Harden conductor access and reconcile router receipts

[CryptoJym]

Summary

• Router: reconciles active dispatch receipts from exact native thread/read evidence before claim scans. It writes COMPLETED, FAILED or CANCELLED only on native terminal evidence, archives aged terminal receipts, warns at 80% of the scan caps, and preserves stale locks under timestamped names. It never touches a live holder's lock.
• Conductor: protected with per-profile bearer tokens (${CODEX_HOME}/.conductor/http-token, 0600), Host and browser-origin checks, JSON-only POSTs, an /rpc method allowlist, auth counters in /status, and a token-free /healthz. Fresh installs default to enforce; report mode is available for migration. Sandbox and approval defaults are unchanged.
• Callers: the shipped router and installer health callers send the profile token.
• CI: runs the connector, coordination, installer, memory, graph and training Python suites, using the repository-pinned requirements and runtimes.
• Release inventory: resealed with installer/release_guard.py on the complete tree.

Verification

• Conductor Node suite: 177 passed, 0 failed.
• Python suites: connector 234 passed (32 existing conditional skips), coordination 44 passed, memory 43 passed (2 existing conditional skips), graph 62 passed, training 6 passed.
• Installer suite on the complete tree, with all three adapter weights present: 100 passed (Python 3.12, installer/requirements.lock).
• Publication guard on an export of this branch's HEAD: PASS files=400.
• Hosted CI: runs on this PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a55d559c-82a0-4658-98d4-283006f47bca

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}