SHELL-DAG: migrate six retained_foreign call sites to typed operations

dag/extdeps/llm/codex_app_server.dag

@@ -1,6 +1,6 @@
 module extdeps.llm.codex_app_server
 
-import std.types { NonEmptyStr, String, FilePath, Int }
+import std.types { NonEmptyStr, String, FilePath, Int, Bool }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Uri, Https }
@@ -64,6 +64,27 @@ type CodexAppServerExecutable {
   path: FilePath
 }
 
+// The `generate-json-schema` subcommand is a separate invocation of the SAME executable this
+// module cites the protocol schema from (codex_app_server_subject_note) — it is the tool this
+// module's method vocabulary was derived from, not a different product surface.
+service codex_app_server.Cli {
+  operation GenerateJsonSchema {
+    input { executable: CodexAppServerExecutable, output_dir: FilePath }
+    output {
+      success: Bool from "exit_success"
+      stdout: String from "stdout"
+      stderr: String from "stderr"
+    }
+    transport shell {
+      argv: ["{executable.path}", "app-server", "generate-json-schema", "-o", "{output_dir}"]
+    }
+    exit {
+      0 => Unit
+      nonzero => String "codex app-server generate-json-schema failed"
+    }
+  }
+}
+
 data codex_app_server_request_line_emit_note: String = "Request lines are BUILT through extdeps.languages.json.emit, not hand-authored as escaped string literals (review 50540). The literals they replace carried their own JSON grammar — braces, quoting and separators spelled out in \\{ and \\\" escapes — which is a second JSON representation sitting beside the module that already owns one (DESIGN §3 dual representation), and it is the representation that cannot escape a value: a method name or client field containing a quote would have produced a malformed frame with nothing to refuse it. serialize_json applies the escaping, so the wire bytes are a consequence of the modeled value rather than of an author getting the backslashes right."
 
 fn codex_app_server_jsonrpc_request(id: Int, method: String, params: JsonValue) -> NonEmptyStr {

dag/extdeps/rust/cargo_build.dag

@@ -1,6 +1,6 @@
 module extdeps.cargo_build
 
-import std.types { FilePath }
+import std.types { FilePath, NonEmptyStr }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 
@@ -13,6 +13,8 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 
 data cargo_compile_env: Map<String, String> = empty_map()
 
+data cargo_test_with_cwd_env_note: String = "cargo.Build.TestWithCwdEnv: env composes cwd (-C) and process env vars (leading VAR=val argv words) into ONE argv vector, matching the shell.Find.Files precedent of argv-native env -C workdir substitution — no shell is needed to chain a cd/export prefix onto a cargo invocation (SHELL-DAG dissolution of the interpreter_dispatch_bijection_real_roster_transport retained_foreign multi-line script: set -euo pipefail; cd; export; two cargo test invocations, now two sequential typed calls with caller-side short-circuit)."
+
 fn cargo_build_jobs_flag(count: Int) -> List<String> {
   ["--jobs", to_string(count)]
 }
@@ -93,6 +95,22 @@ service cargo.Build {
     }
   }
 
+  operation TestWithCwdEnv {
+    input { workdir: FilePath, cargo_bin: NonEmptyStr, env: List<String> = [], extra_args: List<String> = [] }
+    output {
+      success: Bool from "exit_success"
+      exit_code: Int from "exit_code"
+      stdout: String from "stdout"
+      stderr: String from "stderr"
+    }
+    transport shell { argv: ["env", "-C", "{workdir}", env, "{cargo_bin}", "test", extra_args] }
+    exit {
+      0 => Unit
+      101 => String "Tests failed"
+      nonzero => String "cargo test error"
+    }
+  }
+
   operation Nextest {
     input { extra_args: List<String> = [], build_jobs_args: List<String> = [] }
     output {

dag/extdeps/shell.dag

@@ -13,6 +13,8 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 
 data find_files_and_symlinks_positional_note: String = "The script body is a FIXED literal owned here, and root arrives as the positional parameter $1 rather than being spliced into it — so no path can escape a quote, which is exactly what a caller-side concat into a single-quoted find string permitted (review 50535). The pipe to sort stays inside the operation because it is load-bearing: find walks directories in filesystem order, and the caller digests the resulting listing into a tree identity, so an unsorted read would make that identity depend on traversal order. It cannot move into the substrate today — std.primitives declares a sort contract but no callable sort exists (probed, 2026-08-08), which is the dissolve-on for folding this ordering back out of the shell. GNU find -printf keeps this operation Linux-only, per the caller's own linux_find_note."
 
+data files_by_name_sorted_positional_note: String = "shell.Find.FilesByNameSorted: root and name_glob arrive as positional parameters ($1, $2) rather than being spliced into the script body, for the same reason as FilesAndSymlinksWithMode above — no path or glob can escape a quote. The pipe to sort stays inside the operation because the caller digests the listing into a manifest and needs traversal-order independence (SHELL-DAG dissolution of package_delivery.dag's protocol-schema-bundle file listing, previously a retained_foreign concat-built find | sort script)."
+
 
 service shell.Find {
   operation ListDirs {
@@ -61,6 +63,27 @@ service shell.Find {
       nonzero => String "Find command failed"
     }
   }
+
+  operation FilesByNameSorted {
+    input { root: FilePath, name_glob: NonEmptyStr }
+    output {
+      success: Bool from "exit_success"
+      stdout: String from "stdout"
+      stderr: String from "stderr"
+    }
+    readonly
+    transport shell {
+      argv: [
+        "sh", "-c",
+        "find \"$1\" -type f -name \"$2\" | sort",
+        "sh", "{root}", "{name_glob}",
+      ]
+    }
+    exit {
+      0 => Unit
+      nonzero => String "Find command failed"
+    }
+  }
 }
 
 service shell.Env {
@@ -257,6 +280,16 @@ service shell.Remove {
       nonzero => String "rm -rf failed"
     }
   }
+
+  operation EmptyDirectory {
+    input { path: FilePath }
+    output { success: Bool from "exit_success" }
+    transport shell { argv: ["rmdir", "{path}"] }
+    exit {
+      0 => Unit "Directory removed; rmdir refuses when non-empty, which is the safety this relies on"
+      nonzero => String "rmdir failed"
+    }
+  }
 }
 
 service shell.Move {
@@ -269,6 +302,16 @@ service shell.Move {
       nonzero => String "mv failed"
     }
   }
+
+  operation NoReplaceDirectory {
+    input { source: FilePath, destination: FilePath }
+    output { success: Bool from "exit_success" }
+    transport shell { argv: ["mv", "-T", "{source}", "{destination}"] }
+    exit {
+      0 => Unit "Directory moved; -T treats destination as a normal path (no nest into an existing dir), equivalent to renameat2(RENAME_NOREPLACE) for directories on Linux"
+      nonzero => String "mv -T failed"
+    }
+  }
 }
 
 service shell.Chmod {

dag/gunbc/package_delivery.dag

@@ -48,6 +48,7 @@ import extdeps.version { VersionIdentity }
 import extdeps.http.client
 import extdeps.shell
 import extdeps.shell.exec
+import extdeps.llm.codex_app_server { CodexAppServerExecutable }
 import extdeps.filesystem.filesystem_io
 import extdeps.tools.npm
 import gunbc.host_cli_dependency {
@@ -72,7 +73,6 @@ import extdeps.languages.json.emit {
   JsonKeyValue, serialize_json,
 }
 import extdeps.languages.json.parse { parse_json }
-import gunbc.retained_shell_script { retained_foreign }
 import extdeps.ollama.binary_release {
   OllamaBinaryRelease,
   ollama_required_release,
@@ -1409,31 +1409,17 @@ fn observe_protocol_schema_identity(
   if made.success == false {
     none
   } else {
-    let script = retained_foreign(
-      body: concat(
-        "'",
-        concat(
-          native_executable as String,
-          concat(
-            "' app-server generate-json-schema -o '",
-            concat(schema_dir as String, "'"),
-          ),
-        ),
-      ),
-      reason: "Codex generate-json-schema observation pending typed WitnessBin argv enrollment" as NonEmptyStr,
+    let gen = codex_app_server.Cli.GenerateJsonSchema(
+      executable: CodexAppServerExecutable { path: native_executable },
+      output_dir: schema_dir,
     )
-    let gen = shell.Exec.Run(script: script)
     if gen.success == false {
       none
     } else {
-      let list_script = retained_foreign(
-        body: concat(
-          "find '",
-          concat(schema_dir as String, "' -type f -name '*.json' | sort"),
-        ),
-        reason: "Protocol schema bundle file list pending typed Find enrollment" as NonEmptyStr,
+      let listed = shell.Find.FilesByNameSorted(
+        root: schema_dir,
+        name_glob: "*.json" as NonEmptyStr,
       )
-      let listed = shell.Exec.Run(script: list_script)
       if listed.success == false {
         none
       } else {
@@ -1725,41 +1711,48 @@ fn validate_existing_codex_runtime_release(
 
 data codex_runtime_release_publish_note: String = "Publication uses a UNIQUE same-parent staging directory (mktemp -d .<hex>.publishing.XXXXXX), never a deterministic .<hex>.publishing path. Tree-identity scratch (materialized-tree.canonical) is ALWAYS outside the publishing/release tree — passed as scratch_dir — so validation cannot plant a file into the tree it is measuring. Final install is GNU mv -T (no-target-directory): equivalent to renameat2(RENAME_NOREPLACE) for directories on Linux — never nests into an existing winner. On AlreadyExists, delete the contender staging tree and validate the winner with the same external scratch."
 
+// `emptied.success == false` and `moved.success == false` are NOT the same state (review
+// on #8621): the former means the mktemp placeholder was not empty -- something else wrote
+// into a name this call believed was exclusively its own, an exclusivity violation with no
+// established remedy -- while the latter is an ordinary move refusal (destination exists,
+// cross-device, permissions) against a placeholder this call knows is empty and its own.
+// Collapsing both to one Bool, which the pre-typed shell script necessarily did (one exit
+// code), is the state-space conflation DESIGN lists under recurring failure modes; the typed
+// operations below create the distinction, so it is kept to the caller rather than discarded
+// at the binding. The recursive-force cleanup therefore only runs on the move-refusal arm --
+// not-empty is left untouched rather than swept, since rm -rf on a placeholder this call does
+// not own would destroy whatever the other writer put there.
+type UniquePublishingRelocateOutcome
+  = UniquePublishingRelocateReady {
+      path: FilePath
+    }
+  | UniquePublishingPlaceholderNotEmpty
+  | UniquePublishingRelocateRefused
+
 fn relocate_build_root_to_unique_publishing(
   build_root: FilePath,
   parent: FilePath,
   hex: String,
-) -> FilePath? {
+) -> UniquePublishingRelocateOutcome {
   let template = concat(
     parent as String,
     concat("/.", concat(hex, ".publishing.XXXXXX")),
   ) as FilePath
   let staged = shell.Mktemp.DirWithTemplate(template: template)
   if staged.success == false {
-    none
+    UniquePublishingRelocateRefused
   } else {
-    let script = retained_foreign(
-      body: concat(
-        "rmdir '",
-        concat(
-          staged.path as String,
-          concat(
-            "' && mv -T '",
-            concat(
-              build_root as String,
-              concat("' '", concat(staged.path as String, "'")),
-            ),
-          ),
-        ),
-      ),
-      reason: "Exclusive unique publishing relocate: rmdir mktemp placeholder then mv -T build root onto that name" as NonEmptyStr,
-    )
-    let run = shell.Exec.Run(script: script)
-    if run.success == false {
-      let _ = shell.Remove.RecursiveForce(path: staged.path)
-      none
+    let emptied = shell.Remove.EmptyDirectory(path: staged.path)
+    if emptied.success == false {
+      UniquePublishingPlaceholderNotEmpty
     } else {
-      Present { value: staged.path }
+      let moved = shell.Move.NoReplaceDirectory(source: build_root, destination: staged.path)
+      if moved.success == false {
+        let _ = shell.Remove.RecursiveForce(path: staged.path)
+        UniquePublishingRelocateRefused
+      } else {
+        UniquePublishingRelocateReady { path: staged.path }
+      }
     }
   }
 }
@@ -1768,17 +1761,7 @@ fn rename_publishing_noreplace(
   publishing: FilePath,
   dest: FilePath,
 ) -> Bool {
-  let script = retained_foreign(
-    body: concat(
-      "mv -T '",
-      concat(
-        publishing as String,
-        concat("' '", concat(dest as String, "'")),
-      ),
-    ),
-    reason: "Atomic no-nest publication rename (GNU mv -T / renameat2 RENAME_NOREPLACE equivalent for dirs)" as NonEmptyStr,
-  )
-  shell.Exec.Run(script: script).success
+  shell.Move.NoReplaceDirectory(source: publishing, destination: dest).success
 }
 
 fn codex_runtime_release_ready_with_current_link(
@@ -1849,11 +1832,15 @@ fn release_codex_runtime_bundle_immutable(
             parent: parent,
             hex: hex,
           ) {
-            Absent =>
+            UniquePublishingPlaceholderNotEmpty =>
+              CodexRuntimeReleaseFailed {
+                cause: "unique publishing staging placeholder was not empty (exclusivity violation, not swept)" as NonEmptyStr,
+              }
+            UniquePublishingRelocateRefused =>
               CodexRuntimeReleaseFailed {
                 cause: "unique publishing staging relocate refused" as NonEmptyStr,
               }
-            Present { value: publishing } =>
+            UniquePublishingRelocateReady { path: publishing } =>
               if write_codex_runtime_receipt_sidecar(
                 release_root: publishing,
                 receipt_identity: receipt.receipt_identity,
@@ -2568,20 +2555,10 @@ fn finish_bisect_generate_protocol_schema_dir(
   if made.success == false {
     false
   } else {
-    let script = retained_foreign(
-      body: concat(
-        "'",
-        concat(
-          native_executable as String,
-          concat(
-            "' app-server generate-json-schema -o '",
-            concat(schema_dir as String, "'"),
-          ),
-        ),
-      ),
-      reason: "Protocol schema interpreter bisect generate-json-schema pending typed WitnessBin argv enrollment" as NonEmptyStr,
-    )
-    shell.Exec.Run(script: script).success
+    codex_app_server.Cli.GenerateJsonSchema(
+      executable: CodexAppServerExecutable { path: native_executable },
+      output_dir: schema_dir,
+    ).success
   }
 }