@atollhq/skill-codex 0.4.32 → 0.4.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atollhq/skill-codex",
-  "version": "0.4.32",
+  "version": "0.4.33",
   "description": "Install the Atoll project management integration for Codex CLI",
   "bin": {
     "skill-codex": "bin/install.mjs"
@@ -18,7 +18,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/atollhq/atoll.git",
+    "url": "git+https://github.com/antons-agents/atoll.git",
     "directory": "packages/skill-codex"
   },
   "dependencies": {

package/skill/references/local-runner.md

@@ -90,3 +90,78 @@ are blocked while a current job exists. Refresh, config validation, and Codex
 preflight are non-destructive; there is no model retry or cleanup button.
 A UI port or asset failure does not stop headless execution. Do not proxy this
 loopback interface to another host. Service installation remains separate.
+
+### macOS service and lifecycle
+
+Install an explicit user service only when unattended operation is required:
+
+```bash
+atoll-runner --profile agent-a service install
+atoll-runner --profile agent-a service install --ui --ui-port 4735
+atoll-runner --profile agent-a service status
+atoll-runner --profile agent-a service uninstall
+```
+
+The service is macOS-only. Install writes an atomic user-owned `0600` plist
+under `~/Library/LaunchAgents/` with canonical Node and runner entry paths,
+the selected profile, `run`, and optional loopback UI arguments. It contains no
+environment variables, API keys, Codex or lease tokens, shell command,
+checkout path, or worktree path. Unknown or changed plists fail closed.
+Package installation is passive and never installs or starts the service. Use
+uninstall, package upgrade, `doctor`, then install for an upgrade. Uninstall
+removes only the exact owned plist and leaves journals, tokens, logs, branches,
+and worktrees. Status and uninstall validate the local plist and do not require
+profile credentials; install remains authenticated.
+
+SIGINT/SIGTERM closes the process-local intake gate immediately. The current
+child drains for at most 30 seconds; TERM and then KILL after 10 seconds are
+sent only when the journaled PID still has the same process-start identity. A
+wall-clock event-loop gap above 30 seconds is a possible wake. The child is
+stopped, durable lease state is reconciled, and intake reopens only after that
+pass. A wake may release a worker only to finish an already durable result;
+stop never releases a worker. No hosted pause request is sent. Existing-wire
+response failures are bounded as `RUNNER_PROTOCOL_MISMATCH` and keep pending
+mutation journals available for replay.
+
+### Opt-in real local smoke
+
+This developer harness is available only from an Atoll source checkout. It is
+not included in the installed npm CLI. After deterministic checks, use a clean
+loopback fixture profile with no current or conflicting retained job, and run
+from `packages/cli`:
+
+Loopback remains the normal default. Repository owners may also run one bounded
+production validation turn from a clean Atoll source checkout. This mode requires
+an exact canonical production origin, organization, project, authenticated agent,
+issue, runner host and instance, and the live project repository mapping's opaque
+`repo_ref` plus repository full name. The supplied `repo_ref` is checked against
+live issue routing and must never be hard-coded. The smoke derives the canonical
+source root from its own script, requires a clean source checkout, rebuilds the
+candidate in the invocation, and records the source root, source `HEAD`, and
+worker-entry SHA-256 in bounded mode-`0600` evidence. Exact production admission
+performs zero presence `PUT`/upsert operations for either connected or
+disconnected targets. Registration and refresh belong to separate operator setup
+outside this invocation. The invocation reads the connected runner identity
+before claim and rechecks it immediately before the claim; a disconnected target
+fails closed. The runner does not explicitly select a model. The Codex runtime
+and local Codex configuration supply model selection. `@openai/codex` and
+`@openai/codex-sdk` are pinned to package/runtime version `0.153.4`; this
+version is not a model name. Use the internal AH-2088 production smoke
+runbook for the owner-only command and cleanup procedure.
+
+
+```bash
+cd packages/cli && bun run build
+ATOLL_RUNNER_MANUAL_SMOKE=1 bun run runner:manual-smoke -- \
+  --profile agent-a --issue issue-uuid --repository /path/to/checkout \
+  --timeout-ms 300000 --evidence /absolute/path/evidence.json
+```
+
+The smoke runs one real Codex turn through the existing runner. It creates and
+retains its owned local branch and worktree while preserving the primary
+checkout, and writes bounded fixture issue, host, generation, branch/worktree,
+base/head SHA, thread, terminal, and time evidence outside the checkout. A
+timeout is always failure; retained journal state is authoritative. It never
+pushes or deletes retained state, publishes, deploys, or installs a service.
+Codex Desktop visibility is a separate operator observation; deterministic tests
+use a fake SDK.