fix: align host parity with host-owned permissions

Author: rockyshi1993

hooks/_runtime/evidence/codex-skill-route-pass.v1.json

@@ -5,24 +5,24 @@
   "hostVariant": "codex-cli/exec-user-global-local-stdio",
   "testedVersion": "codex-cli 0.145.0 / source candidate 1.19.2",
   "protocol": "MCP 2024-11-05",
-  "runtimeContractDigest": "1233b302908e8080ae6c2c15e21c91c0b002f7f559181a0b30713a322d65d45b",
+  "runtimeContractDigest": "bb67159b9e56e6d411f766e17eb7f844b961ad4586c418150e32015528760214",
   "hostAdapterDigest": "01b3456fe5de1a8425c4a63d40cecc16bbbf83b51bfeca794667ed772ea2a23e",
-  "sourceEvidenceDigest": "aa3257b9b24713bb1fdfe02c9634e38a22b83d5b1d80e631cb332d3483959928",
+  "sourceEvidenceDigest": "669277b85ffe34f355415ff8aac513c5c5a013993043a5ef2f96141fafeaf165",
   "sourceProbe": {
     "schemaVersion": "SkillRouteS15EvidenceV1",
-    "probeRunId": "s15-codex-probe-17b57917-51e0-4ea2-971d-50e17ccf5f85",
+    "probeRunId": "s15-codex-probe-6444b046-0df9-4805-a836-318ad2a3083e",
     "authorizationSource": "isolated-probe-authority",
     "contextSource": "host-hooks",
     "observationMode": "hook-post-history",
     "receiptStatus": "relevant-complete",
-    "completedAt": "2026-08-27T13:08:42.627Z"
+    "completedAt": "2026-08-27T14:32:52.422Z"
   },
   "runtimeBinding": {
     "source": "isolated-source-candidate",
-    "expectedDigest": "1233b302908e8080ae6c2c15e21c91c0b002f7f559181a0b30713a322d65d45b",
-    "generationDigest": "1233b302908e8080ae6c2c15e21c91c0b002f7f559181a0b30713a322d65d45b",
-    "modeReceiptDigest": "1233b302908e8080ae6c2c15e21c91c0b002f7f559181a0b30713a322d65d45b",
-    "routeEnvelopeDigest": "1233b302908e8080ae6c2c15e21c91c0b002f7f559181a0b30713a322d65d45b"
+    "expectedDigest": "bb67159b9e56e6d411f766e17eb7f844b961ad4586c418150e32015528760214",
+    "generationDigest": "bb67159b9e56e6d411f766e17eb7f844b961ad4586c418150e32015528760214",
+    "modeReceiptDigest": "bb67159b9e56e6d411f766e17eb7f844b961ad4586c418150e32015528760214",
+    "routeEnvelopeDigest": "bb67159b9e56e6d411f766e17eb7f844b961ad4586c418150e32015528760214"
   },
   "probe": {
     "schemaVersion": "SkillRouteProbeSummaryV1",

hooks/_runtime/host-skill-route-capabilities.v1.json

@@ -13,10 +13,10 @@
       "status": "PASS",
       "testedVersion": "codex-cli 0.145.0 / source candidate 1.19.2",
       "protocol": "MCP 2024-11-05",
-      "runtimeContractDigest": "1233b302908e8080ae6c2c15e21c91c0b002f7f559181a0b30713a322d65d45b",
+      "runtimeContractDigest": "bb67159b9e56e6d411f766e17eb7f844b961ad4586c418150e32015528760214",
       "hostAdapterDigest": "01b3456fe5de1a8425c4a63d40cecc16bbbf83b51bfeca794667ed772ea2a23e",
       "evidenceRef": "hooks/_runtime/evidence/codex-skill-route-pass.v1.json",
-      "evidenceDigest": "dc16e87091ef193ca2ff63ff65b7841f4973b331a3836d353b2733bdea3e7e6c",
+      "evidenceDigest": "f5bcb910337b20ba820fc4716dcd9f086230604f7e2893ead08ac4bd1f68dc7a",
       "entrySurface": "codex exec --ephemeral",
       "bootstrapDelivery": "stable user-global Hook launcher UserPromptSubmit or profile_context_plan fallback",
       "defaultEligible": true

hooks/_runtime/workflow-root-registry.v1.json

@@ -11,10 +11,10 @@
     },
     {
       "ref": "scripts/lib/host-parity-scorecard.js",
-      "digest": "4f719c98f0c9116ffdebfae582e1603495adb2649612b2ea18338764267895e4"
+      "digest": "369ddd5e734a0da918406ddaeb30f97ff77d5dfe5eb67fe9125099d6cdf160af"
     }
   ],
-  "sourceDigest": "f27ed972829e0b988246fbe8955a9b5ab6a0d9ab92a9d9ed88e3e867b43d4397",
+  "sourceDigest": "dec93e76b16fb4d161a1583ec22f5fe1159f185f1793c56c7793900bf5f6a20a",
   "baseBundles": {
     "chat": [],
     "resume": [

hooks/_runtime/workflow-root-registry.v2.json

@@ -1089,10 +1089,10 @@
     },
     {
       "ref": "scripts/lib/host-parity-scorecard.js",
-      "digest": "4f719c98f0c9116ffdebfae582e1603495adb2649612b2ea18338764267895e4"
+      "digest": "369ddd5e734a0da918406ddaeb30f97ff77d5dfe5eb67fe9125099d6cdf160af"
     }
   ],
-  "sourceDigest": "a9e9a9ec3920dc93a6e18812d9cb15c4fc4ebbc14accc6dfe55fd5163bda014d",
+  "sourceDigest": "46e53587dd323cdc3c2c7b31b8ebaabfef63138b6d3d767473fcb554807484e6",
   "routeRevision": "cd86a6045a9fc8cd72b094254bc68bef4210e0bb4639a7c2d755f8368aa3310b",
-  "registryDigest": "d4374e29da84a8dbd6688162406995401ccb9da7433be4a891628be224e77dd2"
+  "registryDigest": "dfc208ce79d21b76cb85a19db58f37d89d071ce1a884f4ff3c821a31295247a8"
 }

scripts/lib/cli-maintenance-commands.js

@@ -1006,7 +1006,7 @@ function buildCliMaintenanceCommands(ctx) {
       console.log(c.dim('  GrokTurnChecklist: PC0~PC7 → Skill bundle → work → report+memory (see host-parity-grok.md)'))
       console.log()
     } else if (hostParity && hostParity.hardReady) {
-      console.log(c.dim('  Grok HostParity: PreTool deny + path-observable ready. Still cannot claim UserPromptSubmit inject or Stop hard-block.'))
+      console.log(c.dim('  Grok HostParity: host-owned PreTool operations + path-observable ready. Still cannot claim UserPromptSubmit inject or Stop hard-block.'))
       console.log(c.dim('  Prefer `devcodex grok` in child Git projects for Full kernel evidence.'))
       console.log(c.dim('  GrokTurnChecklist + Intent→Skill bundle still required (passive host has no inject).'))
       console.log()

scripts/lib/host-enforcement-matrix.js

@@ -2,7 +2,7 @@
 
 /**
  * HostEnforcementMatrixV1 — canonical hosts, process-enforcement truth source.
- * hard-deny | stop-block | honesty-only | N/A+platform-limit
+ * host-owned-advisory | stop-block | honesty-only | N/A+platform-limit
  */
 
 const HOST_ENFORCEMENT_MATRIX_V1 = Object.freeze({
@@ -11,42 +11,44 @@ const HOST_ENFORCEMENT_MATRIX_V1 = Object.freeze({
     copilot: Object.freeze({
       id: 'copilot',
       label: 'GitHub Copilot',
-      preToolMutationNoCp2: 'hard-deny',
-      preToolNotes: 'CLI hooks when configured; IDE may be instruction-fallback → honesty-only for some surfaces',
+      preToolMutationNoCp2: 'host-owned-advisory',
+      preToolNotes: 'Operation permission belongs to the active host; DevCodex may emit advisory context only',
       stopCompletion: 'stop-block',
       upsInject: 'N/A+platform-limit',
       upsNotes: 'CLI vs IDE ceilings differ; never claim full IDE hook parity'
     }),
     claude: Object.freeze({
       id: 'claude',
       label: 'Claude Code',
-      preToolMutationNoCp2: 'hard-deny',
+      preToolMutationNoCp2: 'host-owned-advisory',
+      preToolNotes: 'Operation permission belongs to Claude Code; DevCodex does not emit allow/deny/ask',
       stopCompletion: 'stop-block',
       upsInject: 'hard-deny',
       upsNotes: 'additionalContext / inject when hook-enforced'
     }),
     codex: Object.freeze({
       id: 'codex',
       label: 'Codex',
-      preToolMutationNoCp2: 'hard-deny',
+      preToolMutationNoCp2: 'host-owned-advisory',
+      preToolNotes: 'Operation permission belongs to Codex; DevCodex does not emit allow/deny/ask',
       stopCompletion: 'stop-block',
       upsInject: 'hard-deny',
       upsNotes: 'systemMessage + additionalContext when configured'
     }),
     gemini: Object.freeze({
       id: 'gemini',
       label: 'Gemini CLI',
-      preToolMutationNoCp2: 'hard-deny',
-      preToolNotes: 'When Gemini hooks/settings support PreTool deny; otherwise document honesty-only in runtime probe',
+      preToolMutationNoCp2: 'host-owned-advisory',
+      preToolNotes: 'Operation permission belongs to Gemini; DevCodex does not emit allow/deny/ask',
       stopCompletion: 'stop-block',
       upsInject: 'N/A+platform-limit',
       upsNotes: 'Do not claim UPS inject without host evidence'
     }),
     grok: Object.freeze({
       id: 'grok',
       label: 'Grok Build',
-      preToolMutationNoCp2: 'hard-deny',
-      preToolNotes: 'decision:deny supported on PreToolUse',
+      preToolMutationNoCp2: 'host-owned-advisory',
+      preToolNotes: 'Operation permission belongs to Grok; DevCodex returns no PreTool decision',
       stopCompletion: 'stop-block',
       stopNotes: 'conditional decision:block when lastAssistantMessage present',
       upsInject: 'N/A+platform-limit',
@@ -55,8 +57,8 @@ const HOST_ENFORCEMENT_MATRIX_V1 = Object.freeze({
     cursor: Object.freeze({
       id: 'cursor',
       label: 'Cursor Beta',
-      preToolMutationNoCp2: 'hard-deny',
-      preToolNotes: 'Local IDE/CLI/Headless user hooks support preToolUse allow/deny with failClosed; Cloud user hooks are unavailable',
+      preToolMutationNoCp2: 'host-owned-advisory',
+      preToolNotes: 'Operation permission belongs to Cursor; Cloud user hooks are unavailable',
       stopCompletion: 'stop-followup',
       stopNotes: 'Local stop uses bounded followup_message with loop_limit=5; not a Cloud claim',
       upsInject: 'session-start-only',

scripts/lib/host-parity-scorecard.js

@@ -2,7 +2,7 @@
 
 /**
  * HostParityScorecardV1 — Grok vs Codex capability honesty for doctor/status.
- * Full ≠ Codex API isomorphism; Full = launcher rules bind + PreTool deny path + path-observable.
+ * Full ≠ Codex API isomorphism; Full = launcher rules bind + host-owned operation path + path-observable.
  * PF-165: GrokTurnChecklist + Intent→Skill bundle + doctor repairSteps (no parallel system).
  */
 
@@ -80,10 +80,10 @@ function buildCheckRepairCatalog(guidance) {
       command,
       detail: 'Reconcile stale receipts or managed configuration drift without reporting present runtime files as missing.'
     },
-    denyAdapterContract: {
-      check: 'denyAdapterContract',
+    operationAdvisoryContract: {
+      check: 'operationAdvisoryContract',
       command,
-      detail: 'lifecycle-host-adapters must export adaptGrokOutput and decision:deny mapping.'
+      detail: 'lifecycle-host-adapters must export adaptGrokOutput and leave operation decisions to the host.'
     },
     pathObservableCapability: {
       check: 'pathObservableCapability',
@@ -327,19 +327,19 @@ function fileExists(filePath) {
   }
 }
 
-function readAdapterDenyContract(adapterPath) {
+function readAdapterOperationContract(adapterPath) {
   if (!fileExists(adapterPath)) {
-    return { present: false, hasAdaptGrok: false, hasDenyDecision: false }
+    return { present: false, hasAdaptGrok: false, operationPermissionHostOwned: false }
   }
   try {
     const text = fs.readFileSync(adapterPath, 'utf8')
     return {
       present: true,
       hasAdaptGrok: /function adaptGrokOutput|adaptGrokOutput\s*\(/.test(text),
-      hasDenyDecision: /decision:\s*['"]deny['"]/.test(text)
+      operationPermissionHostOwned: /isOperationPermissionEvent\(originalEvent\)\)\s*return\s*\{\s*\}/.test(text)
     }
   } catch {
-    return { present: false, hasAdaptGrok: false, hasDenyDecision: false }
+    return { present: false, hasAdaptGrok: false, operationPermissionHostOwned: false }
   }
 }
 
@@ -408,7 +408,7 @@ function evaluateGrokHostParity(input = {}) {
   const pluginRoot = grokTarget.files.plugin
   const codexAdapter = path.join(codexRuntime, 'hooks', '_runtime', 'lifecycle-host-adapters.cjs')
   const codexBootstrap = path.join(codexRuntime, 'hooks', '_runtime', 'lifecycle-bootstrap-state.cjs')
-  const deny = readAdapterDenyContract(codexAdapter)
+  const operationAdapter = readAdapterOperationContract(codexAdapter)
   const bootstrap = readBootstrapCapability(codexBootstrap)
 
   const hasGlobalKernel = input.hasGlobalKernel !== undefined
@@ -440,7 +440,11 @@ function evaluateGrokHostParity(input = {}) {
     codexAdapterContractReady,
     grokAdapterContractReady,
     managedConfigCurrent,
-    denyAdapterContract: Boolean(deny.present && deny.hasAdaptGrok && deny.hasDenyDecision),
+    operationAdvisoryContract: Boolean(
+      operationAdapter.present &&
+      operationAdapter.hasAdaptGrok &&
+      operationAdapter.operationPermissionHostOwned
+    ),
     pathObservableCapability: Boolean(bootstrap.present && bootstrap.grokPathObservable),
     globalGrokPluginInstalled: hasGlobalGrokPlugin,
     globalGrokPluginConfigured: hasGlobalGrokConfig
@@ -451,7 +455,7 @@ function evaluateGrokHostParity(input = {}) {
     && checks.codexAdapterContractReady
     && checks.grokAdapterContractReady
     && checks.managedConfigCurrent
-    && checks.denyAdapterContract
+    && checks.operationAdvisoryContract
     && checks.pathObservableCapability
     && checks.globalGrokPluginInstalled
     && checks.globalGrokPluginConfigured
@@ -500,7 +504,7 @@ function evaluateGrokHostParity(input = {}) {
       codexBootstrap: fileExists(codexBootstrap) ? codexBootstrap : null,
       pluginRoot: hasGlobalGrokPlugin ? pluginRoot : null,
       scope: 'user-global',
-      deny,
+      operationAdapter,
       bootstrap,
       physicalPresence: {
         globalKernelFilesPresent: hasGlobalKernel,
@@ -519,7 +523,7 @@ function evaluateGrokHostParity(input = {}) {
     recommendedEntry,
     cannotClaim,
     userVisibleSummary: hardReady
-      ? 'Grok HostParity: full-capable (PreTool deny + path-observable + kernel). Use `devcodex grok` for Full session evidence. Inject/Stop still Partial. Follow GrokTurnChecklist + Intent→Skill bundle.'
+      ? 'Grok HostParity: full-capable (host-owned PreTool operations + path-observable + kernel). Use `devcodex grok` for Full session evidence. Inject/Stop still Partial. Follow GrokTurnChecklist + Intent→Skill bundle.'
       : `Grok HostParity: partial — failed: ${failedChecks.join(', ') || 'unknown'}. Fix: ${repairPreview || fallbackFix}. Then doctor --json hostParity.repairSteps.`
   }
 
@@ -596,7 +600,7 @@ module.exports = {
   classifyGrokTurnOmissionSample,
   classifyWorkspaceRootScanSample,
   classifyTtfvOmissionSample,
-  readAdapterDenyContract,
+  readAdapterOperationContract,
   readBootstrapCapability
 }
 

scripts/test-host-parity-remaining.js

@@ -3,11 +3,11 @@
 
 /**
  * Remaining HostParity deliverables smoke:
- * - cross-host hard-block matrix not weakened
- * - gemini/grok deny shapes
+ * - cross-host operation authority remains host-owned
+ * - operation outputs carry no DevCodex permission decision
  * - SessionStart stamp
  * - entry check compose
- * - lifecycle PreToolUse deny path via host adapter (fixture)
+ * - lifecycle PreToolUse advisory path via host adapter (fixture)
  */
 
 const assert = require('assert')
@@ -37,46 +37,45 @@ process.once('exit', cleanupTempFixtures)
 
 const hookOut = buildLifecycleHookOutput({ env: {}, enforcementMode: 'safety-only' })
 
-// Cross-host: Codex/Claude not weakened
+// Cross-host: operation permission always belongs to the host.
 assert.strictEqual(hookOut.eventSupportsHardBlock('codex', 'UserPromptSubmit'), true)
-assert.strictEqual(hookOut.eventSupportsHardBlock('codex', 'PreToolUse'), true)
+assert.strictEqual(hookOut.eventSupportsHardBlock('codex', 'PreToolUse'), false)
 assert.strictEqual(hookOut.eventSupportsHardBlock('codex', 'Stop'), true)
 assert.strictEqual(hookOut.eventSupportsHardBlock('claude', 'UserPromptSubmit'), true)
 assert.strictEqual(hookOut.eventSupportsHardBlock('claude', 'Stop'), true)
-assert.strictEqual(hookOut.eventSupportsHardBlock('claude', 'PreToolUse'), true)
-// Grok: PreTool + conditional Stop; UPS remains non-hard
-assert.strictEqual(hookOut.eventSupportsHardBlock('grok', 'PreToolUse'), true)
+assert.strictEqual(hookOut.eventSupportsHardBlock('claude', 'PreToolUse'), false)
+// Grok: PreTool is host-owned; conditional Stop remains a workflow-validity surface.
+assert.strictEqual(hookOut.eventSupportsHardBlock('grok', 'PreToolUse'), false)
 assert.strictEqual(hookOut.eventSupportsHardBlock('grok', 'UserPromptSubmit'), false)
 assert.strictEqual(hookOut.eventSupportsHardBlock('grok', 'Stop'), true)
 // Copilot / instruction-fallback
-assert.strictEqual(hookOut.eventSupportsHardBlock('copilot', 'PreToolUse'), true)
+assert.strictEqual(hookOut.eventSupportsHardBlock('copilot', 'PreToolUse'), false)
 assert.strictEqual(hookOut.eventSupportsHardBlock('jetbrains-copilot', 'PreToolUse'), false)
 
-// Gemini adapter still converts Claude permission shape
+// Operation adapters strip legacy permission shapes for every host.
 const geminiDeny = adaptHostOutput('gemini', 'BeforeTool', {
   hookSpecificOutput: {
     permissionDecision: 'deny',
     permissionDecisionReason: 'gemini-danger'
   }
 })
-assert.strictEqual(geminiDeny.decision, 'deny')
-assert.strictEqual(geminiDeny.reason, 'gemini-danger')
+assert.deepStrictEqual(geminiDeny, {})
 
-// Grok deny official shape
+// Grok operation output is also empty.
 const grokDeny = adaptHostOutput('grok', 'PreToolUse', {
   hookSpecificOutput: {
     permissionDecision: 'deny',
     permissionDecisionReason: 'workflow-invalid'
   }
 })
-assert.deepStrictEqual(grokDeny, { decision: 'deny', reason: 'workflow-invalid' })
+assert.deepStrictEqual(grokDeny, {})
 
-// Codex path through adaptHostOutput is uncommon; ensure non-grok non-gemini does not strip to only decision
+// Codex may carry advisory context, but never a permission decision.
 const codexOut = adaptHostOutput('codex', 'PreToolUse', {
   continue: true,
   hookSpecificOutput: { permissionDecision: 'deny', permissionDecisionReason: 'c' }
 })
-assert.strictEqual(codexOut.hookSpecificOutput.permissionDecision, 'deny')
+assert.ok(!codexOut.hookSpecificOutput?.permissionDecision)
 
 function readIfExists(file) {
   return fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null

scripts/test-host-parity-scorecard.js

@@ -89,7 +89,7 @@ assert.strictEqual(ready.hardReady, true)
 assert.strictEqual(ready.tier, 'full-capable')
 assert.strictEqual(ready.failedChecks.length, 0)
 assert.ok(!ready.repairSteps.some((step) => step.status === 'failed'))
-assert.ok(ready.checks.denyAdapterContract)
+assert.ok(ready.checks.operationAdvisoryContract)
 assert.ok(ready.checks.pathObservableCapability)
 assert.ok(Array.isArray(ready.cannotClaim) && ready.cannotClaim.length >= 3)
 assert.strictEqual(MIN_CANNOT_CLAIM.length, 4)
@@ -172,7 +172,7 @@ assert.match(formatGrokTurnChecklistMarkdown(), /scan-hygiene|ttfv-first-deliver
 const regOnly = buildGrokRepairSteps({
   globalKernelAgentsMd: true,
   globalCodexLifecycleReachable: true,
-  denyAdapterContract: true,
+  operationAdvisoryContract: true,
   pathObservableCapability: true,
   globalGrokPluginInstalled: true,
   globalGrokPluginConfigured: false
@@ -271,14 +271,14 @@ assert.match(entryCheckAssistSuffix({ project: 'x', intent: 'fix' }), /Intent→
 assert.match(entryCheckAssistSuffix({ project: 'x', intent: 'fix' }), /fix-default/)
 assert.match(entryCheckAssistSuffix({ project: 'x', intent: 'audit' }), /TTFV|workspace-root|scan-hygiene/i)
 
-// Smoke: deny path used by PreToolUse
-const deny = adaptHostOutput('grok', 'PreToolUse', {
+// Smoke: PreToolUse never carries a DevCodex permission decision.
+const operationOutput = adaptHostOutput('grok', 'PreToolUse', {
   hookSpecificOutput: {
     permissionDecision: 'deny',
     permissionDecisionReason: 'workflow-invalid'
   }
 })
-assert.deepStrictEqual(deny, { decision: 'deny', reason: 'workflow-invalid' })
+assert.deepStrictEqual(operationOutput, {})
 
 // W8: extra field names for assistant text
 const payloadApi = buildLifecyclePayloadUtils({