VERIFIED (the smoke suite drives the built server over stdio and the hook via stdin): protocol handshake and instructions, all four tools, tier derivation for ASSERTED/OBSERVED/VERIFIED (the VERIFIED tier is opt-in via --verify / WJSON_VERIFY=1: it re-runs a whitelisted read-only git command and reproduces its recorded output, downgrading to OBSERVED when it does not — never on the hook hot path), the deny/warn/none enforcement matrix, evidence citation in deny reasons, META-102 exact-first path matching with absolute-path fallback and fuzzy-match rejection, bounded text and structured payloads, root-marker upward walk from a nested cwd, hook exit codes and JSON emission, and explicit fail-open warnings for missing, malformed, or unparseable inputs.
VERIFIED on real Codex 0.144.1 (2026-07-13): the installed plugin manifest loaded its PreToolUse hook; hookSpecificOutput.permissionDecision: "deny" plus exit code 2 blocked apply_patch under WJSON_DENY_ALL=1; unsetting it allowed a normal edit; the fixture denied a checkout-only edit with the recorded revert d4e5f6 evidence and missing partners; and a single patch covering checkout, session, and format surfaced cautionary context and proceeded. The output contract and manifest remain isolated to single adapter points (emitDecision() in the hook; .codex-plugin/plugin.json).
See also clean-install-audit.md and fixture-verification.md for the install/teardown and fixture-provenance evidence records.