codex-workflow-v2 2.0.0-beta.13.1 → 2.0.0-beta.13.3

package/docs/beta13.2-signal-review-recovery.md

@@ -0,0 +1,38 @@
+# beta.13.2: pending-review recovery
+
+## Confirmed failure
+
+Signal M04 T01 completed the product changes for STEP-002 on beta.13.1, but its
+required independent Step review could not be prepared. The cumulative Task diff
+was 2,236,058 bytes, exceeding the default synchronous Git output buffer. The
+checkout remained clean and the completion commit remained recorded; review had
+not passed.
+
+After the writer lease expired, repository navigation preferred delegated
+Knowledge context refresh over the pending review's credential recovery. The
+context-refresh executor correctly rejected the still-in-progress Step. Thus
+navigation advertised an action its executor could not perform. Ordinary package
+update was also blocked by the in-progress Step.
+
+## Required recovery guarantees
+
+- Large Step and final Task review inputs are complete or fail explicitly; Git
+  errors have bounded diagnostics rather than dumping the input corpus.
+- Pending review and its exact writer credential recovery remain ahead of
+  Knowledge refresh. Refresh during a running Step stays forbidden.
+- Installation recovery validates the source version, exact Task/Plan/Step and
+  completion commit, clean checkout, recorded Git history, review journal, and
+  absence of active ownership or transactions.
+- Dependency transport preserves product bytes and the original reviewed commit.
+  Pending review never establishes passed-review provenance.
+- The original required review, delegated context refresh, Task acceptance and
+  merge remain mandatory after recovery. Grants are not broadened or renewed.
+
+## Release acceptance
+
+The package regression suite must cover oversized review inputs and the combined
+pending-review, expired-lease and stale-Knowledge state, including rejection of
+unsafe recovery candidates. Release validation also requires the ordinary package
+and external-review lifecycle gates. Actual Signal recovery must pass the blocked
+Step review and reach a subsequent executable lifecycle boundary; green fixture
+tests alone do not establish that the production Milestone has resumed.

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -463,7 +463,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает `packageVersion=2.0.0-beta.13.1`, protocol 2, state schema 2 и beta.13
+- handshake подтверждает `packageVersion=2.0.0-beta.13.3`, protocol 2, state schema 2 и beta.13
   capabilities;
 - routine observation начинается с компактного `status`; `status --full` запрашивается только для
   расследования, которому действительно нужна полная historical projection;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -57,7 +57,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.1`, `protocolVersion=2`,
+Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.3`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy, host-safe credential reference, failed-Step continuation transaction,
 cause-bound rolling refinement, structural production edge, compact status, reviewer runtime preflight,
@@ -482,7 +482,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 # 14. Итоговый checklist пользователя
 
 - beta.13.1 exact package и новый bundled gateway установлены; handshake показывает
-  `packageVersion=2.0.0-beta.13.1`, protocol/state schema `2/2` и beta.13 capabilities;
+  `packageVersion=2.0.0-beta.13.3`, protocol/state schema `2/2` и beta.13 capabilities;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -15,7 +15,7 @@ authority сами: mutating permission определяется runtime state
 
 | Параметр beta.13 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.13.1` |
+| npm package | `codex-workflow-v2@2.0.0-beta.13.3` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -333,7 +333,7 @@ local reviewer внутри Codex App sandbox.
 | Повтор stable reviewer `causeId` с `planConflict=true` | Root-cause replan той же Task обязателен |
 | Похожий prose, номер попытки или reviewer cause без Plan conflict | Не создаёт replan authority |
 | Finding `route=fix` или route отсутствует | Продолжить ту же Task/Step независимо от attempt count |
-| Finding `route=replan` с exact Plan conflict | `task plan-set`; меняются только implementation Steps |
+| Finding `route=replan` с exact Plan conflict, включая первый провал | Штатный corrective yield/replan; повторный run запрещён, меняются только implementation Steps |
 | `route=replan` без exact conflict | Невалидный review result, state не меняется |
 | Explicit `split-required` | Structural replacement stop |
 | Exact beta.11 attempt-four `stop-escalate` | Append-only Human-confirmed compatibility override |
@@ -767,7 +767,7 @@ dirty update.
 observed-route matrix/compact-status/reviewer-runtime tests, legacy compatibility regressions,
 `npm run test:signal-t10-check-support-e2e`, `npm run test:signal-remediation-e2e`,
 `npm run pack:check`, `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
-`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.1` tag binding и append-only
+`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.3` tag binding и append-only
 real-agent lifecycle log. Candidate проверяется из clean source checkout; missing built module не должен
 превращаться в stack trace, а обязан быть детерминированно собран или диагностирован release gate.
 

package/docs/pending-review-update.md

@@ -0,0 +1,15 @@
+# Updating while a strict Step review is pending
+
+This narrow bridge supports source `codex-workflow-v2@2.0.0-beta.13.1` and the exact executing target package. It preserves the original completion commit, pending review chain, Plan and Knowledge authorization. It does not mark a review passed or bypass the following Knowledge refresh.
+
+Use only a verified, exact target package runner with capability `pending-strict-review-dependency-bridge-v1`. The source preflight checks its package/build manifest and runtime file hashes. Never use a mutable version range or a global runner. The target runner exception before installation permits only the read-only source preflight below. Use the installed source runner for an explicitly returned stale lease repair.
+
+1. Run the external target runner: `update pending-review-source-preflight --repo <repo> --id <Task> --json`. Save the complete JSON response outside the repository. If `staleLeaseRepair` names exactly this Task, use the **installed source** `locks repair --id <Task>` and rerun source preflight. The lock manager rechecks expiry; a live or unrelated lease is not repairable through this bridge. Do not transport until the fresh result has `eligible=true` and no blockers.
+2. Retain the exact source receipt. Create one dependency transport commit on its `baseBranch` at `baseHead`, using a separate temporary worktree. Create one on `taskBranch` at `completionCommit`. Each commit must have one parent, change exactly `package.json` and `package-lock.json`, and change only the exact Workflow dependency entries from source to target. Preserve all product-owned manifest/lock fields independently on each branch. Do not merge, amend, reset, rebase, copy the base manifest over Task changes, or transport product work.
+3. Install the exact target package in the Task repository. Use its repository-local runner for all remaining commands. Run `status`, then `next`; it must advertise `update pending-review-dependency-recover`. Run `update pending-review-dependency-preflight --id <Task> --file <source-receipt.json>`. Require `eligible=true` and no blockers.
+4. Run `update pending-review-dependency-recover --id <Task> --expected-revision <source-task-revision> --file <source-receipt.json> --actor <coordinator> --reason <substantive-reason>`. Both plain preflight results and CLI `{ok:true,value:...}` receipts are accepted. The receipt is not authority: recovery reconstructs every source binding from canonical Task, artifacts, strict-review sidecars and Git parent commits. It checks clean checkout, all target version surfaces, exact base transport, and absence of any writer lease or pending transaction/Core operation again.
+5. Recovery atomically registers the Task dependency commit in existing dependency provenance and writes the hash-chained `pending-review-updates.jsonl` sidecar. Task schema 2 is unchanged. It increments the Task revision but preserves the original pending event, product completion SHA and Step evidence. Repeating recovery is rejected rather than creating duplicate authority.
+6. Run `status`, then `next`. Recover the exact advertised C1 writer credential if necessary. Generate a fresh `task step-review-packet`; use an independent external sealed reviewer and record the unchanged result with `task step-review-record`. The packet binds the original product commit and includes revalidated transport evidence; its repository seal binds the current dependency HEAD. Any later HEAD, base, Plan, evidence, packet, or seal change fails closed. Local nested review retains its original HEAD guard.
+7. Follow fresh `status` and `next` after review. Under the original eligible Milestone Autonomy Grant, execute the advertised `task context-refresh` for predeclared supporting-source additions and dependency manifest drift. Then continue to the next normal Step or final Task boundary. Do not substitute standalone approval or manually edit state.
+
+A failed preflight is a stop for this bridge. Repair only a specifically documented obstruction, then rerun the read-only assessment; never edit the receipt to hide a blocker. A pending or corrupt transaction must be recovered through its ordinary exact route before retrying.

package/docs/release.md

@@ -4,6 +4,31 @@ The npm package is `codex-workflow-v2` with public visibility. Consumers must pi
 an exact version. Stable compatibility covers the latest minor release of the current
 major only; older minors are unsupported unless a release note explicitly says otherwise.
 
+## beta.13.3 explicit Plan conflict recovery
+
+A first independently recorded reviewer `route=replan` with a validated Plan conflict
+blocks current execution immediately and exposes corrective replan. Historical
+rolling-cause classification remains unchanged; valid older histories are not
+reclassified as corrupt. Ordinary new fix findings still continue in the same Task.
+The failure transaction yields C1 and releases the exact writer lease. An older
+failed Task with a retained C1 claim follows credential recovery and
+`task corrective-yield` before planning; it cannot run or change its Plan while
+the claim remains. Recovery binds the validated remediation event and preserves
+the Task, review evidence, and existing worker identity.
+The release also includes durable App dispatch and explicit role/phase model selection;
+see the packaged `references/chat-dispatch.md`.
+
+## beta.13.2 review recovery gate
+
+The patch preserves protocol 2 and canonical entity schema 2. In addition to the
+ordinary release gates, `release:check` executes the large-diff, pending-review
+update, supporting-source refresh and Task guard regressions. Acceptance requires
+complete external-sealed Step and Task packets above 2 MiB, explicit bounded
+failure above the Git output limit, exact credential recovery before Knowledge
+refresh, and a Signal-shaped delegated update followed by actual review,
+context refresh and the next ordinary Step. A source preflight alone is not
+recovery completion. See `beta13.2-signal-review-recovery.md`.
+
 ## Release gate
 
 Before tagging a release:
@@ -52,8 +77,8 @@ surface and fails unless all of these release contracts remain present:
   adds C1 yield before root-cause replan; the Signal-shaped E2E continues through recovery, the next
   ordinary Step, Task completion, and next-Task dispatch;
 - five distinct or unclassified review findings continue in the same Task without a numeric cap,
-  while root-cause replan requires either a repeated normalized mechanical failure or the same
-  stable external reviewer `causeId` with `planConflict=true`;
+  while repeated normalized mechanical failures still require root-cause replan; a current
+  explicit external reviewer Plan conflict requires replan immediately, without a synthetic retry;
 - a transitive same-component check owner may refine the same Task only under the unchanged semantic
   boundary; for a multi-Step `runtime-composition` consumer the independent PRA classification,
   not a planner opt-in, requires an edge from a transitive owner to an exact executable consumer

package/docs/updating-existing-project.md

@@ -636,8 +636,16 @@ title в registry readback и применяйте только возвращё
 быть уникален и содержать exact `#NNN`, membership ordinal и ID. Input должен состоять из
 TaskContextPacket; допустима только добавленная Codex App служебная `codex_delegation`-обёртка с
 `source_thread_id`, но не parent turns или transcript. Если title отсутствует или нормализован
-неверно, переименуйте и перепроверьте. Ошибка `create_thread` допускает один
-последовательный retry после проверки списка, но не разрешает fallback на `fork_thread`.
+неверно, переименуйте и перепроверьте. Pending `clientThreadId`, тайм-аут или отсутствие в
+`list_threads` не доказывают, что создание не состоялось, и не разрешают повторный `create_thread`.
+До первого вызова сохраните `dispatch-begin`; после него используйте `dispatch-result/status`,
+поиск коррелированного сеанса и `dispatch-observe` с фактическим `read_thread`. На одну
+резервацию выдаётся только одно разрешение создания. Не обходите его новой резервацией или fork.
+Полный контракт восстановления, сохранения supervisor/cursor и явного выбора `model`/`thinking`
+по роли, фазе и сложности находится в
+`plugins/codex-workflow-gateway/references/chat-dispatch.md`. Выбор модели требует соответствующего
+поручения пользователя и актуального списка поддерживаемых пар на целевом host; нельзя молча
+наследовать дорогую конфигурацию координатора или снижать уровень независимого аудита.
 Создавайте или переиспользуйте Task-чат непосредственно перед dispatch этой Task, а не как пустой
 placeholder для всего membership; `T<NN>` берите только из утверждённого membership order.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13.1",
+  "version": "2.0.0-beta.13.3",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/chat-dispatch.md

@@ -0,0 +1,128 @@
+# Durable App dispatch and explicit model selection
+
+This is an App orchestration journal, not Workflow authority. It does not call the App, approve
+Git writes, renew grants, mint credentials, or replace Core status/next. All commands below use
+`node <exact-package>/plugins/codex-workflow-gateway/scripts/chat-registry.mjs` and the existing
+24-hex Workflow `--project-id`. The App project ID is a separate field.
+
+## One reservation, one creation attempt
+
+`allocate` reuses the same non-abandoned role/entity/membership/attempt reservation. Task and
+Coordinator allocations also reuse it when a caller changes the attempt number. Review attempts
+advance only after the actual Workflow review cycle advances. Never invent a new attempt or
+reservation to bypass unresolved creation. Existing v1 registries remain readable; legacy bound
+threads remain usable with explicit model/thinking arguments from the same policy; `model-select`
+and `supervision-record` currently require a tracked dispatch and do not retrofit legacy evidence.
+Legacy unbound reservations may have already created a chat: reconcile
+those using real App/source evidence before using the new dispatch flow.
+
+1. Save the closed context packet to a private local file. Do not include bearer credentials,
+   parent transcript, or approval narratives. Prepare a private dispatch request JSON:
+
+   ```json
+   {
+     "repositoryRoot": "/absolute/canonical/repository",
+     "appProjectId": "project-id-from-list-projects",
+     "hostId": "local",
+     "promptFile": "/private/tmp/task-context.txt",
+     "modelRequest": {
+       "phase": "planning",
+       "complexity": "standard",
+       "highRisk": false,
+       "rationale": "New multi-file implementation plan with established requirements.",
+       "availableModels": [
+         {"id": "gpt-5.6-sol", "reasoningEfforts": ["low", "medium", "high", "xhigh", "max", "ultra"]}
+       ]
+     }
+   }
+   ```
+
+   Populate `availableModels` from the destination App tool's actual model/effort contract, not
+   this example, the parent's settings, API pricing pages, or a guessed alias. Explicit user
+   authorization to select models is required; journal input is not user authorization.
+2. Run `dispatch-begin --reservation-id ID --file request.json` **before** `create_thread`.
+   Save its complete output to a mode-600 file. It atomically persists a creation marker, packet
+   hashes, repository binding and requested model selection, then returns `createAllowed:true`
+   and exact `createArgs` including `model` and App field `thinking`.
+3. Only the process receiving that one permission may make **one** `create_thread(createArgs)`
+   call. A second begin, even after restart or timeout, returns `createAllowed:false` and no
+   create arguments. Do not reissue the external call after a lost/ambiguous response. The marker
+   prepended to the packet is routing provenance, not parent history.
+4. Save the full App result locally, normalize its successful tool text JSON to
+   `{"result":{"clientThreadId":"client-new-thread:...","hostId":"local"}}` or
+   `{"result":{"threadId":"actual-uuid","hostId":"local"}}`, and run `dispatch-result`.
+   Preserve raw evidence separately. Never parse truncated displayed stdout as the full receipt.
+   Invalid JSON cannot change the journal. A pending client ID is never a usable thread ID.
+5. Use `dispatch-status` to resume. Missing `list_threads` results are not proof of failure.
+   If the actual ID is unavailable, identify candidate rollout files from creation-time/worktree
+   evidence and run `dispatch-discover --file candidates.json`, where the file is
+   `{"sessionFiles":["/absolute/rollout.jsonl"]}`. The helper reads only supplied files, checks
+   actual session metadata, exact original dispatched prompt (including the App's routing XML),
+   and the Git common directory. It ignores guardian/subagent sessions and unrelated prompts.
+   It prints candidate IDs/paths only, never transcripts or reasoning. Use bounded candidate
+   lists, not vault searches. Malformed, oversized or partially written files need a later fresh
+   read; they never authorize another creation.
+6. Confirm a correlated candidate using `read_thread`. Save its full response as
+   `{"observation": <parsed read_thread JSON>}` and run `dispatch-observe`. It checks actual UUID,
+   host, repository/worktree and App project when supplied. One candidate still requires App
+   readback; several candidates produce a duplicate conflict and require explicit disposition,
+   not arbitrary selection. After confirming one canonical child, inspect every other candidate,
+   reconcile any work it performed, and archive only idle duplicates. Record
+   `dispatch-resolve-duplicates` with `canonicalThreadId` and `dispositions`, one object per duplicate:
+   `{threadId, observation: <read_thread JSON>, archiveResult: {threadId, archived: true}}`.
+   Preserve the actual archive tool receipt; never fabricate it. Repeat canonical readback and bind.
+   Candidate history is retained and no creation permit is restored. This is a local evidence
+   check, not independent App attestation.
+7. Run ordinary title `readback`/rename until exact match. After any rename, repeat
+   `dispatch-observe` with fresh App readback, then `readback` and `bind`. Binding a tracked
+   dispatch requires the same actual ID, host and observed title. Rebinding it to another child,
+   binding a client ID or sharing one child between reservations is rejected.
+8. Run `supervision-record --file report.json` with `threadId`, `ownerThreadId`, `state`
+   (`active|attention|completed`), `cursor` and `nextAction`. Persist significant wait boundaries;
+   only that supervisor waits for this child. The journal stores routing state, not a Workflow
+   verdict. Do not put secrets, CREFs or confirmation codes in it. On restart, read the child and
+   fresh Core status/next before continuing. Worker reports stay local; the coordinator pulls.
+
+A crash between durable begin and actual submission is deliberately ambiguous. There is no
+App idempotency-key API here, so this provides **at most one create permit per reservation**,
+not an exactly-once guarantee. Never clear the marker, abandon it, or expire it by time to retry.
+If no positive creation evidence can be found, report that exact unresolved App operation. A
+permission denial is a separate real gate; do not reroute it through another chat. Fresh user
+approval does not establish that an ambiguous prior creation never happened.
+
+## Model matrix
+
+The versioned policy is `scripts/chat-model-policy.mjs`. It expresses a conservative relative
+cost/latency preference, not measured savings or guaranteed account availability:
+
+| Work | Preferred model | App thinking | Compatible fallback |
+| --- | --- | --- | --- |
+| Routine mechanical transitions, formatting, retrieval | gpt-5.4-mini | low | gpt-5.6-luna / low |
+| Coordinator supervision; small implementation | gpt-5.6-luna | medium | gpt-5.6-terra / medium |
+| Standard implementation | gpt-5.6-terra | medium | gpt-5.6-sol / medium |
+| Task planning | gpt-5.6-sol | medium | gpt-6-astra / medium |
+| Routine Step review | gpt-5.6-terra | medium | gpt-5.6-sol / medium |
+| Standard Step review, final review, plan/corrective audit | gpt-5.6-sol | high | gpt-6-astra / high |
+| Complex work or high risk, any role | gpt-6-astra | high | gpt-5.6-sol / high |
+
+`routine` means a small, well-specified change or mechanical action with an existing check;
+`standard` is ordinary multi-file work; `complex` covers new architecture, unresolved concurrency,
+recovery/provenance or distributed state. Mark `highRisk` for authorization, security-sensitive
+paths, data-loss exposure or irreversible migrations. The coordinator records the concrete
+rationale; classification is a human/agent judgment, not an automatic risk detector. Unknown
+complexity is not routine. Review/audit role floors override a falsely mechanical phase. No
+automatic xhigh/max/ultra, and no escalation merely because a review failed or a tool timed out.
+
+The policy chooses only a listed supported pair. If neither preferred nor fallback pair is
+available, stop selection rather than silently inheriting the coordinator or lowering the review
+floor. API docs explain the reasoning/latency tradeoff, while App availability and accepted field
+names come from the live App tool contract:
+https://developers.openai.com/api/docs/guides/latest-model
+
+For a phase change in an existing bound chat, call `model-select` with its same `threadId` and
+fresh `modelRequest`; copy the returned `followUpArgs` into `send_message_to_thread` with the
+closed follow-up prompt. For example, planning uses Sol/medium, implementation Terra/medium,
+then mechanical lifecycle work Mini/low. Do not create another Task just to switch model.
+Keep the previous selection unless the phase/risk/scope changes materially. The journal records
+requested settings; tool acceptance/runtime readback, when available, is required to claim the
+actual model used. A model change never changes role, scope, credentials or approval authority.

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -56,10 +56,21 @@
   A provenance recovery recorded after the final context-refresh audit may explain exactly one
   additional Task revision only when it belongs to that verified Git chain. Any unexplained
   revision remains a `doctor` boundary.
+- Before a credential-consuming mutation, check the public `writerCredentialReference.expiresAt`
+  against the current time and its actor/action binding. Lease heartbeat or renewal does not
+  extend that reference's expiry. An expired, missing, consumed or unverifiable reference requires
+  the simultaneously advertised `next.writerCredentialRecovery` action with its exact Task,
+  revision and `requiredActor`, followed by fresh `status` and `next`; use the new reference.
+  If no recovery is advertised, stop before mutation. Never read or patch the vault, extend expiry
+  manually, or reuse the old reference. This check also applies after independent reviews and pauses.
 - `milestone progress --id <MS-ID>` is a read-only projection and the sole source for Coordinator
   progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
 - `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title
   families, verifies exact readback, supplies deterministic fallbacks, and binds the verified chat.
+  It also journals a single creation permit, pending/actual IDs, evidence-based resolution and
+  supervision cursors. Missing App listings never permit a retry. See `chat-dispatch.md` for
+  dispatch commands and the explicit role/phase model + thinking policy. These are App routing
+  helpers; they do not change Workflow protocol/state schema or grant approval authority.
 
 ## Handshake
 

package/plugins/codex-workflow-gateway/scripts/chat-dispatch.mjs

@@ -0,0 +1,185 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { selectChatModel } from './chat-model-policy.mjs';
+
+const hash = text => createHash('sha256').update(text).digest('hex');
+const text = (value, name) => {
+  if (typeof value !== 'string' || !value.trim()) throw new Error(`${name} is required.`);
+  return value.trim();
+};
+const actualId = value => {
+  const id = text(value, 'actual threadId');
+  if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)) throw new Error('Expected actual thread UUID, not clientThreadId.');
+  return id;
+};
+function jsonFile(file) {
+  if (statSync(file).size > 16 * 1024 * 1024) throw new Error('Input file exceeds 16 MiB.');
+  return JSON.parse(readFileSync(file, 'utf8'));
+}
+function commonGitDir(cwd) {
+  return realpathSync(execFileSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
+    cwd, encoding: 'utf8', timeout: 5000, maxBuffer: 1024 * 1024,
+  }).trim());
+}
+function promptMatches(value, digest) {
+  if (typeof value !== 'string') return false;
+  if (hash(value) === digest) return true;
+  const wrapped = /^<codex_delegation>\s*<source_thread_id>[^<]+<\/source_thread_id>\s*<input>([\s\S]*)<\/input>\s*<\/codex_delegation>$/.exec(value);
+  return wrapped !== null && hash(wrapped[1]) === digest;
+}
+function view(entry) {
+  const d = entry.dispatch;
+  return {
+    reservationId: entry.reservationId, state: d?.state ?? (entry.threadId ? 'legacy-bound' : 'untracked'),
+    createAllowed: false, dispatchId: d?.id ?? null, clientThreadId: d?.clientThreadId ?? null,
+    threadId: entry.threadId ?? d?.candidateThreadId ?? null, hostId: d?.hostId ?? entry.hostId ?? null,
+    selection: d?.selection ?? null, supervision: d?.supervision ?? null,
+    candidates: d?.candidates ?? [],
+    nextAction: entry.threadId ? 'supervise-existing' : d?.state === 'resolved' ? 'title-readback-and-bind'
+      : d ? 'resolve-existing-creation' : 'dispatch-begin',
+  };
+}
+export function dispatchAction(action, entry, input = {}) {
+  if (action === 'dispatch-status') return view(entry);
+  if (action === 'dispatch-begin') {
+    // A durable marker is committed BEFORE the external call. Even a lost response never permits another call.
+    if (entry.dispatch || entry.threadId) return view(entry);
+    if (entry.status === 'abandoned' || entry.status === 'blocked') throw new Error('Reservation is not dispatchable.');
+    const repositoryRoot = realpathSync(text(input.repositoryRoot, 'repositoryRoot'));
+    const gitDir = commonGitDir(repositoryRoot);
+    const appProjectId = text(input.appProjectId, 'appProjectId');
+    const hostId = text(input.hostId, 'hostId');
+    const promptPath = realpathSync(text(input.promptFile, 'promptFile'));
+    if (statSync(promptPath).size > 1024 * 1024) throw new Error('TaskContextPacket exceeds 1 MiB.');
+    const prompt = readFileSync(promptPath, 'utf8');
+    if (!prompt.trim() || !prompt.includes(entry.entityId)) throw new Error('Prompt must include the exact entity ID.');
+    const selection = selectChatModel(entry.type, input.modelRequest);
+    const id = randomUUID();
+    const marker = `[workflow-dispatch:${id}:${hash(prompt)}]`;
+    const dispatchedPrompt = `${marker}\n${prompt}`;
+    entry.dispatch = {
+      version: 1, id, state: 'creating', appProjectId, hostId, repositoryRoot, gitDir,
+      promptPath, promptHash: hash(prompt), dispatchedPromptHash: hash(dispatchedPrompt), marker,
+      selection, selectionHistory: [selection], clientThreadId: null, candidateThreadId: null,
+      candidates: [], observations: [], createdAt: new Date().toISOString(),
+    };
+    return { ...view(entry), createAllowed: true, nextAction: 'create-thread-once', createArgs: {
+      target: { type: 'project', projectId: appProjectId, environment: { type: 'worktree' } },
+      title: entry.requestedTitle, prompt: dispatchedPrompt, model: selection.model, thinking: selection.thinking,
+    } };
+  }
+  const d = entry.dispatch;
+  if (!d) throw new Error('No tracked dispatch; reconcile legacy chats manually, never assume creation failed.');
+  if (action === 'dispatch-result') {
+    const result = input.result;
+    if (!result || result.hostId !== d.hostId) throw new Error('Create result host mismatch.');
+    if (result.threadId && result.clientThreadId) throw new Error('Ambiguous create result.');
+    if (result.threadId) {
+      const id = actualId(result.threadId);
+      if (d.candidateThreadId && d.candidateThreadId !== id) throw new Error('Conflicting actual thread IDs.');
+      d.candidateThreadId = id;
+    } else {
+      const id = text(result.clientThreadId, 'clientThreadId');
+      if (!id.startsWith('client-new-thread:')) throw new Error('Invalid pending clientThreadId.');
+      if (d.clientThreadId && d.clientThreadId !== id) throw new Error('Conflicting creation attempts; reconcile duplicates.');
+      d.clientThreadId = id;
+    }
+    if (d.state === 'creating') d.state = 'pending';
+    return view(entry);
+  }
+  if (action === 'dispatch-discover') {
+    // Read only specifically supplied session files; never scan credential stores or print transcripts/reasoning.
+    if (!Array.isArray(input.sessionFiles) || input.sessionFiles.length > 200) throw new Error('Supply at most 200 candidate session files.');
+    const found = new Map(d.candidates.map(c => [c.threadId, c]));
+    for (const file of input.sessionFiles) {
+      if (statSync(file).size > 16 * 1024 * 1024) throw new Error('Session exceeds 16 MiB; narrow evidence required.');
+      const lines = readFileSync(file, 'utf8').split('\n');
+      const meta = JSON.parse(lines[0]).payload;
+      if (!meta || !['vscode', 'cli'].includes(meta.source) || typeof meta.cwd !== 'string') continue;
+      const rows = lines.slice(1).filter(Boolean).map(line => JSON.parse(line));
+      const bound = rows.some(row => {
+        if (row.type !== 'response_item') return false;
+        const p = row.payload;
+        // Actual App rollout format: a create_thread function output containing routing-only XML.
+        if (p?.type === 'function_call_output' && p.name === 'create_thread' && p.namespace === 'codex_app') {
+          return promptMatches(p.output, d.dispatchedPromptHash);
+        }
+        return p?.type === 'message' && p.role === 'user' && p.content?.some(c =>
+          ['input_text', 'text'].includes(c.type) && promptMatches(c.text, d.dispatchedPromptHash));
+      });
+      if (!bound) continue;
+      if (commonGitDir(meta.cwd) !== d.gitDir) throw new Error('Session belongs to another repository.');
+      const id = actualId(meta.id);
+      found.set(id, { threadId: id, cwd: realpathSync(meta.cwd), sourceFile: realpathSync(file) });
+    }
+    d.candidates = [...found.values()];
+    if (d.candidates.length > 1) d.state = 'duplicate-conflict';
+    return view(entry);
+  }
+  if (action === 'dispatch-resolve-duplicates') {
+    const canonical = actualId(input.canonicalThreadId);
+    if (entry.threadId && entry.threadId !== canonical) throw new Error('Cannot replace a bound child.');
+    if (d.candidateThreadId && d.candidateThreadId !== canonical) throw new Error('Cannot replace the correlated create result.');
+    if (!d.candidates.some(c => c.threadId === canonical)) throw new Error('Canonical child must be a discovered candidate.');
+    const others = d.candidates.filter(c => c.threadId !== canonical);
+    if (!others.length || !Array.isArray(input.dispositions) || input.dispositions.length !== others.length) {
+      throw new Error('Require one idle readback and archive receipt for every duplicate.');
+    }
+    const receipts = others.map(candidate => {
+      const matching = input.dispositions.filter(x => x?.threadId === candidate.threadId);
+      if (matching.length !== 1) throw new Error('Duplicate disposition missing or repeated.');
+      const item = matching[0];
+      const t = item.observation?.thread;
+      if (t?.id !== candidate.threadId || t.kind !== 'codex' || t.hostId !== d.hostId
+        || t.status?.type !== 'idle' || realpathSync(text(t.cwd, 'duplicate cwd')) !== candidate.cwd
+        || commonGitDir(t.cwd) !== d.gitDir || item.archiveResult?.threadId !== candidate.threadId
+        || item.archiveResult?.archived !== true) throw new Error('Duplicate requires matching idle readback and successful archive receipt.');
+      return { threadId: candidate.threadId, archived: true, recordedAt: new Date().toISOString() };
+    });
+    d.duplicateDisposition = { canonicalThreadId: canonical, archived: receipts };
+    d.state = 'pending';
+    return view(entry);
+  }
+  if (action === 'dispatch-observe') {
+    const observation = input.observation;
+    const t = observation?.thread;
+    if (!t || t.kind !== 'codex' || t.hostId !== d.hostId) throw new Error('Require actual Codex read_thread observation on the bound host.');
+    const id = actualId(t.id);
+    if (d.candidates.length > 1 && (d.duplicateDisposition?.canonicalThreadId !== id
+      || d.candidates.some(c => c.threadId !== id && !d.duplicateDisposition.archived.some(a => a.threadId === c.threadId)))) {
+      throw new Error('Multiple candidates: explicit duplicate disposition required before binding.');
+    }
+    const candidate = d.candidates.find(c => c.threadId === id);
+    if (id !== d.candidateThreadId && !candidate) throw new Error('Uncorrelated thread; require create result or exact session prompt evidence.');
+    if (commonGitDir(text(t.cwd, 'thread cwd')) !== d.gitDir
+      || (candidate && realpathSync(t.cwd) !== candidate.cwd)) throw new Error('Readback repository/cwd mismatch.');
+    if (t.projectId !== undefined && t.projectId !== d.appProjectId) throw new Error('Readback App project mismatch.');
+    if (d.candidateThreadId && d.candidateThreadId !== id) throw new Error('Readback differs from create result.');
+    d.candidateThreadId = id;
+    d.state = 'resolved';
+    d.observations.push({ threadId: id, hostId: t.hostId, cwd: realpathSync(t.cwd),
+      title: text(t.title, 'observed title'), observedAt: new Date().toISOString() });
+    return view(entry);
+  }
+  if (action === 'supervision-record') {
+    if (!entry.threadId || input.threadId !== entry.threadId || input.ownerThreadId === entry.threadId) throw new Error('Require bound child and separate supervisor.');
+    const owner = actualId(input.ownerThreadId);
+    if (d.supervision && d.supervision.ownerThreadId !== owner) throw new Error('Supervisor already assigned; no parallel wait owner.');
+    if (!['active', 'attention', 'completed'].includes(input.state)) throw new Error('Invalid supervision state.');
+    d.supervision = { ownerThreadId: owner, state: input.state, cursor: input.cursor == null ? null : text(input.cursor, 'cursor'),
+      nextAction: text(input.nextAction, 'nextAction'), updatedAt: new Date().toISOString() };
+    return view(entry);
+  }
+  if (action === 'model-select') {
+    if (!entry.threadId || input.threadId !== entry.threadId) throw new Error('Phase changes require the same bound thread.');
+    const selection = selectChatModel(entry.type, input.modelRequest);
+    d.selection = selection;
+    d.selectionHistory.push(selection);
+    return { ...view(entry), followUpArgs: { threadId: entry.threadId, hostId: entry.hostId,
+      model: selection.model, thinking: selection.thinking } };
+  }
+  throw new Error(`Unknown dispatch action: ${action}`);
+}
+export function dispatchInput(file) { return jsonFile(file); }

package/plugins/codex-workflow-gateway/scripts/chat-model-policy.mjs

@@ -0,0 +1,43 @@
+// Relative cost/latency policy, not a price list or an availability oracle.
+export const MODEL_POLICY_VERSION = 'chat-model-policy-v1';
+const PROFILES = {
+  mechanical: [['gpt-5.4-mini', 'low'], ['gpt-5.6-luna', 'low']],
+  scoped: [['gpt-5.6-luna', 'medium'], ['gpt-5.6-terra', 'medium']],
+  implementation: [['gpt-5.6-terra', 'medium'], ['gpt-5.6-sol', 'medium']],
+  planning: [['gpt-5.6-sol', 'medium'], ['gpt-6-astra', 'medium']],
+  review: [['gpt-5.6-sol', 'high'], ['gpt-6-astra', 'high']],
+  'scoped-review': [['gpt-5.6-terra', 'medium'], ['gpt-5.6-sol', 'medium']],
+  complex: [['gpt-6-astra', 'high'], ['gpt-5.6-sol', 'high']],
+};
+const TYPES = ['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit'];
+export function selectChatModel(type, request) {
+  if (!TYPES.includes(type)) throw new Error('Unknown chat type.');
+  if (!request || !['routine', 'standard', 'complex'].includes(request.complexity)
+    || !['planning', 'implementation', 'mechanical', 'review', 'coordination'].includes(request.phase)
+    || typeof request.rationale !== 'string' || !request.rationale.trim()
+    || typeof request.highRisk !== 'boolean') throw new Error('Explicit phase, complexity, highRisk and rationale are required.');
+  if (!Array.isArray(request.availableModels) || request.availableModels.length === 0
+    || request.availableModels.some(m => !m || typeof m.id !== 'string' || !Array.isArray(m.reasoningEfforts)
+      || m.reasoningEfforts.some(e => typeof e !== 'string'))
+    || new Set(request.availableModels.map(m => m.id)).size !== request.availableModels.length) {
+    throw new Error('Provide the destination host model/effort catalog; never infer availability.');
+  }
+  const reviewRole = type.endsWith('review') || type.endsWith('audit');
+  let profile;
+  if (request.highRisk || request.complexity === 'complex') profile = 'complex';
+  else if (type === 'step-review' && request.complexity === 'routine') profile = 'scoped-review';
+  else if (reviewRole || request.phase === 'review') profile = 'review';
+  else if (request.phase === 'planning') profile = 'planning';
+  else if (request.phase === 'mechanical') {
+    if (request.complexity !== 'routine') throw new Error('Mechanical phase requires routine complexity.');
+    profile = 'mechanical';
+  } else if (type === 'coordinator' || request.phase === 'coordination' || request.complexity === 'routine') profile = 'scoped';
+  else profile = 'implementation';
+  const selected = PROFILES[profile].find(([id, effort]) => request.availableModels.some(m => m.id === id && m.reasoningEfforts.includes(effort)));
+  if (!selected) throw new Error(`No supported model/effort for ${profile}; explicit policy revision required, never inherit coordinator settings.`);
+  return {
+    policyVersion: MODEL_POLICY_VERSION, profile, model: selected[0], thinking: selected[1],
+    phase: request.phase, complexity: request.complexity, highRisk: request.highRisk,
+    rationale: request.rationale.trim(), fallback: selected !== PROFILES[profile][0],
+  };
+}