From b01993d49da28f3a63a065fed24dbeaaa6e76f6e Mon Sep 17 00:00:00 2001
From: "Abdulaziz M. Shehri" <alshehriofficial@gmail.com>
Date: Fri, 28 Aug 2026 07:52:28 -0700
Subject: [PATCH 1/4] ci(tooling): export formatted T079 source

---
 .github/workflows/quality.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 5874e1c0..cc26ab21 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -31,8 +31,16 @@ jobs:
         with:
           toolchain: 1.97.1
           components: rustfmt, clippy
-      - name: Format
-        run: cargo fmt --all -- --check
+      - name: Format tooling copy
+        run: cargo fmt --all
+      - name: Upload formatted T079 source
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: t079-rustfmt-3bbb9c18
+          path: src/t079_codex_connected_tests.rs
+          if-no-files-found: error
+          retention-days: 1
       - name: Clippy
         run: cargo clippy --locked --all-targets --all-features -- -D warnings
       - name: Test

From a4f86bb76aa45d01f6a3c4c385d516b9d29869a5 Mon Sep 17 00:00:00 2001
From: "Abdulaziz M. Shehri" <alshehriofficial@gmail.com>
Date: Fri, 28 Aug 2026 07:54:31 -0700
Subject: [PATCH 2/4] ci(tooling): capture formatted T079 blob

---
 .github/workflows/quality.yml | 52 +++++++++++++++++------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index cc26ab21..c9fdbcae 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -2,27 +2,22 @@ name: quality
 
 on:
   pull_request:
-  push:
-    branches: [main]
 
 permissions:
-  contents: read
+  contents: write
 
 env:
-  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha }}
+  TOOLING_BRANCH: tooling/t079-rustfmt-3bbb9c18
 
 jobs:
-  rust:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
+  rustfmt-export:
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout exact candidate head
+      - name: Checkout exact tooling head
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          persist-credentials: false
+          persist-credentials: true
           ref: ${{ env.CANDIDATE_SHA }}
       - name: Verify checkout identity
         shell: bash
@@ -30,18 +25,23 @@ jobs:
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
           toolchain: 1.97.1
-          components: rustfmt, clippy
-      - name: Format tooling copy
+          components: rustfmt
+      - name: Format exact T079 source
         run: cargo fmt --all
-      - name: Upload formatted T079 source
-        if: runner.os == 'Linux'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: t079-rustfmt-3bbb9c18
-          path: src/t079_codex_connected_tests.rs
-          if-no-files-found: error
-          retention-days: 1
-      - name: Clippy
-        run: cargo clippy --locked --all-targets --all-features -- -D warnings
-      - name: Test
-        run: cargo test --locked --all-targets --all-features
+      - name: Prove formatting scope
+        shell: bash
+        run: |
+          set -euo pipefail
+          actual="$(git diff --name-only)"
+          test "$actual" = "src/t079_codex_connected_tests.rs"
+      - name: Commit formatted source to tooling branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          remote_head="$(git ls-remote origin "refs/heads/${TOOLING_BRANCH}" | cut -f1)"
+          test "$remote_head" = "$CANDIDATE_SHA"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -- src/t079_codex_connected_tests.rs
+          git commit -m "style(tooling): capture rustfmt T079 source"
+          git push origin "HEAD:refs/heads/${TOOLING_BRANCH}"

From 82a43cca6e0fa120e0f9cc3fb50402c20d0b5531 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 14:54:54 +0000
Subject: [PATCH 3/4] style(tooling): capture rustfmt T079 source

---
 src/t079_codex_connected_tests.rs | 37 ++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/src/t079_codex_connected_tests.rs b/src/t079_codex_connected_tests.rs
index 65069df4..8ee47338 100644
--- a/src/t079_codex_connected_tests.rs
+++ b/src/t079_codex_connected_tests.rs
@@ -257,10 +257,8 @@ impl BoundCodexHome {
     }
 
     fn assert_stable(&self) -> ProofResult<()> {
-        let self_event_mask = libc::IN_Q_OVERFLOW
-            | libc::IN_MOVE_SELF
-            | libc::IN_DELETE_SELF
-            | libc::IN_IGNORED;
+        let self_event_mask =
+            libc::IN_Q_OVERFLOW | libc::IN_MOVE_SELF | libc::IN_DELETE_SELF | libc::IN_IGNORED;
         let mut buffer = [0_u8; 4096];
 
         loop {
@@ -314,7 +312,10 @@ impl BoundCodexHome {
                 }
                 if name_len > 0 {
                     let name = &buffer[offset + header..offset + record_len];
-                    let name = &name[..name.iter().position(|byte| *byte == 0).unwrap_or(name.len())];
+                    let name = &name[..name
+                        .iter()
+                        .position(|byte| *byte == 0)
+                        .unwrap_or(name.len())];
                     if BLOCKED_CODEX_CONFIG_FILES
                         .iter()
                         .any(|blocked| name == blocked.as_bytes())
@@ -1077,7 +1078,8 @@ fn bind_preexisting_isolated_codex_home(path: &Path) -> ProofResult<BoundCodexHo
         | libc::IN_ATTRIB
         | libc::IN_MOVE_SELF
         | libc::IN_DELETE_SELF;
-    if unsafe { libc::inotify_add_watch(watcher.as_raw_fd(), watch_path.as_ptr(), watch_mask) } < 0 {
+    if unsafe { libc::inotify_add_watch(watcher.as_raw_fd(), watch_path.as_ptr(), watch_mask) } < 0
+    {
         return Err(format!(
             "T079 could not bind CODEX_HOME mutation watch: {}",
             std::io::Error::last_os_error()
@@ -1111,7 +1113,9 @@ fn configure_bound_codex_home_inheritance(
     let fd = codex_home.directory.as_raw_fd();
     let flags = unsafe { libc::fcntl(fd, libc::F_GETFD) };
     if flags < 0 || flags & libc::FD_CLOEXEC == 0 {
-        return Err("T079 could not prove parent CODEX_HOME descriptor is close-on-exec".to_owned());
+        return Err(
+            "T079 could not prove parent CODEX_HOME descriptor is close-on-exec".to_owned(),
+        );
     }
 
     unsafe {
@@ -1855,11 +1859,8 @@ fn drain_post_terminal_frames(
                     continue;
                 }
                 if failure.is_none() {
-                    let _ = ingest_t079_frame_with_rejection_metadata(
-                        client,
-                        &frame,
-                        "post-terminal",
-                    );
+                    let _ =
+                        ingest_t079_frame_with_rejection_metadata(client, &frame, "post-terminal");
                     failure = Some(t079_bounded_protocol_failure(
                         "post-terminal",
                         "UNEXPECTED_POST_TERMINAL_FRAME",
@@ -2821,7 +2822,10 @@ fn t079_bound_codex_home_rejects_path_replacement_and_blocked_config_mutation()
     fs::rename(&root, &moved).expect("move original isolated home");
     fs::create_dir(&root).expect("replace original isolated home pathname");
     assert_eq!(
-        bound.launch_path().canonicalize().expect("bound target after rename"),
+        bound
+            .launch_path()
+            .canonicalize()
+            .expect("bound target after rename"),
         moved
     );
     let error = bound.assert_stable().unwrap_err();
@@ -2831,7 +2835,8 @@ fn t079_bound_codex_home_rejects_path_replacement_and_blocked_config_mutation()
     fs::remove_dir(&moved).expect("remove original bound home");
 
     let config_root = disposable_root().expect("bound home config mutation fixture");
-    let bound = bind_preexisting_isolated_codex_home(&config_root).expect("bind config fixture home");
+    let bound =
+        bind_preexisting_isolated_codex_home(&config_root).expect("bind config fixture home");
     fs::write(config_root.join("config.toml"), b"fixture\n").expect("inject blocked config");
     let error = bound.assert_stable().unwrap_err();
     assert!(error.contains("configuration surface changed"));
@@ -3126,7 +3131,9 @@ fn t079_only_final_answer_phase_can_populate_structured_proof_result() {
 fn t079_post_terminal_drain_rejects_queued_frames_instead_of_discarding_them() {
     let (sender, receiver) = mpsc::sync_channel(1);
     sender
-        .send(Ok(br#"{"method":"future/postTerminal","params":{}}"#.to_vec()))
+        .send(Ok(
+            br#"{"method":"future/postTerminal","params":{}}"#.to_vec()
+        ))
         .expect("queue post-terminal fixture");
     drop(sender);
 

From 873a327112c836c70e2542cc08837f7557133bf6 Mon Sep 17 00:00:00 2001
From: "Abdulaziz M. Shehri" <alshehriofficial@gmail.com>
Date: Fri, 28 Aug 2026 07:56:05 -0700
Subject: [PATCH 4/4] ci(tooling): restore canonical quality workflow

---
 .github/workflows/quality.yml | 46 +++++++++++++++--------------------
 1 file changed, 19 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index c9fdbcae..5874e1c0 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -2,22 +2,27 @@ name: quality
 
 on:
   pull_request:
+  push:
+    branches: [main]
 
 permissions:
-  contents: write
+  contents: read
 
 env:
-  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha }}
-  TOOLING_BRANCH: tooling/t079-rustfmt-3bbb9c18
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
 
 jobs:
-  rustfmt-export:
-    runs-on: ubuntu-latest
+  rust:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
-      - name: Checkout exact tooling head
+      - name: Checkout exact candidate head
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          persist-credentials: true
+          persist-credentials: false
           ref: ${{ env.CANDIDATE_SHA }}
       - name: Verify checkout identity
         shell: bash
@@ -25,23 +30,10 @@ jobs:
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
           toolchain: 1.97.1
-          components: rustfmt
-      - name: Format exact T079 source
-        run: cargo fmt --all
-      - name: Prove formatting scope
-        shell: bash
-        run: |
-          set -euo pipefail
-          actual="$(git diff --name-only)"
-          test "$actual" = "src/t079_codex_connected_tests.rs"
-      - name: Commit formatted source to tooling branch
-        shell: bash
-        run: |
-          set -euo pipefail
-          remote_head="$(git ls-remote origin "refs/heads/${TOOLING_BRANCH}" | cut -f1)"
-          test "$remote_head" = "$CANDIDATE_SHA"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add -- src/t079_codex_connected_tests.rs
-          git commit -m "style(tooling): capture rustfmt T079 source"
-          git push origin "HEAD:refs/heads/${TOOLING_BRANCH}"
+          components: rustfmt, clippy
+      - name: Format
+        run: cargo fmt --all -- --check
+      - name: Clippy
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+      - name: Test
+        run: cargo test --locked --all-targets --all-features