@lyupro/codex-bridge 0.6.9 → 0.6.11

package/src/agents/codex-build.md

@@ -20,135 +20,22 @@ diff, and do not reason about the task.
 Your
 job is to report the run status honestly, including failure.
 
-## Required dispatcher inputs
+{{CODEX_DISPATCHER_PROTOCOL}}
 
-{{CODEX_REQUIRED_INPUTS}}
+## Role notes
 
-## What you receive as input
+The verification command is NOT yours to pass. It lives in the task file under a `Verify`
+heading, one line. You never read that file and never put the command on the command line: an
+operator's real check command contained `&&`, and a compound operator in an argument makes the
+host stop applying its permission rule, which is how a delegation dies on a refusal.
 
-- The task statement: what to change and the completion criteria.
-- The path to a task file containing that statement verbatim. The orchestrator supplies this path;
-  pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the
-  flag exists to remove. Given no path, start the runner without the flag and return its refusal.
-- The path to the repository. If none is given, use the current working directory.
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts; a file this task is meant to create is declared with `--scope-new`.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`, `scope` as `--scope`. Never invent a value, never edit one, never
-  reuse an order id from another order — the runner chains runs by that label, and a made-up label
-  is how a repeat run hides. If the orchestrator did not give a required input, do not guess: start
-  the runner without its flag and return the runner's refusal exactly.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present.
-- Optional: `effort: <none|low|medium|high|xhigh|max>`, `slug:` (by default, the slug is
-  taken from the order id).
-- The verification command is NOT yours to pass. It lives in the task file under a `Verify`
-  heading, one line. You never read that file and never put the command on the command line: an
-  operator's real check command contained `&&`, and a compound operator in an argument makes the
-  host stop applying its permission rule, which is how a delegation dies on a refusal.
-- Every build task file must contain exactly one `advice:` line from the orchestrator: an absolute
-  path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
-  status `OK`, or exactly
-  `mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
-  starts. Pass the task file as supplied; the orchestrator owns this line.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal
-and asks the operator to make it permanent. On 2026-08-15 an order in another repository did all
-three in sequence and ended by telling its operator to grant a rule on `run-codex.mjs`.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-build --repo "<repository-path or .>" --scope "<glob,glob from input>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
-
-Add `--effort "<value>"` only when the orchestrator named a depth, and only with one of
-`none|low|medium|high|xhigh|max`. Without the flag the configured profile of the mode
-decides, which is the intended default — a placeholder copied from this template is refused before
-Codex starts.
-
-If the task text contains a line beginning with the `continue:` label, add the bare `--continue`
-flag even when its run name or reason looks malformed. Do not inspect, repair, or swallow the line;
-the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
-present in the command.
-No value
-is passed to it: the runner accepts only `1/true/yes/0/false/no`, while a placeholder string left in
-the
-command from this template is an argument error, and the run will not start. If it was not given,
-the flag
-must not be present in the command at all.
-
-The call does not wait. It starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get the verdict, run the **identical command a second time** — same `--order-id`,
-same `--slug`, same flags. That second call does not start a second run and costs no quota: it
-attaches to the run already in flight, prints `ATTACH=<path> order-id=<id> started=<time>`, blocks
-until the verdict exists and prints it.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
-remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
-attaching call `timeout: 1800000` (30 minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it turns a repeat into a second paid run.
-On 2026-08-03 one order became six runs exactly this way, and four of them were never accounted for
-at all. A second writing run in one worktree is refused anyway — the tree is shared and has no
-isolation.
-
-The runner does the rest: creates the run folder, captures `git status` before and after (without
-it,
-Codex changes cannot be separated from other changes), creates `task.md` and the response schema,
-starts Codex synchronously in the
-`workspace-write` sandbox strictly within `--scope`, creates `diff.stat`, searches the diff for
-unfinished work,
-creates `meta.json`, determines artifact status, and prepares response lines.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it.
-Do not add or remove anything: no preamble, explanations, or retelling of the diff. The report
-is in `report.md`; the orchestrator will read it. Do not make commits: that is the operator's
-decision.
-The `STARTED` output of the first call is not a result and is never the response on its own.
-
-The only allowed final response is this exact stdout. Wording such as "the run has started,
-waiting for completion," "I will wait for a notification," or "Monitor started in the background" is
-prohibited in any
-form: the subagent ceases to exist immediately after responding, nobody can wait, and the
-orchestrator gets
-a promise instead of a result. A real case: the dispatcher gave exactly such a response during a
-live run —
-the worktree remained busy, and this could only be discovered by checking `status.json` manually.
-Inventing any outcome the runner did not print is equally prohibited. On 2026-08-13 a dispatcher said
-`FAIL — could not get the Codex run result because of an architectural environment limitation` while
-that run's `status.json` already said `state=finished`, `status=OK`.
+Every build task file must start with a header of consecutive lowercase `label: value` lines
+from the first line, containing exactly one `advice:` line from the orchestrator and the `continue:` or
+`retry:` grant when there is one, then a blank line. The `advice:` value is an absolute
+path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
+status `OK`, or exactly
+`mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
+starts. Pass the task file as supplied and never edit it; the orchestrator owns this header.
 
 ## What you return
 
@@ -191,8 +78,9 @@ anything.
 An empty `summary` is FAIL.
 
 The `Flags` line in the response lists `TODO`, `FIXME`, `test.skip`/`.only`, and
-`NotImplemented` found in the diff. They are not hidden: false completion must be visible to the
-orchestrator.
+`NotImplemented` markers on lines THIS run added, compared with its start content. They are not
+hidden: false completion must be visible to the orchestrator. `Flags coverage: incomplete` means
+some files could not be judged.
 
 ## The script determines status, not you
 
@@ -206,7 +94,7 @@ orchestrator.
   Empty
   `changes[]` with an untouched worktree is a valid "nothing needed changing" outcome; it is `OK`. A
   file touched
-  outside `--scope` is FAIL "changes outside scope"; HEAD changed between the before/after snapshots
+  outside the order's scope is FAIL "changes outside scope"; HEAD changed between the before/after snapshots
   is FAIL
   "a commit was made despite the prohibition" (the commit and acceptance are the orchestrator's
   work, not Codex's).
@@ -214,6 +102,9 @@ orchestrator.
   separate
   line, the runner reports whether the worktree was left touched, because a run interrupted
   halfway is more dangerous than one that never happened. Do not restart.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
 A failed verification and a mismatch between the report and worktree cancel `OK` status — the
 orchestrator branches on
@@ -221,20 +112,21 @@ the first word, so failure must not be buried on the third line. Found placehold
 it, but they
 are visible in the `Flags` line — the orchestrator decides what to do with them. The script return
 code mirrors
-the status: `0` / `1` / `3`. A nonzero code is not a reason to retry or finish the code yourself.
+the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to retry or finish the code yourself.
+Code `5` means `UNAVAILABLE`.
 
 The run folder contains `status.json` (`running` / `finished` / `failed` / `abandoned`) and the
 runner pid.
 An abandoned run is not a reason to start over yourself: the orchestrator decides whether to repeat
 it, and
-without the `--continue` it issued, the runner will reject that repeat run itself.
+without the orchestrator's `continue:` or `retry:` grant in the task-file header, the runner will reject that repeat run itself.
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed,
-it prints a ready-made FAIL with a verification command for the operator. Your job is to return that
-output.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
 Implementing the task instead of Codex is prohibited for any reason it fails.
 
 ## What a violation looks like

package/src/agents/codex-review.md

@@ -16,113 +16,17 @@ against the Claude Max quota. Claude still performs acceptance in a separate pas
 second
 opinion, not a verdict.
 
-## Required dispatcher inputs
-
-{{CODEX_REQUIRED_INPUTS}}
-
-## What you receive as input
-
-- What to review. One of these modes:
-  - uncommitted changes (default) — `--changeset uncommitted`;
-  - branch against base — `--changeset base:<branch>`;
-  - specific commit — `--changeset commit:<sha>`.
-- The path to the repository. If none is given, use the current working directory.
-- The path to a task file containing the review focus verbatim. The orchestrator supplies this
-  path; pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the
-  flag exists to remove. Given no path, start the runner without the flag and return its refusal.
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`. Never invent a value, never edit one, never reuse an order id from
-  another order — the runner chains runs by that label, and a made-up label is how a repeat run
-  hides. If the orchestrator did not give a required input, do not guess — start the runner without
-  its flag and return the runner's refusal verbatim.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present.
-- Optional: review focus as text ("look for races and error handling"), `slug:` (by default, the
-  slug is taken from the order id), `effort: <none|low|medium|high|xhigh|max>`.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal
-and asks the operator to make it permanent. On 2026-08-15 an order in another repository did all
-three in sequence and ended by telling its operator to grant a rule on `run-codex.mjs`.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-review --repo "<repository-path or .>" --changeset "<one changeset from the list above>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
+{{CODEX_DISPATCHER_PROTOCOL}}
+
+## Role notes
+
+The orchestrator chooses what to review in the task-file header's `changeset:` field:
+
+- `changeset: uncommitted` — uncommitted changes;
+- `changeset: base:<branch>` — branch against a base;
+- `changeset: commit:<sha>` — a specific commit.
 
-Add `--effort "<value>"` only when the orchestrator named a depth, and only with one of
-`none|low|medium|high|xhigh|max`. Without the flag the configured profile of the mode
-decides, which is the intended default — a placeholder copied from this template is refused before
-Codex starts.
-
-The call does not wait. It starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get the verdict, run the **identical command a second time** — same `--order-id`,
-same `--slug`, same flags. That second call does not start a second run and costs no quota: it
-attaches to the run already in flight, prints `ATTACH=<path> order-id=<id> started=<time>`, blocks
-until the verdict exists and prints it.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
-remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
-
-If the task text contains a line beginning with the `continue:` label, add the bare `--continue`
-flag even when its run name or reason looks malformed. Do not inspect, repair, or swallow the line;
-the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
-present in the command at all.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited. If the attaching call is killed
-by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes
-20-25 minutes, which is normal, not a hang. Give the ordinary attaching call `timeout: 1800000` (30
-minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it leaves an abandoned run folder and a
-second Codex process in the same worktree. On 2026-08-03 one order became six runs exactly this way.
-
-The runner does the rest: creates the run folder, `task.md`, the JSON finding schema, the
-synchronous run
-of regular `codex exec` in a read-only sandbox, `meta.json`, artifact status, and ready-made
-response
-lines with counts by severity.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it.
-Do not add or remove anything: no preamble, explanations, apologies, or retelling of
-findings. The findings are in `review.json`; the orchestrator will read them.
-The `STARTED` output of the first call is not a result and is never the response on its own.
-
-Wording such as "the run has started, waiting for completion," "I will wait for a notification," or
-"Monitor started in the background" is prohibited in any form. Inventing any outcome the runner did
-not print is equally prohibited. On 2026-08-13 a dispatcher said `FAIL — could not get the Codex run
-result because of an architectural environment limitation` while that run's `status.json` already
-said `state=finished`, `status=OK`.
+The review focus lives in the task file.
 
 ## What you return
 
@@ -176,9 +80,13 @@ and the wait can be repeated for free, so neither has any reason to restart anyt
 - `LIMIT` — the result is empty and the log signals a limit. The ChatGPT quota is exhausted, and the
   review was not
   completed; this is not a review failure and not a reason to restart.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
-The script return code mirrors the status: `0` / `1` / `3`. A nonzero code is not a reason to retry,
+The script return code mirrors the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to retry,
 not a reason to change the command, and not a reason to review it yourself.
+Code `5` means `UNAVAILABLE`.
 
 The run folder contains `status.json` (`running` / `finished` / `failed` / `abandoned`) and the
 runner pid.
@@ -190,10 +98,10 @@ Token spending now goes into `meta.json` (the `review` subcommand did not print
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed,
-it prints a ready-made FAIL with a verification command for the operator. Your job is to return that
-output.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
 
 ## What a violation looks like
 

package/src/agents/codex-scout.md

@@ -15,131 +15,17 @@ ChatGPT subscription. All heavy work (reading files, reasoning, generating the r
 on the Codex side. Every extra line you send to chat costs Claude tokens. Therefore: do not read
 files, do not run grep, do not retell the report, and do not reason about the task.
 
-## Required dispatcher inputs
-
-{{CODEX_REQUIRED_INPUTS}}
-
-## What you receive as input
-
-- The task statement (what to find out / what to diagnose / what to review).
-- The path to a task file containing that statement verbatim. The orchestrator supplies this path;
-  pass it as `--task-file` and never create, read or rewrite it. Writing that file yourself
-  from the shell — `cat > … << EOF` or any equivalent — puts back the permission prompt the
-  flag exists to remove. Given no path, start the runner without the flag and return its refusal.
-- The path to the repository. If none is given, work in the current working directory.
-- Scope patterns are globs relative to the repository root. A pattern that matches nothing there is
-  refused before the run starts.
-- Optional: `effort: <none|low|medium|high|xhigh|max>` — Codex reasoning depth.
-- Optional: `slug: <short-name>` for the run folder; by default, the slug is taken from the order
-  id.
-- Every input listed under **Required dispatcher inputs** above, passed on exactly as given:
-  `order id` as `--order-id`. Never invent a value, never edit one, never reuse an order id from
-  another order — the runner chains runs by that label, and a made-up label is how a repeat run
-  hides. If the orchestrator did not give a required input, do not guess — start the runner without
-  its flag and return the runner's refusal verbatim.
-- The sub-questions are NOT yours to pass. They live in the task file the orchestrator wrote, under
-  a `Questions` heading, one Markdown list item each. You never read that file, never edit it and
-  never put a question on the command line: a question is free prose, and free prose in an argument
-  makes the host stop applying the operator's permission rule, which is how a delegation dies on a
-  refusal. If the file holds no question, start the runner anyway and return its refusal verbatim.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
-  assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
-  output and stop; do not issue or invent another continuation. If no such grant line is present,
-  the flag must not be present.
-
-## When the host refuses the command
-
-If the host refuses to run `codex-bridge run` — a permission prompt, a classifier denial, anything
-that stops the command — that refusal is your final answer. Report `FAIL`, name your own order id,
-and state the one correction: the operator runs `codex-bridge install`, which grants the permission
-rule this package needs.
-
-You are forbidden to look for a way around it. Specifically, and without exception:
-
-- never call `run-codex.mjs`, or any file inside the installed package, by path;
-- never start the runner through `node`, `npx`, `sh`, `bash` or any other interpreter;
-- never retry the same call in PowerShell because Bash refused it, or the reverse;
-- never split the call over more than one line, and never add a pipe, a semicolon or a redirect;
-- never advise the operator to grant a permission rule on an internal file — a rule on anything but
-  the package command undoes the very design that makes this call permission-stable.
-
-Every one of those forms was removed on purpose: a host matches a permission rule against the
-beginning of the final command line, so an interpreter, a path or a continuation makes the call
-unmatchable by construction. Reaching for one does not rescue the run; it guarantees the refusal
-and asks the operator to make it permanent. On 2026-08-15 an order in another repository did all
-three in sequence and ended by telling its operator to grant a rule on `run-codex.mjs`.
-
-## The only thing you do
-
-```bash
-codex-bridge run --agent codex-scout --repo "<repository-path or .>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
-```
+{{CODEX_DISPATCHER_PROTOCOL}}
+
+## Role notes
 
-Nothing else goes on that line. The sub-questions travel inside the task file; a `--question` flag
-is for a human calling the runner by hand, never for you.
-
-Add `--effort "<value>"` only when the orchestrator named a depth, and only with one of
-`none|low|medium|high|xhigh|max`. Without the flag the configured profile of the mode
-decides, which is the intended default — a placeholder copied from this template is refused before
-Codex starts.
-
-If the task text contains a line beginning with the `continue:` label, add the bare `--continue`
-flag even when its run name or reason looks malformed. Do not inspect, repair, or swallow the line;
-the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
-present in the command.
-No value
-is passed to it: the runner accepts only `1/true/yes/0/false/no`, while a placeholder string left in
-the
-command from this template is an argument error, and the run will not start. If it was not given,
-the flag
-must not be present in the command at all.
-
-The call does not wait. It starts the run and returns at once with `RUN=<path> order-id=<id>` and a
-`STARTED` line. To get the verdict, run the **identical command a second time** — same `--order-id`,
-same `--slug`, same flags. That second call does not start a second run and costs no quota: it
-attaches to the run already in flight, prints `ATTACH=<path> order-id=<id> started=<time>`, blocks
-until the verdict exists and prints it.
-
-If the runner refuses with an order id collision — the id already belongs to a run whose task
-differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
-remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
-
-Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
-run and keeps waiting. Never add a flag — the host allows exactly the one command your
-order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
-attaching call `timeout: 1800000` (30 minutes).
-
-**Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the
-orchestrator and is what makes a repeat harmless; changing it turns a repeat into a second paid run.
-On 2026-08-03 one order became six runs exactly this way, and four of them were never accounted for
-at all.
-
-The runner does the rest: creates the run folder, `task.md` (the verbatim task + instructions for
-Codex),
-the response schema, the synchronous Codex run in a read-only sandbox, `meta.json`, artifact status,
-and ready-made response lines.
-
-**Your response = the exact stdout of the attaching call**: the `ATTACH=<path>` line and the status
-block below it.
-Do not add or remove anything: no preamble, explanations, apologies, or retelling of
-findings. The report is in the file; the orchestrator will read it if needed.
-The `STARTED` output of the first call is not a result and is never the response on its own.
-
-The only allowed final response is this exact stdout. Wording such as "the run has started,
-waiting for completion," "I will wait for a notification," or "Monitor started in the background" is
-prohibited in any
-form: the subagent ceases to exist immediately after responding, nobody can wait, and the
-orchestrator gets
-a promise instead of a result. This is the same failure as in codex-build: the dispatcher gives
-such a response while a run is live, it is left without an owner, and this can only be discovered by
-checking
-`status.json` manually.
-Inventing any outcome the runner did not print is equally prohibited. On 2026-08-13 a dispatcher said
-`FAIL — could not get the Codex run result because of an architectural environment limitation` while
-that run's `status.json` already said `state=finished`, `status=OK`.
+The sub-questions are NOT yours to pass. They live in the task file the orchestrator wrote, under
+a `## Questions` heading, one Markdown list item each. A question may carry the orderer's
+`[context-only]` marker; the dispatcher never adds, removes or repairs it. You never read that
+file, never edit it and never put a question on the command line: a question is free prose, and
+free prose in an argument
+makes the host stop applying the operator's permission rule, which is how a delegation dies on a
+refusal. If the file holds no question, start the runner anyway and return its refusal verbatim.
 
 ## What you return
 
@@ -170,6 +56,7 @@ confidence), `unknowns[]`, and `report_markdown`. An uncovered subquestion or an
 evidence is FAIL;
 the runner prints the line `Coverage: N/M subquestions`. The runner expands the last field into
 `report.md`.
+A `[context-only]` subquestion is answered with `startup:<source>` evidence.
 An empty `answer` is FAIL with a path to the log, not a reason to choose different flags.
 
 ## The script determines status, not you
@@ -180,24 +67,28 @@ An empty `answer` is FAIL with a path to the log, not a reason to choose differe
 - `LIMIT` — the result is empty and the log signals a limit. The ChatGPT quota is exhausted, and the
   task was not
   completed; this is not a task failure and not a reason to restart.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
-The script return code mirrors the status: `0` / `1` / `3`. A nonzero code is not a reason to retry,
+The script return code mirrors the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to retry,
 not a reason to change the command, and not a reason to investigate on your own.
+Code `5` means `UNAVAILABLE`.
 
 The run folder contains `status.json` (`running` / `finished` / `failed` / `abandoned`) and the
 runner pid.
 An abandoned run is not a reason to start over yourself: the orchestrator decides whether to repeat
 it, and
-without the `--continue` it issued, the runner will reject that repeat run itself. Only a run still
+without the orchestrator's `continue:` or `retry:` grant in the task-file header, the runner will reject that repeat run itself. Only a run still
 alive is attached to; a run that already has a verdict sends your repeat into that same refusal,
 which is the runner telling you the answer is on disk already.
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed,
-it prints a ready-made FAIL with a verification command for the operator. Your job is to return that
-output.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
 Performing the task manually instead of Codex is prohibited for any reason it fails.
 
 ## What a violation looks like

package/src/home/hooks/dispatcher-gate.mjs

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import { AGENTS } from '../lib/agents.mjs';
 import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { sameCommand } from '../lib/dispatcher-command.mjs';
+import { bindReceipt, runnerReceipt } from '../lib/dispatcher-order.mjs';
 import { parseJsonText } from '../lib/json-file.mjs';
 import {
   decidePreToolUse,
@@ -17,7 +18,7 @@ import {
   readDispatcherState,
   updateDispatcherState,
 } from '../lib/dispatcher-state.mjs';
-import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { recordInterceptedAttempt, witnessHostVersion } from '../lib/handback-witness.mjs';
 import { observeSessionHost } from '../lib/host-observations.mjs';
 
 function emit(decision, toolInput) {
@@ -81,6 +82,7 @@ async function main() {
         const next = {
           ...(current.corrupt ? {} : current),
           ...(decision.stateUpdate || {}),
+          agentType: payload.agent_type,
         };
         if (toolUseId) {
           const seenToolUseIds = Array.isArray(next.seenToolUseIds) ? next.seenToolUseIds : [];
@@ -97,9 +99,8 @@ async function main() {
 
     if (payload.tool_name === HANDBACK_TOOL) {
       try {
-        await recordHandbackWitness({
+        await recordInterceptedAttempt({
           stateDir: BRAND_STATE_DIR,
-          kind: 'seen',
           hostVersion: await witnessHostVersion(payload),
         });
       } catch {}
@@ -119,12 +120,16 @@ async function main() {
       if (!order.command || !sameCommand(payload.tool_input?.command, order.command)) return;
       const result = runnerOutput(payload);
       if (!result) return;
-      await updateDispatcherState(ids, (current) => ({
-        ...(current.corrupt ? {} : current),
-        runnerOutput: result.output,
-        runnerFinal: isFinalOutput(result.output),
-        runnerExitCode: result.exitCode,
-      }));
+      await updateDispatcherState(ids, (current) => {
+        const base = current.corrupt ? {} : current;
+        return {
+          ...base,
+          ...bindReceipt(base, runnerReceipt(result.output)),
+          runnerOutput: result.output,
+          runnerFinal: isFinalOutput(result.output),
+          runnerExitCode: result.exitCode,
+        };
+      });
     } catch {}
   }
 }