Three deferred P2 findings from the PR #27 codex review, now fixed properly:

1. config.py — per-key LAYER PROVENANCE for unknown items. The loader now tracks
   which config FILE last declared each top-level key (key_sources, built in
   cascade order). An unknown item that came SOLELY from the global config is
   reported against ~/.config/rig/config.yaml, not the repo rig.yaml. plan.py's
   unknown-item errors resolve the source via config.source_for_key().

2. missing_target.py — SKIP `-m module` invocations. `python3 -m my_hook --out x`
   runs a module by import name, not a script FILE; the scanner now treats `-m`
   like `-c` (interpreter mode, no path to verify), so a healthy module-based hook
   with an absolute --out arg no longer false-flags as a missing target.

3. cli.py — EXIT-CODE PRECEDENCE. A dead hook/target now surfaces its exit code
   (EXIT_MISSING_TARGET=5) even alongside config<->disk drift, instead of being
   masked by the drift exit (3). Both findings are still printed; missing-target
   outranks drift (it fails at runtime). Precedence documented in `rig --help`.

Also makes tests/smoke.sh run pytest via `uv run --with pytest` when uv is
available (the documented command), so the suite runs on a machine whose bare
python3 lacks pytest.

Tests: RED-first for each finding; full suite 504 -> 513 passing; smoke green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ixture

#27's clean-sample leg enumerates every default-ON category and disables
it to assert zero false drift. tg_ctl (added by this PR) is default-ON, so
its provision_tg_ctl action made the clean sample report drift (exit 3).
Mirror how #29 added 'gitignore: {enabled: false}' and disable tg_ctl too.

* feat(rig): add tg_ctl config block + pure plist planning

Add the tg_ctl config block (validate + plan) and the pure, effect-free
TgCtlPlan that renders the ai.hyperide.tg-ctl.plist LaunchAgent XML
byte-exact to the working hand-created file (sort_keys=False preserves the
insertion order so a re-apply is a true no-op). Default-on, per-machine
(GLOBAL layer), macOS-only. Mirrors the tmux block's schema style.

boot:null and label:null resolve to their defaults (not bool(None)=False /
str(None)="None").

Reviewed via multi-model `review`; findings addressed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(rig): provision + reconcile tg-ctl boot LaunchAgent

Runner: _do_provision_tg_ctl writes the byte-exact plist, backs up a
differing prior, ensures the log dir, tears down the stale predecessor
(com.ultra.codex-tg-bot: bootout + timestamped backup + remove), and
(re)loads via launchctl bootout/bootstrap in the gui/<uid> domain. A
re-apply against the already-correct loaded plist is a skipped no-op.
RIG_TG_CTL_DRY_RUN writes the plist but skips every live/destructive
mutation (launchctl AND the stale teardown) so tests/smoke never touch the
real launchd domain.

Drift: _check_tg_ctl flags missing / divergent / written-but-not-loaded, a
leftover plist when boot:false, and the stale predecessor (extra). CLI:
GLOBAL status line shows installed / drifted / disabled / unsupported
(off-darwin), resolved through the shared plan builder.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(rig): tg-ctl unit suite + HOME-isolated smoke leg

test_tg_ctl.py mirrors test_tmux.py: config validation, byte-exact plist
render (incl. against the live machine plist when present, read-only),
create/idempotent/conflict/dry-run states, stale-predecessor teardown, drift
(missing/modified/extra/not-loaded), status states, and the boot:null /
label:null / dry-run-no-stale-removal / off-darwin regressions.

conftest neutralizes the default-on tg_ctl provisioner + drift check and
stubs the gui-domain launchctl seams suite-wide (dedicated tests restore the
real ones with their own HOME-isolated tmp dirs); no test ever touches the
real ~/Library/LaunchAgents or runs real launchctl. smoke.sh gains a
focused, HOME-isolated, RIG_TG_CTL_DRY_RUN tg-ctl leg and prefers
`uv run --extra test pytest`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(rig): document the tg_ctl config block

docs/config-schema.md: the tg_ctl section (keys, defaults, the byte-exact
no-op contract, gui-domain (re)load, stale-predecessor teardown, drift, the
RIG_TG_CTL_DRY_RUN seam, and the enabled:false vs boot:false distinction) +
the validation paragraph. AGENTS.md: refine the "never mutate a LIVE service"
rule — the stateless background daemons (models cron, tg_ctl) are the
documented (re)load exceptions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(rig): disable tg_ctl in the error-system-v2 clean-sample smoke fixture

#27's clean-sample leg enumerates every default-ON category and disables
it to assert zero false drift. tg_ctl (added by this PR) is default-ON, so
its provision_tg_ctl action made the clean sample report drift (exit 3).
Mirror how #29 added 'gitignore: {enabled: false}' and disable tg_ctl too.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>