diff --git a/.agents/skills/plan-anvil/SKILL.md b/.agents/skills/plan-anvil/SKILL.md
index 8cd57d3..5ee2ca9 100644
--- a/.agents/skills/plan-anvil/SKILL.md
+++ b/.agents/skills/plan-anvil/SKILL.md
@@ -17,7 +17,7 @@ Create an auditable implementation contract, commit planning artifacts only, rep
 
 ## Workflow
 
-1. Read every applicable repository instruction and `references/lifecycle.md`. Current official Codex documentation has higher authority than bundled references.
+1. Read every applicable repository instruction and `references/lifecycle.md`. Read `references/codex-0.152-contract.md` when the active Codex runtime is 0.152.x. Current official Codex documentation has higher authority than bundled references.
 2. Start the deterministic bootstrap controller:
 
    ```text
@@ -32,11 +32,11 @@ Create an auditable implementation contract, commit planning artifacts only, rep
    ```
 
    This performs read-only preflight, a real reversible Git ref/branch/worktree/index/commit probe, planning-worktree isolation, profiling, run scaffolding, and durable bootstrap evidence. On any non-ready result, preserve evidence, report the exact blocker, and stop.
-3. Continue only in the returned planning worktree and run root. Fully read and hash all applicable instruction files, resolve their scope and precedence, and write the instruction map with `map_instructions.py`. A remaining critical conflict blocks the run.
+3. Continue only in the returned planning worktree and run root. Fully read and hash all applicable instruction files, resolve their scope and precedence, and write the instruction map with `map_instructions.py`. A remaining critical conflict blocks the run. Any PlanAnvil repository-evidence child must be spawned with the exact `agent_type` `plan_anvil_profiler`; never substitute a default/unnamed agent.
 4. Analyze the goal from repository evidence. Record immutable `evidence/analysis.md` and `.json` with `record_analysis.py`. A critical unknown blocks readiness; non-critical ambiguity requires an evidence-backed interpretation and verification method.
-5. Using the templates and references, author `PLAN.md`, stable stage briefs, acceptance criteria, risks, controls, rollback, recovery, approvals, and complete traceability. Write requirements for a separate later execution run, not executable product changes. Seal the contract with `seal_artifacts.py`.
+5. Using the templates and references, author `PLAN.md`, stable stage briefs, acceptance criteria, risks, controls, rollback, recovery, approvals, and complete traceability. Write requirements for a separate later execution run, not executable product changes. Prefer deterministic PlanAnvil scripts for control-state writes. If a direct file-change tool is used, immediately run `validate_diff.py --run-root <run-root> --source <source-worktree> --no-write-report`; any out-of-policy path or source-worktree change blocks the run. Then seal the contract with `seal_artifacts.py`.
 6. Run `validate_all.py --phase pre-review`. Do not proceed unless profiles, schemas, privacy, source immutability, instruction coverage, plan structure, traceability, risks, and the planning-branch diff all pass.
-7. Build the immutable review bundle with `prepare_review_bundle.py`. Dispatch a fresh read-only reviewer without planner reasoning, record its single blind result with `record_blind_review.py`, then run `compare_review.py`. Any failed or stale review blocks readiness.
+7. Build the immutable review bundle with `prepare_review_bundle.py`. Dispatch a fresh read-only reviewer using the real Codex subagent mechanism with exact `agent_type` `plan_anvil_reviewer`; never use a default/unnamed child for this role. Record its single blind result with `record_blind_review.py`, then run `compare_review.py`. Any failed or stale review blocks readiness.
 8. Run `commit_plan.py`. It repeats the final gates, writes the final report, commits only allowlisted planning/control artifacts, preserves the source worktree, and never pushes.
 9. Report status, planning branch, commit SHA, plan path, assumptions, unknowns, review result, and the separate execution-run prompt. State: `No implementation was executed. Start a separate Codex run using the execution prompt in PLAN.md.` Then stop.
 
@@ -47,6 +47,7 @@ Ask the user only when the unresolved decision materially changes business scope
 ## References
 
 - `references/lifecycle.md` — state order, Git isolation, ownership, and blockers
+- `references/codex-0.152-contract.md` — Codex 0.152 tool, compaction, and subagent semantics
 - `references/plan-contract.md` — required plan and stage content
 - `references/artifact-contract.md` — canonical state, schemas, privacy, and path safety
 - `references/review-and-stop.md` — validation, blind review, commit, and hard stop
diff --git a/.agents/skills/plan-anvil/references/codex-0.152-contract.md b/.agents/skills/plan-anvil/references/codex-0.152-contract.md
new file mode 100644
index 0000000..7eaf500
--- /dev/null
+++ b/.agents/skills/plan-anvil/references/codex-0.152-contract.md
@@ -0,0 +1,32 @@
+# Codex CLI 0.152 compatibility contract
+
+PlanAnvil targets the runtime semantics of Codex CLI 0.152.x. These rules are product requirements, not qualification-only exceptions.
+
+## Tool mutation boundary
+
+Codex 0.152 exposes `apply_patch` through model metadata as a freeform tool, and the native `PreToolUse` hook adapter is attached to that freeform handler. PlanAnvil must not assume that every file-change transport observed by the client is intercepted by `PreToolUse`.
+
+During PlanAnvil generation, hook enforcement is an early guard only. The deterministic planning-diff/source-immutability validator is authoritative. After any direct file-change tool call that is not performed by a PlanAnvil deterministic script, immediately run `validate_diff.py --no-write-report` for the active run. On any out-of-policy path or source-worktree change, stop the run; do not continue planning or review.
+
+Prefer the PlanAnvil deterministic scripts for control-state writes. Never use a successful file-change item or missing hook event as evidence that a mutation was safe.
+
+## Compaction
+
+`model_auto_compact_token_limit` is not necessarily the effective trigger. Codex 0.152 can add the token-budget fallback buffer before declaring the auto-compaction limit reached. PlanAnvil therefore treats `PreCompact`/`PostCompact` as runtime lifecycle events and never assumes they fire at an exact raw token count.
+
+Normal product operation must not disable a user's TokenBudget configuration merely to force compaction. Qualification may disable the fallback buffer only in an isolated fixture whose purpose is to deterministically exercise the real automatic-compaction path.
+
+## Subagents
+
+`SubagentStart` matcher input is the spawned `agent_type`. PlanAnvil must spawn configured roles with the exact role name, not as an unnamed/default child:
+
+- `plan_anvil_profiler`
+- `plan_anvil_reviewer`
+
+The role name must match the `name` field in the corresponding agent TOML and the project `SubagentStart` matcher.
+
+For Codex 0.152, `SubagentStart` may inject `additionalContext`, but `continue: false` is not a stop control for this event. PlanAnvil must never depend on `continue: false` to prevent the child from starting.
+
+## Fail-closed rule
+
+When the active Codex runtime cannot provide a lifecycle behavior required by the PlanAnvil contract, preserve deterministic evidence and stop with a runtime prerequisite blocker. Do not weaken path, source-immutability, approval, or recovery guarantees to make the run pass.
diff --git a/.agents/skills/plan-anvil/references/execution-contract.md b/.agents/skills/plan-anvil/references/execution-contract.md
index 0fac043..5051a76 100644
--- a/.agents/skills/plan-anvil/references/execution-contract.md
+++ b/.agents/skills/plan-anvil/references/execution-contract.md
@@ -8,6 +8,19 @@ The later executor uses a flat direct-child topology: Jim coordinates, Jenny own
 
 Jim never modifies product code or tests. Jenny never modifies production code. Only one agent modifies repository files at a time.
 
+Configured child roles must be spawned with their exact `agent_type`; do not substitute an unnamed/default child when a role-specific hook or instruction boundary is required. In Codex 0.152, `SubagentStart` matchers receive `agent_type` as matcher input.
+
+## Tool and mutation boundary
+
+Treat `PreToolUse` as an early guard, not the sole enforcement boundary. Codex 0.152 can surface file changes through transports for which a project hook is not a reliable complete mutation ledger. Every implementation/test mutation therefore requires an immediate deterministic postcondition before the next modifying action:
+
+1. enumerate the actual changed paths from Git and the filesystem;
+2. prove every path is inside the approved task/test scope for the active stage;
+3. prove the control/planning worktree and source/base worktree remain outside the mutation set;
+4. stop and restore from the stage recovery point if the mutation escaped scope.
+
+Prefer the runtime's native freeform `apply_patch` path when available, but never infer safety from a successful `apply_patch`, `file_change` item, or missing hook event. Shell, patch, edit, write, and write-capable MCP paths are subject to the same postcondition.
+
 ## Evidence cycle
 
 Behavior-changing stages use:
@@ -18,7 +31,7 @@ The red result must fail for the intended behavioral reason. Non-behavior stages
 
 ## Retry model
 
-Use three attempts for one strategy, then three attempts for a materially different strategy. Preserve failed-attempt evidence. After six failures, run read-only incident analysis and stop with `BLOCKED_BY_UNRESOLVED_FAILURE`.
+Use STRATEGY-A with ATTEMPT-A1, ATTEMPT-A2, and ATTEMPT-A3, then STRATEGY-B with ATTEMPT-B1, ATTEMPT-B2, and ATTEMPT-B3. Preserve failed-attempt evidence. After six implementation failures, run read-only incident analysis and stop with `BLOCKED_BY_UNRESOLVED_FAILURE`.
 
 ## Git and control ownership
 
@@ -26,7 +39,11 @@ Task branch: `pursue/<PLAN-ID>/<slug>`. Integration branch: `pursue/integration/
 
 Control state, reports, checkpoints, and evidence stay in the retained planning worktree. Product code and tests change only in task or integration worktrees. Each completed stage ends in one coherent implementation-and-test commit.
 
-Never automatically push or merge the base branch. Require explicit approval before live switching, irreversible operations, or base integration.
+Never automatically push or merge the base branch. Require explicit user approval before a base merge or push, live switching, irreversible operations, or base integration.
+
+## Compaction and recovery
+
+`PreCompact`/`PostCompact` are lifecycle events, not exact-token timers. In Codex 0.152 the configured auto-compaction limit can be increased by a token-budget fallback buffer. Recovery correctness must depend on observed lifecycle events and canonical checkpoint/Git state, never on an assumed raw token count.
 
 ## Stateful changes
 
diff --git a/.agents/skills/plan-anvil/templates/PLAN.md b/.agents/skills/plan-anvil/templates/PLAN.md
index 00b1446..1b80cd5 100644
--- a/.agents/skills/plan-anvil/templates/PLAN.md
+++ b/.agents/skills/plan-anvil/templates/PLAN.md
@@ -4,7 +4,7 @@
 
 - Plan ID: `{{PLAN_ID}}`
 - Run ID: `{{RUN_ID}}`
-- Contract: PlanAnvil 2.1
+- Contract: PlanAnvil 2.3
 - Artifact schema: 1.1.0
 - Base branch: `{{BASE_BRANCH}}`
 - Base SHA: `{{BASE_SHA}}`
@@ -26,6 +26,16 @@ PlanAnvil generated and validated this plan. It must not implement any stage, mo
 
 Use this approved `PLAN.md` as the immutable execution contract in a separate Codex run. Reconcile `manifest.json`, `state.json`, `local-state.json`, the latest valid checkpoint, profiles, instruction map, and Git state before acting. Execute only the next approved action, preserve all gates and approvals, and stop on any mismatch.
 
+## Execution runtime invariants
+
+Use a flat direct-child topology. Jim coordinates and does not modify product code or tests. Jenny owns approved tests only. One implementation agent modifies approved product paths. The independent verifier is read-only. Winston Wolfe performs read-only incident analysis only after six implementation failures. Spawn any configured role with its exact `agent_type` so Codex 0.152 `SubagentStart` matchers receive the intended role name.
+
+Only one agent modifies repository files at a time. Treat `PreToolUse` as an early guard, not the sole mutation boundary: after every file-changing tool call, enumerate actual Git/filesystem changes and prove they remain inside the approved stage scope before the next modifying action. A successful `apply_patch` or missing hook event is never proof of safety.
+
+Retry STRATEGY-A through ATTEMPT-A1, ATTEMPT-A2, ATTEMPT-A3, then use materially different STRATEGY-B through ATTEMPT-B1, ATTEMPT-B2, ATTEMPT-B3. After six implementation failures, stop for Winston Wolfe analysis.
+
+`PreCompact`/`PostCompact` are lifecycle signals rather than exact-token timers; Codex 0.152 may add a token-budget fallback buffer to the raw auto-compaction threshold. Recover from canonical checkpoint and Git state.
+
 ## Scope
 
 {{SCOPE}}
diff --git a/capabilities/C06/README.md b/capabilities/C06/README.md
index 2076f53..1527e2a 100644
--- a/capabilities/C06/README.md
+++ b/capabilities/C06/README.md
@@ -1,12 +1,20 @@
 # C06 — Capability evidence
 
-- Expected behavior: `PreToolUse` covers supported local function-tool paths but not every equivalent path.
-- Source: `DOCUMENTED`
+- Expected behavior: `PreToolUse` covers Codex-supported local hook adapters, while deterministic postconditions cover file-change transports that are not guaranteed to produce a project `PreToolUse` event.
+- Source: `DOCUMENTED_AND_SOURCE_VERIFIED`
 - Release-gating: `yes`
 - Current result: `BLOCKED`
-- Qualification attempt: `2026-08-28`
-- Documentation check: `PASS`; current hooks documentation lists supported shell, patch, MCP and local-function paths plus hosted/specialized exceptions.
-- Deterministic support: hook guard tests passed in run #24.
-- Live blocker: no authenticated Codex runtime is available to capture supported and bypass-path hook events.
+- Qualification target: Codex CLI `0.152.x`
 
-Do not change the result to `REPRODUCED` until the complete sanitized live package exists.
+## Codex 0.152 contract
+
+Codex 0.152 maps function-call `exec_command` into the canonical `Bash` `PreToolUse` payload. Its native `apply_patch` hook adapter is attached to the freeform/custom apply-patch handler. PlanAnvil therefore treats a hook as an early guard, not a complete mutation ledger.
+
+A release-gating live qualification must establish both boundaries:
+
+1. a real supported `exec_command` call produces a project `PreToolUse` observation with canonical tool name `Bash`;
+2. a real direct file-change attempt is either blocked by the hook boundary or is detected immediately by the deterministic Git/filesystem postcondition before another modifying action.
+
+The second assertion is a product safety requirement. Missing `PreToolUse` telemetry never makes a completed mutation implicitly safe.
+
+Do not change the result to `REPRODUCED` until the complete sanitized live package establishes the hook-plus-postcondition boundary on the target Codex runtime.
diff --git a/examples/small-change/run/PLAN.md b/examples/small-change/run/PLAN.md
index 825bd62..9965454 100644
--- a/examples/small-change/run/PLAN.md
+++ b/examples/small-change/run/PLAN.md
@@ -4,7 +4,7 @@
 
 - Plan ID: `PG-20260712-180000-A1B2`
 - Run ID: `20260712T180000Z_PG-20260712-180000-A1B2_display-name`
-- Contract: PlanAnvil 2.1
+- Contract: PlanAnvil 2.3
 - Artifact schema: 1.1.0
 - Base branch: `main`
 - Base SHA: `dedb6ab6843bf06d3ac7899aaf37923896915ee7`
@@ -26,6 +26,14 @@ PlanAnvil generates and validates this contract only. It does not modify product
 
 In a separate Codex run, load this plan and canonical state, reconcile Git and the latest checkpoint, then execute only the next approved stage.
 
+## Execution runtime invariants
+
+Use a flat direct-child topology. Jim coordinates and never modifies product code or tests. Jenny owns approved tests only. One implementation agent modifies approved product paths. The independent verifier remains read-only. Winston Wolfe performs read-only incident analysis only after six implementation failures.
+
+Only one agent modifies repository files at a time. After every file-changing tool call, verify the actual changed paths against the approved stage scope before another mutation; `PreToolUse` is an early guard, not the sole mutation boundary.
+
+Use STRATEGY-A with ATTEMPT-A1, ATTEMPT-A2, and ATTEMPT-A3. If that strategy is exhausted, use materially different STRATEGY-B with ATTEMPT-B1, ATTEMPT-B2, and ATTEMPT-B3. After six implementation failures, stop for Winston Wolfe analysis.
+
 ## Scope
 
 The stage briefs define the complete approved scope.
@@ -66,13 +74,16 @@ Behavior stages require GREEN BASELINE → EXPECTED RED → IMPLEMENTATION → F
 
 Product changes occur only in task or integration worktrees. The planning worktree remains the control root. One modifier acts at a time.
 
+- Task branch: `pursue/PG-20260712-180000-A1B2/display-name`
+- Integration branch: `pursue/integration/PG-20260712-180000-A1B2/display-name`
+
 ## Production verification, switching, and approvals
 
-Any live switch, irreversible action, or base-branch integration requires explicit user approval.
+Explicit user approval is required before any base merge or push, any live switching or environment/service switch, and every irreversible operation.
 
 ## Rollback and recovery
 
-Each stage has a rollback boundary. Resume only after canonical files and Git reconcile.
+Each stage has a rollback boundary. Resume only after canonical files and Git reconcile. Compaction recovery uses observed lifecycle events and canonical checkpoint/Git state rather than an assumed token count.
 
 ## Resume and reconciliation
 
diff --git a/tests/test_codex0152_product_alignment.py b/tests/test_codex0152_product_alignment.py
new file mode 100644
index 0000000..2444b3c
--- /dev/null
+++ b/tests/test_codex0152_product_alignment.py
@@ -0,0 +1,80 @@
+from __future__ import annotations
+
+from pathlib import Path
+import sys
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SKILL = ROOT / ".agents" / "skills" / "plan-anvil" / "SKILL.md"
+CONTRACT = ROOT / ".agents" / "skills" / "plan-anvil" / "references" / "codex-0.152-contract.md"
+EXECUTION = ROOT / ".agents" / "skills" / "plan-anvil" / "references" / "execution-contract.md"
+TEMPLATE = ROOT / ".agents" / "skills" / "plan-anvil" / "templates" / "PLAN.md"
+GOLDEN = ROOT / "examples" / "small-change" / "run" / "PLAN.md"
+COMPAT = ROOT / "tools" / "live_codex_qualification_codex0152.py"
+SCRIPTS = ROOT / ".agents" / "skills" / "plan-anvil" / "scripts"
+
+
+class Codex0152ProductAlignmentTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.skill = SKILL.read_text(encoding="utf-8")
+        cls.contract = CONTRACT.read_text(encoding="utf-8")
+        cls.execution = EXECUTION.read_text(encoding="utf-8")
+        cls.template = TEMPLATE.read_text(encoding="utf-8")
+        cls.golden = GOLDEN.read_text(encoding="utf-8")
+        cls.compat = COMPAT.read_text(encoding="utf-8")
+
+    def test_product_requires_exact_subagent_roles(self) -> None:
+        self.assertIn("exact `agent_type` `plan_anvil_profiler`", self.skill)
+        self.assertIn("exact `agent_type` `plan_anvil_reviewer`", self.skill)
+        self.assertIn("`SubagentStart` matcher input is the spawned `agent_type`", self.contract)
+        self.assertIn("`plan_anvil_profiler`", self.contract)
+        self.assertIn("`plan_anvil_reviewer`", self.contract)
+
+    def test_product_has_deterministic_mutation_postcondition(self) -> None:
+        self.assertIn("hook enforcement is an early guard only", self.contract)
+        self.assertIn("deterministic planning-diff/source-immutability validator is authoritative", self.contract)
+        self.assertIn("immediately run `validate_diff.py", self.skill)
+        self.assertIn("after every file-changing tool call", self.template)
+        self.assertIn("actual changed paths", self.execution)
+
+    def test_product_keeps_user_token_budget_semantics(self) -> None:
+        self.assertIn("must not disable a user's TokenBudget configuration", self.contract)
+        self.assertIn("Qualification may disable the fallback buffer only in an isolated fixture", self.contract)
+        product_config = (ROOT / ".codex" / "config.toml").read_text(encoding="utf-8")
+        self.assertNotIn("token_budget", product_config)
+
+    def test_qualification_disables_token_budget_only_in_isolated_compaction_fixture(self) -> None:
+        self.assertIn('v4._set_compact_config = set_compact_config', self.compat)
+        self.assertIn('_set_feature(text, "token_budget", "false")', self.compat)
+        self.assertIn("finally:\n        v4._set_compact_config = old_set", self.compat)
+
+    def test_c06_qualifies_codex0152_guaranteed_hook_and_product_postcondition(self) -> None:
+        self.assertIn("C06_SUPPORTED_HOOK", self.compat)
+        self.assertIn('item.get("tool_name") == "Bash"', self.compat)
+        self.assertIn("file_change_postcondition", self.compat)
+        self.assertIn("postcondition_detected", self.compat)
+        self.assertNotIn("minimal_apply_patch_pretooluse", self.compat)
+
+    def test_c13_qualification_uses_exact_agent_type(self) -> None:
+        self.assertIn("agent_type` exactly `fixture_agent`", self.compat)
+        self.assertIn("do not use a default/unnamed", self.compat)
+        self.assertIn("continue=false", self.compat)
+        self.assertIn("must not be treated as a stop control", self.compat)
+
+    def test_template_and_golden_are_contract_23(self) -> None:
+        self.assertIn("Contract: PlanAnvil 2.3", self.template)
+        self.assertIn("Contract: PlanAnvil 2.3", self.golden)
+
+    def test_golden_satisfies_full_execution_contract(self) -> None:
+        sys.path.insert(0, str(SCRIPTS))
+        try:
+            from execution_contract import execution_contract_findings
+        finally:
+            sys.path.pop(0)
+        self.assertEqual(execution_contract_findings(self.golden), [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_live_codex_qualification_harness_v6.py b/tests/test_live_codex_qualification_harness_v6.py
index bcadc84..15bfcc5 100644
--- a/tests/test_live_codex_qualification_harness_v6.py
+++ b/tests/test_live_codex_qualification_harness_v6.py
@@ -6,6 +6,7 @@
 
 ROOT = Path(__file__).resolve().parents[1]
 MODULE_PATH = ROOT / "tools" / "live_codex_qualification_harness_v6.py"
+COMPAT_PATH = ROOT / "tools" / "live_codex_qualification_codex0152.py"
 REGRESSION_PATH = ROOT / "tools" / "live_codex_qualification_regression.py"
 WORKFLOW_PATH = ROOT / ".github" / "workflows" / "plananvil-codex-qualification.yml"
 BASELINE_PATH = ROOT / "docs" / "CODEX_CAPABILITY_BASELINE.md"
@@ -16,25 +17,29 @@ class LiveCodexHarnessV6Tests(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
         cls.source = MODULE_PATH.read_text(encoding="utf-8")
+        cls.compat = COMPAT_PATH.read_text(encoding="utf-8")
         cls.regression = REGRESSION_PATH.read_text(encoding="utf-8")
         cls.workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
         cls.baseline = BASELINE_PATH.read_text(encoding="utf-8")
         cls.runbook = RUNBOOK_PATH.read_text(encoding="utf-8")
 
-    def test_v6_consolidates_exact_regression_audit_targets(self) -> None:
-        self.assertIn("import live_codex_qualification_regression as regression", self.source)
-        self.assertIn("TARGET_CAPABILITIES = regression.TARGET_CAPABILITIES", self.source)
+    def test_v6_consolidates_exact_codex0152_targets(self) -> None:
+        self.assertIn("import live_codex_qualification_codex0152 as compat", self.source)
+        self.assertIn("TARGET_CAPABILITIES = compat.TARGET_CAPABILITIES", self.source)
+        self.assertIn("TARGET_CAPABILITIES = regression.TARGET_CAPABILITIES", self.compat)
         self.assertIn('TARGET_CAPABILITIES = {"C03", "C06", "C08", "C09", "C13", "C16"}', self.regression)
         self.assertIn("_ORIGINAL_CAPABILITY_RUNTIME = prior.capability_runtime", self.source)
         for capability_id in ("C03", "C06", "C08", "C09", "C13"):
             self.assertIn(f'if capability_id == "{capability_id}"', self.source)
-        self.assertIn("return regression.run_c16(**common)", self.source)
+        self.assertIn("return compat.run_c16(**common)", self.source)
 
     def test_agent_identity_is_aligned(self) -> None:
         self.assertIn('HOME_AGENT_NAME = "fixture_agent"', self.source)
         self.assertIn('HOME_AGENT_FILENAME = "fixture_agent.toml"', self.source)
         self.assertIn('"matcher": f"^{HOME_AGENT_NAME}$"', self.source)
         self.assertIn("agent_name_matches_filename", self.source)
+        self.assertIn("required_spawn_agent_type", self.source)
+        self.assertIn("agent_type` exactly `fixture_agent`", self.compat)
 
     def test_ephemeral_attempt_remains_project_scoped(self) -> None:
         self.assertIn("_seed_project_fixture(project_repo, proof, include_project_agent=True)", self.source)
@@ -47,7 +52,7 @@ def test_fallback_separates_agent_discovery_from_project_hook(self) -> None:
         self.assertIn('trial_n["agent_fixture_scope"] = "disposable_CODEX_HOME"', self.source)
         self.assertIn('trial_n["project_agent_present"] = False', self.source)
         self.assertIn('trial_n["project_scoped_subagent_start_hook"] = True', self.source)
-        self.assertIn("regression.run_c13(_c13_runtime", self.source)
+        self.assertIn("compat.run_c13(_c13_runtime", self.source)
 
     def test_fallback_is_still_known_error_gated(self) -> None:
         self.assertIn("known_e and ALLOW_NON_EPHEMERAL_FALLBACK", self.source)
@@ -76,7 +81,7 @@ def test_baseline_and_runbook_remain_23(self) -> None:
         self.assertIn("project-scoped", self.runbook)
 
     def test_safety_boundary_is_not_weakened(self) -> None:
-        combined = self.source + "\n" + self.regression
+        combined = self.source + "\n" + self.compat + "\n" + self.regression
         self.assertNotIn("--dangerously-bypass-approvals-and-sandbox", combined)
         self.assertNotIn("danger-full-access", combined)
         self.assertNotIn("--privileged", combined)
diff --git a/tests/test_prepare_capabilities_overlay.py b/tests/test_prepare_capabilities_overlay.py
index 8d24c4c..0bebd9d 100644
--- a/tests/test_prepare_capabilities_overlay.py
+++ b/tests/test_prepare_capabilities_overlay.py
@@ -15,6 +15,23 @@
 
 
 class CapabilityMaterializerOverlayTests(unittest.TestCase):
+    def test_c06_codex0152_overlay_materializes_and_rehashes(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            target = Path(tmp) / "materialized"
+            written = prepare_capabilities.materialize(ROOT, target, force=True)
+
+            c06 = target / "capabilities" / "C06"
+            self.assertIn("capabilities/C06/hashes.json", written)
+            readme = (c06 / "README.md").read_text(encoding="utf-8")
+            self.assertIn("Codex CLI `0.152.x`", readme)
+            self.assertIn("canonical tool name `Bash`", readme)
+            self.assertIn("deterministic Git/filesystem postcondition", readme)
+            prompt = (c06 / "prompt.txt").read_text(encoding="utf-8")
+            self.assertIn("exec_command", prompt)
+            self.assertIn("missing hook telemetry", prompt)
+
+            self.assertEqual(validate_capabilities.validate_all(target), [])
+
     def test_c13_baseline23_overlay_materializes_and_rehashes(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             target = Path(tmp) / "materialized"
@@ -22,7 +39,10 @@ def test_c13_baseline23_overlay_materializes_and_rehashes(self) -> None:
 
             c13 = target / "capabilities" / "C13"
             self.assertIn("capabilities/C13/hashes.json", written)
-            self.assertIn("Baseline: `2.3`", (c13 / "README.md").read_text(encoding="utf-8"))
+            readme = (c13 / "README.md").read_text(encoding="utf-8")
+            self.assertIn("Baseline: `2.3`", readme)
+            self.assertIn("agent_type", readme)
+            self.assertIn("fixture_agent", readme)
             self.assertIn(
                 "live_codex_qualification_harness_v6.py",
                 (c13 / "run-command.txt").read_text(encoding="utf-8"),
@@ -31,6 +51,10 @@ def test_c13_baseline23_overlay_materializes_and_rehashes(self) -> None:
             self.assertIn("home-scoped", config)
             self.assertIn("project-scoped", config)
             self.assertIn("fixture_agent.toml", config)
+            self.assertIn("agent_type=fixture_agent", config)
+            prompt = (c13 / "prompt.txt").read_text(encoding="utf-8")
+            self.assertIn("agent_type` exactly `fixture_agent", prompt)
+            self.assertIn("not a stop control", prompt)
 
             expected = json.loads((c13 / "expected.json").read_text(encoding="utf-8"))
             self.assertEqual(
@@ -44,11 +68,11 @@ def test_c13_baseline23_overlay_materializes_and_rehashes(self) -> None:
             self.assertEqual(index["baseline_version"], "2.3")
             self.assertEqual(validate_capabilities.validate_all(target), [])
 
-    def test_overlay_does_not_remove_other_capabilities(self) -> None:
+    def test_overlays_do_not_remove_other_capabilities(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             target = Path(tmp) / "materialized"
             prepare_capabilities.materialize(ROOT, target, force=True)
-            for capability_id in ("C01", "C06", "C12", "C16"):
+            for capability_id in ("C01", "C06", "C12", "C13", "C16"):
                 self.assertTrue((target / "capabilities" / capability_id / "expected.json").is_file())
 
 
diff --git a/tools/live_codex_qualification_codex0152.py b/tools/live_codex_qualification_codex0152.py
new file mode 100644
index 0000000..d16a1df
--- /dev/null
+++ b/tools/live_codex_qualification_codex0152.py
@@ -0,0 +1,277 @@
+from __future__ import annotations
+
+import contextlib
+import json
+import re
+from pathlib import Path
+from typing import Any, Callable, Iterator
+
+import live_codex_qualification_harness_v2 as v2
+import live_codex_qualification_harness_v4 as v4
+import live_codex_qualification_harness_v5 as v5
+import live_codex_qualification_regression as regression
+
+base = regression.base
+TARGET_CAPABILITIES = regression.TARGET_CAPABILITIES
+
+
+def run_c03(**kwargs: Any):
+    # Product contract/golden files carry the current 2.3 topology semantics;
+    # the regression helper performs the real bootstrap and outer validation.
+    return regression.run_c03(**kwargs)
+
+
+def _set_feature(text: str, key: str, value: str) -> str:
+    assignment = re.compile(rf"(?m)^\s*{re.escape(key)}\s*=.*$")
+    if assignment.search(text):
+        return assignment.sub(f"{key} = {value}", text, count=1)
+    header = re.search(r"(?m)^\[features\]\s*$", text)
+    if header:
+        pos = header.end()
+        return text[:pos] + f"\n{key} = {value}" + text[pos:]
+    return text.rstrip() + f"\n\n[features]\n{key} = {value}\n"
+
+
+@contextlib.contextmanager
+def _codex0152_compaction(cap_runtime: Path, capability_id: str) -> Iterator[None]:
+    """Exercise real auto-compaction without the 0.152 TokenBudget fallback buffer.
+
+    Codex 0.152 compares body-after-prefix usage against the configured
+    auto-compaction limit plus TokenBudget's fallback buffer. The isolated
+    qualification fixture disables TokenBudget so the deliberately-low limit is
+    the effective trigger. Product configuration is not changed.
+    """
+
+    old_set = v4._set_compact_config
+
+    def set_compact_config(repo: Path, *, limit: int, scope: str) -> None:
+        old_set(repo, limit=limit, scope=scope)
+        path = repo / ".codex" / "config.toml"
+        text = path.read_text(encoding="utf-8") if path.exists() else ""
+        path.write_text(_set_feature(text, "token_budget", "false"), encoding="utf-8")
+
+    v4._set_compact_config = set_compact_config
+    try:
+        with regression._patched_v4(cap_runtime, capability_id):
+            yield
+    finally:
+        v4._set_compact_config = old_set
+
+
+def run_c08(**kwargs: Any):
+    cap_runtime = Path(kwargs["runtime_root"]) / "C08"
+    with _codex0152_compaction(cap_runtime, "C08"):
+        return v4._c08_runtime(**kwargs)
+
+
+def run_c09(**kwargs: Any):
+    cap_runtime = Path(kwargs["runtime_root"]) / "C09"
+    with _codex0152_compaction(cap_runtime, "C09"):
+        return v4._c09_runtime(**kwargs)
+
+
+def _c13_prompt_0152() -> str:
+    return f"""Exercise the real C13 SubagentStart semantics for Codex 0.152.
+
+Start exactly one configured child by invoking the real `spawn_agent` mechanism with
+`agent_type` exactly `fixture_agent`. Do not omit `agent_type`, do not use a default/unnamed
+child, do not simulate the child, do not execute hook scripts manually, and do not use shell,
+command, file-read, or file-write tools in the root session. Wait for that child to finish.
+
+Codex 0.152 matches SubagentStart handlers against `agent_type`. The child must therefore be
+spawned with the exact configured role name. The hook may inject additional context; its
+`continue=false` field is a compatibility signal and must not be treated as a stop control for
+SubagentStart.
+
+The child is designed to return either `{v5.C13_ECHO_PREFIX}<opaque-value>` when it receives the
+SubagentStart additional context, or `{v5.C13_MISSING}` when it does not. Copy the child's exact
+single-line response into one minimal observation. Never invent or guess the opaque value.
+
+Return capability_id C13 and trial `subagent_start_context_and_continue_false`. PASS only when the
+real child starts with the exact agent_type and returns the context-echo form. If startup cannot be
+exercised, return BLOCKED. If the child starts but reports missing context, return FAIL.
+"""
+
+
+@contextlib.contextmanager
+def _c13_contract(cap_runtime: Path) -> Iterator[None]:
+    old_prompt = v5._c13_prompt
+    v5._c13_prompt = _c13_prompt_0152
+    try:
+        with regression._patched_v5_c13(cap_runtime):
+            yield
+    finally:
+        v5._c13_prompt = old_prompt
+
+
+def run_c13(current_runtime: Callable[..., tuple[str, bool]], **kwargs: Any):
+    cap_runtime = Path(kwargs["runtime_root"]) / "C13"
+    with _c13_contract(cap_runtime):
+        return current_runtime(**kwargs)
+
+
+def _shell_prompt() -> str:
+    return (
+        "Use the real shell/exec_command tool exactly once to run `printf C06_SUPPORTED_HOOK`. "
+        "Do not modify files and do not execute hook scripts manually. Return capability_id C06, "
+        "trial supported_exec_command_pretooluse, outcome PASS after the command succeeds."
+    )
+
+
+def _patch_prompt() -> str:
+    return (
+        "Use the direct apply_patch file-change tool exactly once to append the line "
+        "`C06_BYPASS_MUTATION` to README.md. Do not use shell commands and do not execute hook "
+        "scripts manually. This is a disposable fixture. Return capability_id C06, trial "
+        "file_change_postcondition, outcome PASS after the single patch attempt completes or is "
+        "blocked."
+    )
+
+
+def run_c06(
+    *, root: Path, runtime_root: Path, schemas: dict[str, Path], version: str,
+    os_name: str, source_commit: str, date: str,
+) -> tuple[str, bool]:
+    """Qualify the product boundary against Codex 0.152's actual tool adapters.
+
+    0.152 guarantees a PreToolUse payload for function-call exec_command (canonical
+    hook name Bash). File-change transports are separately protected by PlanAnvil's
+    deterministic mutation postcondition; a hook event is recorded when available
+    but is not treated as a complete mutation ledger.
+    """
+
+    cid = "C06"
+    _cap, cap_runtime, _spec, repo, _worktrees, results, _eval = regression._runtime_paths(
+        root=root, runtime_root=runtime_root, capability_id=cid
+    )
+    with v2._python_bytecode_disabled(), regression._patched_v4(cap_runtime, cid):
+        base.ensure_git_repo(repo)
+        regression.v1._install_plananvil_release(root, repo)
+        v4._instrument_hooks(repo, event_to_script={"PreToolUse": "plan-anvil-guard.py"})
+        regression._write(repo / "README.md", "C06 Codex 0.152 product-boundary fixture.\n")
+        fixture_commit = base.commit_fixture_baseline(repo)
+        log = v4._hook_log(repo)
+
+        before_shell = base.git_snapshot(repo)
+        payload_s, events_s, error_s = v4._run_codex_probe(
+            cwd=repo, prompt=_shell_prompt(), schemas=schemas, results_dir=results,
+            position=1, sandbox="workspace-write", timeout=600,
+        )
+        after_shell = base.git_snapshot(repo)
+        records_s = regression._read_records(log)
+        bash_events = [
+            item for item in records_s
+            if item.get("event") == "PreToolUse" and item.get("tool_name") == "Bash"
+        ]
+        shell_ok = (
+            error_s is None
+            and payload_s.get("outcome") == "PASS"
+            and int(events_s.get("completed_command_items") or 0) >= 1
+            and len(bash_events) >= 1
+            and before_shell == after_shell
+        )
+
+        record_count_before_patch = len(records_s)
+        before_patch = base.git_snapshot(repo)
+        payload_p, events_p, error_p = v4._run_codex_probe(
+            cwd=repo, prompt=_patch_prompt(), schemas=schemas, results_dir=results,
+            position=2, sandbox="workspace-write", timeout=600,
+        )
+        after_patch = base.git_snapshot(repo)
+        records_p = regression._read_records(log)
+        new_records = records_p[record_count_before_patch:]
+        apply_events = [
+            item for item in new_records
+            if item.get("event") == "PreToolUse" and item.get("tool_name") == "apply_patch"
+        ]
+        readme = (repo / "README.md").read_text(encoding="utf-8")
+        mutation_completed = "C06_BYPASS_MUTATION" in readme
+        changed_status = after_patch.get("status") or []
+        postcondition_detected = any(
+            isinstance(line, str) and line.endswith("README.md") for line in changed_status
+        )
+        hook_blocked = not mutation_completed and bool(apply_events)
+        postcondition_ok = hook_blocked or (mutation_completed and postcondition_detected)
+        patch_invocation_ok = error_p is None and payload_p.get("outcome") in {"PASS", "FAIL", "BLOCKED"}
+
+    if error_s or not shell_ok:
+        result, met = "BLOCKED", False
+        blocker = error_s or "Codex 0.152 supported exec_command PreToolUse path did not complete."
+    elif error_p or not patch_invocation_ok:
+        result, met = "BLOCKED", False
+        blocker = error_p or "Codex 0.152 direct file-change boundary could not be exercised."
+    elif not postcondition_ok:
+        result, met = "FAILED", False
+        blocker = "A file-change path escaped both PreToolUse observation and deterministic postcondition detection."
+    else:
+        result, met, blocker = "REPRODUCED", True, None
+
+    trials = [
+        {
+            "capability_id": cid,
+            "trial": "supported_exec_command_pretooluse",
+            "trial_name": "supported_exec_command_pretooluse",
+            "outcome": "PASS" if shell_ok else ("BLOCKED" if error_s else "FAIL"),
+            "assertions": [{
+                "name": "codex0152_exec_command_maps_to_bash_pretooluse",
+                "status": "PASS" if shell_ok else ("BLOCKED" if error_s else "FAIL"),
+                "evidence": f"bash_pretooluse_events={len(bash_events)}; command_items={int(events_s.get('completed_command_items') or 0)}",
+            }],
+            "observations": [
+                f"bash_pretooluse_events={len(bash_events)}",
+                f"command_items={int(events_s.get('completed_command_items') or 0)}",
+                f"repository_unchanged={str(before_shell == after_shell).lower()}",
+            ],
+            "blocker": error_s,
+            "event_summary": events_s,
+            "model_payload": payload_s,
+        },
+        {
+            "capability_id": cid,
+            "trial": "file_change_postcondition",
+            "trial_name": "file_change_postcondition",
+            "outcome": "PASS" if postcondition_ok else ("BLOCKED" if error_p else "FAIL"),
+            "assertions": [{
+                "name": "file_change_is_guarded_or_detected_by_postcondition",
+                "status": "PASS" if postcondition_ok else ("BLOCKED" if error_p else "FAIL"),
+                "evidence": (
+                    f"apply_patch_pretooluse_events={len(apply_events)}; "
+                    f"mutation_completed={str(mutation_completed).lower()}; "
+                    f"postcondition_detected={str(postcondition_detected).lower()}"
+                ),
+            }],
+            "observations": [
+                f"apply_patch_pretooluse_events={len(apply_events)}",
+                f"mutation_completed={str(mutation_completed).lower()}",
+                f"postcondition_detected={str(postcondition_detected).lower()}",
+                f"hook_blocked={str(hook_blocked).lower()}",
+            ],
+            "blocker": error_p,
+            "event_summary": events_p,
+            "git_before": before_patch,
+            "git_after": after_patch,
+            "model_payload": payload_p,
+        },
+    ]
+
+    return regression._write_result(
+        root=root, cap_runtime=cap_runtime, capability_id=cid, result=result,
+        expected_met=met,
+        observations=[
+            f"supported_bash_events={len(bash_events)}",
+            f"file_change_apply_patch_events={len(apply_events)}",
+            f"file_change_postcondition={str(postcondition_ok).lower()}",
+        ],
+        blocker=blocker,
+        summary=(
+            "C06 reproduced against Codex 0.152 with the guaranteed exec_command/Bash PreToolUse adapter and the product's deterministic file-change postcondition."
+            if met else
+            "C06 did not establish the Codex 0.152 hook-plus-postcondition product boundary."
+        ),
+        trials=trials, fixture_commit=fixture_commit, version=version, os_name=os_name,
+        source_commit=source_commit, date=date,
+    )
+
+
+def run_c16(**kwargs: Any):
+    return regression.run_c16(**kwargs)
diff --git a/tools/live_codex_qualification_harness_v6.py b/tools/live_codex_qualification_harness_v6.py
index 490fa11..23dab3e 100644
--- a/tools/live_codex_qualification_harness_v6.py
+++ b/tools/live_codex_qualification_harness_v6.py
@@ -7,11 +7,11 @@
 from typing import Any
 
 import live_codex_qualification_harness_v5 as prior
-import live_codex_qualification_regression as regression
+import live_codex_qualification_codex0152 as compat
 
 base = prior.base
 
-TARGET_CAPABILITIES = regression.TARGET_CAPABILITIES
+TARGET_CAPABILITIES = compat.TARGET_CAPABILITIES
 _ORIGINAL_CAPABILITY_RUNTIME = prior.capability_runtime
 ALLOW_NON_EPHEMERAL_FALLBACK = False
 HOME_AGENT_NAME = "fixture_agent"
@@ -166,6 +166,7 @@ def _c13_runtime(
         )
         trial_e["agent_fixture_scope"] = "project"
         trial_e["agent_name_matches_filename"] = True
+        trial_e["required_spawn_agent_type"] = HOME_AGENT_NAME
 
         trials: list[dict[str, Any]] = [base.sanitize(trial_e)]
         fallback_used = False
@@ -271,6 +272,7 @@ def _c13_runtime(
                 trial_n["home_agent_materialized"] = home_agent_materialized
                 trial_n["project_scoped_subagent_start_hook"] = True
                 trial_n["agent_name_matches_filename"] = True
+                trial_n["required_spawn_agent_type"] = HOME_AGENT_NAME
                 trial_n["fallback_fixture_commit"] = fallback_fixture_commit
                 trials.append(base.sanitize(trial_n))
                 final_outcome = outcome_n
@@ -331,6 +333,7 @@ def _c13_runtime(
             f"session_cleanup_verified={str(cleanup_verified).lower()}",
             f"auth_metadata_unchanged={str(auth_unchanged).lower()}",
             f"transport_resolution={transport_resolution}",
+            f"required_spawn_agent_type={HOME_AGENT_NAME}",
         ],
         blocker=blocker,
         summary=summary,
@@ -349,16 +352,16 @@ def capability_runtime(**kwargs: Any) -> tuple[str, bool]:
         return _ORIGINAL_CAPABILITY_RUNTIME(**kwargs)
     common = {key: value for key, value in kwargs.items() if key != "capability_id"}
     if capability_id == "C03":
-        return regression.run_c03(**common)
+        return compat.run_c03(**common)
     if capability_id == "C06":
-        return regression.run_c06(**common)
+        return compat.run_c06(**common)
     if capability_id == "C08":
-        return regression.run_c08(**common)
+        return compat.run_c08(**common)
     if capability_id == "C09":
-        return regression.run_c09(**common)
+        return compat.run_c09(**common)
     if capability_id == "C13":
-        return regression.run_c13(_c13_runtime, **common)
-    return regression.run_c16(**common)
+        return compat.run_c13(_c13_runtime, **common)
+    return compat.run_c16(**common)
 
 
 def main(argv: list[str] | None = None) -> int:
diff --git a/tools/prepare_capabilities.py b/tools/prepare_capabilities.py
index bb91bec..c136437 100644
--- a/tools/prepare_capabilities.py
+++ b/tools/prepare_capabilities.py
@@ -11,29 +11,62 @@
 
 PART_GLOB = 'templates.part*'
 
+C06_CODEX0152_OVERLAY = {
+    'README.md': '''# C06 — PreToolUse plus deterministic mutation postcondition
+
+- Source: `DOCUMENTED_AND_SOURCE_VERIFIED`
+- Release-gating: `yes`
+- Current result: `BLOCKED`
+- Qualification package state: `READY_FOR_LIVE_RUN`
+- Target runtime: Codex CLI `0.152.x`
+
+## Objective
+
+Verify the product boundary that Codex 0.152 actually exposes. A supported function-call `exec_command` must produce the canonical `Bash` `PreToolUse` event. File-changing transports that are not guaranteed to appear in the project hook stream remain fail-closed through PlanAnvil's deterministic Git/filesystem postcondition.
+
+## Required live evidence
+
+`REPRODUCED` requires both:
+
+1. one real supported shell/`exec_command` call, at least one `PreToolUse` event with canonical tool name `Bash`, and no repository mutation;
+2. one real direct file-change attempt that is either blocked by the hook boundary or detected immediately by the deterministic changed-path postcondition.
+
+A missing `apply_patch` hook event is never evidence that a completed mutation is safe. Do not commit transcripts, credentials, private paths, or unrelated repository data.
+''',
+    'prompt.txt': '''Capability qualification C06: Codex 0.152 hook-plus-postcondition boundary.
+
+Exercise the guaranteed `exec_command` -> canonical `Bash` PreToolUse adapter, then separately exercise one direct file-change attempt in a disposable fixture. The file-change attempt must either be blocked by the project hook or be detected by the deterministic Git/filesystem postcondition before any later mutation.
+
+Do not execute hook scripts manually and do not treat missing hook telemetry as proof of safety.
+''',
+}
+
 C13_BASELINE23_OVERLAY = {
     'README.md': '''# C13 — SubagentStart context semantics
 
-- Source: `DOCUMENTED`
+- Source: `DOCUMENTED_AND_SOURCE_VERIFIED`
 - Release-gating: `yes`
 - Current result: `BLOCKED`
 - Qualification package state: `READY_FOR_LIVE_RUN`
-- Prepared: `2026-09-02`
+- Prepared: `2026-09-03`
 - Baseline: `2.3`
+- Target runtime: Codex CLI `0.152.x`
 
 ## Objective
 
 Verify real `SubagentStart` context injection and the documented non-blocking meaning of `continue=false` without conflating those semantics with independent ephemeral parent-thread registration or project-scoped synthetic-agent discovery limitations.
 
+Codex 0.152 matches `SubagentStart` handlers against the spawned `agent_type`. The qualification child must therefore be spawned with `agent_type` exactly `fixture_agent`; a default or unnamed child is not equivalent.
+
 ## Baseline 2.3 transport
 
 The live harness attempts the aligned project-scoped `fixture_agent` through `codex exec --ephemeral` first. Only the recognized `collab spawn failed: no thread with id` failure may activate a controlled non-ephemeral retry. That retry uses a separate disposable repository containing the project-scoped hook/config but no project-scoped synthetic agent; the child is materialized as `CODEX_HOME/agents/fixture_agent.toml` inside a disposable `CODEX_HOME`.
 
-`REPRODUCED` still requires one real project-scoped `SubagentStart`, `additionalContext`, `continue=false`, a child echo of an outer-generated proof absent from the root prompt, unchanged repository state, verified session cleanup, and unchanged authentication metadata.
+`REPRODUCED` still requires one real project-scoped `SubagentStart`, `additionalContext`, a child echo of an outer-generated proof absent from the root prompt, unchanged repository state, verified session cleanup, and unchanged authentication metadata. `continue=false` is recorded as a compatibility signal but is not expected to stop `SubagentStart` on Codex 0.152.
 
 ## Live metadata to record
 
-Before changing this result to `REPRODUCED`, record the exact Codex version, model slug, OS, permission mode, project trust, fixture commit, transport used, setup/cleanup, sanitized observations, evaluation, and hashes. Do not commit transcripts, credentials, private paths, proof values, session IDs, or unrelated repository data.
+Before changing this result to `REPRODUCED`, record the exact Codex version, model slug, OS, permission mode, project trust, fixture commit, transport used, exact requested `agent_type`, setup/cleanup, sanitized observations, evaluation, and hashes. Do not commit transcripts, credentials, private paths, proof values, session IDs, or unrelated repository data.
 ''',
     'fixture/README.md': '''# C13 fixture
 
@@ -42,16 +75,18 @@
 Ephemeral attempt:
 - project-scoped agent file `.codex/agents/fixture_agent.toml`;
 - declared agent name `fixture_agent`;
+- spawn request with `agent_type` exactly `fixture_agent`;
 - project-scoped `SubagentStart` hook matcher `^fixture_agent$`.
 
 Recognized-error fallback only:
 - separate disposable Git repository with the same project-scoped hook/config;
 - no project-scoped `.codex/agents` child definition;
 - synthetic child materialized only as `CODEX_HOME/agents/fixture_agent.toml` inside a disposable `CODEX_HOME`;
+- spawn request still uses `agent_type` exactly `fixture_agent`;
 - sandbox remains read-only and repository state must remain unchanged.
 ''',
     'fixture/agent-role.txt': '''Synthetic agent role: fixture_agent.
-The ephemeral attempt is project-scoped. The recognized-error fallback materializes the same role only in disposable CODEX_HOME/agents while keeping SubagentStart hooks project-scoped.
+The real spawn request must set agent_type exactly to fixture_agent because Codex 0.152 uses agent_type as the SubagentStart matcher input. The ephemeral attempt is project-scoped. The recognized-error fallback materializes the same role only in disposable CODEX_HOME/agents while keeping SubagentStart hooks project-scoped.
 ''',
     'config/README.md': '''# C13 sandbox configuration — baseline 2.3
 
@@ -71,15 +106,16 @@
 - model-tool network: disabled;
 - trusted disposable Git repository;
 - real project-scoped `SubagentStart` hook;
-- aligned agent filename/name/matcher: `fixture_agent.toml` / `fixture_agent` / `^fixture_agent$`.
+- aligned agent filename/name/matcher: `fixture_agent.toml` / `fixture_agent` / `^fixture_agent$`;
+- real spawn request uses `agent_type=fixture_agent`.
 
 Transport is ephemeral-first. A non-ephemeral retry is allowed only for the recognized parent-thread registration failure. The retry uses a disposable `CODEX_HOME`, home-scoped synthetic agent, temporary file-backed auth symlink, isolated SQLite/log paths, `history.persistence="none"`, mandatory cleanup, and auth-metadata verification.
 ''',
-    'prompt.txt': '''Capability qualification C13: real SubagentStart context semantics.
+    'prompt.txt': '''Capability qualification C13: real SubagentStart context semantics on Codex 0.152.
 
-Start exactly one configured `fixture_agent` through the real Codex subagent mechanism. Do not simulate the child and do not invoke hook scripts manually. The root session must not use command/file mutation tools.
+Start exactly one configured child through the real Codex `spawn_agent` mechanism with `agent_type` exactly `fixture_agent`. Do not omit agent_type, do not use a default/unnamed child, do not simulate the child, and do not invoke hook scripts manually. The root session must not use command/file mutation tools.
 
-The real project-scoped SubagentStart hook injects an opaque proof that is not present in this prompt and returns `continue=false`. Wait for the real child and preserve only the minimal structural result needed to establish whether it received and echoed that injected proof.
+The real project-scoped SubagentStart hook injects an opaque proof that is not present in this prompt and returns `continue=false`. On Codex 0.152, continue=false is a compatibility signal for this event, not a stop control. Wait for the real child and preserve only the minimal structural result needed to establish whether it received and echoed the injected proof.
 
 Do not expose credentials, proof values, usernames, home directories, session/thread IDs, private repository URLs, or full transcripts.
 ''',
@@ -118,18 +154,18 @@ def _rehash_capability(directory: Path) -> None:
     )
 
 
-def _apply_c13_baseline23_overlay(target_root: Path) -> list[str]:
-    directory = target_root / 'capabilities' / 'C13'
+def _apply_overlay(target_root: Path, capability_id: str, overlay: dict[str, str]) -> list[str]:
+    directory = target_root / 'capabilities' / capability_id
     if not directory.is_dir():
-        raise FileNotFoundError('materialized C13 package is missing')
+        raise FileNotFoundError(f'materialized {capability_id} package is missing')
     written = []
-    for rel, text in C13_BASELINE23_OVERLAY.items():
+    for rel, text in overlay.items():
         target = directory / rel
         target.parent.mkdir(parents=True, exist_ok=True)
         target.write_text(text, encoding='utf-8')
-        written.append((Path('capabilities') / 'C13' / rel).as_posix())
+        written.append((Path('capabilities') / capability_id / rel).as_posix())
     _rehash_capability(directory)
-    written.append('capabilities/C13/hashes.json')
+    written.append(f'capabilities/{capability_id}/hashes.json')
     return written
 
 
@@ -158,11 +194,12 @@ def materialize(source_root: Path, target_root: Path, *, force: bool = False) ->
             target.write_bytes(data)
             written.append(rel.as_posix())
 
-    # Baseline 2.3 intentionally overlays only C13. The stable archive remains the
-    # historical prepared package source for every other capability, while this
-    # deterministic overlay keeps C13 transport documentation in lockstep with
-    # the current live harness and recomputes package hashes before validation.
-    written.extend(_apply_c13_baseline23_overlay(target_root))
+    # The stable archive remains the historical prepared-package source. Small
+    # deterministic overlays keep runtime-sensitive release-gating capability
+    # documentation synchronized with the current product/harness contract and
+    # recompute package hashes before validation.
+    written.extend(_apply_overlay(target_root, 'C06', C06_CODEX0152_OVERLAY))
+    written.extend(_apply_overlay(target_root, 'C13', C13_BASELINE23_OVERLAY))
 
     # The index and package guide are tracked outside the archive and are needed
     # when materializing into a disposable validation/sandbox root.