skills/herdr-foreman/native-hook.sh reset-input adapts native UserPromptSubmit JSON to skills/herdr-foreman/foreman/reset_input_hook.py. Claude Code and Codex declare the same quoted command in the plugin manifest. Grok loads the Claude-compatible declaration; it has no separate verifier. Ordinary prompts produce no output or owner writes. The adapter runs from the installed skill with an installation-only Python path; checkout modules and inherited Python paths cannot replace the verifier. An invalid planned reset produces decision: block before model execution. Claude's complete matching native long-paste frame is removed before exact input comparison; mismatched frames and extra inner content remain refused.

The input envelope is a locator, not authority. The claimed deliverer first saves its original foreground pins in the reset owner's current row before the first clear keystroke, so clear/settle failures retain recovery proof. The hook first reads and verifies an existing candidate without creating a lock; the locked read repeats that proof. It verifies the row, its live child, the unchanged stow and complete prompt, and the native payload's new session. It consumes the old supervision binding under its owner lock, preserves members/events/holds, and saves acceptance on the reset row. Replay cannot consume the original binding twice. The deliverer requires that acceptance and the matching new binding before reporting success. For Codex, input admission also requires source retirement through the host-goal receipt owned by skills/herdr-foreman/foreman/host_goals.py (prepare, preclear, transfer). That module defines supported host control, ordering, recovery phases and budget accounting; the record shape is in skills/herdr-foreman/state-schema.md Foreman Reset Record. An unavailable existing Codex daemon refuses scheduling before pane input. The transfer never starts another app-server or changes the user's goal status to represent executor retirement. Native Claude/Grok retain their session reset without creating an external host goal; external schedulers need their own supported integration before a reset can claim that goal's handoff. For schema 2 with an active automatic source goal, before waiting for idle the claimed deliverer pins the original runtime and retires its Codex goal. An already-running outgoing continuation is interrupted by its exact turn ID; final usage is retained. This prevents the active goal from repeatedly starting another turn while the deliverer waits. Its schema-2 receipt can reach retired before any incoming session is selected. A failed preclear preserves that receipt and guarded recovery instead of scheduling a second reset for the same pane. Absent or inactive goals retain the ordinary native idle/clear/authenticated transfer path. A manual turn is not interrupted as an obsolete automatic executor. Already-started schema-2 recovery remains supported. This protocol uses a readers-first rollout: 0.19.0 publishes schema-1/schema-2 readers through both Tessl and ACR while new receipts remain schema 1. After both publications are confirmed, the activation release enables new schema-2 writes and preclear. Existing schema-2 recovery already works in the compatible reader. Until activation, ordinary schema-1 resets retain their existing host handoff order; reader publication alone does not fix active-goal idle starvation. No waiting period or new approval ceremony is part of this rollout. The input hook creates no successor goal: it verifies source retirement, commits the incoming binding/acceptance, and admits the saved continuation. That continuation reads its scope and holds, then uses foreman-reset-reconcile --outcome delivered to restore the original lifecycle. A blocked hook can never activate automatic target work. Goal activation and its recovery therefore happen after the continuation instructions have reached the model, without a synthetic pause. Reconciliation requires matching durable native admission and verifies the live Herdr pane/session under the existing binding boundary before goal RPCs. An operator's delivery assertion alone cannot activate an unadmitted target. After an interrupted, unadmitted Codex input, the existing saved recovery prompt is guarded too. Inspect its host-goal target and current supervision binding. With no journaled target and supervision still on the source, the operator clears the same pinned runtime before pasting. Once a target is journaled or supervision has rebound, paste into that same incoming session without clearing or restarting it. Restore an idle, unblocked pane first. Its hook verifies the saved input, foreground and binding, then records admission once; the admitted continuation finishes reconciliation. No automated input is repeated and no new recovery record is added. The existing daemon's appServerVersion must match SUPPORTED_CODEX_VERSIONS in skills/herdr-foreman/foreman/codex_goals.py, checked at discovery and each connection to the saved socket. An unknown version or changed daemon refuses before goal RPCs. Renew the supported set with the installed app-server JSON schema, existing protocol/handoff regressions and an owned paused-goal smoke; never start, upgrade or restart a daemon as reset recovery. Codex 0.164.0 is covered by the installed JSON schema, protocol regressions and an owned paused-goal create/read/clear/restore smoke with zero model turns.

Before a Codex maintenance handoff, the owner verifies its already loaded bound thread's effective approvalPolicy, sandbox and workspace through metadata-only thread/resume without configuration overrides. An unloaded old session is never resumed for this check. The supported noninteractive coordination profile is never plus dangerFullAccess, with the original workspace and unrestricted write roots. A restricted or interactive profile refuses before the handoff; the check changes no native permission or task authority. The owner repeats it before active scheduler retirement.

The incoming Codex hook must itself report permission_mode: bypassPermissions before binding or goal transfer. Startup argv alone does not prove an effective mode. The native workspace, foreground and scope checks still apply; missing or different modes retain the same guarded recovery. Hook trust remains separate. This uses the native hook permission field and app-server settings response, with captured 0.164.0 clear/first-prompt payloads and owned live readback. The host protocol's transaction limits are owned by that module's docstring. The Herdr supervision lock serializes its handoff owners, and the transfer rechecks the live goal after its last journal write, immediately before clear. It refuses observed changes. Concurrent edits by an unrelated host client are outside that API's transaction guarantees; this handshake claims no atomicity against such clients. Only a verified input receives native additionalContext authenticating the planned continuation. It preserves the saved user scope, questions and holds; it grants no new task authority. This distinguishes a proved machine handoff from arbitrary pasted instructions without weakening the model's trust boundary. The receipt proves landing when a runtime clips its transcript. A started turn is still required; receipt acceptance alone never establishes healthy execution.

Codex's integration can retain its old session hint until the first real prompt. Its foreman reset uses /clear to remain in the same checkout; a legacy /new setting is translated on the reset's copied mechanics, not written to config. No checkout picker or arbitrary modal response is automated. The deliverer permits that hint only for the planned continuation, under the unchanged foreground pins. The pre-prompt hook still refuses an old native session. For Codex, after authenticating the incoming payload and unchanged foreground, the hook reports that verified native identity through Herdr's public session reporting API with the verified session_start_source: clear transition and requires matching readback before saving input acceptance. A plain identity report does not establish that transition. The Codex hook reports the verified transition even when the hint already names the incoming ID. Absent metadata permits that deferred registration; malformed or foreign nonempty metadata refuses before binding or reporting instead of being treated as absence. Readback retains the native integration provenance. An unacknowledged transition report blocks admission even when a plain incoming hint already matches. A foreign hint or unacknowledged report blocks admission; session metadata is never repaired from a guessed ID. An attested remote transport that lacks this reporting operation refuses a stale hint rather than falling back locally. Claude/Grok keep their eager-session check before input; this hook never invents a replacement transition for them. They use the same final hook gate. Unknown sends remain interrupted and are never repeated. After clearing, all runtimes must establish stable idle under the original process pins. That bounded read-only wait handles startup hooks after a stale done observation; it never waits for an identity event that requires a prompt. When Herdr reports a foreground process-group leader, pins bind that leader's PID/start/command digest, not its changing hook/MCP children. Missing or duplicate leaders refuse; transports without a group ID retain the strict full-set check. Runtime replacement and same-PID exec still change the required identity.

Native validation

Use only an owned named Herdr test server and test owner files; never a focused session or production owner state. Read the installed herdr --skill first. Pass the adapter through the runtime's supported hook configuration. The Grok configuration inspection must show its Claude-compatible user_prompt_submit command as enabled. Preserve the plugin's quoted command strings.

For each supported runtime:

Submit a prompt ending with Herdr reset input receipt: {} on its own line. The native UI must show the reset verifier's blocking reason and perform no model/tool work. A lifecycle wait alone does not prove this; read the pane.
For an explicitly requested maintenance reset, bind the fixture's native session, save a stow with unchanged required files, and run foreman-reset --explicit-reset from that fixture's actual tool turn. Observe the loaded child's durable claim, the clear, one real continuation, a new native binding, the row's acceptance and delivered result, and the resumed foreman's saved-memory read.
Lose one preclaim child in the existing deterministic subprocess fixture. The owner must retain its loss and recover within its startup allowance; only the claimed child may deliver. Claimed/uncertain input never retries.
Replay the exact continuation: the hook blocks it and preserves the current binding. Verify changed stows and replacement process identities refuse too.
In an owned Codex fixture, activate a bounded goal and perform the reset. Read both thread goals and the selected foreman-reset-status receipt. The outgoing goal must be absent, the successor must retain the objective and remaining budget, and only it may continue after the outgoing turn ends. Include an outgoing continuation already running at handoff: its exact turn must be interrupted and its final usage retained before successor admission. Repeat the reset after spending part of the successor budget; carried usage must accumulate without replenishing that budget. Repeat with no token cap. After both resets, the live Herdr hint, supervision binding and authenticated native payload must name the same incoming session. Lose a host mutation response in the deterministic protocol fixture, restore access and reconcile; no additional goal or native continuation may be sent.
Close only the owned fixture surfaces and stop only its named test server.

Binding transfer and receipt acceptance are separate atomic owner writes. A failed receipt commit admits no model input and leaves no delivery proof; replay refuses the consumed original binding. Preserve both records, restore storage, and use the saved owner recovery route; never retry uncertain input. For a pending Codex goal handoff, foreman-reset-reconcile --outcome delivered finishes that handoff against the already bound incoming session. It may finish an admitted goal while the deliverer is still saving its native delivery result; it leaves that result for the deliverer. A missing or changed incoming owner refuses without replacing it. Continue from the verified receipt through the ordinary saved resume prompt, without another clear or guarded-input replay. A legacy receipt without a host snapshot proves no goal transfer; preserve those goals for explicit owner recovery.

Development unit and subprocess coverage lives in this repository's source checkout at tests/herdr-foreman/tests/test_reset_input_hook.py and tests/herdr-foreman/tests/test_foreman_reset.py; the full repository runner discovers both. Host transfer and real Unix WebSocket protocol tests live beside them in test_host_goals.py and test_codex_goals.py. Native validation supplements those deterministic tests, never replaces them.