[codex] 0.18: decontaminate packet planning and repair the substrate

.github/scripts/check-workflow-policy.mjs

@@ -325,7 +325,6 @@ export function benchmarkDependencyIsolationViolations(source) {
     const reviewedProductDependencies = [
       ["codestory-agent", {
         workspace: true,
-        features: [proofQualificationSupport],
       }],
       ["codestory-cli", {
         workspace: true,
@@ -365,7 +364,6 @@ export function benchmarkDependencyIsolationViolations(source) {
       violations,
       dependencyMatches(dependencies, "codestory-agent", {
         workspace: true,
-        features: [proofQualificationSupport],
       })
         && dependencyMatches(dependencies, "codestory-cli", {
           workspace: true,
@@ -375,8 +373,8 @@ export function benchmarkDependencyIsolationViolations(source) {
           workspace: true,
           features: [benchmarkSupport, proofQualificationSupport],
         })
-        && qualificationFeatureOwners.length === 3
-        && ["codestory-agent", "codestory-cli", "codestory-runtime"]
+        && qualificationFeatureOwners.length === 2
+        && ["codestory-cli", "codestory-runtime"]
           .every((name) => qualificationFeatureOwners.some((record) =>
             record.name === name
           )),

.github/scripts/check-workflow-policy.test.mjs

@@ -58,7 +58,7 @@ import {
 } from "./qualification-driver-artifact.mjs";
 
 const fullSha = "0123456789abcdef0123456789abcdef01234567";
-const proofTopology = "proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5";
+const proofTopology = "proof5-v1-f1f03863d1fa5a61a86f02f1e1ca06bc2a619a401ab0f557ec2d74964f34fef0";
 const cacheManifestIdentity = "${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 
@@ -182,11 +182,11 @@ test("qualification product dependencies use only the reviewed feature topology"
   const source = benchmarkManifestSource();
   const fixtures = [
     [
-      "agent feature missing",
+      "agent feature added",
       replaceManifestFragment(
         source,
-        'codestory-agent = { workspace = true, features = ["proof-qualification-support"] }',
         "codestory-agent = { workspace = true }",
+        'codestory-agent = { workspace = true, features = ["proof-qualification-support"] }',
       ),
     ],
     [
@@ -217,8 +217,8 @@ test("qualification product dependencies use only the reviewed feature topology"
       "agent dependency attributes widened",
       replaceManifestFragment(
         source,
-        'codestory-agent = { workspace = true, features = ["proof-qualification-support"] }',
-        'codestory-agent = { workspace = true, default-features = false, features = ["proof-qualification-support"] }',
+        "codestory-agent = { workspace = true }",
+        "codestory-agent = { workspace = true, default-features = false }",
       ),
     ],
     [

.github/workflows/retrieval-engine-smoke.yml

@@ -43,10 +43,14 @@ on:
       - scripts/lint-retrieval-generalization.mjs
       - scripts/lib/retrieval-generalization-lint.mjs
       - scripts/tests/lint-retrieval-generalization.test.mjs
+      - scripts/check-packet-generalization-boundary.mjs
+      - scripts/lib/packet-generalization-boundary.mjs
+      - scripts/tests/check-packet-generalization-boundary.test.mjs
       - scripts/prepare-embedded-model.mjs
       - docs/contributors/testing-matrix.md
       - docs/ops/retrieval-engine.md
       - docs/testing/retrieval-architecture.md
+      - docs/architecture/packet-generalization.md
   # Base-branch runs seed caches that sibling PRs are allowed to restore.
   push:
     branches:
@@ -88,10 +92,14 @@ on:
       - scripts/lint-retrieval-generalization.mjs
       - scripts/lib/retrieval-generalization-lint.mjs
       - scripts/tests/lint-retrieval-generalization.test.mjs
+      - scripts/check-packet-generalization-boundary.mjs
+      - scripts/lib/packet-generalization-boundary.mjs
+      - scripts/tests/check-packet-generalization-boundary.test.mjs
       - scripts/prepare-embedded-model.mjs
       - docs/contributors/testing-matrix.md
       - docs/ops/retrieval-engine.md
       - docs/testing/retrieval-architecture.md
+      - docs/architecture/packet-generalization.md
   workflow_dispatch:
 
 permissions:
@@ -118,9 +126,15 @@ jobs:
       - name: Generalization lint (production paths)
         run: node scripts/lint-retrieval-generalization.mjs
 
+      - name: Packet generalization boundary
+        run: node scripts/check-packet-generalization-boundary.mjs
+
       - name: Generalization lint hostile matrix
         run: node --test scripts/tests/lint-retrieval-generalization.test.mjs
 
+      - name: Packet generalization boundary hostile matrix
+        run: node --test scripts/tests/check-packet-generalization-boundary.test.mjs
+
       - name: Release evidence gate contracts
         run: node --test scripts/tests/codestory-release-evidence-gate.test.mjs
 
@@ -148,13 +162,13 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-stable-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-retrieval-contracts-proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-stable-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-retrieval-contracts-proof5-v1-f1f03863d1fa5a61a86f02f1e1ca06bc2a619a401ab0f557ec2d74964f34fef0-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
 
       - name: Runtime retrieval and packet contract tests
         run: |
           cargo test --locked -p codestory-runtime --lib agent::retrieval_primary::tests
           cargo test --locked -p codestory-runtime --lib agent::packet_search::tests
-          cargo test --locked -p codestory-runtime --lib agent::packet_claim_profile
+          cargo test --locked -p codestory-agent --test packet_generalization_boundary
           cargo test --locked -p codestory-runtime --lib -- --exact tests::search_scoring_tests::search_rejects_natural_language_queries_without_full_sidecars
           cargo test --locked -p codestory-runtime --lib -- --exact tests::repo_text_tests::search_results_ignores_repo_text_hits_without_full_sidecars
           cargo test --locked -p codestory-runtime --lib -- --exact tests::repo_text_tests::repo_text_auto_fallback_is_not_product_search_without_full_sidecars
@@ -203,7 +217,7 @@ jobs:
           cargo test --locked -p codestory-llama-sys --test model_staging --no-run
           cargo test --locked -p codestory-cli --test stdio_protocol_contracts --no-run two_stdio_processes_observe_only_complete_generations_during_real_refresh -- --nocapture
           cargo test --locked -p codestory-runtime --no-run publication_transitions_fail_or_cancel_atomically -- --nocapture
-          cargo test --locked -p codestory-store --no-run staged_promotion_abort_recovers_old_or_complete_new_and_cleans_artifacts -- --nocapture
+          cargo test --locked -p codestory-store --no-run immutable_generation_process_crash_matrix_preserves_an_old_or_new_publication -- --nocapture
 
       - name: Save Cargo registry, git sources, and build output
         if: success() && steps.cargo-cache-restore.outputs.cache-hit != 'true' && steps.cargo-cache-restore.outputs.cache-primary-key != ''

.github/workflows/rust-ci.yml

@@ -80,11 +80,11 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-draft-v2-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-workspace-proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
+          key: ${{ runner.os }}-draft-v2-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-workspace-proof5-v1-f1f03863d1fa5a61a86f02f1e1ca06bc2a619a401ab0f557ec2d74964f34fef0-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-stable-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-retrieval-contracts-proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
-            ${{ runner.os }}-draft-v2-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-workspace-proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-
-            ${{ runner.os }}-cargo-stable-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-retrieval-contracts-proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-
+            ${{ runner.os }}-cargo-stable-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-retrieval-contracts-proof5-v1-f1f03863d1fa5a61a86f02f1e1ca06bc2a619a401ab0f557ec2d74964f34fef0-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
+            ${{ runner.os }}-draft-v2-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-workspace-proof5-v1-f1f03863d1fa5a61a86f02f1e1ca06bc2a619a401ab0f557ec2d74964f34fef0-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-
+            ${{ runner.os }}-cargo-stable-${{ steps.rust-cache-key.outputs.version }}-${{ steps.rust-cache-key.outputs.target }}-retrieval-contracts-proof5-v1-f1f03863d1fa5a61a86f02f1e1ca06bc2a619a401ab0f557ec2d74964f34fef0-default-features-${{ hashFiles('Cargo.toml', 'crates/**/Cargo.toml', 'vendor/**/Cargo.toml') }}-
 
       - name: Restore compiler objects
         id: compiler-cache-restore
@@ -122,7 +122,7 @@ jobs:
           cargo test --locked -p codestory-cli --test native_launcher_contracts
           cargo test --locked -p codestory-cli --test stdio_protocol_contracts two_stdio_processes_observe_only_complete_generations_during_real_refresh -- --nocapture
           cargo test --locked -p codestory-runtime publication_transitions_fail_or_cancel_atomically -- --nocapture
-          cargo test --locked -p codestory-store staged_promotion_abort_recovers_old_or_complete_new_and_cleans_artifacts -- --nocapture
+          cargo test --locked -p codestory-store immutable_generation_process_crash_matrix_preserves_an_old_or_new_publication -- --nocapture
 
       - name: Save Cargo inputs and output
         if: success() && steps.cargo-cache-restore.outputs.cache-hit != 'true' && steps.cargo-cache-restore.outputs.cache-primary-key != ''

AGENTS.md

@@ -39,14 +39,17 @@ pages, runbooks, and workflows own detailed mechanics.
   publication.
 - `codestory-retrieval`: lexical, semantic, and SCIP artifacts; immutable
   sidecar generations; manifests; health; and fail-closed query execution.
-- `codestory-agent`: packet planning only -- prompt terms, flow requirements,
-  evidence roles and carriers, citation scoring, and the query plan. It depends
-  on `codestory-contracts` alone and reads pinned runtime state only through the
-  `PinnedReader` trait, so it can never activate, store, execute retrieval,
-  retry a publication, or move readiness.
+- `codestory-agent`: prompt-blind packet seed planning and pure evidence-policy
+  helpers. Horizon A forwards the unchanged question to generic retrieval and
+  accepts caller-supplied free-query seeds; it does not infer answer shapes or
+  traversal policy. It depends on `codestory-contracts` alone and can never
+  activate, store, execute retrieval, admit or hydrate candidates, retry a
+  publication, or move readiness. Repository-derived compilation is owned by
+  Horizon B (#2106), not the interim product graph.
 - `codestory-runtime`: the only product orchestration layer. Indexing,
   grounding, search, packet assembly, and retrieval execution belong here.
-  Packet planning belongs in `codestory-agent`.
+  Retrieval, admission, hydration, retry, and interim packet assembly belong
+  here; prompt-blind seed planning belongs in `codestory-agent`.
 - `codestory-cli`: command and transport parsing, output rendering, process
   configuration capture, and managed sidecar lifecycle boundaries. Do not move
   product orchestration into adapters.

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+- Packet requests no longer accept `task_class`. Ordinary wording reaches
+  generic retrieval; the public packet reports `answer_sufficiency: not_asserted`.
+- The serialized public packet is capped at 16 KiB. When exact hydration cannot
+  fit, the packet records a typed `serialized_public_budget` gap instead of
+  silently dropping evidence.
+- Indexed call-path verification uses the frozen `from` / `direct-call`
+  grammar. Compact results are capped at 4 KiB, and
+  `translation_status` is `host_supplied`.
+- `affected` reports indexed tests in the same package as a changed source file
+  as focused hints when the graph walk does not reach them.
+
 - Added an observational exact call-path verifier to the CLI and MCP. It checks
   a complete host-supplied typed contract against one pinned indexed
   publication, reports proof-domain uncertainty explicitly, and never treats

benchmarks/release-evidence/fixtures/candidate.json

@@ -62,7 +62,7 @@
   },
   "release_claims": {
     "graph_schema": "codestory.release-claims/v1",
-    "graph_sha256": "01c33786c7b946b89264a8b124b22d6bbd57fbef9dd6c48c354fa1f99b2f3fa6",
+    "graph_sha256": "d3ed1831b8d95f5a1366c69ffcc8d5dc10325629124112fa6bb7bfd99678f9a7",
     "observed_at": "2026-08-09T12:50:08.593Z",
     "expires_at": "2026-08-10T12:50:08.593Z",
     "requested_claims": [
@@ -85,7 +85,7 @@
         "type": "performance",
         "tier": "live_behavior",
         "status": "measured",
-        "graph_sha256": "01c33786c7b946b89264a8b124b22d6bbd57fbef9dd6c48c354fa1f99b2f3fa6",
+        "graph_sha256": "d3ed1831b8d95f5a1366c69ffcc8d5dc10325629124112fa6bb7bfd99678f9a7",
         "observed_at": "2026-08-09T12:50:08.593Z",
         "expires_at": "2026-08-10T12:50:08.593Z",
         "identity": {
@@ -106,7 +106,7 @@
         "type": "answer_quality",
         "tier": "answer_quality",
         "status": "pass",
-        "graph_sha256": "01c33786c7b946b89264a8b124b22d6bbd57fbef9dd6c48c354fa1f99b2f3fa6",
+        "graph_sha256": "d3ed1831b8d95f5a1366c69ffcc8d5dc10325629124112fa6bb7bfd99678f9a7",
         "observed_at": "2026-08-09T12:50:08.593Z",
         "expires_at": "2026-08-10T12:50:08.593Z",
         "identity": {

benchmarks/release-evidence/fixtures/report.json

@@ -7,7 +7,7 @@
   "baseline_id": "ci-contract-v1@1111111111111111111111111111111111111111",
   "baseline_sha256": "0bbbe6dd8b4000151edf7b1270959d08e94e08db876e7f2372b25613e0f237c1",
   "candidate_path": "benchmarks/release-evidence/fixtures/candidate.json",
-  "candidate_sha256": "fcdbc3d918efd5b83b6ddd1da4be2d0ebef56f3a8bb09eb5d80c7a1252c93f51",
+  "candidate_sha256": "885d704b5de1c2a467928b3d468e320343f3b0baa2d19646c80b3a719e9d400c",
   "artifact_paths": [
     {
       "path": "candidate-stats.json",
@@ -26,7 +26,7 @@
       "type": "performance",
       "tier": "live_behavior",
       "status": "pass",
-      "graph_sha256": "01c33786c7b946b89264a8b124b22d6bbd57fbef9dd6c48c354fa1f99b2f3fa6",
+      "graph_sha256": "d3ed1831b8d95f5a1366c69ffcc8d5dc10325629124112fa6bb7bfd99678f9a7",
       "observed_at": "2026-08-09T12:50:08.593Z",
       "expires_at": "2026-08-10T12:50:08.593Z",
       "identity": {
@@ -47,7 +47,7 @@
       "type": "answer_quality",
       "tier": "answer_quality",
       "status": "pass",
-      "graph_sha256": "01c33786c7b946b89264a8b124b22d6bbd57fbef9dd6c48c354fa1f99b2f3fa6",
+      "graph_sha256": "d3ed1831b8d95f5a1366c69ffcc8d5dc10325629124112fa6bb7bfd99678f9a7",
       "observed_at": "2026-08-09T12:50:08.593Z",
       "expires_at": "2026-08-10T12:50:08.593Z",
       "identity": {
@@ -69,7 +69,7 @@
     "schema": "codestory.release-claim-evaluation/v1",
     "status": "pass",
     "graph_schema": "codestory.release-claims/v1",
-    "graph_sha256": "01c33786c7b946b89264a8b124b22d6bbd57fbef9dd6c48c354fa1f99b2f3fa6",
+    "graph_sha256": "d3ed1831b8d95f5a1366c69ffcc8d5dc10325629124112fa6bb7bfd99678f9a7",
     "evidence_selection": "all_matching_rows_must_pass",
     "expected_commit": "2222222222222222222222222222222222222222",
     "evaluated_at": "2026-08-09T12:50:08.593Z",

crates/codestory-agent/Cargo.toml

@@ -4,13 +4,10 @@ version = "0.17.5"
 edition = "2024"
 
 [features]
-default = ["proof-qualification-support"]
+default = []
 # Compiles the eval/holdout probe hooks for downstream unit tests. No product
 # build enables it.
 test-support = ["dep:sha2"]
-# Compiles the private exact-verifier kernel and its qualification facade. The
-# public CLI/runtime use the same sealed implementation that benchmarks inspect.
-proof-qualification-support = ["dep:sha2"]
 # Compiles only the dark v3 evidence planner needed by the Q1 separability
 # gate. It has no proof-kernel edge and registers no product surface.
 v3-evidence-separation-support = []
@@ -19,10 +16,8 @@ v3-evidence-separation-support = []
 codestory-contracts = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_json_canonicalizer = { workspace = true }
 sha2 = { workspace = true, optional = true }
 
 [dev-dependencies]
-serde_json_canonicalizer = { workspace = true }
 sha2 = { workspace = true }
 tempfile = { workspace = true }

crates/codestory-agent/src/citation.rs

@@ -32,7 +32,6 @@ pub fn to_citation_from_hit(
         evidence_producer: None,
         resolution_status: None,
         loss_reason: None,
-        coverage_role: None,
         eligible_for_sufficiency: None,
         source_excerpt: hit.source_excerpt.clone(),
     };