, previews, queued submissions and writer observations never imply consumption/ACK or permission to resend.
• Updates all four CLI-reference locales, their manifest and the generated standalone.

Refs #324. Paired-device, Antigravity and Windows address-book workflows remain explicitly excluded from this approved scope. Ordinary Windows functionality is unchanged. No team directory, authorization delegation, automatic reselection, native generation emulation or experimental handoff is added.

Storage and compatibility

• Strict versioned JSON; duplicate/unknown/malformed records are refused, not repaired. Each store is bounded to 64 KiB and 128 records.
• The address store reuses the existing descriptor-based ownership, ACL, no-follow, regular-file/hardlink, mount, locking and atomic-replacement guards with private static storage parameters. Default preset calls keep their old argument shape and behavior.
• Reads do not initialize missing configuration. Only opted-in address invocations read the address store. No body, credentials, executable, SSH options, permissions, raw process metadata or receipt authority is persisted in an address.
• Shared/unsafe ancestor directories and ownership-ignoring macOS mounts remain refused. No filesystem permissions, mount settings, global configuration or installed tools are changed.
• Preset and address files are not one atomic transaction. An invocation freezes its checked values; later mutation does not cancel an already expanded invocation. Dry-run is a snapshot, not a reservation or guarantee about the next send.

Independent review

Before pushing this expansion, Claude Code 2.1.308 (claude-opus-5-5, confirmed by response metadata) and Codex CLI 0.163.0 reviewed the same immutable, sanitized source/test evidence independently and non-interactively. Codex's actual backend model identity was not exposed. Review input SHA-256: 05ec775e89f2913db31e25334307fd4282222e9b2f633921e9b9be5804f46bd8; both exited successfully with the input unchanged. Neither review is a native-delivery or platform acceptance test.

Confirmed findings were checked against source and corrected with regressions: literal Claude PID response binding, sanitizing remote selection failures, refusing ambiguous named selections after partial discovery, stale preset classification, dash-prefixed remote selectors, and structured no-retry refusal when the writer changes at the effect boundary. These small follow-up edits are validated by Codex/tests; the external CLIs did not re-review an identical final tree. Optional broad Unicode-policy changes were not silently adopted.

Translation review

Antigravity CLI 1.4.5 was invoked afresh with gemini-3.8-flash-medium, medium thinking, plan/sandbox mode and a five-minute bound. Input was the English and existing Korean/Japanese/Simplified Chinese preset/address sections plus relevant implementation context; no private configuration or credentials were supplied. Exit 0, structured success, 196.801 seconds; the CLI reported two internal turns. Backend identity/tool-use details were not independently exposed. Codex applied only verified wording corrections and rejected a suggestion that changed the incarnation guarantee.

• Prompt SHA-256: 16b7a67a3ed5cb4a4adb273b9c0fed8cb17ae02afeddc51fee812605229ba2a4
• Evidence SHA-256: 490c17a814121df471c2f6e75812fb93825b7b3b69c4dadfa493b21635cca608

Validation and limits

Candidate d004928f7eeb9f9985f23730d90b0bfd80f92ddd: 59 focused address storage/selection/flow/submission-boundary tests pass on Python 3.9.6 and 3.13.7; all 65 documentation tests, generator --check and git diff --check pass. The final read-only subagent audit caught a POSIX-path fixture that would stringify differently on Windows; it now uses PurePosixPath. All new native sends and SSH endpoints are mocked; temporary stores, sockets and subprocess boundary fixtures are not evidence of live agent consumption or a whole-platform guarantee.

The prescribed local temporary root is on an ownership-ignoring external volume with a group-writable ancestor. An unfiltered local full run exposed 29 existing preset-test failures (3 failures, 26 errors). The exact IDs, failure kinds and signatures were reproduced using original 6510c93 preset code loaded in memory, without weakening production guards. A final Python 3.13 dev-mode full-discovery audit excludes only those 29 proven baseline IDs: 1415 retained tests pass, 21 skipped, zero failures/errors. This is not an unfiltered green full-suite claim. New address lifecycle positives use clearly labeled controlled-metadata fixtures; native ownership-enforcing CI remains a separate gate. An initial audit harness used StringIO for stderr and broke two MCP fileno checks; that harness was corrected to use real file descriptors before rerunning.

Exact-head CI for d004928f7eeb9f9985f23730d90b0bfd80f92ddd: run 39891532335 succeeded, and all 28 PR checks pass, including the unfiltered Ubuntu full suite, macOS/Windows test jobs, distribution, dependency/security checks and release gate. This is distinct from the constrained local audit above. No new inline automatic-review findings were present at the verification snapshot; this is not a claim that a new exact-head model review has completed. Previous 6510c93 reviews are historical evidence for the original preset slice. The runtime version remains 1.2.1 until a separately authorized release-preparation change.

Approval gates

Isolated local integration of #325/#328/#329/#330/#331/#332 was checked at detached commit 0511ef4a6ee7ae0b2866193db963ac18a563e001. All six feature heads are included; source-level parser/import/documentation conflicts were resolved only in that local worktree, and the standalone was regenerated. Python 3.9 focused composition suite: 110 pass; documentation: 65 pass; six new cross-feature regressions pass. Combined full discovery retains 1698 passing tests, 23 skipped, excluding exactly 35 independently reproduced environment-baseline method IDs (29 preset methods and six original #330 SSH-storage methods, with their subtest events counted separately). No production permission guard, fixture assertion or real filesystem permission was weakened. This is not unfiltered combined-tree CI or native-delivery acceptance. Local integration commits are not pushed PR/main merges; sequential public merges will still require current-head conflict resolution and checks.

• No merge, tag, release, package publication, global installation, operations change or real agent/model delivery test is authorized by this PR.
• The sibling v1.3 features are verified separately and in an isolated combined tree; local integration commits are not public PR/main merges.
• Human review and normal repository protections remain required. No admin bypass or review-request mention is included.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T09:14:43.393999Z	6510c93	PR opened
🔒 Security Review	✅ Completed 2026-10-22T09:15:35.753553Z	6510c93	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.