```json
{
  "ocx": 2,
  "to": "x86-1",
  "run": {
    "workspace": [
      {
        "step": "directory",
        "at": "$$root$$/$$process_user$$/projects/$$repository_name$$/$$run$$",
        "remove_on": "saved"
      },
      {
        "step": "files",
        "of": "384b909ae6bdae51bfe1a0de4bdf6a648dc6e94a9efe562d8bcc847b8a434b54",
        "into": "$$workspace$$/tree"
      }
    ],
    "sandbox": {
      "uid": 1000,
      "gid": 1000,
      "linux_capabilities": [],
      "network": true,
      "isolate_terminal": true,
      "ends_with_parent": true,
      "read_only": [
        "/usr",
        "/bin",
        "/sbin",
        "/lib",
        "/lib64",
        "/etc/resolv.conf",
        "/etc/hosts",
        "/etc/nsswitch.conf",
        "/etc/ssl/certs"
      ],
      "read_write": [
        "$$workspace$$"
      ],
      "homes": [
        "/root/.codex"
      ],
      "created_files": [
        {
          "at": "/etc/passwd",
          "text": "$$process_user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
        }
      ],
      "proc": "/proc",
      "dev": "/dev",
      "tmp": "/tmp"
    },
    "limits": {
      "wall": "2h",
      "cpu": 3600,
      "processes": 512,
      "file_size": "256M"
    },
    "process": {
      "user": "codex-task",
      "command": [
        "/bin/sh",
        "-c",
        "read -r run || exit 2; objective=$(printf '%s' \"$run\" | jq -r .objective) || exit 2; cp -a $$tree$$ $$workspace$$/base || exit 2; nice -n 10 /usr/bin/codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check \"$1 $objective\" < /dev/null; codex=$?; cd $$workspace$$ || exit 2; diff -ruN base tree > change.patch; [ $? -le 1 ] || exit 2; exit $codex",
        "codex-task",
        "This directory holds the files of a check-in, with no version control: make in its files the change this objective asks, and nothing more; remove any file you made only to build or check it; do not commit. Your last message says what you changed and what you checked. The objective:"
      ],
      "cwd": "$$tree$$",
      "keep": {
        "stderr": "2K",
        "stdout": "4K",
        "stdout_when": "always"
      },
      "unversioned_files": [
        {
          "at": "$$workspace$$/change.patch",
          "as": "codex-$$run$$.patch"
        }
      ],
      "env": {
        "HOME": "$$workspace$$",
        "USER": "$$process_user$$",
        "PATH": "/usr/local/bin:/usr/bin:/bin"
      }
    },
    "objective": "Build slice 6 of the release design in ocx-rootfs/README.md, section \"Releasing from clients to servers (planned, not built)\", subsection \"The client follows\": a command a person runs on the client so its release root runs what the server accepted. Slice 5 built the server's read-only `release` tool (src/ocx/commands/release_read.cr), offered at /ext/ocx2-cgi/release, which answers current and previous, each its name and its listed files with their SHA-256, and gives one listed file's bytes, base64, to a signed-in login holding setup or listed in the server root's settings/builders.json.\n\nThe contract:\n- `ocx2 follow SERVER --root ROOT`, command line only, run inside the client's root as the root's owner. SERVER is the served repository's URL. It signs in to SERVER as the clone's user the daemon already uses for that repository on this host, with the credentials the daemon reads from ROOT/settings/credentials/ (src/ocx/daemon.cr, src/ocx/acting.cr), signing in the way clones already ask the server's receipt page; it never prints, logs or copies the password.\n- It asks SERVER's release tool which release is current. If that name is the client's own current, it changes nothing and says so. If it is the client's own previous, it moves current to it, keeping the release it leaves as previous. Otherwise it fetches each listed file it lacks from SERVER, by name, checks every file's SHA-256 against the server's answer, and only when every one matches puts the release in ROOT as accept puts a release (Releases, src/ocx/releases.cr: its release.txt, its files' modes), then moves current to it, keeping the one it leaves as previous. Any mismatch or failed fetch changes nothing in ROOT and says which file.\n- It takes the release root's lock (Releases.locked), as the other release tools do. It starts no daemon: the daemon ends when current moves, and the person starts it again with `confine daemon`, as ocx-rootfs/README.md \"Start\" says; follow's answer says so when it moved current. Nothing runs it on a timer.\nAdd specs for each clause: already current, nothing changed; server's current is the client's previous, links moved, nothing fetched; a new release fetched, checked and served, previous kept; a changed byte or a failed fetch, nothing in ROOT changed; no password in its answer or log; the lock held. Use a fixture server as the release and receipt specs do. Document it in USAGE.md under \"Stage, accept or roll back a release\" and in docs/protocol-v2-tools.md, plainly, and change ocx-rootfs/README.md only if what you build differs from it. Do not edit scripts/ or ocx-rootfs/hosts.json. Follow docs/crystal.md, KEEP.md, PLAN.md and the guards. Run the full `crystal run ci.cr`, make it pass, and give its last line in your last message.\nBefore your last message, remove lib/ and anything else `shards install` or the build made (bin/, .shards/, .crystal caches): the patch is made by `diff -ruN` over the whole directory, and the symbolic links shards makes under lib/ loop and stop it, which lost an earlier attempt at this same objective. Judge every choice in this task by README.md's four virtues, as the maintainer asks of every turn: Clarity (it can be stated: the contract below, and nothing it leaves unsaid); Loose Coupling (it can be replaced: clean boundaries, nothing tied to an unpredictable or external part); Demonstrability (it can be demonstrated: specs that prove each clause); Parsimony (it can be bounded: no mechanism, state or abstraction beyond what the contract needs; the smallest mechanism that satisfies it and can be demonstrated). A person runs each release step and can redo it or fix a link by hand, so add nothing to make retries, races or recovery automatic beyond what is asked. In your last message, name for each thing you added the contract clause it satisfies.",
    "clone": "fa361107a96cf737cbba73269a20490cf7b227ff"
  }
}
```