@fitlab-ai/agent-infra 0.11.10 → 0.11.12

package/lib/internal/codex-lifecycle.ts

@@ -1,390 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-
-import {
-  preflightCodexLifecycleEvidence,
-  resolveCodexTerminal,
-  resolveCodexThread
-} from '../agent-clients/adapters/codex-lifecycle/app-server.ts';
-import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.ts';
-import { createCodexCapabilityStore } from '../agent-clients/adapters/codex-lifecycle/capability-store.ts';
-import { computeLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
-import { verifyCodexSandboxControllerContextWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
-import type { CodexLifecycleEvent } from '../agent-clients/adapters/codex-lifecycle/evidence.ts';
-import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { hasSealableOrchestrationDelegation } from '../task/orchestration.ts';
-import {
-  activateCodexOrchestrationDelegation,
-  activateCodexSpawnDelegation,
-  reconcileCodexOrchestrationDelegation,
-  sealCodexOrchestrationDelegation,
-  sealCodexParentDelegation
-} from '../task/codex-orchestration.ts';
-import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
-
-const USAGE = 'Usage: agent-infra-internal codex-lifecycle <capability-arm|hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
-const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
-
-type Parsed = Readonly<{ operation: string; values: Readonly<Record<string, string>> }>;
-type UnresolvedHookChild = Omit<Extract<CodexLifecycleEvent, { type: 'hook-child' }>, 'parentThreadId'>;
-
-function output(value: unknown): void {
-  process.stdout.write(`${JSON.stringify(value)}\n`);
-}
-
-function failure(code: string, message: string): void {
-  output({ status: 'failed', changed: false, evidence: null, diagnostics: [], error: { code, message } });
-  process.exitCode = 1;
-}
-
-function outputBridgeResult(result: Awaited<ReturnType<typeof activateCodexOrchestrationDelegation>>): void {
-  if (result.error?.code === 'ORCHESTRATION_DELEGATION_MISSING') {
-    output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
-    return;
-  }
-  output(result);
-  if (result.status !== 'running') process.exitCode = 1;
-}
-
-function parse(args: string[]): Parsed | null {
-  if (args[0] === '--help' || args[0] === '-h') {
-    process.stdout.write(USAGE);
-    return null;
-  }
-  const operation = args[0];
-  if (!operation) {
-    failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', 'operation is required');
-    return null;
-  }
-  const allowed = {
-    'capability-arm': ['--task-id'],
-    'hook-event': ['--event', '--bridge'],
-    'resolve-start': ['--child-id'],
-    'resolve-stop': ['--child-id'],
-    preflight: ['--format', '--session-id', '--turn-id', '--tool-use-id'],
-    consume: ['--child-id', '--consumer']
-  }[operation];
-  if (!allowed) {
-    failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', 'unknown operation');
-    return null;
-  }
-  const values: Record<string, string> = {};
-  for (let index = 1; index < args.length; index += 1) {
-    const flag = args[index]!;
-    if (!allowed.includes(flag) || Object.hasOwn(values, flag)) {
-      failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
-      return null;
-    }
-    const value = args[++index];
-    if (!value || value.startsWith('--')) {
-      failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', `option '${flag}' requires a value`);
-      return null;
-    }
-    values[flag] = value;
-  }
-  return Object.freeze({ operation, values: Object.freeze(values) });
-}
-
-function cliVersion(): string {
-  const result = spawnSync('codex', ['--version'], { encoding: 'utf8' });
-  const version = /codex-cli\s+(\d+\.\d+\.\d+)/.exec(result.stdout ?? '')?.[1];
-  if (result.status !== 0 || !version) throw new Error('Codex CLI version is unavailable');
-  return version;
-}
-
-function hookDefinitionHash(): string {
-  const file = path.join(process.cwd(), '.codex', 'hooks.json');
-  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-}
-
-function controllerBinding(taskId: string) {
-  const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-  if (!contextPath) return undefined;
-  const context = verifyCodexSandboxControllerContextWithWarnings(contextPath, { repoRoot: process.cwd() }).context;
-  return {
-    instanceDigest: context.controllerInstanceDigest,
-    controlGeneration: context.controlGeneration
-  };
-}
-
-async function readStdin(): Promise<unknown> {
-  let input = '';
-  process.stdin.setEncoding('utf8');
-  for await (const chunk of process.stdin) {
-    input += chunk;
-    if (Buffer.byteLength(input) > 64 * 1024) throw new Error('Codex lifecycle input exceeds 64 KiB');
-  }
-  return JSON.parse(input || '{}') as unknown;
-}
-
-function recordFromPayload(phase: string, payload: unknown): CodexLifecycleEvent | UnresolvedHookChild | null {
-  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
-    throw new Error('Codex lifecycle hook payload must be an object');
-  }
-  const value = payload as Record<string, unknown>;
-  const text = (key: string) => typeof value[key] === 'string' ? value[key] as string : '';
-  if (!MANAGED_AGENT.test(text('nativeAgent'))) return null;
-  if (phase === 'pre-tool') return {
-    type: 'hook-spawn',
-    sessionId: text('sessionId'),
-    turnId: text('turnId'),
-    toolUseId: text('toolUseId'),
-    nativeAgent: text('nativeAgent'),
-    ...(text('requestedModel') ? { requestedModel: text('requestedModel') } : {}),
-    ...(text('requestedReasoningEffort') ? { requestedReasoningEffort: text('requestedReasoningEffort') } : {}),
-    hookDefinitionHash: text('hookDefinitionHash')
-  };
-  if (phase === 'subagent-start') return {
-    type: 'hook-child',
-    sessionId: text('sessionId'),
-    turnId: text('turnId'),
-    childThreadId: text('childThreadId'),
-    nativeAgent: text('nativeAgent'),
-    source: 'hook'
-  };
-  if (phase === 'subagent-stop') return {
-    type: 'hook-stop',
-    sessionId: text('sessionId'),
-    turnId: text('turnId'),
-    childThreadId: text('childThreadId'),
-    nativeAgent: text('nativeAgent')
-  };
-  if (phase === 'post-tool') return null;
-  throw new Error(`unknown Codex lifecycle hook phase '${phase}'`);
-}
-
-function payloadText(payload: unknown, key: string): string {
-  return payload && typeof payload === 'object' && !Array.isArray(payload)
-    && typeof (payload as Record<string, unknown>)[key] === 'string'
-    ? (payload as Record<string, string>)[key]!
-    : '';
-}
-
-async function codexLifecycle(args: string[] = []): Promise<void> {
-  if (!ensureInternalHandlerRoute('codex-lifecycle', args)) return;
-  const parsed = parse(args);
-  if (!parsed || process.exitCode) return;
-  try {
-    if (internalHandlerRoute('codex-lifecycle', 'preflight', parsed.operation)) {
-      const format = parsed.values['--format'] ?? 'json';
-      if (!['text', 'json'].includes(format)) throw new Error("format must be 'text' or 'json'");
-      const runtimeFields = [
-        parsed.values['--session-id'],
-        parsed.values['--turn-id'],
-        parsed.values['--tool-use-id']
-      ];
-      if (runtimeFields.some(Boolean) && !runtimeFields.every(Boolean)) {
-        throw new Error('preflight runtime identity requires --session-id, --turn-id, and --tool-use-id together');
-      }
-      const runtimeIdentity = runtimeFields.every(Boolean) ? {
-        sessionId: runtimeFields[0]!,
-        turnId: runtimeFields[1]!,
-        toolUseId: runtimeFields[2]!
-      } : undefined;
-      const result = await preflightCodexLifecycleEvidence(process.cwd(), runtimeIdentity);
-      if (format === 'text') {
-        process.stdout.write(`Codex lifecycle static preflight: ready\nCLI: ${result.cliVersion}\nRuntime hook liveness: ${result.runtimeLiveness ? 'observed' : 'not-yet-observed'}\n`);
-      } else output({ status: 'ready', changed: false, evidence: result, diagnostics: result.diagnostics, error: null });
-      return;
-    }
-
-    if (internalHandlerRoute('codex-lifecycle', 'capability-arm', parsed.operation)) {
-      const taskId = parsed.values['--task-id'];
-      if (!taskId) throw new Error('capability-arm requires --task-id');
-      const resolved = resolveTaskRef(taskId, { repoRoot: process.cwd() });
-      if (!resolved.ok) throw new Error(`${resolved.code}: ${resolved.message}`);
-      const armed = createCodexCapabilityStore().arm({
-        taskId: resolved.taskId,
-        buildIdentity: computeLifecycleBuildIdentity(process.cwd()),
-        controller: controllerBinding(resolved.taskId)
-      });
-      output({
-        status: 'armed',
-        changed: true,
-        capabilityRef: armed.capabilityRef,
-        marker: armed.marker,
-        expiresAt: armed.expiresAt,
-        buildIdentity: armed.buildIdentity,
-        error: null
-      });
-      return;
-    }
-
-    const store = createCodexLifecycleStore({ cliVersion: cliVersion() });
-    if (internalHandlerRoute('codex-lifecycle', 'hook-event', parsed.operation)) {
-      const phase = parsed.values['--event'];
-      if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
-        throw new Error('hook-event requires a known --event');
-      }
-      if (parsed.values['--bridge'] !== undefined && parsed.values['--bridge'] !== 'true') {
-        throw new Error("hook-event --bridge must be 'true'");
-      }
-      const payload = await readStdin();
-      if (phase === 'post-tool') {
-        const capabilityRef = payloadText(payload, 'capabilityRef');
-        if (capabilityRef) {
-          const capabilityStore = createCodexCapabilityStore();
-          const armed = capabilityStore.inspectReference(capabilityRef);
-          const capability = capabilityStore.attestByReference({
-            capabilityRef,
-            sessionId: payloadText(payload, 'sessionId'),
-            turnId: payloadText(payload, 'turnId'),
-            toolUseId: payloadText(payload, 'toolUseId'),
-            hookDefinitionHash: payloadText(payload, 'hookDefinitionHash'),
-            buildIdentity: computeLifecycleBuildIdentity(process.cwd()),
-            controller: controllerBinding(armed.taskId)
-          });
-          output({
-            status: capability.status,
-            changed: true,
-            evidence: {
-              revision: capability.revision,
-              sessionId: capability.sessionId,
-              turnId: capability.turnId,
-              toolUseId: capability.toolUseId,
-              expiresAt: capability.expiresAt
-            },
-            diagnostics: [],
-            error: null
-          });
-          return;
-        }
-      }
-      if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
-        const toolName = payloadText(payload, 'toolName');
-        if (toolName === 'collaborationspawn_agent') {
-          const nativeAgent = payloadText(payload, 'nativeAgent');
-          if (!MANAGED_AGENT.test(nativeAgent)) {
-            output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
-            return;
-          }
-          const requestedModel = payloadText(payload, 'requestedModel');
-          const requestedReasoningEffort = payloadText(payload, 'requestedReasoningEffort');
-          const bridged = await activateCodexSpawnDelegation({
-            sessionId: payloadText(payload, 'sessionId'),
-            turnId: payloadText(payload, 'turnId'),
-            toolUseId: payloadText(payload, 'toolUseId'),
-            transcriptPath: payloadText(payload, 'transcriptPath'),
-            nativeAgent,
-            taskName: payloadText(payload, 'taskName'),
-            ...(requestedModel ? { requestedModel } : {}),
-            ...(requestedReasoningEffort ? { requestedReasoningEffort } : {})
-          }, { store });
-          outputBridgeResult(bridged);
-          return;
-        }
-        if (toolName === 'collaborationwait_agent') {
-          outputBridgeResult(await sealCodexParentDelegation(payloadText(payload, 'sessionId'), { store }));
-          return;
-        }
-        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
-        return;
-      }
-      const event = recordFromPayload(phase, payload);
-      if (!event) {
-        if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
-          const value = payload as Record<string, unknown>;
-          const childThreadId = String(value.childThreadId ?? '');
-          const reconciled = reconcileCodexOrchestrationDelegation(childThreadId);
-          outputBridgeResult(reconciled);
-          return;
-        }
-        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
-        return;
-      }
-      if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
-        try {
-          if (store.read(event.childThreadId).consumer) {
-            const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
-            outputBridgeResult(bridged);
-            return;
-          }
-        } catch {
-          // The normal apply path below owns missing or invalid evidence errors.
-        }
-      }
-      if (parsed.values['--bridge'] === 'true' && event.type === 'hook-child') {
-        const resolved = await resolveCodexThread(event.childThreadId);
-        store.apply({
-          ...event,
-          parentThreadId: resolved.resolution.thread.parentThreadId
-        });
-        const bridged = await activateCodexOrchestrationDelegation(event.childThreadId, {
-          store,
-          resolveThread: async () => resolved
-        });
-        outputBridgeResult(bridged);
-        return;
-      }
-      if (event.type === 'hook-child') {
-        const resolved = await resolveCodexThread(event.childThreadId);
-        const result = store.apply({
-          ...event,
-          parentThreadId: resolved.resolution.thread.parentThreadId
-        });
-        output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: resolved.diagnostics, error: result.state.error });
-        if (result.state.status === 'invalid') process.exitCode = 1;
-        return;
-      }
-      const result = store.apply(event);
-      if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
-        if (!hasSealableOrchestrationDelegation('codex', event.childThreadId, { repoRoot: process.cwd() })) {
-          output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
-          return;
-        }
-        output({
-          status: result.state.status,
-          changed: true,
-          evidence: result.state,
-          diagnostics: [],
-          error: result.state.error
-        });
-        return;
-      }
-      output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: [], error: result.state.error });
-      if (result.state.status === 'invalid') process.exitCode = 1;
-      return;
-    }
-
-    const childThreadId = parsed.values['--child-id'];
-    if (!childThreadId) throw new Error(`operation '${parsed.operation}' requires --child-id`);
-    if (internalHandlerRoute('codex-lifecycle', 'resolve-start', parsed.operation)) {
-      if (store.read(childThreadId).state.spawn?.hookDefinitionHash !== hookDefinitionHash()) {
-        throw new Error('Codex lifecycle hook definition hash is stale');
-      }
-      const resolved = await resolveCodexThread(childThreadId);
-      let latest = store.apply(resolved.resolution.thread);
-      for (const reroute of resolved.reroutes) latest = store.apply(reroute);
-      latest = store.apply(resolved.resolution.settings);
-      output({ status: latest.state.status, changed: true, evidence: latest.state.startEvidence, diagnostics: resolved.diagnostics, error: latest.state.error });
-      if (latest.state.status !== 'start-ready') process.exitCode = 1;
-      return;
-    }
-    if (internalHandlerRoute('codex-lifecycle', 'resolve-stop', parsed.operation)) {
-      const stopTurnId = store.read(childThreadId).state.stop?.turnId;
-      if (!stopTurnId) throw new Error('Codex lifecycle stop hook is not available');
-      const terminal = await resolveCodexTerminal(childThreadId, stopTurnId);
-      const latest = store.apply(terminal);
-      if (latest.state.status !== 'stop-ready') {
-        throw new Error(`Codex lifecycle stop evidence is not ready (status=${latest.state.status})`);
-      }
-      output({ status: latest.state.status, changed: true, evidence: latest.state.stopEvidence, diagnostics: [], error: latest.state.error });
-      return;
-    }
-    if (internalHandlerRoute('codex-lifecycle', 'consume', parsed.operation)) {
-      const consumer = parsed.values['--consumer'];
-      if (!consumer) throw new Error('consume requires --consumer');
-      const consumed = store.consume(childThreadId, consumer, hookDefinitionHash());
-      output({ status: 'consumed', changed: true, evidence: {
-        start: consumed.state.startEvidence,
-        stop: consumed.state.stopEvidence
-      }, diagnostics: [], error: null });
-    }
-  } catch (error) {
-    failure('CODEX_LIFECYCLE_FAILED', error instanceof Error ? error.message : String(error));
-  }
-}
-
-export { codexLifecycle };

package/lib/task/codex-orchestration.ts

@@ -1,276 +0,0 @@
-import {
-  preflightCodexLifecycleEvidence,
-  resolveCodexSpawnedChild,
-  resolveCodexTerminal,
-  resolveCodexThread
-} from '../agent-clients/adapters/codex-lifecycle/app-server.ts';
-import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.ts';
-import {
-  computeLifecycleBuildIdentity,
-  type LifecycleBuildIdentity,
-} from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
-import type { AgentClientId } from '../agent-clients/types.ts';
-import { resolveTaskRef } from './resolve-ref.ts';
-import {
-  activateMatchingOrchestrationDelegation,
-  hasActivatableOrchestrationDelegation,
-  hasSealableOrchestrationDelegation,
-  OrchestrationStateError,
-  pauseMatchingOrchestrationDelegation,
-  prepareOrchestrationDelegation,
-  reconcileMatchingOrchestrationDelegation,
-  sealMatchingOrchestrationDelegationWithHostEvidence
-} from './orchestration.ts';
-import type { OrchestrationOptions, OrchestrationResult } from './orchestration.ts';
-
-type LifecycleStore = ReturnType<typeof createCodexLifecycleStore>;
-type CodexBridgeOptions = Readonly<{
-  repoRoot?: string;
-  store?: LifecycleStore;
-  preflight?: typeof preflightCodexLifecycleEvidence;
-  resolveThread?: typeof resolveCodexThread;
-  resolveTerminal?: typeof resolveCodexTerminal;
-  buildIdentity?: LifecycleBuildIdentity;
-  orchestrationOptions?: OrchestrationOptions;
-}>;
-
-type CodexSpawnIdentity = Readonly<{
-  sessionId: string;
-  turnId: string;
-  toolUseId: string;
-  transcriptPath: string;
-  nativeAgent: string;
-  taskName: string;
-  requestedModel?: string;
-  requestedReasoningEffort?: string;
-}>;
-
-function coreOptions(options: CodexBridgeOptions): OrchestrationOptions {
-  return { ...options.orchestrationOptions, repoRoot: options.repoRoot ?? options.orchestrationOptions?.repoRoot };
-}
-
-function bridgeFailure(code: string, message: string): OrchestrationResult {
-  return {
-    status: 'failed', changed: false, taskId: null, run: null, next: null,
-    error: { code, message }
-  };
-}
-
-function pauseBridge(code: string, message: string, options: CodexBridgeOptions): OrchestrationResult {
-  const paused = pauseMatchingOrchestrationDelegation('codex', code, message, coreOptions(options));
-  return paused.error?.code === 'ORCHESTRATION_DELEGATION_MISSING'
-    ? bridgeFailure(code, message)
-    : paused;
-}
-
-function requiredStore(options: CodexBridgeOptions): LifecycleStore {
-  if (!options.store) throw new Error('Codex lifecycle store is required for orchestration bridge events');
-  return options.store;
-}
-
-async function prepareCodexOrchestrationDelegation(
-  taskRef: string,
-  input: Readonly<{
-    client: AgentClientId;
-    requestedModel?: string;
-    requestedReasoningEffort?: string;
-  }>,
-  options: CodexBridgeOptions = {}
-): Promise<OrchestrationResult> {
-  if (input.client !== 'codex') return prepareOrchestrationDelegation(taskRef, input, coreOptions(options));
-  try {
-    const repoRoot = options.repoRoot ?? process.cwd();
-    const resolved = resolveTaskRef(taskRef, { repoRoot });
-    if (!resolved.ok) return bridgeFailure(resolved.code, resolved.message);
-    await (options.preflight ?? preflightCodexLifecycleEvidence)(repoRoot);
-    return prepareOrchestrationDelegation(taskRef, input, coreOptions(options));
-  } catch (error) {
-    if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
-    return bridgeFailure('ORCHESTRATION_CLIENT_PREFLIGHT_FAILED', error instanceof Error ? error.message : String(error));
-  }
-}
-
-async function activateCodexOrchestrationDelegation(
-  childThreadId: string,
-  options: CodexBridgeOptions = {}
-): Promise<OrchestrationResult> {
-  try {
-    if (!hasActivatableOrchestrationDelegation('codex', childThreadId, coreOptions(options))) {
-      return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'No matching Codex delegation is active');
-    }
-    const store = requiredStore(options);
-    const resolved = await (options.resolveThread ?? resolveCodexThread)(childThreadId);
-    store.apply(resolved.resolution.thread);
-    for (const reroute of resolved.reroutes) store.apply(reroute);
-    store.apply(resolved.resolution.settings);
-    const record = store.read(childThreadId);
-    const evidence = record.state.startEvidence;
-    if (record.state.status !== 'start-ready' || !evidence) {
-      return pauseBridge('ORCHESTRATION_CODEX_START_EVIDENCE_INVALID', 'Codex lifecycle start evidence is not ready', options);
-    }
-    const repoRoot = options.repoRoot ?? process.cwd();
-    const preflight = await (options.preflight ?? preflightCodexLifecycleEvidence)(repoRoot, {
-      sessionId: evidence.parentThreadId,
-      turnId: evidence.parentTurnId,
-      toolUseId: evidence.spawnToolUseId
-    });
-    const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
-    const activated = activateMatchingOrchestrationDelegation('codex', {
-      nativeAgent: evidence.nativeAgent,
-      childId: evidence.childThreadId,
-      parentId: evidence.parentThreadId,
-      spawnMode: evidence.spawnMode,
-      actualModel: evidence.actualModel.value,
-      actualReasoningEffort: evidence.actualReasoningEffort.value,
-      ...(evidence.modelFallbackReason ? { modelFallbackReason: evidence.modelFallbackReason } : {}),
-      ...(evidence.reasoningEffortFallbackReason
-        ? { reasoningEffortFallbackReason: evidence.reasoningEffortFallbackReason }
-        : {}),
-      hostEvidence: {
-        kind: 'codex-lifecycle-v2',
-        hookDefinitionHash: evidence.hookDefinitionHash,
-        startRevision: record.revision,
-        ...buildIdentity,
-        ...preflight.hookProvenance,
-        capabilitySessionId: evidence.parentThreadId,
-        capabilityTurnId: evidence.parentTurnId,
-        spawnToolUseId: evidence.spawnToolUseId,
-        spawnObservedAt: record.spawnObservedAt ?? undefined,
-        controllerInstanceDigest: null,
-        controlGeneration: null
-      }
-    }, coreOptions(options));
-    return activated;
-  } catch (error) {
-    if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
-    return pauseBridge('ORCHESTRATION_CODEX_START_FAILED', error instanceof Error ? error.message : String(error), options);
-  }
-}
-
-async function activateCodexSpawnDelegation(
-  spawn: CodexSpawnIdentity,
-  options: CodexBridgeOptions = {}
-): Promise<OrchestrationResult> {
-  try {
-    const store = requiredStore(options);
-    const childThreadId = resolveCodexSpawnedChild(spawn.transcriptPath, spawn);
-    const resolved = await (options.resolveThread ?? resolveCodexThread)(childThreadId);
-    store.applyToSpawn(spawn, {
-      type: 'hook-child',
-      sessionId: spawn.sessionId,
-      turnId: spawn.turnId,
-      childThreadId,
-      parentThreadId: resolved.resolution.thread.parentThreadId,
-      nativeAgent: spawn.nativeAgent,
-      source: 'parent-rollout'
-    });
-    return activateCodexOrchestrationDelegation(childThreadId, {
-      ...options,
-      store,
-      resolveThread: async () => resolved
-    });
-  } catch (error) {
-    if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
-    return pauseBridge('ORCHESTRATION_CODEX_START_FAILED', error instanceof Error ? error.message : String(error), options);
-  }
-}
-
-async function sealCodexOrchestrationDelegation(
-  childThreadId: string,
-  options: CodexBridgeOptions = {}
-): Promise<OrchestrationResult> {
-  try {
-    if (!hasSealableOrchestrationDelegation('codex', childThreadId, coreOptions(options))) {
-      return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'No matching Codex delegation is active');
-    }
-    const store = requiredStore(options);
-    const existing = store.read(childThreadId);
-    if (!existing.consumer) {
-      const stopTurnId = existing.state.stop?.turnId;
-      if (!stopTurnId) {
-        return pauseBridge('ORCHESTRATION_CODEX_STOP_EVIDENCE_INVALID', 'Codex lifecycle stop hook is not available', options);
-      }
-      store.apply(await (options.resolveTerminal ?? resolveCodexTerminal)(childThreadId, stopTurnId));
-    }
-    const record = store.read(childThreadId);
-    const evidence = record.state.stopEvidence;
-    if (record.state.status !== 'stop-ready' || !evidence || !record.state.startEvidence) {
-      return pauseBridge('ORCHESTRATION_CODEX_STOP_EVIDENCE_INVALID', 'Codex lifecycle stop evidence is not ready', options);
-    }
-    return sealMatchingOrchestrationDelegationWithHostEvidence(
-      'codex',
-      { nativeAgent: record.state.startEvidence.nativeAgent, childId: childThreadId },
-      (receipt) => {
-        const consumed = store.consume(childThreadId, receipt.id, receipt.hostEvidence?.hookDefinitionHash);
-        return {
-          stopRevision: consumed.revision,
-          consumer: consumed.consumer!,
-          consumedAt: consumed.consumedAt!
-        };
-      },
-      coreOptions(options)
-    );
-  } catch (error) {
-    if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
-    return pauseBridge('ORCHESTRATION_CODEX_STOP_FAILED', error instanceof Error ? error.message : String(error), options);
-  }
-}
-
-async function sealCodexParentDelegation(
-  parentThreadId: string,
-  options: CodexBridgeOptions = {}
-): Promise<OrchestrationResult> {
-  try {
-    const store = requiredStore(options);
-    const candidates = store.findByParent(parentThreadId);
-    if (!candidates.length) return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'No matching Codex delegation is active');
-    for (const consumed of candidates.filter((record) => record.consumer)) {
-      const replayed = await sealCodexOrchestrationDelegation(consumed.state.startEvidence!.childThreadId, options);
-      if (replayed.error?.code !== 'ORCHESTRATION_DELEGATION_MISSING') return replayed;
-    }
-    const active = candidates.find((record) => !record.consumer);
-    if (!active) return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'No matching Codex delegation is active');
-    const start = active.state.startEvidence!;
-    const child = active.state.child!;
-    if (!active.state.terminal) {
-      const resolveTerminal = options.resolveTerminal ?? resolveCodexTerminal;
-      store.apply(active.state.stop
-        ? await resolveTerminal(start.childThreadId, active.state.stop.turnId)
-        : await resolveTerminal(start.childThreadId));
-    }
-    if (!store.read(start.childThreadId).state.stop) {
-      store.apply({
-        type: 'hook-stop',
-        sessionId: parentThreadId,
-        turnId: child.turnId,
-        childThreadId: start.childThreadId,
-        nativeAgent: start.nativeAgent,
-        source: 'parent-rollout'
-      });
-    }
-    return sealCodexOrchestrationDelegation(start.childThreadId, options);
-  } catch (error) {
-    if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
-    if (error instanceof Error && error.message === 'CODEX_TURN_NOT_TERMINAL') {
-      return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'The matching Codex child has not completed');
-    }
-    return pauseBridge('ORCHESTRATION_CODEX_STOP_FAILED', error instanceof Error ? error.message : String(error), options);
-  }
-}
-
-function reconcileCodexOrchestrationDelegation(
-  childThreadId: string,
-  options: CodexBridgeOptions = {}
-): OrchestrationResult {
-  return reconcileMatchingOrchestrationDelegation('codex', childThreadId, coreOptions(options));
-}
-
-export {
-  activateCodexOrchestrationDelegation,
-  activateCodexSpawnDelegation,
-  prepareCodexOrchestrationDelegation,
-  reconcileCodexOrchestrationDelegation,
-  sealCodexParentDelegation,
-  sealCodexOrchestrationDelegation
-};
-export type { CodexBridgeOptions };