Review · codex-ce-code-review-02 · Installable Patrol modules

High

[x] AUTO-FIX: Detached module hooks cannot pass authenticated attempt startup (bin/hive:51, lib/hive/attempts/context.rb:113): context installation scrubs HIVE_ATTEMPT_INTERNAL before the private-route check and then resolves the module name as a task, so every real scheduled or named-event hook is rejected before execution.
[x] AUTO-FIX: Packaged workflow hook targets remain execution-disabled (lib/hive/modules/target_executor.rb:46): the production default runner always raises WorkflowAdmissionUnavailable, leaving a plan-required declarative target kind nonfunctional.
[x] AUTO-FIX: Legacy patrol aliases bypass module admission and ownership (lib/hive/commands/patrol.rb:49, lib/hive/commands/refactor_patrol.rb:128): both public commands still invoke their legacy engines directly after cutover instead of forwarding through the durable module-hook path.
[x] AUTO-FIX: First-party capability grants are only adapter preflights (lib/hive/modules/adapters/patrol.rb:91, lib/hive/modules/adapters/architecture_patrol.rb:85): neither legacy engine receives a capability-bound gateway, so configured commands and repository/GitHub/network sinks can exercise authority outside the reviewed grant snapshot.
[x] AUTO-FIX: External-command sandboxing does not enforce the declared grant model (lib/hive/modules/target_executor.rb:23): it exposes the entire host root read-only while hard-disabling all network and writes, leaking ungranted files and making approved filesystem/network capabilities unusable.
[x] AUTO-FIX: Command-target secrets can be persisted verbatim in attempt logs (lib/hive/modules/target_executor.rb:151): granted values enter the child environment while stdout and stderr flow unredacted into durable supervisor logs.
[x] AUTO-FIX: Production shadow evidence has no legacy producer (lib/hive/modules/adapters/patrol.rb:159): adapters consume legacy_mutator_capture, but no scheduler or reconciler publishes it, so comparable counts remain zero and the evidence gate can never pass.
[x] AUTO-FIX: Module admission can race migration ownership transitions (lib/hive/modules/migration/coordinator.rb:28, lib/hive/modules/dispatcher.rb:47): quiescence uses a precomputed attempt snapshot and module dispatch does not share the migration lock, allowing a newly admitted shadow or mutator attempt to cross cutover/rollback and duplicate effects.
[x] AUTO-FIX: Rollback permits immediate recutover with stale evidence (lib/hive/modules/migration/patrols.rb:199): rolled_back is accepted without resetting the window or matching evidence to the restored active generations, so the old report can authorize an unproven executable/configuration.
[x] AUTO-FIX: CLI reinstall is impossible after uninstall (lib/hive/commands/module/lifecycle.rb:54): an uninstalled tombstone is truthy and is rejected as “already installed,” violating the required uninstall/reinstall no-replay flow.
[x] AUTO-FIX: Activation finalization straddles incompatible commit points (lib/hive/module_package/managed_store.rb:66): recovery evidence is deleted before the fallible Hive-state commit, while cleanup failures after that commit still roll back in-memory bytes, producing unrecoverable or split-brain state.
[x] AUTO-FIX: Attempt admission and launch-decision persistence are not crash-atomic (lib/hive/modules/dispatcher.rb:71): a crash after worker admission but before the decision append recovers the real launch as a duplicate or terminal_replay skip instead of the required launch receipt.
[x] AUTO-FIX: Attempt v3 rejects plan-required v1 records (lib/hive/attempts/record.rb:17): only schema versions 2 and 3 are accepted, so historical v1 attempts cannot be read despite U4 explicitly requiring v1/v2 compatibility.
[x] AUTO-FIX: Required rollout and acceptance proof is absent (docs/dogfood-reports/installable-patrol-modules.md:11): the committed report records zero comparable decisions, no seven-day window, no cutover/rollback drill, and no reviewed exact-head merge-ready proof required by R15.
[x] AUTO-FIX: The reviewed head is not the current PR/base universe: local HEAD is three commits behind origin/main, while draft PR #886 still points to the prior commit and has three failed checks, so the plan's current-base exact-head green gate is unsatisfied.

Medium

[x] AUTO-FIX: Catalog rejection deletes caller-owned destination contents (lib/hive/module_package/catalog_client.rb:65): the broad rescue recursively removes even a pre-existing non-empty directory that was rejected before materialization.
[x] AUTO-FIX: Migration JSON failures do not validate against their advertised schemas (lib/hive/commands/module.rb:47, schemas/hive-module-migration.v1.json:5): error envelopes are labeled with success-only migration schemas, and pre-Thor nested migration routing falls back to the lifecycle schema.
[x] AUTO-FIX: Every daemon tick rescans the full durable event and decision histories (lib/hive/modules/daemon_runtime.rb:69): unbounded retained ledgers make idle dispatch work grow as events times modules times hooks times decisions.
[x] AUTO-FIX: Command-bearing modules activate without validating the sandbox runtime (lib/hive/modules/target_executor.rb:55): health checks accept them on macOS or hosts without bwrap, then every command hook fails only after activation.

Nit

[x] AUTO-FIX: Operator documentation still says the reserve-to-spawn ownership barrier is missing (docs/modules.md:157): pass-1 code now holds the migration admission lock through reservation and child registration, so this stated blocker is stale.
[x] AUTO-FIX: Canonical agent guidance omits the exact structured migration diagnostic (skills/hive/references/workflow-actions.md:41): hive module migration status appears only in prose without the --json invocation pinned for other read-only module surfaces.