Recover and check Codex profiles alongside shared credential pointers

[seathatflowsinourveins]

Scope

One pointer source supplies eight credential-file pointers and RTK telemetry policy to login shells, user services and Codex shell calls. F9 gains a value-free preflight and login-env check; the repaired check accepts NativeStack2604's exact .bash_profile-to-.profile chain before any host mutation.

This retained PR also folds #716 at b63381f877dd1108a0347300f4a3ee765eb1f0d6 and #756 at 5cfb02f7ab11161711bc0de4cb898744bf2296b6, as directed by command-center review review-ns2604-coop-20261007T023012Z. Existing profile-v2 files gain missing render-owned keys through the guarded additive merge; differing operator values stay. --check --host NAME and apply verification report render-owned profile drift by dotted key name. Plain --check remains the repository wiring check. No host configuration is changed by this lane.

The shared controller keeps the landed #752 one-time service-tier migration and native daemon writer confined to codex/config. Profile recovery invokes neither main-config writer nor its completion marker. The Headroom/SocratiCode defaults from #716 remain explicitly authorization-gated. Source decision records, measured receipts and gateway-preview artifacts are carried intact; shared controller/tests/templates and generator-owned inventory tables are composed with the existing #770 changes, with each merged path recorded in the new fold ledger. No new gateway experiment or installation is included.

The review repair also keeps generic and selected Grafana store provenance separate, adds native Read/store-path protection, accepts exact observed legacy export shapes, and defers every host mutation until the frozen paper run finishes.

• Base: 0d5e6506434fab598dee861c749a22e628beb75a, retaining the landed Follow-up residuals: Codex normal tier by default (user 13:22Z), #713/#726 gate-read P2s, #713's macOS-only fixes #752 migration and its tests.
• Lane: lane:foundation; remains draft for the command center's micro-check and cross-family read.
• Landing path: the co-op verifies both folds and requests the command center's retained-head read/ACK; 5f performs the single landing rebase and lands Recover and check Codex profiles alongside shared credential pointers #770 in its ranked queue. This lane publishes content only. Recover Codex profile policy and measure input preprocessing #716 and fix(adoption): report Codex profile drift without replacing values #756 are closed with a record by the co-op after verification, with their branches kept; Avoid duplicate template memory and record native startup counter scopes #823 lands after Recover and check Codex profiles alongside shared credential pointers #770.
• Owned paths: pointer template; managed-block/F9 module and templates/map; separate credential pointer checker; Grafana inventory rows; guard/Read denies and focused tests; secret-storage/decision docs; sanitized receipt and final registries.
• CI follow-up repairs four failing units: selected/generic refusal coverage, two unreleased checksum markers, five current-file citation locators, and a fresh monitoring-only census. The historical Oct4 census and every strict gate assertion remain intact.
• Dependency: #769, verified at b444d148019e705f3f94123cd579fef1d0a8336f. IBKR owner rows/functions remain separate. Its guard hunks touch SECRET_NAMES/POINTER_VARIABLE, ours STORE_PATHS; the second PR rebases and regenerates the combined checksum.
• Host gate: command-center micro-check of the repaired head, both PRs landed, F9 quiet window, paper-ext finished no earlier than 8:10 PM EDT October 6 (00:10Z October 7), and explicitly dated 5f approval. No host apply by this lane.

SOTA sources

• Folded profile recovery follows openai/codex@a956835d020762cb2b570053af06f643a11c0ecc (rust-v0.160.0), loader/mod.rs:286-333, config_manager_service.rs:224-237 and cli/src/main.rs:1861-1886. Native profile-v2 is an override layer; the existing repository merge fills the gap in the main-config-only native writer. The new root-group guard preserves that boundary and Follow-up residuals: Codex normal tier by default (user 13:22Z), #713/#726 gate-read P2s, #713's macOS-only fixes #752's native migration contract.

• Folded read-only drift checking reuses native-agent-stack@2d849ba1fe1b879144cfa470f0514d3ac3b8e487:tools/adoption/new_wsl_client_config.py:1567-1573,1626-1661 (typed equality and additive merge). Compare missing/conflicting desired-render keys, rather than the operator-preserving expected merge; stdlib TOML parsing follows Python tomllib. It is local integration, not an upstream effective-config acceptance test.

• Folded approval defaults follow openai/codex@a956835d, mcp_tool_call.rs:2466-2495 and the official configuration reference. They render/write only with the existing explicit authorization flag, preserving operator values. Source records under docs/decisions/2026-10-05-codex-token-parity.md, 2026-10-05-codex-profile-drift-check.md and 2026-10-05-gateway-token-features.md retain the original pins, observations and limits; the new fold record describes the composed behavior.

• Native follow-up source: native-agent-stack@0d5e6506434fab598dee861c749a22e628beb75a:tools/credentials/credential_run.py:185-189, tests/test_adoption_docs_consistency.py:478-505, tests/test_upstream_surface_watch.py:2054-2063, and .github/workflows/validate.yml:226-239. Existing refusal semantics, release markers, source verification and the native unittest command are reused.

• Native census source: native-agent-stack@1b9bcf5a170531cea7f15fba10a83f872dffe3d8:tests/test_runtime_worker_openhands_push_gate.py:1126-1131,1175 and blueprints/runtime-workers/openhands/resolver/push_gate.py:949-962. Actual native recapture: 322 entries, 1 test/8.371s/exit0; no enforcement waiver, worker/provider acceptance or complete read-inventory claim.

• systemd/systemd v259.5, b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a: man/environment.d.xml:59-74, src/basic/env-file.c:526-559, man/systemd.environment-generator.xml:116-121. Native assignment/expansion and manager reload; no custom environment loader.

• openai/codex rust-v0.160.0, a956835d020762cb2b570053af06f643a11c0ecc: codex-rs/config/src/shell_environment_policy.rs:23,35,106-108,161 and codex-rs/protocol/src/shell_environment.rs:100-147. Literal set values and post-set filtering; inherit=none remains.

• GNU Bash login startup, installed Bash 5.3.9 and native set-a behavior checked 2026-10-06; Python stdlib tomllib. Existing guarded repository writer/string.Template reused for the deliberately restricted assignment intersection.

• containers/bubblewrap v0.11.1, 124c4cdf4321f63ef17a1cb0ce8f9dd45bd7adbe: bwrap.xml:50-59,230-233,309-314,409-415. Native binaries qualified in isolated readonly synthetic filesystems, with all four system environment locations masked.

• native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:tools/adoption/managed_block.py:93-114,319-338; existing atomic/backup protocol and F9 apply. Selected Dagu unit: evidence/artifacts/new-wsl-install-plan-20261002/install-plan.json:3282,3305; native health command: accept.sh:1463.

• IBKR owner native-agent-stack@bf1d143cd62f57445f85aa9415247974a70cb3bc:adoption/credential-inventory.json, docs/secret-storage.md:297-299,647-649; approved Phase 1 plan SHA256 775119dc6840552def19142a10e2730b489b6365c346e6f9fb6f5db5f2572ba2, lines 63-106 and A7/A8 2026-10-06. Selected Grafana path is an owner-directed existing store; no producer or service-acceptance claim.

• Docker exec, typed inspect and rootless mode, read 2026-10-06; installed Docker 29.8.2 exec --help. IBKR-owner native-agent-stack@e0c260caa1e5a9c3246e3365f5af41fd46b158d8:docs/secret-storage.md:645-679 and blueprints/us-equities/runtime-2604/ibkr-gateway-recreate-durable.sh:26,29,60-65,98-105 define the intended container reader and readonly mounts. Shell proof and metadata selection reuse these native routes; no custody or container configuration change.

• Native GNU sed 4.9, grep 3.12, coreutils 9.7 help/version and stdin qualification, 2026-10-06. Remote GNU manual fetches timed out; the owner procedure states that limit.

• GNU Bash 5.3 release, archive SHA256 0d5cd86965f869a26cf64f4b71be7b96f90a3ba8b3d74e27e8e9d9d5550f31ba: doc/bashref.texi:7935-7945, shell.c:1116-1126, builtins/evalfile.c:119-130; patches 001-009 reviewed. Native startup selection falls through only on ENOENT. The finite recognizer preserves physical LF and ASCII blank semantics.

• native-agent-stack@ce80c086203985b753b2847260c4c20bccf6d89f:tools/adoption/new_wsl_client_config.py:plan_merge,merge_toml_text,first_difference; prospective pointer-policy merge uses existing supported glue. native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:observability/backends/configure.py:94,108,140-146 establishes the independent generic Grafana store.

• uutils/coreutils 0.10.0, 28b6856d7b215bf844b4223589cb54ade84f5223: native SHA256 print/check for the existing hook registry; no custom checksum tool.

Evidence-class table

The new composition record is docs/decisions/2026-10-07-codex-profile-environment-content-fold.md; its receipt and exact donor-byte ledger are under evidence/artifacts/codex-profile-env-fold-20261007/. #716 contributes 70 unchanged added files out of 76 changed paths; #756 contributes 2 unchanged added files out of 5. The six shared paths are listed individually in the new receipt. Their measured source observations are unchanged. Older source create-only behavior is explicitly superseded by additive recovery plus independent drift reporting.

Fold claim	Evidence class	Command / receipt
Newly imported source files are unchanged	source_review / local_integration	source-bytes.json: #716 70/70 added files; #756 2/2 added files
Recovery, authorization boundaries, drift reporting and P1ENV composition	synthetic / local_integration	env CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_new_wsl_client_config tests.test_managed_block tests.test_credential_status tests.test_adoption_docs_consistency: exit 0; 370 tests, one skip, 113.237s
Main-config writers never handle profile recovery, including an absent daemon key	synthetic / local_integration	Focused ProfileMergeTests.test_profile_merge_does_not_migrate_owned_main_config_values_or_disable_its_daemon: exit 0; one test with daemon-present and daemon-missing subcases, 0.293s. This overlaps the module test count; it is not an additional unique test.
Failed composition attempts remain visible	local_integration	New receipt preserves 234 tests / six failures and 235 tests / two failures, with causes and durable logs. No source failed attempt or observation is overwritten.
Copied gateway token measurements	source_review of historical local_integration evidence	Original #716 artifacts retain their request-local text-artifact preprocessing scope. No new provider request, integrated worker route or gateway setting change.

The current follow-up fixes all four #770 target units. The host suite is not all green: the complete first attempt failed, and the second attempt timed out. #772 owns the inherited prerequisite, dirname, keyed-property and mutation-interpreter repairs per A11/CITE-772. No assertion or safety canary is weakened here; no further matrix starts before GO-RELAUNCH. Acceptance requires that dependency to land and a passing rerun.

Claim	Evidence class	Command / receipt
Reported login-chain false rejection fixed	synthetic	Exact chaining fixture red then green; finite startup recognizer and write-free refusal controls
Pointer policy and reader integration	local_integration	Six touched modules: 530 tests pass, four existing CI skips; final F9 module rerun recorded below
Native generator/login/config read-back in isolation	synthetic	Native binaries via bwrap, synthetic HOME, all system environment locations masked; preflight, check and Bash login each exit 0
Dated scheduling and legacy cleanup syntax	synthetic	Five native Bash syntax checks; 18 controlled clock cases match; four exact legacy export shapes qualify grep/sed
Store provenance and lifecycle	source_review	Pinned upstream/repository sources and two independent critics; no credential content or real store reader call
Repository integrity	local_integration	validate.py, F9 map check, generated handbook/reports and diff check; no live provider/GPU acceptance
Installed host guard parity	pending host acceptance	Local comparison failed because installed copy predates this repository repair; retained, owner apply forbidden until gates pass

Correction retained: CI=1 did not select this suite's existing CI mode; it requires CI=true. The failed retry repeated the installed-host-copy mismatch. Existing dotenv Bash protection already covered modeled .env readers; this repair closes native Read-deny and explicit store-path coverage.

Local commands run

Latest fold head: e4e1e6094526848b18d3d5cae3df35f4d84ef350, with source commits 8949b2f (#716) and 35fbd56 (#756), followed by the registry-only final commit e4e1e60. These are content commits on the existing branch; no rebase or merge was performed. Python was 3.13.16 with CI=true, umask 022 and no ABI-mixing PYTHONPATH. All heavier commands used nice -n 19 ionice -c3.

env CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_new_wsl_client_config tests.test_managed_block tests.test_credential_status tests.test_adoption_docs_consistency
# exit 0; 370 tests / 113.237s / skipped 1
# Production controller and existing cases stayed unchanged for the following focused extension.
env CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_new_wsl_client_config.ProfileMergeTests.test_profile_merge_does_not_migrate_owned_main_config_values_or_disable_its_daemon
# exit 0; one overlapping test / 0.293s; daemon-present and daemon-missing cases
nice -n 19 ionice -c3 python3 tools/adoption/new_wsl_client_config.py --check --markdown
# exit 0; native generated projection appended, decided text retained
nice -n 19 ionice -c3 python3 scripts/build_new_wsl_handbook.py --check
# exit 0; outputs already match, no regeneration needed
nice -n 19 ionice -c3 python3 scripts/validate_convergence.py evidence/artifacts/gateway-token-feature-evaluation-20261005/experiment.json
# exit 0; declared evidence consistency only, no new trial
nice -n 19 ionice -c3 python3 tools/adoption/new_wsl_client_config.py --check
# exit 0; the same two MCP Inspector warnings
nice -n 19 ionice -c3 python3 scripts/component_matrix.py --write
nice -n 19 ionice -c3 python3 scripts/new_host_grand_list.py --write
# each exit 0; generated report bytes unchanged
nice -n 19 ionice -c3 python3 scripts/validate.py
# exit 0; 69 components / 10413 hashed files / 4 profiles / 214 receipts
git diff --check 1a567f540ac9231328bbe349ad05baeaa12b5ad9..HEAD
# exit 0

Private source/failure logs remain durable; the public fold receipt names each attempt and input condition. The two earlier controller failures were 234 tests / six failures and 235 tests / two failures; neither is erased. The earlier full-suite observations below remain historical and do not become an all-green host claim from this scoped fold.

Current follow-up on unchanged source candidate 34ca0c7034015ca7067e93b76bda69f71c679283:

CI=true TMPDIR=<durable-state>/tmp PYTHONDONTWRITEBYTECODE=1 PYTHONFAULTHANDLER=1 rtk proxy nice -n 19 timeout --signal=ABRT --kill-after=60s 55m python3 -B -m unittest -v --durations 50
# exit 1; 10398 tests / 2768.824s; failures 21, errors 18, skipped 907
# All four #770 target units passed. All 18 errors: missing exchange_calendars.
rtk proxy nice -n 19 python3 -m venv <durable-state>/venv
rtk proxy nice -n 19 <durable-state>/venv/bin/python -m pip --isolated --require-virtualenv install --disable-pip-version-check --no-input --no-cache-dir --only-binary=:all: --require-hashes --index-url https://pypi.org/simple -r .github/requirements-ci.txt
# each exit 0; compatible locked cp313 wheels observed
rtk proxy nice -n 19 python3 -m venv --system-site-packages <durable-state>/venv
# exit 0; retains existing PyYAML 6.0.3, shared Python packages unchanged
rtk proxy bash <durable-state>/run-full-unittest.sh <durable-state>/venv/bin/python full-unittest-ci.log
# exit 124 at the unchanged 55-minute workflow cap; incomplete, no completion summary
rtk proxy nice -n 19 python3 -B scripts/build_new_wsl_handbook.py --write
rtk proxy nice -n 19 python3 -B scripts/build_new_wsl_handbook.py --check
# each exit 0; output digests and historical regeneration receipt updated
rtk proxy nice -n 19 python3 -B scripts/component_matrix.py --write
rtk proxy nice -n 19 python3 -B scripts/new_host_grand_list.py --write
# each exit 0; no platform-status flips
rtk proxy nice -n 19 python3 -B scripts/validate.py
# exit 0; 69 components / 10341 hashed files / 4 profiles / 214 receipts
rtk proxy nice -n 19 python3 -B tools/adoption/new_wsl_client_config.py --check
# exit 0; 409 pieces / 369 wired / 24 unwired / 16 authorization; same two warnings
rtk proxy sha256sum -c SHA256SUMS
# exit 0; all 12 hook files, run from adoption/hooks/claude
rtk git diff --check
# exit 0

All results, logs and the dated replay script are durable under a private mode0700 state directory. The snapshot's actual source commit 1b9bcf5a170531cea7f15fba10a83f872dffe3d8 remains an ancestor. The later publication change adds result metadata and registry hashes; execution code is unchanged. A cached, scoped GitHub review-thread query found no chatgpt-codex-connector threads to resolve before this push.

The commands below are historical qualification at the earlier reviewed head; they are retained separately from these latest failures and observations.

Paths in the commands below are redacted to <owned-cache>; no private host profile or credential file is included.

CI=true TMPDIR=<owned-cache> PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B -m unittest tests.test_new_wsl_client_config tests.test_managed_block tests.test_credential_status tests.test_secret_path_guard tests.test_install_claude_profile tests.test_render_config
# exit 0; 530 tests / 164.853s / skipped 4
CI=true TMPDIR=<owned-cache> PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B -m unittest tests.test_new_wsl_client_config
# exit 0; 203 tests / 75.563s; final native filter-type and presence contract included
PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B scripts/build_new_wsl_handbook.py --write
PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B scripts/build_new_wsl_handbook.py --check
# both exit 0; committed outputs unchanged
PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B scripts/component_matrix.py --write
PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B scripts/new_host_grand_list.py --write
# both exit 0; no platform status flips
PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B tools/adoption/new_wsl_client_config.py --check
# exit 0; 409 pieces / 369 wired / 24 unwired / 16 authorization
# Existing two mcp-inspector manifest/plan warnings retained.
TMPDIR=<owned-cache> PYTHONDONTWRITEBYTECODE=1 rtk proxy nice -n 19 python3 -B scripts/validate.py
# exit 0; 69 components / 10276 hashed files / 4 profiles / 212 receipts
rtk git diff --check
# exit 0

Historical red/error attempts, usage-free native receipts and the separate installed-copy limitation are preserved in evidence/artifacts/pointer-environment-transfer-20261006/receipt.json. Locally authored checks are integration evidence, not upstream or real-host acceptance.

Decision record

docs/decisions/2026-10-06-pointer-environment-transfer.md records alternatives, the finite preflight scope, timing deferral, critic corrections and overturn conditions.

Host evidence

No new file under evidence/hosts and no host configuration change. This is an unexecuted owner procedure. Preflight catches deterministic pointer-policy/target barriers; arbitrary operator .profile behavior, unrelated Codex settings and races still require post-apply native proof. Failed proof blocks the paper switch.

Owner host apply, read-back and rollback

Current host custody: the command center applies only after the retained head's read, ACK and landing. The earlier dated paper-window procedure below is retained as its original proposed sequence; command-center task-ns2604-coop-20261006T223504Z supersedes clock-based foundation holds. Its consuming-identity proof, preflight, backup/rollback, pointer protection and no-lane-apply boundaries remain required. The former PAPER_ENV_FILE_2 removal cutoff has elapsed; cleanup is still a separate exact-match, by-name owner step. No native instruction/MCP/RTK re-wiring is folded here.

The exact commands, read-backs and per-file/service rollback below are mirrored from the committed receipt README. Metadata preflight precedes step 1; every mutation waits for the gates above. Missing/stale/malformed dated windows fail closed; an explicit NONE requires 5f's approval for that UTC day.

Owner apply and read-back

This is an unexecuted host procedure for the co-op after the command center micro-checks the repaired head and this PR and the IBKR owner's inventory/security changes land. The lane changes repository files only. Use the user's existing F9 apply authorization; wait for the F9 Codex quiet window before the config writer. Stop on any failed command or reported conflict. Do not override operator values to make the checks pass.

The source and readers follow systemd v259.5 (b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a: man/environment.d.xml:59-74, man/systemd.environment-generator.xml:116-121), Bash's native login startup, and Codex rust-v0.160.0 (a956835d020762cb2b570053af06f643a11c0ecc: codex-rs/protocol/src/shell_environment.rs:100-147). File installation, backup and exact-name cleanup use the installed GNU coreutils 9.7, grep 3.12 and sed 4.9 commands; their native --help options were checked on 2026-10-06. Reference formats are GNU's cp, grep and sed address manuals; the remote fetch timed out, so the qualification here rests on the installed commands and synthetic stdin results. Shell sourcing and service restarts are native operations, not a replacement runner. Dagu's adopted unit is dagu.service (native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:evidence/artifacts/new-wsl-install-plan-20261002/install-plan.json:3282,3305).

The supported scope is conventional HOME/.config and base Codex config. The owner must supply its existing private adoption/hosts/nativestack2604.json in the landed checkout: it is deliberately absent from this branch. Do not create a competing host profile. Its HOME must equal the selected login HOME, because --render uses that profile while --apply and --check-login-env rebase to the actual HOME (native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:tools/adoption/new_wsl_client_config.py:1080-1104,1524-1548, tools/adoption/render_config.py:108-115). The check recognizes finite native Bash chains to .profile and rejects unknown shadow files and incompatible Codex filters conservatively. Neither active profiles nor custom XDG/CODEX homes are qualified. No credential file is part of the backup or cleanup.

Paper timing and generator lifecycle

The frozen 10-06 units inherit the manager's environment when they start, so leaving their unit files unchanged is insufficient. Defer every host mutation in this procedure—including installation of environment.d, manager reload, Dagu restart, profile and Codex writes—until paper-ext-20261006 has finished, no earlier than 8:10 PM EDT on 2026-10-06 (2026-10-07T00:10Z). The metadata-only preflight below may run earlier.

The known 10-06 protected windows remain 6:35 AM-9:45 AM EDT (10:35Z-13:45Z) and 3:50 PM-8:10 PM EDT (19:50Z on 10-06 through 00:10Z on 10-07). After the cutoff, there is no open-ended approved slot. Before applying, the co-op supplies 5f's approved UTC day as P1_APPROVED_DAY_UTC (eight digits, YYYYMMDD) and that day's complete windows as P1_PAPER_WINDOWS_UTC (one line of whitespace-separated fourteen-digit START:END UTC intervals). NONE is valid only when 5f explicitly approved no windows for that day. Missing, malformed or stale approval fails closed; a UTC day rollover requires new input. No heavy phase or user-manager restart/re-exec occurs in the supplied windows. Start a bounded step only with enough headroom to finish before the next window; otherwise defer it. Pause between steps and never kill a running case. Before the one Dagu restart, the co-op confirms it will not interrupt a running case.

Installing the file alone does not refresh the running manager or existing processes. At systemd v259.5, generators run at manager startup and configuration reload: systemd.environment-generator(7):54-58,71-73 explicitly documents daemon-reload; environment.d(5) supplies the user-service environment-file route. Re-exec is not required by this pin. The procedure keeps daemon-reload outside the paper windows and requires the actual user-manager child below to prove every pointer is set and readable before Dagu or another adopted unit relies on it. Existing process environments are not acceptance evidence. The co-op reports the proof to 5f; 5f switches the 10-07 units only on that proof.

Readability is proved in each store's intended consumer context. The IBKR owner's inventory and custody contract at e0c260c intentionally makes the two mode-0600 password files unreadable to the ordinary host user. The owned recreate recipe:26,29,60-65,98-105 names the existing rootless container and its readonly secret mounts. The user-manager child checks all eight names and inventory paths, six host-readable pointers, rootless-daemon identity and the two exact readonly mount sources, then uses Docker's native exec --user as uid 1000:1000 to test the password mounts' readability. Rootless namespace behavior and installed Docker 29.8.2 help were checked on 2026-10-06. No full inspect or credential content is printed; no file ownership, mode, container configuration or credential is changed. A missing/stopped gateway or any failed proof leaves adoption/10-07 switching pending with the owner.

The UID flag maps directly to the native exec request at docker/cli@v29.8.2:exec.go:72,224. Mount checks use Docker's documented typed, formatted inspect and select only the two source/read-only metadata fields, never the full container environment. Container-side checks also require its _FILE settings to name those exact mounted destinations.

Value-free preflight before any host mutation

From the owner's landed checkout and existing private host profile, run:

set -e
test "${XDG_CONFIG_HOME:-$HOME/.config}" = "$HOME/.config"
test -z "${CODEX_HOME:-}"
test -z "${CLAUDE_CONFIG_DIR:-}"
python3 -B -c 'import sys; from pathlib import Path; sys.path.insert(0, "tools/adoption"); import render_config; ok = render_config.load_host_values("nativestack2604")["HOME"] == str(Path.home()); print("host_home_matches=" + str(ok).lower()); sys.exit(0 if ok else 1)'
python3 -B tools/adoption/new_wsl_client_config.py --preflight-login-env --host nativestack2604

Stop on any failed preflight before backups, source installation or manager operations. The native 2604 wrapper if [ -r "$HOME/.profile" ]; then . "$HOME/.profile"; fi is supported; an empty, unrecognized or unreadable higher-priority login file is rejected before writes. The preflight reuses the repository's merge/text validation to predict preserved pointer-policy conflicts and incompatible filters. It executes no startup script and prints no configuration values. Arbitrary operator .profile behavior, unrelated settings and concurrent changes remain subject to post-apply native proof and guarded rollback. Use the existing owner scratch TMPDIR outside shared /tmp for rendering; no credential store is opened.

Initial apply after the cutoff, with dated approval

Run these commands from the owner's landed checkout, with no credential values in the command or output. The dedicated backup preserves only the four configuration files this procedure may change. Keep p1_backup for rollback; it is not a credential backup. A symlink target is a stop condition.

set -e
p1_stamp_valid() {
    local p1_stamp="$1"
    [[ "$p1_stamp" =~ ^[0-9]{14}$ ]] || return 1
    test "$(date -u --date="${p1_stamp:0:4}-${p1_stamp:4:2}-${p1_stamp:6:2} ${p1_stamp:8:2}:${p1_stamp:10:2}:${p1_stamp:12:2} UTC" +%Y%m%d%H%M%S 2>/dev/null)" = "$p1_stamp"
}
p1_check_window() {
    local p1_now p1_interval p1_start p1_end
    local -a p1_ranges
    p1_now="$(date -u +%Y%m%d%H%M%S)"
    test "$p1_now" -ge 20261007001000 || return 1
    test "${P1_APPROVED_DAY_UTC:-}" = "${p1_now:0:8}" || return 1
    p1_stamp_valid "${P1_APPROVED_DAY_UTC}000000" || return 1
    if test "${P1_PAPER_WINDOWS_UTC:-}" = NONE; then
        return 0
    fi
    local p1_pattern='^[0-9]{14}:[0-9]{14}([[:blank:]]+[0-9]{14}:[0-9]{14})*$'
    [[ "${P1_PAPER_WINDOWS_UTC:-}" =~ $p1_pattern ]] || return 1
    IFS=$' \t' read -r -a p1_ranges <<< "$P1_PAPER_WINDOWS_UTC"
    for p1_interval in "${p1_ranges[@]}"; do
        p1_start="${p1_interval%:*}"
        p1_end="${p1_interval#*:}"
        p1_stamp_valid "$p1_start" && p1_stamp_valid "$p1_end" || return 1
        test "$p1_start" -lt "$p1_end" || return 1
        test "$p1_start" -le "${P1_APPROVED_DAY_UTC}235959" || return 1
        test "$p1_end" -gt "${P1_APPROVED_DAY_UTC}000000" || return 1
        if test "$p1_now" -ge "$p1_start" && test "$p1_now" -lt "$p1_end"; then
            return 1
        fi
    done
}
p1_check_window
p1_repo="$PWD"
# Keep these native shell definitions with the recorded apply/rollback context.
p1_prove_pointers() {
    p1_check_window
    systemd-run --user --wait --pipe --collect /bin/sh -c '
        set -e
        test -n "$PAPER_ENV_FILE" && test -r "$PAPER_ENV_FILE"
        test -n "$PAPER_ENV_FILE_2" && test -r "$PAPER_ENV_FILE_2"
        test -n "$SEC_CONTACT_ENV" && test -r "$SEC_CONTACT_ENV"
        test -n "$PIT_ALPACA_ENV_PATH" && test -r "$PIT_ALPACA_ENV_PATH"
        test -n "$PIT_SEC_ENV_PATH" && test -r "$PIT_SEC_ENV_PATH"
        test -n "$IBKR_PAPER_LOGIN_ENV" && test -r "$IBKR_PAPER_LOGIN_ENV"
        test -n "$IBKR_PAPER_TWS_FILE"
        test -n "$IBKR_PAPER_VNC_FILE"
        test "$RTK_TELEMETRY_DISABLED" = 1
        /usr/bin/python3 -B "$1/scripts/credential_status.py" --require-pointers
        case "$(docker info --format "{{.SecurityOptions}}")" in
            *name=rootless*) ;;
            *) exit 1 ;;
        esac
        test "$(docker inspect --type container --format "{{range .Mounts}}{{if eq .Destination \"/run/secrets/tws_password\"}}{{.Source}}:{{.RW}}{{end}}{{end}}" native-trading-ibkr-paper-20261005)" = "$IBKR_PAPER_TWS_FILE:false"
        test "$(docker inspect --type container --format "{{range .Mounts}}{{if eq .Destination \"/run/secrets/vnc_password\"}}{{.Source}}:{{.RW}}{{end}}{{end}}" native-trading-ibkr-paper-20261005)" = "$IBKR_PAPER_VNC_FILE:false"
        p1_probe_now="$(date -u +%Y%m%d%H%M%S)"
        test "$p1_probe_now" -ge 20261007001000
        test "$(date -u +%Y%m%d)" = "$2"
        test -n "$3"
        if test "$3" != NONE; then
            for p1_interval in $3; do
                if test "$p1_probe_now" -ge "${p1_interval%:*}" && test "$p1_probe_now" -lt "${p1_interval#*:}"; then
                    exit 1
                fi
            done
        fi
        exec docker exec --user 1000:1000 native-trading-ibkr-paper-20261005 /bin/sh -c "test \"\$TWS_PASSWORD_FILE\" = /run/secrets/tws_password && test \"\$VNC_SERVER_PASSWORD_FILE\" = /run/secrets/vnc_password && test -s /run/secrets/tws_password && test -r /run/secrets/tws_password && test -s /run/secrets/vnc_password && test -r /run/secrets/vnc_password"
    ' p1-env "$p1_repo" "$P1_APPROVED_DAY_UTC" "$P1_PAPER_WINDOWS_UTC"
}
p1_work="$HOME/.cache/ns2604-p1-env-apply"
p1_backup="$p1_work/backup-$(date -u +%Y%m%dT%H%M%SZ)"
python3 -B tools/adoption/new_wsl_client_config.py --preflight-login-env --host nativestack2604
test "${XDG_CONFIG_HOME:-$HOME/.config}" = "$HOME/.config"
test -z "${CODEX_HOME:-}"
test -z "${CLAUDE_CONFIG_DIR:-}"
python3 -B -c 'import sys; from pathlib import Path; sys.path.insert(0, "tools/adoption"); import render_config; ok = render_config.load_host_values("nativestack2604")["HOME"] == str(Path.home()); print("host_home_matches=" + str(ok).lower()); sys.exit(0 if ok else 1)'
install -d -m 700 "$p1_work" "$p1_backup"
for p1_rel in .config/environment.d/60-native-agent-stack.conf .profile .codex/config.toml .bashrc; do
    test ! -L "$HOME/$p1_rel"
    install -d -m 700 "$p1_backup/$(dirname "$p1_rel")"
    if test -f "$HOME/$p1_rel"; then
        cp -a -- "$HOME/$p1_rel" "$p1_backup/$p1_rel"
    else
        test ! -e "$HOME/$p1_rel"
        touch "$p1_backup/$p1_rel.absent"
    fi
done

# 1. Render the one source and install only its pointer configuration.
python3 -B tools/adoption/new_wsl_client_config.py --render --host nativestack2604 --out "$p1_work/render"
p1_check_window
install -D -m 600 "$p1_work/render/60-native-agent-stack.conf" "$HOME/.config/environment.d/60-native-agent-stack.conf"

# 2. Re-run the environment generator, then prove the consuming-unit environment.
p1_check_window
systemctl --user daemon-reload
p1_prove_pointers

# 3. Only after the proof passes and no running case is affected, restart Dagu once.
p1_check_window
systemctl --user restart dagu.service

# 4. Add the native login reader; the writer preserves operator text.
p1_check_window
python3 -B tools/adoption/managed_block.py profile-env --env-file "$HOME/.config/environment.d/60-native-agent-stack.conf"

# 5. F9 adopts the base Codex table and verifies the login-env write.
# Config merge conflicts are preserved; no overwrite flag is passed.
p1_check_window
python3 -B tools/adoption/new_wsl_client_config.py --apply --host nativestack2604 \
    --skip claude-hooks --skip claude-agents --skip claude-mcp \
    --skip claude-settings --skip claude-launcher --skip rtk-claude-init \
    --skip claude-md --skip codex-files --skip codex-md --skip login-path --skip verify

# 6. Read back configuration, then require every pointer in a new login.
python3 -B tools/adoption/new_wsl_client_config.py --check-login-env --host nativestack2604
env -u PAPER_ENV_FILE -u PAPER_ENV_FILE_2 -u SEC_CONTACT_ENV \
    -u PIT_ALPACA_ENV_PATH -u PIT_SEC_ENV_PATH -u IBKR_PAPER_LOGIN_ENV \
    -u IBKR_PAPER_TWS_FILE -u IBKR_PAPER_VNC_FILE -u RTK_TELEMETRY_DISABLED \
    bash --login -c 'test "$RTK_TELEMETRY_DISABLED" = 1 && exec python3 -B "$1/scripts/credential_status.py" --require-pointers' p1-env "$p1_repo"

Separate cleanup: not before 2026-10-07T00:10Z

Do not remove, move or edit the PAPER_ENV_FILE_2 export in ~/.bashrc before 8:10 PM EDT on 2026-10-06 (2026-10-07T00:10Z). The frozen 10-06 units launch through /bin/bash -ic and still need it. Initial adoption leaves all four legacy exports in place. This separate step runs after paper-ext-20261006 ends, after step 6 passes, and after repeating the consuming-unit proof; no running case is killed.

Step 7 then removes only the four single-export lines confirmed by the co-op: PAPER_ENV_FILE_2, IBKR_PAPER_LOGIN_ENV, IBKR_PAPER_TWS_FILE and IBKR_PAPER_VNC_FILE. The guard requires exactly one assignment for each exact name with the observed ${XDG_CONFIG_HOME:-$HOME/.config}/native-agent-stack/ prefix and its inventory basename. It accepts optional double quotes and a whitespace-separated trailing # comment; compound commands, changed paths, single-quoted forms or other layouts stop for owner review. It prints no assigned values and never uses a line number. Reuse the recorded initial backup; do not silently replace it with a post-apply backup.

set -e
test "$(date -u +%Y%m%d%H%M%S)" -ge 20261007001000
python3 -B "$p1_repo/tools/adoption/new_wsl_client_config.py" --check-login-env --host nativestack2604
p1_prove_pointers
p1_legacy_pattern() {
    case "$1" in
        PAPER_ENV_FILE_2) p1_basename='alpaca-paper-2\.env' ;;
        IBKR_PAPER_LOGIN_ENV) p1_basename='ibkr-paper-login\.env' ;;
        IBKR_PAPER_TWS_FILE) p1_basename='ibkr-paper-tws\.password' ;;
        IBKR_PAPER_VNC_FILE) p1_basename='ibkr-paper-vnc\.password' ;;
        *) return 1 ;;
    esac
    p1_prefix='\$\{XDG_CONFIG_HOME:-\$HOME/\.config\}/native-agent-stack/'
    printf '%s\n' "^[[:space:]]*export[[:space:]]+$1=(\"${p1_prefix}${p1_basename}\"|${p1_prefix}${p1_basename})([[:blank:]]+#.*)?[[:blank:]]*$"
}
for p1_name in PAPER_ENV_FILE_2 IBKR_PAPER_LOGIN_ENV IBKR_PAPER_TWS_FILE IBKR_PAPER_VNC_FILE; do
    p1_pattern="$(p1_legacy_pattern "$p1_name")"
    test "$(grep -Ec "$p1_pattern" "$HOME/.bashrc")" = 1
    test "$(grep -Ec "^[[:space:]]*export[[:space:]]+${p1_name}=" "$HOME/.bashrc")" = 1
done
for p1_name in PAPER_ENV_FILE_2 IBKR_PAPER_LOGIN_ENV IBKR_PAPER_TWS_FILE IBKR_PAPER_VNC_FILE; do
    p1_pattern="$(p1_legacy_pattern "$p1_name")"
    sed -i -E "\@${p1_pattern}@d" "$HOME/.bashrc"
done

Read back

Reuse the initial p1_repo, exact p1_backup, and the native shell definitions. In a new terminal, restore that context and definitions only; do not rerun the initial apply to recreate the backup.

Step 8 repeats the fresh login check after cleanup and checks a new user-manager child. The latter verifies the manager reload rather than inheriting the owner's terminal environment. Keep the returned boolean reports as new host evidence. Do not print systemctl show-environment, an env dump or credential-file contents.

set -e
p1_check_window
python3 -B tools/adoption/new_wsl_client_config.py --check-login-env --host nativestack2604
env -u PAPER_ENV_FILE -u PAPER_ENV_FILE_2 -u SEC_CONTACT_ENV \
    -u PIT_ALPACA_ENV_PATH -u PIT_SEC_ENV_PATH -u IBKR_PAPER_LOGIN_ENV \
    -u IBKR_PAPER_TWS_FILE -u IBKR_PAPER_VNC_FILE -u RTK_TELEMETRY_DISABLED \
    bash --login -c 'test "$RTK_TELEMETRY_DISABLED" = 1 && exec python3 -B "$1/scripts/credential_status.py" --require-pointers' p1-env "$p1_repo"
p1_prove_pointers
systemctl --user is-active dagu.service
curl -fsS http://127.0.0.1:21080/api/v1/health

Fresh Claude and Codex sessions also need their own value-free pointer check after the owner reloads them; an existing client process is not evidence of new-session adoption. A future paper unit on or after 2026-10-07 passes its selected runner's existing --env-file argument directly in ExecStart=. The 2026-10-06 units stay untouched. Generation-key and firewall-lane stores remain conditional on the approved service/route decisions; this procedure creates neither.

Rollback

The source, profile and Codex writes are separate transactions. Before restoring, stop concurrent configuration writers and ensure no later operator change would be overwritten. If one exists, the owner restores only the reviewed change. Select the exact saved p1_backup from above; do not infer it from the newest directory.

Rollback obeys the same paper windows and never edits, moves or removes the protected PAPER_ENV_FILE_2 export before 2026-10-07T00:10Z. Before then, .bashrc has not been edited by this procedure and is excluded from rollback. Defer manager-affecting rollback or any restart until an allowed slot with no affected running case; pause between steps instead of killing it.

For each failed or reverted step, restore its corresponding configuration file with the loop below: source installation/login-env -> .config/environment.d/60-native-agent-stack.conf; profile reader -> .profile; F9 Codex merge -> .codex/config.toml; legacy cleanup -> .bashrc. The native F9/managed-block backup names remain additional recovery evidence.

set -e
# Reuse the initial p1_check_window definition; stop if the paper window has begun.
p1_check_window
# Set p1_restore to only affected paths. .bashrc stays excluded before the cutoff.
p1_restore='.config/environment.d/60-native-agent-stack.conf .profile .codex/config.toml'
# Only after the cutoff, and only if step 7 changed it, append .bashrc to p1_restore.
for p1_rel in $p1_restore; do
    p1_check_window
    if test "$p1_rel" = .bashrc; then
        test "$(date -u +%Y%m%d%H%M%S)" -ge 20261007001000
    fi
    test ! -L "$HOME/$p1_rel"
    if test -f "$p1_backup/$p1_rel.absent"; then
        rm -f -- "$HOME/$p1_rel"
    else
        test -f "$p1_backup/$p1_rel"
        cp -a -- "$p1_backup/$p1_rel" "$HOME/$p1_rel"
    fi
done

If the source or manager refresh is rolled back, restore the manager's prior pointer values by reloading a restored source. When the source was originally absent, clear only these nine new names, then reload: systemctl --user unset-environment PAPER_ENV_FILE PAPER_ENV_FILE_2 SEC_CONTACT_ENV PIT_ALPACA_ENV_PATH PIT_SEC_ENV_PATH IBKR_PAPER_LOGIN_ENV IBKR_PAPER_TWS_FILE IBKR_PAPER_VNC_FILE RTK_TELEMETRY_DISABLED. This absent-source rollback is appropriate only when the owner confirms those manager names were not independently managed before adoption; otherwise retain their owner's prior values. Re-run p1_check_window immediately before each manager-affecting command. Finally run systemctl --user daemon-reload, the consuming-unit proof, systemctl --user restart dagu.service only when no running case is affected, and the Dagu health/readiness commands above. New login/client sessions are required after profile/config restoration. Never restart the operating system or rotate/copy a credential for rollback.

Checklist

• No secrets printed, logged or committed; only nonsecret pointer names/paths and value-free reports.
• No new paid hosting, subscription or billing surface.
• Peer-owned worktrees, IBKR rows and functions preserved.
• No new GitHub Actions or workflow permission changes.
• Registry and shared checksum are in the final commit; native generated reports/handbook checked.
• Command-center micro-check/cross-family read, both dependencies landed, and new real-host acceptance (owner only).