@@ -165,7 +165,7 @@ Twenty packages under `src/agent/directors/<id>/` register in `DIRECTOR_REGISTRY
 
    **Grok infer envelope.** `loadSessionChatPrompt` always appends `loadAgentContextExtensions` (`AGENTS.md`, capped at `MAX_AGENTS_MD_BYTES`) and advertises CORE+CATALOG full schemas via `advertisedToolNamesForSessionMode`. That assembly is family-agnostic — Grok does not substitute the trimmed director prompt (`buildSubAgentSystemPrompt` + `formatDirectorSystemPrompt`). Workers already use that trimmed path (no `AGENTS.md`, mounted-tool schemas only). Keep the infer envelope on Grok; do not strip `AGENTS.md` or core schemas. Measure in `src/agent/prompt-sizes.ts` (`assembleSkywalkerInferEnvelope` vs `assembleDirectorPrompt("skywalker", "grok")`).
 
-   **Codex tool proxies.** When the active provider is Codex (`isCodexProviderName`), `createAgentToolset` and `runSubAgent` mount `apply_patch`, `shell`, and `update_plan` stringTools from `createCodexToolProxies`, all forwarding through the same posix `ToolRunner` seam (`runTool`) so permission plugins still apply. `apply_patch` parses the Codex envelope and forwards each op (`write_file` / `delete_file` / `read_file`). `shell` — the native Codex name is `shell`, not `exec_command` — normalizes Codex's `command` (string or `["bash","-lc",script]`-style argv array), `workdir`, and `timeout_ms` onto `run_shell`'s `{command, cwd?, timeout?}` and is gated by `allowShellFromCapabilities` (mirrors `allowDeleteFromCapabilities` against `run_shell`). `update_plan` maps Codex's `plan: [{step, status}]` onto `manage_tasks(action: "create")`; `pending`/`in_progress`/`completed` map to `todo`/`doing`/`done` — `manage_tasks`'s `cancelled` status has no Codex equivalent and is never produced by this proxy. Primary strips `apply_patch` after mount (Corbits DIY stays on `write_file` / `edit_file` / `delete_file`); `shell` and `update_plan` stay on primary (same classification as `run_shell` / `manage_tasks`). Build and docs worker allowlists (`BUILD_TOOLS` / `DOCS_TOOLS`) include `apply_patch` so Codex workers keep the proxy after the capability filter. `CORE_TOOL_NAMES` does not list it.
+   **One advertised posix set (CL-8400).** Registry engines stay posix-named (`read_file`, `write_file`, `edit_file`, `delete_file`, `run_shell`, `search_files`, `grep`). Advertise is a 1:1 projection onto wire names (`read`, `write`, `edit`, `delete`, `bash`, `glob`, `grep`) plus the unchanged control-plane. Incoming aliases (wire names, old posix ids, Codex `shell` → `run_shell`, `update_plan` → `manage_tasks`) canonicalize onto the engine id for dispatch and grants. `apply_patch` is neither advertised nor dispatched (not an alias of `edit`). `list_dir` stays mounted and unadvertised. Director `tools.allow` stays engine names. Codex does not dual-publish `shell`+`run_shell`. Hidden `shell` coerces Codex `command` (string or `["bash","-lc",script]` argv), `workdir`, and `timeout_ms` onto `run_shell`. Hidden `update_plan` maps `plan: [{step, status}]` onto `manage_tasks(action: "create")` (`pending`/`in_progress`/`completed` → `todo`/`doing`/`done`).
 
 6. There is no static write-path declaration on packages or profiles (CL-6952 removed it — no shipped director ever set one). Instead, `agent-fleet.ts` tracks each running dispatch by cwd; a new mutating dispatch that lands on the same cwd as a live mutating peer (`pending_init`/`running`, and not a declared read-only `modelRole` of `explore`/`plan`/`review`/`test`) records at most one `concurrent-lane-overlap` entry per cwd wave in `intervention-log.ts` (class `conflict`). The wave flag clears when no live mutating writer remains for that cwd. Terminal-but-unsettled lanes (for example cancelled with `finishedAt` set while the run promise has not reached `finally`) are pruned from the map and do not warn. This is advisory only — it never blocks the spawn, since cwd overlap does not prove the two lanes touch the same files.
 7. Spawn effort: pin > package `modelRole` default (`defaultEffortForDirector`; intern=low; plan/review/orchestrator=high; implement/explore/docs/test=medium) > orchestrator/worker binary > parent inheritance. Attached skills (style + philosophy on directors that listed both; never intern or Skywalker primary) are injected into the worker system prompt at spawn from plugin skill dirs only (no project-local `.agents`/`.claude`/`.codex` fallback). Optional skills are listed in the identity header for awareness; workers mount `skill_search` + `use_skill` on every family, scoped to the union of `attachedSkills` and `optionalSkills`. `use_skill` refuses names already attached or already loaded this session and does not return the body again. Primary mounts `use_skill` for its own skill list (same in-session refuse; no attached set).
 
@@ -74,7 +74,7 @@ describe("prompt-variance family rows", () => {
     expect(grokRow.residual).toContain("prefer the structured report");
     expect(grokRow.residual).toContain("re-open paths you already read");
     expect(grokRow.residual).toContain("done-definition is met");
-    expect(grokRow.residual).toContain("never run_shell");
+    expect(grokRow.residual).toContain("never bash");
   });
 
   test("each ceremony line appears exactly once in the grok row (P2 invariant)", () => {
 
@@ -64,7 +64,7 @@ export const grokRow: PromptVarianceRow = {
     "- Once you can answer the dispatch brief, prefer the structured report over another speculative tool call.",
     "- If the next call would only re-open paths you already read, write the report instead.",
     "- When the dispatch brief's done-definition is met, write the report envelope instead of making one more search or micro-edit.",
-    "- Route file and web work through the dedicated tools, never run_shell — mining showed grok reaching for shell first when a typed tool already covered the job.",
+    "- Route file and web work through the dedicated tools, never bash — mining showed grok reaching for shell first when a typed tool already covered the job.",
     "- Never run git add, git commit, git stash, or any other state-changing git command unless the user asks.",
     "- Do not narrate a plan before acting on a small task; act, then report.",
     "- Verify with the test command once at the end, not after every edit.",
 
@@ -16,7 +16,7 @@ Do not delete Corbits-only skills (`plan`, `git-worktrees`, `idiot-proof`). They
 
 Corbits tests use `bun:test` (`bun test`, `bun run test`), not GaaS `tap` (`import t from "tap"`). When the typescript skill shows tap examples, map them to bun:test (`import { expect, test } from "bun:test"`). Do not fork the typescript skill body.
 
-GaaS opsh scripts are bash (`#!/usr/bin/env opsh`, `lib::import`) and use TAP via `prove` (`test-harness`). That harness is not Corbits `bun:test`. Write scripts with `write_file`/`edit_file`; agent commands use `run_shell`. Do not fork the GaaS opsh body.
+GaaS opsh scripts are bash (`#!/usr/bin/env opsh`, `lib::import`) and use TAP via `prove` (`test-harness`). That harness is not Corbits `bun:test`. Write scripts with `write`/`edit`; agent commands use `bash`. Do not fork the GaaS opsh body.
 
 ## Tool mapping
 
@@ -32,14 +32,14 @@ When a GaaS skill names a Claude/GaaS tool, use the Corbits equivalent. Do not c
 | `@critic` / `@critique` | `spawn_agent(agent="critic")`                      |
 | `@intern`               | `spawn_agent(agent="intern")`                      |
 | `@explorer`             | `spawn_agent(agent="explorer")`                    |
-| Read / Write / Edit     | `read_file` / `write_file` / `edit_file`           |
-| Glob / Grep             | `search_files` / `grep`                            |
-| Bash                    | `run_shell`                                        |
+| Read / Write / Edit     | `read` / `write` / `edit`                          |
+| Glob / Grep             | `glob` / `grep`                                    |
+| Bash                    | `bash`                                             |
 | WebFetch / WebSearch    | `web_fetch` / `web_search`                         |
 
 `intent="general"` is not a Corbits spawn. Use a closed director id.
 
-GaaS ast-grep invokes `sg` as a CLI. Corbits extras: run `sg` via `run_shell`. Do not fork the GaaS ast-grep body.
+GaaS ast-grep invokes `sg` as a CLI. Corbits extras: run `sg` via `bash`. Do not fork the GaaS ast-grep body.
 
 Slash names that differ from GaaS skill ids: `/review` is GaaS `code-review`; `/create-issue` is GaaS `linear-create`. Keep those Corbits names.
 
@@ -67,7 +67,7 @@ GaaS linear-issue-workflow inlines `git worktree add` and marks In Progress afte
 
 GaaS `style` refuses to operate outside a git repo. Corbits does not: a folder without `.git` is a valid working directory (scratch, unpacked tarball, new project). Git-using skills (`implement`, `review`, `git-rebase`, `pull-request-review`) still no-op or ask when they need a repo. Do not invent a git repo to satisfy those skills.
 
-When GaaS git-rebase writes `/tmp` editor scripts, Corbits still plans on the primary and intern executes sequenced git via `run_shell`; intern may use inline `GIT_SEQUENCE_EDITOR` instead of write_file editor scripts. Do not fork the GaaS git-rebase body.
+When GaaS git-rebase writes `/tmp` editor scripts, Corbits still plans on the primary and intern executes sequenced git via `bash`; intern may use inline `GIT_SEQUENCE_EDITOR` instead of write editor scripts. Do not fork the GaaS git-rebase body.
 
 ## Tracker-agnostic issues
 
 
@@ -5,13 +5,13 @@ disable-model-invocation: true
 description: Compact Corbits worker runtime invariants for baked prompts.
 ---
 
-Use Corbits tool names: `read_file`, `write_file`, `edit_file`, `delete_file`,
-`grep`, `search_files`, `run_shell`, `web_search`, `web_fetch`,
+Use Corbits tool names: `read`, `write`, `edit`, `delete`,
+`grep`, `glob`, `bash`, `web_search`, `web_fetch`,
 `manage_tasks`, and `ask_director` for worker questions.
 
 Use file tools for file reads, edits, writes, and deletions. Never use shell
 redirects, heredocs, `echo`, `cat`, stream editors, or remove commands as
-substitutes for file tools. Use bounded `grep` and `search_files` instead of
+substitutes for file tools. Use bounded `grep` and `glob` instead of
 unbounded recursive shell searches. Use web tools for URLs; never use curl or
 wget.
 
 
@@ -381,8 +381,8 @@ describe("buildEvalDiagnostics", () => {
     const diagnostics = await buildEvalDiagnostics(
       sampleConfig({ providerName: "openai" }),
     );
-    expect(diagnostics.advertisedTools).toContain("read_file");
-    expect(diagnostics.advertisedTools).toContain("run_shell");
+    expect(diagnostics.advertisedTools).toContain("read");
+    expect(diagnostics.advertisedTools).toContain("bash");
     expect(diagnostics.advertisedTools).not.toContain("ask_operator");
     expect(diagnostics.reasoningEffort).toBeNull();
   });
@@ -394,7 +394,7 @@ describe("buildEvalDiagnostics", () => {
         sampleConfig({ providerName }),
       );
       expect(diagnostics).not.toHaveProperty("codexInstructionsHash");
-      expect(diagnostics.advertisedTools).toContain("read_file");
+      expect(diagnostics.advertisedTools).toContain("read");
     },
   );
 
 
@@ -1,15 +1,20 @@
+import { engineToolName } from "./tool-aliases.js";
+
 const DEFAULT_PREFIX = "default.";
 
 // Muse Spark emits `default.<name>` and duplicated `<name>.<name>`. Dispatch
 // already strips those onto catalog keys; classify, grants, and the execution
 // cache must use the same name so an alias cannot force a second ask/deny.
+// Wire names (read/bash/…) and hidden aliases (shell/update_plan) collapse onto
+// the registry engine id so a grant stored as run_shell covers bash.
 export function canonicalToolName(requested: string): string {
   let name = requested;
   if (name.startsWith(DEFAULT_PREFIX)) {
     const stripped = name.slice(DEFAULT_PREFIX.length);
     if (stripped.length > 0) name = stripped;
   }
-  return undoubledName(name) ?? name;
+  name = undoubledName(name) ?? name;
+  return engineToolName(name);
 }
 
 function undoubledName(requested: string): string | undefined {
 
@@ -1,13 +1,6 @@
 /**
- * Mount coverage for Codex tool proxies (apply_patch, shell, update_plan):
- * primary strip of apply_patch, allowlists, and build-shaped capability filter
- * retention.
- *
- * runSubAgent has no standalone toolset-factory export to import directly (the
- * mount is inline in runSubAgent's tool-assembly), so the subagent mount path
- * is covered here via the same allowDeleteFromCapabilities /
- * allowShellFromCapabilities calls runSubAgent makes against a leaf
- * capability filter, feeding createCodexToolProxies exactly as run.ts does.
+ * Mount coverage for Codex: no advertised apply_patch/shell/update_plan,
+ * engines stay posix-named, hidden aliases dispatch without dual-publish.
  */
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -21,7 +14,7 @@ import {
   createCodexToolProxies,
 } from "./codex-tool-proxies.js";
 import { BUILD_TOOLS, DOCS_TOOLS } from "./directors/tool-sets.js";
-import { CORE_TOOL_NAMES } from "./tool-search.js";
+import { advertisedTools, CORE_TOOL_NAMES } from "./tool-search.js";
 
 afterEach(() => {
   spyOn(posixModule, "createPosixTools").mockRestore();
@@ -55,7 +48,7 @@ describe("Codex tool proxy mount", () => {
     await toolset.dispose();
   });
 
-  test("Codex createAgentToolset strips apply_patch on primary; keeps shell/update_plan", async () => {
+  test("Codex createAgentToolset does not advertise apply_patch/shell/update_plan", async () => {
     // Unstubbed createPosixTools: write_file / edit_file / delete_file come from
     // the real posix + delete-file plugin mount. An empty stub would hide them
     // and make the DIY-remains assertion meaningless.
@@ -74,19 +67,24 @@ describe("Codex tool proxy mount", () => {
     });
     const names = toolset.dynamicRunner.currentDefinitions().map((d) => d.name);
     expect(names).not.toContain("apply_patch");
-    // Primary DIY product writes remain mounted.
     expect(names).toContain("write_file");
     expect(names).toContain("edit_file");
     expect(names).toContain("delete_file");
-    // shell / update_plan are not product-mutation tools (same classification
-    // as run_shell / manage_tasks), so the primary apply_patch strip does not
-    // remove them — they stay mounted on primary, mirroring run_shell.
-    expect(names).toContain("shell");
-    expect(names).toContain("update_plan");
+    expect(names).toContain("run_shell");
+    expect(names).not.toContain("shell");
+    expect(names).not.toContain("update_plan");
+    const advertised = advertisedTools(
+      toolset.dynamicRunner.currentDefinitions(),
+    ).map((d) => d.name);
+    expect(advertised).toContain("bash");
+    expect(advertised).not.toContain("run_shell");
+    expect(advertised).not.toContain("shell");
+    expect(advertised).not.toContain("apply_patch");
+    expect(advertised).not.toContain("update_plan");
     await toolset.dispose();
   });
 
-  test("update_plan dispatches through the real mount without hitting posixTools", async () => {
+  test("update_plan hidden-dispatches through manage_tasks without a proxy mount", async () => {
     // Unstubbed createPosixTools (real temp dir): update_plan used to call
     // runTool("manage_tasks", ...), which forwards onto posixTools.run and
     // fails with "unknown tool: manage_tasks" — posixTools has no
@@ -120,13 +118,13 @@ describe("Codex tool proxy mount", () => {
     await toolset.dispose();
   });
 
-  test("BUILD_TOOLS and DOCS_TOOLS include apply_patch; CORE_TOOL_NAMES does not", () => {
-    expect(BUILD_TOOLS).toContain("apply_patch");
-    expect(DOCS_TOOLS).toContain("apply_patch");
+  test("BUILD_TOOLS and DOCS_TOOLS omit apply_patch; CORE_TOOL_NAMES does not list it", () => {
+    expect(BUILD_TOOLS).not.toContain("apply_patch");
+    expect(DOCS_TOOLS).not.toContain("apply_patch");
     expect(CORE_TOOL_NAMES).not.toContain("apply_patch");
   });
 
-  test("capability include-filter keeps proxies for build-shaped allowlists", () => {
+  test("capability include-filter no longer keeps Codex proxy names", () => {
     const proxies = createCodexToolProxies({
       isCodex: true,
       runTool: async () => ({ content: "ok" }),
@@ -141,46 +139,31 @@ describe("Codex tool proxy mount", () => {
 
     const allow = new Set<string>(BUILD_TOOLS);
     const kept = proxies.filter((t) => allow.has(t.definition.name));
-    expect(kept.map((t) => t.definition.name)).toEqual([
-      "apply_patch",
-      "shell",
-      "update_plan",
-    ]);
+    expect(kept).toEqual([]);
 
     const docsAllow = new Set<string>(DOCS_TOOLS);
     const docsKept = proxies.filter((t) => docsAllow.has(t.definition.name));
-    expect(docsKept.map((t) => t.definition.name)).toEqual([
-      "apply_patch",
-      "update_plan",
-    ]);
+    expect(docsKept).toEqual([]);
   });
 
-  test("runSubAgent-shaped mount: docs capability filter denies shell, keeps update_plan", () => {
-    // Mirrors run.ts: allowDelete / allowShell are derived from the leaf
-    // capability filter before createCodexToolProxies runs. update_plan is
-    // never gated by it (manage_tasks is unconditionally mounted for every
-    // sub-agent), so it stays regardless of the allowlist shape.
-    const docsCapabilities = { mode: "allow" as const, tools: DOCS_TOOLS };
+  test("runSubAgent-shaped allowlists do not keep Codex proxy names", () => {
+    const docsAllow = new Set<string>(DOCS_TOOLS);
     const proxies = createCodexToolProxies({
       isCodex: true,
       runTool: async () => ({ content: "ok" }),
       readRawFile: async () => ({ content: "ok" }),
       runManageTasks: async () => ({ content: "ok" }),
-      allowDelete: allowDeleteFromCapabilities(docsCapabilities),
-      allowShell: allowShellFromCapabilities(docsCapabilities),
+      allowDelete: allowDeleteFromCapabilities({
+        mode: "allow",
+        tools: DOCS_TOOLS,
+      }),
+      allowShell: allowShellFromCapabilities({
+        mode: "allow",
+        tools: DOCS_TOOLS,
+      }),
     });
-    expect(proxies.map((t) => t.definition.name)).toEqual([
-      "apply_patch",
-      "shell",
-      "update_plan",
-    ]);
-
-    const docsAllow = new Set<string>(DOCS_TOOLS);
     const docsKept = proxies.filter((t) => docsAllow.has(t.definition.name));
-    expect(docsKept.map((t) => t.definition.name)).toEqual([
-      "apply_patch",
-      "update_plan",
-    ]);
+    expect(docsKept).toEqual([]);
   });
 
   test("non-Codex runSubAgent-shaped mount produces no proxies at all", () => {
 
@@ -42,10 +42,10 @@ describe("bruckheimerPackage", () => {
 
   test("systemPrompt uses Corbits file tools (not Read/Write/Bash)", () => {
     const p = bruckheimerPackage.systemPrompt;
-    expect(p).toMatch(/read_file/);
-    expect(p).toMatch(/write_file/);
-    expect(p).toMatch(/edit_file/);
-    expect(p).toMatch(/search_files/);
+    expect(p).toMatch(/`read`/);
+    expect(p).toMatch(/`write`/);
+    expect(p).toMatch(/`edit`/);
+    expect(p).toMatch(/`glob`/);
     expect(p).not.toMatch(/\bAskUserQuestion\b/);
     expect(p).not.toMatch(/Use Read and Write/);
     expect(p).not.toMatch(/Use Bash sparingly/);