[abruption]

Summary

Adds diagnose_destination with metadata-only default mode and explicit policy-v2 permissions: diagnostics for inspection, plus diagnostics_probe for active checks. Existing v1/default permissions do not expand. The combined tool has non-read-only/non-idempotent annotations because active SSH configuration may execute operator-controlled commands; host approval remains separate.

Active checks are limited to macOS/Linux, at most three permitted agents, a shared 20-second execution budget excluding bounded local cleanup, and 64 KiB retained per stdout/stderr pipe. No reverse probe, installation, pairing, service change, native submission or model activation is added. Windows metadata remains available; Windows active mode fails before process creation.

New CLI doctor --agent and --selected-home-only narrow actual execution and forwarded SSH scope, not merely output filtering. Scoped doctor skips shared installed-skill scans. Codex inspects only the policy-pinned home; the existing all-agent command remains compatible. A selected disabled agent no longer becomes healthy by an empty-set comparison.

Responses expose only bounded known statuses/checks. Missing/malformed/partial/truncated diagnostics become unknown/diagnostic_incomplete; positive Codex results require expected executable/DB checks and a nontruncated writer scan. Registered Antigravity's legitimate empty check list is qualified by its existing registry scope. SSH failures retain only a fixed failure category. TCP/TLS/paired-device authentication and per-target readiness remain explicitly unobserved. ok means recognized collection, not availability or authorization.

Refs #358. Depends on #362; stacked base feat/mcp-357-preflight. Retarget/revalidate only after the preceding PR is approved and merged normally. No automatic issue closure.

Validation

• macOS arm64/Python 3.13.7/MCP 1.30.0: final complete MCP suite 71 passed with development mode and ResourceWarning errors; documentation 87 passed; generator/diff/i18n checks passed.
• Focused diagnostics/owned-pipe/core checks: 48 passed, 1 skipped. Existing legacy MCP cleanup regressions passed alongside the new helper; old send/wake helper behavior is retained.
• Real stdio invokes the actual scoped CLI against a fresh empty SQLite fixture and a synthetic Claude inbox. The Codex executable is a test shim with an invocation marker; neither it nor the inbox was called. No live/native sessions, actual SSH or model calls were used.
• Owned POSIX child fixtures cover stdout/stderr overflow (including valid JSON prefixes), timeout, repeated cancellation, an escaped setsid descendant holding inherited pipes, and cleanup errors during cancellation. Diagnostic-only nonblocking readers prevent inherited EOF from hanging completion. The helper signals only its original reserved process group; the test releases its own escaped fixture through a control pipe, without a saved-PID kill.
• Cleanup failure cannot replace cancellation or start a second agent probe. Timeout-fixture readiness is synchronized rather than assuming two processes start within a fixed short window.
• Protocol tests skip cleanly without the optional SDK; active-only cases preserve platform exclusions. No native Windows process-tree, physical SSH/authentication, fleet or installed wheel/sdist active-diagnostic acceptance is claimed here; CI provides the declared package/platform checks.
• Initial active smoke overrestricted PATH and removed the system cleanup utility; corrected the fixture to include OS defaults without exposing installed native-agent binaries. A fixture SQLite connection was explicitly closed after development-mode warning detection.

Independent review

Applied independent-cli-review in parallel pairs: Claude Code 2.1.314, response-confirmed claude-opus-5-5; Codex CLI 0.166.0, ephemeral/read-only/ignore-user-config default model (actual model ID not exposed). Claude tools/MCP/hooks were disabled. Both pairs completed non-interactively from identical immutable self-contained inputs; reviewers did not run tests or edit files.

• Initial SHA-256 aa3352807a159049b69084107a63136db31df991c89514e02f9babd1398b4b7f.
• Revised source/cleanup evidence SHA-256 7ea01b56637062d81c78b6b7f1b63e693e6beea6d654b31df6251b914bdb3408.
• Source verification and tests addressed annotations, scope/skill scans, partial results and scan truncation, inherited-pipe hangs, cancellation-vs-cleanup priority, no-next-probe behavior, disabled-agent aggregation and optional-SDK/platform fixtures. The final targeted corrections followed the second review and were checked by Codex; no third exact-byte CLI review is claimed.
• Diagnostic availability is deliberately distinct from per-target readiness: readiness stays not_checked because no target is selected; active evidence is at most a point-in-time diagnostic. Complete negative availability can still be a successful collection. Empty Antigravity checks are legitimate only under its existing registry scope.

Separate translation QA: Antigravity CLI 1.4.12 / gemini-3.8-flash-medium / medium, fresh read-only plan+sandbox calls, structured success at 105.459 s and 90.918 s. Inputs were eight changed localized document diffs against English. Codex checked flags/limits/permission boundaries and corrected Japanese optional-check wording and Korean particles. Final small effect-table/evidence clarifications were aligned by Codex and i18n tests, not claimed as a third Gemini pass.

Limits

Forward SSH only; return-route diagnostics would require a separately reviewed operator-owned reverse-route allowlist. Execution budget excludes cleanup and is not a strict wall-clock or remote-process cleanup promise. No effective-storage attestation, ACK, version bump, merge, tag/release, package publication, global install or operational rollout.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T01:49:11.405714Z	29858dd	PR opened
🔒 Security Review	✅ Completed 2026-11-02T01:50:30.564518Z	29858dd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Additional final translation verification completed after the effect-table clarification: Antigravity CLI 1.4.12, requested gemini-3.8-flash-medium / medium / fresh read-only plan+sandbox, 91.043 seconds, structured success. All eight changed localized document diffs were checked against English, including supported-check/effect tables, collection versus availability, per-target readiness limits, effective-storage/return-route caveats and TCP/TLS/paired authentication distinctions. Input SHA-256 e35fea9e181b210da06e7abf4195038efef2302e28c7e23b0f1a9342645d07e9. No material translation mismatch reported; this is text QA, not runtime/native acceptance.

[abruption]

Sequential integration after #362: base is now main, integrated head 9ab142f. The main squash tree equals the previously included bdcd570 base; conflict resolution preserved the entire reviewed 29858dd tree exactly (tree d16034941bd3c255767101754e3ff127dc942b42). Generator and diff checks pass; no source, documentation or test bytes changed. Existing completed code/security reviews apply to the identical content, not asserted as newly run at the integration SHA. Fresh current-head/main CI and normal protections remain mandatory before merge.