[abruption]

Summary

Refs #180, which remains open: Codex and other native profiles do not provide a proven atomic generation precondition.

Add opt-in list --with-target-generation and send --target-generation. Claude tokens bind the home, native process-creation evidence and inbox endpoint. Before any message or Windows authentication bytes, check the connected socket/pipe server PID and original process evidence. Changed, missing or unavailable identity is refused; unsupported Codex, Antigravity and paired-device paths refuse before submission or wake. Unpinned output and Python Claude optional absence remain unchanged.

Forward and check generation results over source-streamed SSH without retries. Missing or incorrect generation echoes retain returned native target, chars, dry-run and SSH metadata while reporting unknown/no automatic retry. Completed generation refusals remain refused. A stale_target refusal now includes the closed, bounded lastSeenTarget: {agent: "claude", targetGeneration: ORIGINAL_TOKEN}: the original requested token, not successor metadata. Unavailable/unsupported/invalid/default results do not gain this field. No raw creation values, paths, user names or host names are added.

The optional SSH refusal metadata must match an original single Claude send target and generation. Malformed optional metadata cannot establish a completed refusal. Complete positive results accepted by the existing ordinary parser retain their existing semantics with invalid optional metadata removed; this is not a new full native-context validator.

A private POSIX effect/total monotonic deadline interface bounds socket connect/write/drain for handoff integration. Windows bounded pipe submission refuses before effect. Post-write failure stays unknown/no-retry rather than inventing submitted:false. Filesystem/native identity inspection is not universally cancellable.

Validation

At df610896cc0c889c767f6096e6c685de4bccf97d:

• Generation and ordinary SSH suites: 83 passed (21 generation, 62 SSH), using development mode and ResourceWarning-as-error.
• Documentation: 32 passed; generated standalone and whitespace checks passed. Four CLI-reference locales and the source manifest are aligned.
• Independent exact-candidate read-only review reran 82 selected generation/SSH/i18n tests on Python 3.13.7 and found no additional scoped blocker. This local review is not current-head CI or full platform/native acceptance.
• Complete default discovery in an isolated Python 3.14.8 environment with repository-pinned packaging==26.3: 623 tests passed, 29 skipped. No optional Relay/MCP packages were installed in this environment. An earlier system-interpreter run failed only because the release-artifact test lacked packaging; the isolated rerun above supplies that existing test dependency without changing shared installations.
• The source-streamed regression executes the actual generated standalone source through an owned local fake-SSH process. After a protocol inbox process is stopped and restarted with the same alias and socket path, the original list token refuses normal send and dry-run with zero received bytes and exactly one source invocation each. A newly listed token yields exactly one write to the successor. Fixture records contain only body-free counts.
• Prior runtime 6e2f9f8 had a separate complete extras run of 805 tests (12 skipped); that historical run does not cover this new metadata implementation.
• Exact-head CI run 37875282240 completed successfully. All 28 current-head checks succeeded, including Linux/macOS Python 3.9/3.13, Windows Python 3.13, optional transports/Control, package/documentation checks, the release gate, CodeQL and GitGuardian. These platform fixtures are not live native-agent acceptance.
• The automatic Codex review summary still names earlier commit 7e8afb7, not df61089. No current-head automatic-review approval is inferred; no mentions or manual review triggers were posted.

Boundaries

No actual Claude/Codex/model message, physical remote-host SSH delivery, real Windows pipe experiment or new Linux live-platform experiment was performed locally. The owned Unix protocol inbox is not a native agent. Fake SSH proves source/argv/wire integration, not SSH authentication or fleet acceptance. It does not prove actual PID recycling, receiver deduplication or exactly-once delivery.

Native creation values have OS-specific granularity and are not globally unique or clone-proof authentication. Same-account adversarial endpoint manipulation is outside this precondition. The generation token is not a secret, permission, ACK, retry key or cryptographic SSH host-key continuity. Native Codex queue insertion cannot atomically constrain a later consuming writer; its unsupported boundary stays explicit and #180 remains open.

No merge, release, version bump, deployment, policy change or credentials/private session identifiers in the diff. Automatic Codex review and required current-head checks are inspected without mentions or manual review triggers.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T00:21:34.026470Z	7e8afb7	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-09T00:20:14.422174Z	7e8afb7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.