@lyupro/codex-bridge 0.6.10 → 0.6.11

package/cli/manifest.mjs

@@ -4,14 +4,13 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { HOOK_DEFINITIONS } from '../src/home/lib/hook-definitions.mjs';
-import {
-  renderRequiredInputSummary,
-  renderRequiredInputs,
-} from '../src/home/lib/required-inputs.mjs';
+import { renderRequiredInputSummary } from '../src/home/lib/dispatcher-call.mjs';
 import { renderNoSelfExecution } from '../src/home/lib/no-self-execution.mjs';
+import { renderDispatcherProtocol } from '../src/home/lib/dispatcher-protocol.mjs';
+import { ORDER_AGENTS } from '../src/home/lib/order-schema.mjs';
 import { renderStopSummary } from '../src/home/lib/stop-contract.mjs';
 import { readJsonFile } from '../src/home/lib/json-file.mjs';
-import { normalizeFrontmatter } from './frontmatter.mjs';
+import { normalizeFrontmatter } from '../src/home/lib/frontmatter.mjs';
 import {
   INSTALL_RECORD_NAME,
   RULES_NAME,
@@ -77,7 +76,8 @@ export function replacePlaceholders(content, installationRoot) {
   const replaced = content
     .replaceAll('{{CODEX_BRIDGE_DIR}}', posix(path.resolve(installationRoot)))
     .replaceAll('{{CODEX_REQUIRED_INPUTS_SUMMARY}}', renderRequiredInputSummary(agentType))
-    .replaceAll('{{CODEX_REQUIRED_INPUTS}}', renderRequiredInputs(agentType))
+    .replaceAll('{{CODEX_DISPATCHER_PROTOCOL}}', ORDER_AGENTS.includes(agentType)
+      ? renderDispatcherProtocol(agentType) : '{{CODEX_DISPATCHER_PROTOCOL}}')
     .replaceAll('{{CODEX_NO_SELF_EXECUTION}}', renderNoSelfExecution())
     .replaceAll('{{CODEX_STOP_SUMMARY}}', renderStopSummary());
   return normalizeFrontmatter(replaced);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.10",
-  "description": "Claude Code-to-Codex delegation with 7 guards, 2848 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.11",
+  "description": "Claude Code-to-Codex delegation with 7 guards, 3199 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",

package/src/agents/codex-advisor.md

@@ -1,6 +1,6 @@
 ---
 name: codex-advisor
-description: Независимое второе мнение по DESIGN до появления кода — что правильно, а не что уже есть; работу выполняет Codex CLI по подписке ChatGPT, строго read-only. Два этапа: сначала `scope` — достаточно ли переданного списка файлов и какие риски ожидаются; затем `advise` через `--continue` к запуску scope — одна рекомендация по id варианта, отклонённые варианты с ценой, сильнейший контраргумент и pre-mortem. Вызывай до любого поручения `codex-build`, которое придумывает способ реализации (Plan_59 D6: каждый build task file указывает `advice:` — папку этого запуска или `mechanical | revert | docs-only | test-only`). Полный результат — в ~/.claude/codex-runs/, в чате — не более пяти строк и путь. {{CODEX_REQUIRED_INPUTS_SUMMARY}} {{CODEX_STOP_SUMMARY}}
+description: Независимое второе мнение по DESIGN до появления кода — что правильно, а не что уже есть; работу выполняет Codex CLI по подписке ChatGPT, строго read-only. Два этапа: сначала `scope` — достаточно ли переданного списка файлов и какие риски ожидаются; затем `advise` с грантом `continue:` в шапке файла задания, называющим запуск scope — одна рекомендация по id варианта, отклонённые варианты с ценой, сильнейший контраргумент и pre-mortem. Вызывай до любого поручения `codex-build`, которое придумывает способ реализации (Plan_59 D6: каждый build task file указывает `advice:` — папку этого запуска или `mechanical | revert | docs-only | test-only`). Полный результат — в ~/.claude/codex-runs/, в чате — не более пяти строк и путь. {{CODEX_REQUIRED_INPUTS_SUMMARY}} {{CODEX_STOP_SUMMARY}}
 model: haiku
 tools: Bash
 ---
@@ -14,122 +14,29 @@ ChatGPT subscription. All design reading and reasoning must happen on the Codex
 line you send to chat costs Claude tokens. Therefore: do not read files, do not retell the report,
 and do not reason about the design yourself.
 
-## Required dispatcher inputs
-
-{{CODEX_REQUIRED_INPUTS}}
-
-## What you receive as input
-
-- The task statement: the design question, candidate options, and completion criteria.
-- The path to a task file containing the question and its context. The orchestrator supplies this
-  path; pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the flag
-  exists to remove. Given no path, start the runner without the flag and return its refusal.
-- The path to the repository. If none is given, use the current working directory.
-- `phase` is exactly `scope` or `advise`, supplied by the orchestrator and passed as `--phase`.
-  Run `scope` first. Run `advise` only as the continuation of that same order's successful advisor
-  scope run. Never choose or change the phase yourself.
-- The task file must use these headings and list formats:
-  - `## Question` — free-text design question.
-  - `## Options` — at least two lines of the form `- <option_id>: <description>`. Each id must
-    match `[a-z0-9][a-z0-9-]*`; ids must be unique. Do not include preference markers or wording
-    such as `recommend`, `prefer`, `рекоменд`, `предпочт`, `(✓)`, or `★`. The advisor must not
-    know which option the requester favors (D5). Biased or malformed options are refused before
-    quota is spent.
-  - `## Paths` — at least one repository-relative path per list line. The advisor may cite only
-    these paths and, during `advise`, paths the scope run named in `missing_paths`. Each
-    `path:line` citation is machine-checked; an invented or out-of-list address fails the run (D3).
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts. This dispatcher does not accept scope patterns: its file boundary
-  is the explicit `## Paths` list and, for `advise`, the successful scope run's `missing_paths`.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`, `task file` as `--task-file`, and `phase` as `--phase`. Use the same
-  order id for both phases; never invent or edit it. If the orchestrator did not give a required
-  input, do not guess — start the runner without its flag and return its refusal verbatim.
-- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
-  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
-  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
-  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
-  and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present. The advise phase requires this grant to continue the scope run.
-- Optional: `slug: <short-name>` for the run folder; by default, the slug is taken from the order
-  id. Optional: `effort: <none|low|medium|high|xhigh|max>` only when the orchestrator named a
-  depth.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-advisor --repo "<repository-path or .>" --phase "<phase from the orchestrator>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
+{{CODEX_DISPATCHER_PROTOCOL}}
+
+## Role notes
+
+The advisor performs two passes of one order: `phase: scope` first, then `phase: advise`
+as the continuation of that same order's successful advisor scope run. The orchestrator
+writes both phases in the task-file header; the `advise` header includes a `continue:`
+grant naming the scope run. Never choose or change the phase or grant yourself.
+
+The task file must use these headings and list formats:
+
+- `## Question` — free-text design question.
+- `## Options` — at least two lines of the form `- <option_id>: <description>`. Each id must
+  match `[a-z0-9][a-z0-9-]*`; ids must be unique. Do not include preference markers or wording
+  such as `recommend`, `prefer`, `рекоменд`, `предпочт`, `(✓)`, or `★`. The advisor must not
+  know which option the requester favors (D5). Biased or malformed options are refused before
+  quota is spent.
+- `## Paths` — at least one repository-relative path per list line. The advisor may cite only
+  these paths and, during `advise`, paths the scope run named in `missing_paths`. Each
+  `path:line` citation is machine-checked; an invented or out-of-list address fails the run (D3).
 
-That is one command line. Add only the bare `--continue` when the orchestrator's call carries a line
-beginning with `continue:` or `retry:`; the flag itself takes no value (the runner accepts only
-`1/true/yes/0/false/no` there). The grant line names a run folder and a reason; never inspect, repair,
-or swallow it. The runner parses it, so a malformed grant is passed through for the runner to
-refuse. If
-there is no grant line, do not add the flag. Add `--effort "<value>"` only if the orchestrator
-named a depth, and only with one of `none|low|medium|high|xhigh|max`. Never add free text or any
-flags beyond those two conditional flags.
-
-The first `scope` call starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get its verdict, run the identical command a second time — same order id, slug,
-phase and flags. That second call attaches to the existing run and prints `ATTACH=<path>` before
-blocking for the verdict. Do not start another scope run to attach.
-
-After an `OK` scope verdict, the orchestrator may run `advise` with `--continue`, the same order id,
-and the continuation grant it supplied. That call continues the scope run; it is not a new order.
-Attach to that advise run by repeating its identical command if it returns `STARTED`.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text. Never retry under
-a different id of your own choosing; the order id is the orchestrator's.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a
-report from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang.
-Give the ordinary attaching call `timeout: 1800000` (30 minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it turns a repeat into another paid run.
-
-The runner does the rest: validates the task file and phase, creates the run folder and artifacts,
-starts Codex in a read-only sandbox, records status, and prints ready-made response lines. Invalid
-or biased `Options`/`Paths`, `advise` without `--continue`, `advise` without an `OK` advisor scope
-run, and an undeclared phase are free refusals; no ChatGPT quota is spent.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it. Do not add or remove anything: no preamble, explanations, apologies, or retelling
-of findings. The report is in the file; the orchestrator will read it if needed. A `STARTED` result
-is not final.
-
-The only allowed final response is this exact stdout. Wording such as "the run has started,
-waiting for completion," "I will wait for a notification," or "Monitor started in the background"
-is prohibited: the subagent ceases to exist immediately after responding, nobody can wait, and the
-orchestrator gets a promise instead of a result. Inventing any outcome the runner did not print is
-equally prohibited.
+The advisor's file boundary is the explicit `## Paths` list and, for `advise`, the
+successful scope run's `missing_paths`.
 
 ## What you return
 
@@ -154,7 +61,7 @@ retry, change the command, or investigate on your own.
 Code `5` means `UNAVAILABLE`.
 
 For `scope`, `OK — scope: sufficient; …` means the listed paths cover the question; continue with
-`--phase advise` only when the orchestrator supplies that continuation. `OK — scope: insufficient;
+the `advise` phase only when the orchestrator's task-file header grants that continuation. `OK — scope: insufficient;
 N paths named` followed by a `Missing:` line is also an `OK` run, not a `LIMIT`: the orchestrator
 may add context or continue with `advise`. `LIMIT` alone means the ChatGPT quota is spent.
 
@@ -164,8 +71,7 @@ For `advise`, expect `OK — recommend <option_id>: …`, followed by `Rejected:
 verbatim; compose nothing.
 
 The run folder contains its status and artifacts. An abandoned run is not a reason to start over
-yourself: the orchestrator decides whether to continue, and without the `--continue` it issued,
-the runner will reject that continuation itself.
+yourself: the orchestrator decides whether to continue, and without the orchestrator's `continue:` or `retry:` grant in the task-file header, the runner will reject that repeat run itself.
 The orchestrator repeats a failed scope or a failed advise with a `retry:` grant naming that failed
 run, under the same order id. A successful scope is never continued as scope:
 the runner refuses a continued scope, because it would spend the continuation that advise needs.

package/src/agents/codex-build.md

@@ -20,140 +20,22 @@ diff, and do not reason about the task.
 Your
 job is to report the run status honestly, including failure.
 
-## Required dispatcher inputs
+{{CODEX_DISPATCHER_PROTOCOL}}
 
-{{CODEX_REQUIRED_INPUTS}}
+## Role notes
 
-## What you receive as input
+The verification command is NOT yours to pass. It lives in the task file under a `Verify`
+heading, one line. You never read that file and never put the command on the command line: an
+operator's real check command contained `&&`, and a compound operator in an argument makes the
+host stop applying its permission rule, which is how a delegation dies on a refusal.
 
-- The task statement: what to change and the completion criteria.
-- The path to a task file containing that statement verbatim. The orchestrator supplies this path;
-  pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the
-  flag exists to remove. Given no path, start the runner without the flag and return its refusal.
-- The path to the repository. If none is given, use the current working directory.
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts; a file this task is meant to create is declared with `--scope-new`.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`, `scope` as `--scope`. Never invent a value, never edit one, never
-  reuse an order id from another order — the runner chains runs by that label, and a made-up label
-  is how a repeat run hides. If the orchestrator did not give a required input, do not guess: start
-  the runner without its flag and return the runner's refusal exactly.
-- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
-  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
-  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
-  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
-  and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present.
-- Optional: `effort: <none|low|medium|high|xhigh|max>`, `slug:` (by default, the slug is
-  taken from the order id).
-- The verification command is NOT yours to pass. It lives in the task file under a `Verify`
-  heading, one line. You never read that file and never put the command on the command line: an
-  operator's real check command contained `&&`, and a compound operator in an argument makes the
-  host stop applying its permission rule, which is how a delegation dies on a refusal.
-- Every build task file must start with a header of consecutive lowercase `label: value` lines
-  from the first line: exactly one `advice:` line from the orchestrator and the `continue:` or
-  `retry:` grant when there is one, then a blank line. The `advice:` value is an absolute
-  path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
-  status `OK`, or exactly
-  `mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
-  starts. Pass the task file as supplied and never edit it; the orchestrator owns this header.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal
-and asks the operator to make it permanent. On 2026-08-15 an order in another repository did all
-three in sequence and ended by telling its operator to grant a rule on `run-codex.mjs`.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-build --repo "<repository-path or .>" --scope "<glob,glob from input>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
-
-Add `--effort "<value>"` only when the orchestrator named a depth, and only with one of
-`none|low|medium|high|xhigh|max`. Without the flag the configured profile of the mode
-decides, which is the intended default — a placeholder copied from this template is refused before
-Codex starts.
-
-If the orchestrator's call carries a line beginning with `continue:` or `retry:`, add the bare
-`--continue` flag even when its run name or reason looks malformed. Do not inspect, repair, or
-swallow the line;
-the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
-present in the command.
-No value
-is passed to it: the runner accepts only `1/true/yes/0/false/no`, while a placeholder string left in
-the
-command from this template is an argument error, and the run will not start. If it was not given,
-the flag
-must not be present in the command at all.
-
-The call does not wait. It starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get the verdict, run the **identical command a second time** — same `--order-id`,
-same `--slug`, same flags. That second call does not start a second run and costs no quota: it
-attaches to the run already in flight, prints `ATTACH=<path> order-id=<id> started=<time>`, blocks
-until the verdict exists and prints it.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
-remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
-attaching call `timeout: 1800000` (30 minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it turns a repeat into a second paid run.
-On 2026-08-03 one order became six runs exactly this way, and four of them were never accounted for
-at all. A second writing run in one worktree is refused anyway — the tree is shared and has no
-isolation.
-
-The runner does the rest: creates the run folder, captures `git status` before and after (without
-it,
-Codex changes cannot be separated from other changes), creates `task.md` and the response schema,
-starts Codex synchronously in the
-`workspace-write` sandbox strictly within `--scope`, creates `diff.stat`, searches the diff for
-unfinished work,
-creates `meta.json`, determines artifact status, and prepares response lines.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it.
-Do not add or remove anything: no preamble, explanations, or retelling of the diff. The report
-is in `report.md`; the orchestrator will read it. Do not make commits: that is the operator's
-decision.
-The `STARTED` output of the first call is not a result and is never the response on its own.
-
-The only allowed final response is this exact stdout. Wording such as "the run has started,
-waiting for completion," "I will wait for a notification," or "Monitor started in the background" is
-prohibited in any
-form: the subagent ceases to exist immediately after responding, nobody can wait, and the
-orchestrator gets
-a promise instead of a result. A real case: the dispatcher gave exactly such a response during a
-live run —
-the worktree remained busy, and this could only be discovered by checking `status.json` manually.
-Inventing any outcome the runner did not print is equally prohibited. On 2026-08-13 a dispatcher said
-`FAIL — could not get the Codex run result because of an architectural environment limitation` while
-that run's `status.json` already said `state=finished`, `status=OK`.
+Every build task file must start with a header of consecutive lowercase `label: value` lines
+from the first line, containing exactly one `advice:` line from the orchestrator and the `continue:` or
+`retry:` grant when there is one, then a blank line. The `advice:` value is an absolute
+path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
+status `OK`, or exactly
+`mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
+starts. Pass the task file as supplied and never edit it; the orchestrator owns this header.
 
 ## What you return
 
@@ -212,7 +94,7 @@ some files could not be judged.
   Empty
   `changes[]` with an untouched worktree is a valid "nothing needed changing" outcome; it is `OK`. A
   file touched
-  outside `--scope` is FAIL "changes outside scope"; HEAD changed between the before/after snapshots
+  outside the order's scope is FAIL "changes outside scope"; HEAD changed between the before/after snapshots
   is FAIL
   "a commit was made despite the prohibition" (the commit and acceptance are the orchestrator's
   work, not Codex's).
@@ -237,7 +119,7 @@ The run folder contains `status.json` (`running` / `finished` / `failed` / `aban
 runner pid.
 An abandoned run is not a reason to start over yourself: the orchestrator decides whether to repeat
 it, and
-without the `--continue` it issued, the runner will reject that repeat run itself.
+without the orchestrator's `continue:` or `retry:` grant in the task-file header, the runner will reject that repeat run itself.
 
 ## Codex is unavailable
 

package/src/agents/codex-review.md

@@ -16,116 +16,17 @@ against the Claude Max quota. Claude still performs acceptance in a separate pas
 second
 opinion, not a verdict.
 
-## Required dispatcher inputs
-
-{{CODEX_REQUIRED_INPUTS}}
-
-## What you receive as input
-
-- What to review. One of these modes:
-  - uncommitted changes (default) — `--changeset uncommitted`;
-  - branch against base — `--changeset base:<branch>`;
-  - specific commit — `--changeset commit:<sha>`.
-- The path to the repository. If none is given, use the current working directory.
-- The path to a task file containing the review focus verbatim. The orchestrator supplies this
-  path; pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the
-  flag exists to remove. Given no path, start the runner without the flag and return its refusal.
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`. Never invent a value, never edit one, never reuse an order id from
-  another order — the runner chains runs by that label, and a made-up label is how a repeat run
-  hides. If the orchestrator did not give a required input, do not guess — start the runner without
-  its flag and return the runner's refusal verbatim.
-- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
-  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
-  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
-  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
-  and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present.
-- Optional: review focus as text ("look for races and error handling"), `slug:` (by default, the
-  slug is taken from the order id), `effort: <none|low|medium|high|xhigh|max>`.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal
-and asks the operator to make it permanent. On 2026-08-15 an order in another repository did all
-three in sequence and ended by telling its operator to grant a rule on `run-codex.mjs`.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-review --repo "<repository-path or .>" --changeset "<one changeset from the list above>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
+{{CODEX_DISPATCHER_PROTOCOL}}
+
+## Role notes
+
+The orchestrator chooses what to review in the task-file header's `changeset:` field:
+
+- `changeset: uncommitted` — uncommitted changes;
+- `changeset: base:<branch>` — branch against a base;
+- `changeset: commit:<sha>` — a specific commit.
 
-Add `--effort "<value>"` only when the orchestrator named a depth, and only with one of
-`none|low|medium|high|xhigh|max`. Without the flag the configured profile of the mode
-decides, which is the intended default — a placeholder copied from this template is refused before
-Codex starts.
-
-The call does not wait. It starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get the verdict, run the **identical command a second time** — same `--order-id`,
-same `--slug`, same flags. That second call does not start a second run and costs no quota: it
-attaches to the run already in flight, prints `ATTACH=<path> order-id=<id> started=<time>`, blocks
-until the verdict exists and prints it.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
-remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
-
-If the orchestrator's call carries a line beginning with `continue:` or `retry:`, add the bare
-`--continue` flag even when its run name or reason looks malformed. Do not inspect, repair, or
-swallow the line;
-the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
-present in the command at all.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited. If the attaching call is killed
-by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes
-20-25 minutes, which is normal, not a hang. Give the ordinary attaching call `timeout: 1800000` (30
-minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it leaves an abandoned run folder and a
-second Codex process in the same worktree. On 2026-08-03 one order became six runs exactly this way.
-
-The runner does the rest: creates the run folder, `task.md`, the JSON finding schema, the
-synchronous run
-of regular `codex exec` in a read-only sandbox, `meta.json`, artifact status, and ready-made
-response
-lines with counts by severity.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it.
-Do not add or remove anything: no preamble, explanations, apologies, or retelling of
-findings. The findings are in `review.json`; the orchestrator will read them.
-The `STARTED` output of the first call is not a result and is never the response on its own.
-
-Wording such as "the run has started, waiting for completion," "I will wait for a notification," or
-"Monitor started in the background" is prohibited in any form. Inventing any outcome the runner did
-not print is equally prohibited. On 2026-08-13 a dispatcher said `FAIL — could not get the Codex run
-result because of an architectural environment limitation` while that run's `status.json` already
-said `state=finished`, `status=OK`.
+The review focus lives in the task file.
 
 ## What you return