[gpazo]

Rat Things previously required nine patches to Codex, including a private checkpoint RPC. This change uses the official, unmodified Codex 0.164.0 release and companions. Rat Things handles integration through the public app-server protocol. All nine patches and the custom Codex compilation path are removed.

Packaging checks every runtime file against the pinned upstream package inventory and rejects modified or old custom artifacts. Both macOS assembly paths preserve upstream bytes and signatures. Managed execution verifies its effective named permission profile before exposing tools, keeps disabled networking behind an empty proxy allowlist, and accepts only known authentication-only requirements. Cancellation waits for the matching terminal event; service tiers follow public capabilities; completed command output uses the canonical aggregate. Pi file tools return exact stdout on success while commands and failures retain stderr diagnostics.

The private checkpoint RPC is replaced by host-controlled shutdown and recovery verification. The host stops writers, flushes its journal, synchronizes storage, then verifies root/child identities and complete public native history through isolated fresh-process read and resume before publishing a checkpoint. Corrupt history, unexpected activity, unsafe startup integrations, and unsupported providers fail closed. Both guest boot paths restore a fixed, loopback-resolvable hostname so stock executor configuration discovery cannot stall heartbeat responses on DNS.

Validation on b75947e:

• Full repository check: 2,365 tests passed, 53 opt-in tests skipped; architecture, typecheck, official ARM packaging, site and Terraform validation passed.
• CI run 40278691698 is green on this commit: ARM, x86, and macOS desktop jobs all passed. x86 passed 898 native contract tests; ARM native-image passed 899; both passed all 13 isolated cold-recovery helper cases. All 36 site browser tests passed.
• Live managed Codex on the actual KVM worker: two turns, exact files and history across service close/reopen, non-root subprocess execution, network/credential isolation, local hostname resolution, and complete cleanup passed.
• Live Pi through the production Rust widget harness and real KVM worker: two turns, eight managed operations, exact file contents, saved Agent/environment controls, ConsoleApp reopen, continued turn, and cleanup passed. Rendered evidence was inspected.
• Existing 0.154 root and child histories were resumed and continued with official 0.164 in a fresh process, retaining identities and prior messages.

Limits: checkpoints certify completed public native history plus the separately persisted host journal; hidden Codex mailbox state and running processes are outside that contract. Codex cold checkpoints support OpenAI and custom Responses providers; Bedrock/Ollama/LM Studio are refused before shutdown. Live AWS worker replacement and signed macOS native-runtime admission remain unvalidated. The live Rust UI harness exercises production widgets, not native-window automation or wake/unlock. Service reopen validation runs within one host process.