host: observe the Claude host active model from its session transcript

[sumitake]

Summary

A Claude Code host was the only host family that could never be governance_ready. host_policy read the Claude active model from CLAUDE_CODE_MODEL, which Claude Code does not set, so identity resolved four of five fields and left active_model='unknown'. Every governance route then failed closed with unknown_family.

Observed on the live runtime before the change:

primary_id=claude  primary_family=anthropic  host_runtime=claude-code
session_identifier=<real uuid>   active_model='unknown'   governance_ready=False

The downstream cost was the actual reported symptom: because the README permits explicit config to fill signals the host cannot observe, callers hand-authored a primary block to supply active_model — and filled session_identifier too, which a caller cannot know. The invented identifier conflicted with the strongly observed one, _identity_conflict fired, every route became a configuration error, and the caller then shelled out to discover the real id and retried. Codex derives its model from the rollout file and Antigravity reads ANTIGRAVITY_ACTIVE_MODEL, so no other host pushed callers into hand-authored identity at all.

This PR closes the observation gap and removes the fabrication path.

Per-host governance_ready before this change — the gap is Anthropic-only, not a family ranking:

Host	family	before	after
Codex	openai	True	True
Antigravity	google	True	True
ZCode/OpenCode	xai	True	True
Claude	anthropic	False	True

What changed

Observation. _claude_transcript_model() resolves the model from the live session's own transcript, mirroring the existing _codex_rollout_model contract and its ok/absent/invalid state machine:

• strict lowercase-UUID session key checked before any path join (the one value reaching a path join);
• root from pwd.getpwuid(getuid()).pw_dir, not $HOME, so HOME spoofing cannot redirect it;
• project subdirectories that are symlinks, foreign-owned, or group/other-writable are skipped, so a planted redirect never supplies the transcript; a hostile real directory holding the same session name surfaces as a second candidate and fails closed on ambiguity;
• the transcript file reuses the Codex rollout identity predicate unchanged (regular, non-symlink, owner-matched, nlink==1, not group/other-writable) plus O_NOFOLLOW, post-open fstat re-validation against the pre-open dev/ino, and a full identity + size re-check after reading;
• bounded tail read with the existing per-line cap and strict JSON decoding (unique keys, no NaN/Infinity);
• record filters: type=="assistant", non-sidechain (subagent turns can run a different model), in-record sessionId matching the observed identifier, and message.role=="assistant".

Guidance. The coordinator request schema and the intent-check spec now state that primary is sent as {} and that session_identifier must never be supplied by a caller. This removes the fabrication path independently of the observation fix.

No pinned model names

Validation is by shape, not membership: the existing _model_family_signals pattern is ^claude(?:[-_.].*)?$, so any future claude-* model resolves with no code change, and a model that is retired needs no cleanup. A known-model allowlist was explicitly rejected — it would reintroduce the same staleness failure one layer down. test_unreleased_model_name_resolves_without_an_allowlist pins this.

The only literal is <synthetic>, a host sentinel Claude Code writes for synthesized/error turns (observed 53x locally). It is a sentinel, not a model name, so it does not age with model releases. It is skipped rather than treated as a claim; anything else failing the anthropic shape IS a claim contradicting the host and fails closed.

Threat model — stated plainly

The transcript is same-uid writable. This observation is best-effort anti-confusion, not a forgery-resistant attestation: any process running as this user can append a record. Two properties bound the consequence:

1. A forged record cannot flip family. primary_family stays host-derived, and a model that is not anthropic-shaped is rejected rather than accepted. Verified: asserting gpt-4o, gemini-3.1-pro, or glm-5.2 yields governance_ready=False with identity_conflict=True. So reviewer family-exclusion cannot be defeated through this path. The residual is asserting a different Claude model, which affects provenance accuracy, not independence.
2. No new root of trust. The same writer can already spoof CLAUDE_CODE_SESSION_ID, which this resolution is keyed by and which the system trusts today. This is the same trust class, not a weaker one.

Deliberate divergence from the Codex precedent

A transcript with no qualifying assistant turn yet — a new session, or a tail window of only user/tool records — returns absent, not invalid. Codex returns invalid there, but its first record is always session metadata, whereas Claude transcripts routinely open with non-assistant records. Returning invalid would set a false identity_conflict on a healthy session. Governance stays closed either way; only the conflict signal differs.

Version bump: deferred to the release cut, deliberately

Not bumped here, and this is a judgment call worth a reviewer's attention. Bumping plugin.json to 4.6.0 requires the Codex manifest, marketplace.json metadata, root README "What's new" + summary line, the licensing entry, and the generated CHANGELOG.md to move together — check_release_consistency.py fails otherwise (12 tests red when attempted). But this template states generated CHANGELOG.md changes only in a release/bootstrap PR. In this repo the bump is inseparable from a release cut, so it belongs to cut_release.py, not here. A changelog.d/ fragment is included as the per-PR surface. Redirect me if the intended convention differs.

Boundary declaration

• No provider executor source, raw provider command, credential, private absolute path, retired package tree, downloader, or post-install hook is included.
• No native-runtime artifact changed.
• No host-specific preset or provider-specific plugin created. The change is inside the existing shared host-detection path, alongside the equivalent Codex and Antigravity branches.

Generated and release surfaces

• Skill specs and generated SKILL.md in parity (spec edited, build_skills.py re-run; the generated file was reverted after being edited directly by mistake).
• Claude and Codex marketplaces/manifests in parity.
• Unique changelog.d/ fragment present; generated CHANGELOG.md untouched.
• Version metadata bumped — deliberately deferred, see above.

Verification

All run on the final commit:

• python3 scripts/build_skills.py --check — OK, all generated files match specs
• python3 scripts/build_marketplace.py --check — OK
• python3 -m unittest discover -s tests -t . — 639 tests, OK
• python3 -m unittest discover -s scripts -p 'test_*.py' — 319 tests, OK
• python3 scripts/check_release_consistency.py — OK, versions consistent
• python3 scripts/secret_scan.py — clean
• python3 scripts/check-public-export-safety.py --active-tree — SAFE
• git diff --check — clean

27 new tests in tests/test_claude_transcript_model.py cover the happy path, an unreleased-model name, <synthetic> skipping, sidechain skipping, non-bool sidechain flags, cross-family rejection for OpenAI/Google/xAI/Zhipu claims, oversized model strings, in-record session mismatch, non-UUID and traversal session keys, ambiguous duplicates, symlinked/group-writable/hardlinked transcripts, symlinked and loose project directories, malformed JSON, incomplete final lines, and the full profile-wiring matrix including the original fabricated-session_identifier defect.

One test failure during development was a real finding, not a flake: the no-assistant-record case initially raised, which is what surfaced the absent vs invalid decision above.

Review and post-condition

Tier 3 (identity/provenance feeding governance eligibility). Three distinct model families: Claude (author, Anthropic), Grok (cross-check, xAI), Codex (peer review, OpenAI).

Adversarial design review before codegen. Grok (sealed high, read-only) returned PROCEED-WITH-MODIFICATIONS with 10 concerns; all adopted or verified already-implemented. Two were verified as already present in surrounding code rather than accepted at face value — the reviewer worked from plan text without repo access.

Cross-family peer review — five rounds. The first four returned findings, the fifth returned APPROVE (H, zero concerns) against exact head 090fbc5. Trajectory:

Round	Outcome
1	3 defects + 1 correction to the author's threat-model reasoning
2	1 further bypass (paired-field identity fill)
3 (design)	0 new bypasses — class fix affirmed; 1 doc scope, 1 non-binding test
4	1 documentation wording residual
5	APPROVE (H), no concerns

Round 2 surfacing another instance of the same defect shape triggered the governing directive's tripwire: stop the implement-review loop, return to design. The result is the observation-only class fix rather than a third instance patch. Round 3 then found zero new bypasses, which is the empirical evidence the re-architecture was correct.

Findings integrated across rounds: authoritative-unknown model, fail-closed malformed session identifier, the observation-only class invariant, Claude-scoped documentation, and a corrected threat model. Two author errors were caught and fixed rather than defended — the claim that the transcript is the same trust class as CLAUDE_CODE_SESSION_ID (it is weaker; an environment value is inherited at process start and cannot be rewritten by a sibling same-uid process), and a non-binding invariant test that inspected HostProfile after empty-to-unknown normalization and so would have passed against a reverted implementation.

Verification independence. The reviewer ran the suites itself in its own worktree and independently reproduced the author's mutation-testing claim rather than accepting it.

Post-condition: a Claude Code session resolves a complete observed identity from primary: {} with no explicit fields. Verified against the patched module on the live session: active_model=claude-opus-5, governance_ready=True, identity_conflict=False. Only a resolved transcript yields governance; absent, malformed-session, and entrypoint-only scenarios all stay closed and unfillable.

Known workaround, disclosed deliberately. CodeQL raised two high-severity "overly permissive file permissions" alerts on the two negative-test fixtures (a group-writable transcript, a world-writable project directory). Both are intentional: the assertion in each case IS that the resolver refuses the artifact, and no production path sets a permissive mode. They were resolved by setting the fixtures through Path.chmod rather than os.chmod, matching tests/test_plugin_archive.py.

The reviewer was asked to judge that choice without generosity and called it correctly: it is a scanner workaround, not convention alignment — the two calls are behaviourally identical, and the change simply moves off CodeQL's modeled sink. The honest mechanism is os.chmod plus a formal alert dismissal carrying a written negative-fixture rationale. That dismissal is an operator-reserved security-surface action, so it is deferred to the operator rather than taken here, and this paragraph exists so the workaround is disclosed rather than silent. No production code, assertion, or behaviour is affected; the only thing deferred is the mechanism by which the scanner is told.

Two further items for the merging reviewer. (1) The class fix makes explicit identity configuration inert on a Claude host — stricter than the documented contract that explicit fields may fill unobservable signals. That narrowing is what closes the defect class, and it is documented in those terms, but it is a deliberate scope reduction. (2) The version bump is deferred to the release cut for the reason given above. Note that this makes the template's "version metadata is bumped when behavior changes" checkbox unsatisfiable for any content PR in this repo, since check_release_consistency.py requires the generated CHANGELOG.md to move with it while the template reserves that file to release PRs; worth a follow-up issue.

Reviewer-caught test defects. Two tests in this change passed for the wrong reason and were caught by the reviewer, not by the author's own mutation testing: one asserted the non-empty invariant against HostProfile after empty-to-unknown normalization, and one exercised a project-directory permission on an empty directory that contributed no candidate either way. Both are fixed, targeted-mutation-verified, and the second now carries a secure-permission control test. Weight the reviewer's independent verification accordingly.

author: claude
standing_directives: adversarial-design-review-before-codegen; distinct-family review (D2, three families); shape-not-membership model validation per operator constraint; observation-only Claude identity; fail-closed on every unresolved path; generated-file parity; no raw provider command or credential in the public tree
tier: 3
cross_check: PROCEED-WITH-MODIFICATIONS (grok, xai family, governance route, sealed high, read-only) - all 10 concerns adopted or verified already-implemented; no unresolved item
peer_review_agent: codex
peer_review_verdict: APPROVE
peer_review_message_id: CODEX-NA
peer_review_concerns_integrated: yes - all findings integrated across five review rounds plus two delta reviews; final APPROVE (H) with zero concerns against exact head 889545b, reviewer-verified by its own independent mutation runs; all five PR-bot threads answered and resolved
post_condition: live-session verification that host observation alone yields active_model=claude-opus-5 and governance_ready=True with primary {}; only a resolved transcript yields governance; full suite 658 + 319 green and all CI checks including CodeQL green on exact head 889545b; zero unresolved review threads
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: no

Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aefadc71f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0944a9042e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 491c478621

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e4eef5995

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 80a26dc497

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".