spacedock-dev
diff --git a/‎.github/workflows/runtime-live-e2e.yml‎
Lines changed: 6 additions & 4 deletions b/‎.github/workflows/runtime-live-e2e.yml‎
Lines changed: 6 additions & 4 deletions
diff --git a/‎internal/contractlint/boot_resident_closure_test.go‎
Lines changed: 68 additions & 6 deletions b/‎internal/contractlint/boot_resident_closure_test.go‎
Lines changed: 68 additions & 6 deletions
diff --git a/‎internal/contractlint/structural_checks_test.go‎
Lines changed: 4 additions & 0 deletions b/‎internal/contractlint/structural_checks_test.go‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎internal/dispatch/spawn_standing_all_test.go‎
Lines changed: 8 additions & 0 deletions b/‎internal/dispatch/spawn_standing_all_test.go‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎internal/dispatch/standing.go‎
Lines changed: 6 additions & 2 deletions b/‎internal/dispatch/standing.go‎
Lines changed: 6 additions & 2 deletions
diff --git a/‎internal/dispatch/testdata/golden/spawn-standing-spec-nonascii.txt‎
Lines changed: 1 addition & 0 deletions b/‎internal/dispatch/testdata/golden/spawn-standing-spec-nonascii.txt‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎internal/dispatch/testdata/golden/spawn-standing-spec.txt‎
Lines changed: 1 addition & 0 deletions b/‎internal/dispatch/testdata/golden/spawn-standing-spec.txt‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎internal/ensigncycle/claude_live_runner_test.go‎
Lines changed: 4 additions & 4 deletions b/‎internal/ensigncycle/claude_live_runner_test.go‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎internal/ensigncycle/live_gate_stop_test.go‎
Lines changed: 2 additions & 2 deletions b/‎internal/ensigncycle/live_gate_stop_test.go‎
Lines changed: 2 additions & 2 deletions
@@ -167,9 +167,11 @@ jobs:
 
       # TestLiveEnsignCycle is the full lifecycle canary, TEAM-AGNOSTIC: it gates on
       # dispatch-close + the on-disk terminal end-state, so it greens whether the
-      # headless `-p` FO drove team or bare (no team-vs-bare coin). TestLiveEnsignCycleTeamTeardown
-      # FORCES team mode and keeps the TERMINAL_TEARDOWN_BOUNDED teardown-marker
-      # coverage (the team-only signal removed from the canary's default path).
+      # headless `-p` FO drove team or bare (no team-vs-bare coin). Headless `-p` goes
+      # bare per the captain's go-bare determination, so the live suite carries no
+      # forced-team test; live team end-to-end (roster injection, the bounded teardown
+      # marker) is deferred to the terminal/pty harness task
+      # m40mphxan8phr3t3tp03gk89.
       # TestLiveDefaultHeadlessStopsAtGate is AC-a: default `-p` with NO conn drives to
       # a gate:true stage and EXITS reporting gate status, without resolving the gate.
       # TestLiveZeroDiscoverReportsAndStops is the cheap boot-only lean-boot guard (a
@@ -182,7 +184,7 @@ jobs:
         run: |
           set -o pipefail
           mkdir -p "$SPACEDOCK_LIVE_ARTIFACT_DIR"
-          go test -tags live -count=1 -timeout 40m -run 'TestLiveEnsignCycle|TestLiveEnsignCycleTeamTeardown|TestLiveDefaultHeadlessStopsAtGate|TestLiveZeroDiscoverReportsAndStops|TestLiveStandingResidencyInjectsCommOfficer' ./internal/ensigncycle/ -v 2>&1 | tee live-e2e-transcript.txt
+          go test -tags live -count=1 -timeout 40m -run 'TestLiveEnsignCycle|TestLiveDefaultHeadlessStopsAtGate|TestLiveZeroDiscoverReportsAndStops' ./internal/ensigncycle/ -v 2>&1 | tee live-e2e-transcript.txt
 
       # The shared scenario suite: the Claude lane runs the SAME host-neutral
       # gate/rejection/merge-hook scenarios the codex-live lane runs, through the
 
@@ -10,15 +10,33 @@ import (
 	"testing"
 )
 
-// bootResidentBodies are the two contract bodies the FO loader inlines/reads at
-// boot: the slimmed shared core and the Claude runtime adapter. AC-4 walks these
-// (NOT a SKILL.md, which the existing TestUserSkillReferenceClosureResolves reads)
-// because the loader reads the bodies directly, and only the bodies name the
-// deferred load-points the boot core defers to (a sibling reference path, a bare
-// skill invocation, a canonical mod file).
+// bootResidentBodies are the contract bodies the FO loader inlines/reads at boot:
+// the slimmed shared core and each host's runtime adapter. AC-4 walks these (NOT a
+// SKILL.md, which the existing TestUserSkillReferenceClosureResolves reads) because
+// the loader reads the bodies directly, and only the bodies name the deferred
+// load-points the boot core defers to (a sibling reference path, a bare skill
+// invocation, a canonical mod file). The codex and pi adapters join the Claude one
+// so the closure walk catches a dead-end reference on every host, not only Claude.
 var bootResidentBodies = []string{
 	filepath.Join("skills", "first-officer", "references", "first-officer-shared-core.md"),
 	filepath.Join("skills", "first-officer", "references", "claude-first-officer-runtime.md"),
+	filepath.Join("skills", "first-officer", "references", "codex-first-officer-runtime.md"),
+	filepath.Join("skills", "first-officer", "references", "pi-first-officer-runtime.md"),
+}
+
+// foReferenceCores are the two host-neutral cores the boot-resident shared core names
+// at its dispatch and merge load points. Because every host loads the shared core at
+// boot, naming the cores there is what makes the ceremony REACHABLE on codex and pi —
+// no per-host re-naming is required. Each core must exist on disk (the closure walk
+// over bootResidentBodies resolves them once shared-core names them) and carry its
+// ceremony anchors.
+var foReferenceCores = map[string][]string{
+	filepath.Join("skills", "first-officer", "references", "fo-merge-core.md"): {
+		"## Merge and Cleanup", "### Ship-Local Ceremony", "### Worktree removal safety", "## Mod-Block Enforcement",
+	},
+	filepath.Join("skills", "first-officer", "references", "fo-dispatch-core.md"): {
+		"## Dispatch", "## Reuse and Fresh Dispatch", "## Dispatch Adapter", "## Event Loop",
+	},
 }
 
 // bodyReferenceRe matches a sibling reference read-path named in a contract body
@@ -155,3 +173,47 @@ func TestBootResidentDeferredLoadPointGuardFailsOnDanglingTarget(t *testing.T) {
 		t.Fatal("control: the real load-point (using-claude-team) was not resolved — the discriminator has nothing to contrast the dangling case against")
 	}
 }
+
+// TestHostNeutralCoresResolveAndCarryCeremony is the AC-1 reachability guard: the two
+// host-neutral cores the boot-resident shared core names at its dispatch and merge
+// load points exist on disk AND carry their ceremony anchors. Reachability for codex
+// and pi rides on the SINGLE core-naming in first-officer-shared-core.md — every host
+// loads the shared core at boot, so a core it names there is reachable on every host;
+// no per-adapter re-naming is required (the per-adapter restatement only added
+// redundancy). The closure half — that the shared core's named references resolve to
+// real files — is TestBootResidentDeferredLoadPointsResolve walking bootResidentBodies
+// (which includes the shared core). This test adds the content half: each core carries
+// its four ceremony anchors, so "reachable" means "reaches a real ceremony," not an
+// empty file. The independent source is the filesystem + the anchor set; a core
+// renamed/emptied/dropped fails.
+func TestHostNeutralCoresResolveAndCarryCeremony(t *testing.T) {
+	root := repoRoot(t)
+	if len(foReferenceCores) == 0 {
+		t.Fatal("no host-neutral cores declared — the reachability check would pass vacuously")
+	}
+	// The shared core must NAME each core at a load point — that single naming is what
+	// makes the ceremony reachable on every host.
+	sharedCore := filepath.Join("skills", "first-officer", "references", "first-officer-shared-core.md")
+	sharedData, err := os.ReadFile(filepath.Join(root, sharedCore))
+	if err != nil {
+		t.Fatalf("read shared core %s: %v", sharedCore, err)
+	}
+	sharedBody := string(sharedData)
+	for corePath, anchors := range foReferenceCores {
+		base := filepath.Base(corePath)
+		if !strings.Contains(sharedBody, base) {
+			t.Errorf("%s does not name %s — the boot-resident core is the sole core-namer, so an unnamed core is unreachable on every host", sharedCore, base)
+		}
+		data, err := os.ReadFile(filepath.Join(root, corePath))
+		if err != nil {
+			t.Errorf("host-neutral core %s does not resolve on disk: %v", corePath, err)
+			continue
+		}
+		body := string(data)
+		for _, anchor := range anchors {
+			if !strings.Contains(body, anchor) {
+				t.Errorf("%s is missing ceremony anchor %q — the named core resolves but does not carry the ceremony, so reachability reaches an empty file", corePath, anchor)
+			}
+		}
+	}
+}
@@ -259,6 +259,10 @@ func TestNoUnexpectedModHookOrPRMergeIntroduced(t *testing.T) {
 		// example into the dispatch reference — both legitimately carry `## Hook:`.
 		filepath.Join("skills", "first-officer", "references", "claude-fo-merge.md"):    true,
 		filepath.Join("skills", "first-officer", "references", "claude-fo-dispatch.md"): true,
+		// The host-neutral extraction re-homed Mod-Block Enforcement (which names the
+		// `## Hook: merge` mechanism surface) into the merge core; it legitimately
+		// carries the `## Hook:` token the same way the claude-fo-merge seam did.
+		filepath.Join("skills", "first-officer", "references", "fo-merge-core.md"): true,
 	}
 	allowedPRMergeFiles := map[string]bool{
 		filepath.Join("mods", "pr-merge.md"): true,
 
@@ -12,6 +12,7 @@ import (
 // values are sourced from the fixture mod, NOT the binary.
 type spawnAllSpec struct {
 	SubagentType string `json:"subagent_type"`
+	Description  string `json:"description"`
 	Name         string `json:"name"`
 	TeamName     string `json:"team_name"`
 	Model        string `json:"model"`
@@ -55,6 +56,13 @@ func TestSpawnStandingAllEmitsAbsentMemberSpec(t *testing.T) {
 	if got.SubagentType != "general-purpose" {
 		t.Errorf("subagent_type = %q, want general-purpose", got.SubagentType)
 	}
+	// The Agent tool REQUIRES description; the spec must carry a non-empty one
+	// (spawn-standing-all derives it from the member name) or the forwarded
+	// Agent() call fails InputValidationError and the standing teammate never
+	// spawns.
+	if want := "standing teammate: comm-officer"; got.Description != want {
+		t.Errorf("description = %q, want %q", got.Description, want)
+	}
 	if got.Name != "comm-officer" {
 		t.Errorf("name = %q, want comm-officer", got.Name)
 	}
 
@@ -204,6 +204,7 @@ func buildSpawnSpec(home, modPath, teamName string) (spec spawnSpec, alreadyAliv
 
 	return spawnSpec{
 		SubagentType: subagentType,
+		Description:  fmt.Sprintf("standing teammate: %s", declaredName),
 		Name:         declaredName,
 		TeamName:     teamName,
 		Model:        model,
@@ -223,10 +224,13 @@ func emitAlreadyAlive(stdout io.Writer, name string) {
 }
 
 // spawnSpec is the Agent() call spec spawn-standing emits when the member is not
-// yet alive. Field order matches the oracle's dict: subagent_type, name,
-// team_name, model, prompt.
+// yet alive. The Agent tool REQUIRES description, so the spec carries one (else
+// the forwarded Agent() call fails InputValidationError and the teammate never
+// spawns). Field order matches dispatch build's envelope: subagent_type,
+// description, name, team_name, model, prompt.
 type spawnSpec struct {
 	SubagentType string `json:"subagent_type"`
+	Description  string `json:"description"`
 	Name         string `json:"name"`
 	TeamName     string `json:"team_name"`
 	Model        string `json:"model"`
 
@@ -3,6 +3,7 @@
 ===== stdout =====
 {
   "subagent_type": "general-purpose",
+  "description": "standing teammate: comm-officer",
   "name": "comm-officer",
   "team_name": "fixture-team",
   "model": "sonnet",
 
@@ -3,6 +3,7 @@
 ===== stdout =====
 {
   "subagent_type": "general-purpose",
+  "description": "standing teammate: comm-officer",
   "name": "comm-officer",
   "team_name": "fixture-team",
   "model": "sonnet",
 
@@ -38,7 +38,7 @@ const antiShutdownOverride = "Do not shut down your team or prepare your final "
 
 type claudeLiveRunner struct {
 	binary       string
-	repoRoot     string
+	pluginDir    string
 	env          []string
 	model        string
 	artifactRoot string
@@ -138,7 +138,7 @@ func claudeScenarioRunners() map[string]func(*testing.T, claudeLiveRunner, share
 func newClaudeLiveRunner(t *testing.T) claudeLiveRunner {
 	t.Helper()
 	binary := spacedockBinary(t)
-	repo := repoRoot(t)
+	pluginDir := livePluginDir(t)
 	model := envOr("SPACEDOCK_LIVE_MODEL", "sonnet")
 
 	// isolatedClaudeEnv resolves the credential (OAuth benchmark-token locally,
@@ -152,7 +152,7 @@ func newClaudeLiveRunner(t *testing.T) claudeLiveRunner {
 	home, _ := envValue(env, "HOME")
 	return claudeLiveRunner{
 		binary:       binary,
-		repoRoot:     repo,
+		pluginDir:    pluginDir,
 		env:          env,
 		model:        model,
 		artifactRoot: claudeLiveArtifactDir(t, "claude-shared-scenarios"),
@@ -327,7 +327,7 @@ func (r claudeLiveRunner) run(t *testing.T, scenario sharedRuntimeScenario, work
 	finalPath := filepath.Join(artifactDir, "claude-final-message.txt")
 
 	cmd := exec.Command(r.binary, "claude",
-		"--plugin-dir", r.repoRoot,
+		"--plugin-dir", r.pluginDir,
 		"--skip-contract-check",
 		"--",
 		"-p", prompt+" "+antiShutdownOverride,
 
@@ -94,7 +94,7 @@ var (
 // and a distinct prompt (no conn) from TestLiveEnsignCycle's conn-cue drive.
 func TestLiveDefaultHeadlessStopsAtGate(t *testing.T) {
 	binary := spacedockBinary(t)
-	repoRoot := repoRoot(t)
+	pluginDir := livePluginDir(t)
 	model := envOr("SPACEDOCK_LIVE_MODEL", "sonnet")
 
 	childEnv := isolatedClaudeEnv(t, os.Getenv("HOME"))
@@ -117,7 +117,7 @@ func TestLiveDefaultHeadlessStopsAtGate(t *testing.T) {
 	// drives-to-the-gate-and-stops is exactly the behavior under test.
 	drivePrompt := "Drive the workflow. " + antiShutdownOverride
 	cmd := exec.Command(binary, "claude",
-		"--plugin-dir", repoRoot,
+		"--plugin-dir", pluginDir,
 		"--skip-contract-check",
 		"--",
 		"-p", drivePrompt,
Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,7 @@`
`3`	`3`	`===== stdout =====`
`4`	`4`	`{`
`5`	`5`	`"subagent_type": "general-purpose",`
	`6`	`+ "description": "standing teammate: comm-officer",`
`6`	`7`	`"name": "comm-officer",`
`7`	`8`	`"team_name": "fixture-team",`
`8`	`9`	`"model": "sonnet",`