mirror shim: reuse a running shim only if it is this checkout's tools/mirror.py

[TusanHomichi]

What this adds

This PR changes the harness and the spec. It adds no route, so the template's route lines don't apply. It is the follow-up to Codex's stale-shim finding on #123, which Peter chose to handle separately.

Before: ensure_mirror reused any shim already listening on the port. One started by an older checkout, say one that doesn't allow the new https archive hosts or that caches live dists/ metadata, would keep serving with the old rules, and a run would fail or pin stale data with no hint as to why.

After: the shim answers /.wend-shim with the sha256 of its own tools/mirror.py. ensure_mirror compares that with this checkout's file:

• If they match, it reuses the shim, as before.
• If they differ, or the shim predates the endpoint (it answers 403), it refuses with a message to stop the shim with python3 tools/vm.py shim-stop PID and run again.
• If nothing answers, it starts its own shim, as before.

How:

• tools/mirror.py: computes VERSION from its own file and serves it on /.wend-shim ahead of the host check.
• tools/sandbox.py: checks the version before reusing a shim.
• tools/test_fetched.py: three new checks cover the version endpoint, reuse of a matching shim, and refusal of an old one.
• SPEC: one sentence in the shim paragraph.

Model

None: written by hand.

Evidence

• ./wend check, every tools/test_*.py, cargo fmt, clippy and test, and client/parity.py all pass, with both engines identical.
• CI's gate copies tools/ from base, so it won't exercise this. A remi VM run follows once Codex has reviewed this head. It has to run solo, because it touches mirror.py.

Self-review

• A shim is reused only when its code is byte-identical to this checkout's.
• The refusal names the exact command that clears it, and it never kills anything itself.
• Edits tools/ and SPEC on purpose, as a maintainer-requested follow-up from apt: reach every Debian and Ubuntu archive over https, through the mirror shim #123.
• Commits are signed off.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EQ9ijFk8JWP18n4iscLJXi

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T03:06:33.062059Z	8ed097f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ed097fc8e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[TusanHomichi]

Claude sign-off for head 8ed097f.

• All checks are green on this head. replay was skipped, because no route changed.
• remi ran this exact head (run.json head commit 8ed097f, dirty false) with nothing else running: ubuntu/trusty-web trusty to resolute on BIOS PASSED, with all 6 hops ok.
• During the run, /.wend-shim returned 84e6336d…63ad, the same value as sha256sum tools/mirror.py, so the run reused its own shim and nothing was refused.
• Codex's one finding, the protected-paths one, is answered.

Merging under the project's merge policy.

---

Generated by Claude Code