[abruption]

Summary

Adds a separately authorized preflight_send MCP tool and explicit policy schema v2 preflight capability. Default and v1 policy permissions do not expand. Validation-only callers cannot send, and requested Codex wake eligibility additionally requires wake without starting a turn or reserving a budget.

The opt-in CLI send --dry-run --explain-json supplies a versioned allowlisted explanation without scraping text or changing ordinary CLI JSON. Existing --explain remains text-only. The new mode captures original SSH facts before compatibility shaping, accepts one destination, and rejects device/preset/address/handoff routes before input or effects. Preset integration is a later separate adapter change (#359).

The shared classifier fails closed on unknown, malformed or contradictory native facts, including positive consumption evidence mixed with dry-run, known refusal reasons, and unknown submission fields. MCP validates the complete required projection before reconstructing it; raw paths, bodies, errors, host data and authority fields are excluded. Policy refusals have a fixed not-run/not-attempted shape; post-invocation I/O/timeout stays unknown and never permits automatic retry. Registered Antigravity dry-run reuses its existing experimental adapter; this does not promote native support.

Refs #357. Depends on #361; stacked base is feat/mcp-356-destinations, not an independent merge target. Merge/retarget only after the preceding PR is approved and merged normally, then rerun current-head checks. No issue closure requested.

Validation

• macOS arm64, Python 3.13.7/MCP 1.30.0: final focused core/MCP/real-stdio suite 73 passed. Earlier broader core suite 976 passed, 4 skipped; documentation 87 passed. Generator and diff checks pass.
• Tests cover policy v1/v2 isolation, URI host/home mismatches, known early refusal, malformed/contradictory output, sanitized refusal reasons, invalid timeout, independent host-approval annotations, raw SSH facts before legacy shaping, synthetic Claude/Codex/Antigravity dry-runs, framing limits, interruption and zero submission/wake-budget effects. Negative mocks explicitly assert no calls rather than relying on exceptions swallowed by CLI error handling.
• Installed-wheel isolated-site import and stdio smoke passed using explicit installed module paths. Initial non-isolated build lacked Hatchling; a clean isolated build resolved it without changing the provided environment. No sdist-installed preflight smoke, live native sessions, real SSH or model calls were run. Client-side approval behavior and broader native/platform acceptance remain outside this synthetic evidence.
• Four MCP and four CLI guides plus manifest agree. Runtime version and published assets remain unchanged.

Independent verification

Used independent-cli-review with Claude Code 2.1.314 (claude-opus-5-5, response-confirmed) and Codex CLI 0.166.0 (isolated default model; actual model ID not exposed). Each pair ran independently/non-interactively in parallel from the same immutable input, with tools disabled for Claude and ephemeral read-only/ignore-user-config for Codex. All runs completed successfully; no reviewer ran tests or edited files.

• Whole-change inputs: SHA-256 5cd7d5e58c7ba186c6a1cbe04dc94663e24421214a14467bd0fb659e9b77e846, then 60adcb70ead68973972fd6af0dd0c3d39b5561e6869adefdb1e4b8c2b81642a7.
• Focused evidence/refusal follow-up input: 08ec8b1f14b61c27c5b829d7fb934b0d7b7953d623eec64a8627f7f5210b1779.
• Root source checks and regression tests addressed projection consistency, contradictory submission/consumption/refusal facts, wrong types, URI early failures, operator-action consistency, timeout/I/O categorization, fixed rejection schema, AGY no-RPC dry-run and negative-mock gaps. Final small corrections followed the focused review and were revalidated by Codex; they are not claimed to have received a fourth exact-byte CLI review.
• Review limitations about native/platform/client approval acceptance remain explicit. Missing implementation in a review excerpt was not treated as proof of a product defect; actual source and installed-wheel evidence were checked separately.

Separate translation QA: Antigravity CLI 1.4.12 / gemini-3.8-flash-medium / medium, fresh read-only plan+sandbox invocation, 82.576 s, structured success. Input was the eight changed document diffs against English. Technical flags, versions and authority boundaries were preserved; optional stylistic changes that narrowed the meaning of unknown evidence were not adopted. No runtime testing was delegated to the translation model.

Boundaries

No merge, version bump, tag/release/package publication, global installation, policy/service update or live delivery/ACK test. Automatic Codex review is triggered by opening the PR; no review mention is needed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T02:41:11.886462Z	3b76b2e	Manual request
🔒 Security Review	✅ Completed 2026-11-02T01:22:09.985363Z	1273a73	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Current head bdcd570: all 38 available checks pass. Initial Windows core failure was the added fixture assuming wake preflight support on Windows, plus its aggregate release-gate failure. The fixture now tests ordinary queue dry-run on supported platforms, keeps wake-positive/interruption cases macOS/Linux only, and explicitly tests unsupported-platform refusal without probing or effects. Runtime source is unchanged by this test-only follow-up. Automatic code/security review completed at earlier runtime-identical head 1273a73, not asserted as a fresh exact-head review. No review mention or protection bypass was used. This stacked PR still requires normal current-main checks after its dependency is merged and the base is retargeted.

[abruption]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: bdcd570f8c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[abruption]

@codex review

Please check the integrated head 3b76b2e. The #361 squash-merge history is now integrated; its Git tree is byte-identical to the previously reviewed bdcd570 head. No functional, documentation or test file changed during this integration.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 3b76b2e837

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".