codex-workflow-v2 2.0.0-beta.13.1 → 2.0.0-beta.13.3

package/plugins/codex-workflow-gateway/scripts/chat-registry.mjs

@@ -12,6 +12,7 @@ import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { randomUUID } from 'node:crypto';
+import { dispatchAction, dispatchInput } from './chat-dispatch.mjs';
 
 const TYPES = new Set(['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit']);
 const LOCK_STALE_MS = 30_000;
@@ -25,6 +26,14 @@ export function allocateChat(options) {
     const sequence = registry.nextSequence;
     const reservationId = randomUUID();
     const candidates = buildTitleCandidates({ ...options, sequence });
+    const existing = registry.entries.find(entry => entry.status !== 'abandoned'
+      && entry.type === options.type && entry.entityId === options.entityId
+      && entry.milestoneOrdinal === requiredOrdinal(options.milestoneOrdinal, 'M')
+      && entry.taskOrdinal === optionalOrdinal(options.taskOrdinal, 'T')
+      && entry.stepOrdinal === optionalOrdinal(options.stepOrdinal, 'S')
+      && (['task', 'coordinator'].includes(options.type)
+        || entry.attempt === positiveInteger(options.attempt ?? 1, 'attempt')));
+    if (existing) return { ...publicEntry(existing), reused: true };
     const entry = {
       sequence,
       reservationId,
@@ -92,6 +101,17 @@ export function bindChat(options) {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
     if (!entry.titleVerified) throw new Error('Chat title must pass exact readback before binding.');
+    if (options.threadId?.startsWith('client-')) throw new Error('Cannot bind a pending clientThreadId.');
+    if (entry.threadId && (entry.threadId !== options.threadId || entry.hostId !== options.hostId)) {
+      throw new Error('Reservation already bound to another thread.');
+    }
+    if (registry.entries.some(other => other !== entry && other.threadId === options.threadId
+      && other.hostId === options.hostId)) throw new Error('Thread already belongs to another reservation.');
+    if (entry.dispatch && (entry.dispatch.state !== 'resolved' || entry.dispatch.candidateThreadId !== options.threadId
+      || entry.dispatch.hostId !== options.hostId
+      || entry.dispatch.observations.at(-1)?.title !== entry.observedTitle)) {
+      throw new Error('Tracked creation must pass correlated read_thread observation before binding.');
+    }
     entry.threadId = requiredText(options.threadId, 'threadId');
     entry.hostId = requiredText(options.hostId, 'hostId');
     entry.status = 'bound';
@@ -106,6 +126,9 @@ export function retitleChat(options) {
   return withRegistryLock(options.projectId, options.registryHome, (file) => {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
+    if (entry.dispatch && options.entityId !== entry.entityId) {
+      throw new Error('Tracked dispatch entity is immutable; retitle cannot replace its identity.');
+    }
     entry.entityId = requiredText(options.entityId, 'entityId');
     entry.semanticTitle = requiredText(options.semanticTitle, 'semanticTitle');
     entry.candidates = buildTitleCandidates({
@@ -134,6 +157,7 @@ export function abandonChat(options) {
   return withRegistryLock(options.projectId, options.registryHome, (file) => {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
+    if (entry.dispatch || entry.threadId) throw new Error('Cannot abandon a started creation or bound chat to enable a duplicate.');
     entry.status = 'abandoned';
     entry.updatedAt = new Date().toISOString();
     writeRegistry(file, registry);
@@ -141,6 +165,20 @@ export function abandonChat(options) {
   });
 }
 
+export function dispatchChat(options) {
+  validateProjectId(options.projectId);
+  return withRegistryLock(options.projectId, options.registryHome, file => {
+    const registry = readRegistry(file, options.projectId);
+    const entry = requireEntry(registry, options.reservationId);
+    const result = dispatchAction(options.action, entry, options.input);
+    if (options.action !== 'dispatch-status') {
+      entry.updatedAt = new Date().toISOString();
+      writeRegistry(file, registry);
+    }
+    return result;
+  });
+}
+
 export function showRegistry(options) {
   validateProjectId(options.projectId);
   const file = registryFile(options.projectId, options.registryHome);
@@ -217,7 +255,10 @@ function withRegistryLock(projectId, registryHome, operation) {
 
 function lockIsStale(lock) {
   try {
-    return Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS;
+    if (Date.now() - statSync(lock).mtimeMs <= LOCK_STALE_MS) return false;
+    const owner = JSON.parse(readFileSync(path.join(lock, 'owner.json'), 'utf8'));
+    if (!Number.isSafeInteger(owner.pid) || owner.pid < 1) return false;
+    try { process.kill(owner.pid, 0); return false; } catch (error) { return error?.code === 'ESRCH'; }
   } catch {
     return false;
   }
@@ -253,7 +294,7 @@ function readRegistry(file, projectId) {
 
 function writeRegistry(file, registry) {
   const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { flag: 'wx' });
+  writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   renameSync(temporary, file);
 }
 
@@ -275,6 +316,7 @@ function publicEntry(entry) {
     threadId: entry.threadId,
     hostId: entry.hostId,
     status: entry.status,
+    dispatchState: entry.dispatch?.state ?? null,
   };
 }
 
@@ -334,6 +376,11 @@ function cli() {
     projectId: option(args, 'project-id'),
     registryHome: option(args, 'registry-home'),
   };
+  if (action?.startsWith('dispatch-') || action === 'supervision-record' || action === 'model-select') {
+    const file = option(args, 'file');
+    return dispatchChat({ ...common, action, reservationId: option(args, 'reservation-id'),
+      input: file ? dispatchInput(file) : {} });
+  }
   if (action === 'allocate') return allocateChat({
     ...common,
     type: option(args, 'type'),
@@ -363,7 +410,7 @@ function cli() {
   });
   if (action === 'abandon') return abandonChat({ ...common, reservationId: option(args, 'reservation-id') });
   if (action === 'show') return showRegistry(common);
-  throw new Error('Use allocate, retitle, readback, bind, abandon, or show.');
+  throw new Error('Use allocate, retitle, readback, bind, abandon, show, dispatch-begin/result/discover/resolve-duplicates/observe/status, supervision-record, or model-select.');
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(new URL(import.meta.url).pathname)) {

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -278,22 +278,32 @@ because the sandboxed call returned a permission error; those actions require th
 authorization and evidence.
 
 When `next` includes `writerTokenContract`, treat it as an exact first-call precondition. Retain
-the active writer lease from the first-field `writerLeaseReceipt` returned by `task run` and pass it using the advertised `option` for that
-transition. The token is sensitive: never print, summarize, persist, or substitute a redacted
-fingerprint. Stop before mutation if the active lease is unavailable. This input contract is
-independent from `gitMutationPolicy`; satisfy both when both are present.
-
-On successful `task handoff-prepare`, consume the first-field `credentialHandoff` before reading
-the Task/event/bundle payload. Retain its one-time token only in working memory and use it exactly
-once with the declared `action` and `option` for the declared `targetActor`. Successful `task claim`
-returns a first-field `writerLeaseReceipt`; retain that lease and pass it to claimed `task run` when
-the fresh `next.writerTokenContract` requires it. Successful `task run` returns the refreshed
-`writerLeaseReceipt`; retain it only until Core releases that lease.
-Never search later payload fields for either credential and never copy credentials into evidence.
+the `writerCredentialReference` returned by `task run`, `task claim`, or
+`task writer-credential-replace`, including its public `credentialRef`, actor, allowed actions and
+`expiresAt`. Pass the reference using the advertised `--writer-credential-ref` option. The secret
+stays in the local vault: never read, print, copy, or edit vault records or substitute a redacted
+token. This input contract is independent from `gitMutationPolicy`; satisfy both when present.
+
+Before every credential-consuming mutation, especially after an independent review or a pause,
+compare the held reference's `expiresAt` with the current time and verify its actor/action binding.
+A live or renewed lease does not extend an existing reference's expiry; `reuse-reference` is not
+permission to reuse an expired reference. If the reference is expired, missing, consumed, or its
+validity cannot be established, use only the simultaneously advertised
+`next.writerCredentialRecovery` action with its exact Task, revision and `requiredActor` before
+attempting the blocked mutation. Follow successful replacement with `status` then `next`, retain
+the newly returned reference and expiry, and discard the prior reference. If recovery is not
+advertised, stop before mutation. Never extend expiry manually or retry with the old reference.
+
+Successful `task handoff-prepare` returns a one-time `claimCredentialReference`; use its
+`credentialRef` with the declared `--claim-credential-ref` option for `task claim` and the bound
+actor. Successful claim consumes that reference. A renewed claim/run may return
+`writerCredential.disposition=renewed` without a new reference; the held reference must still
+satisfy its own expiry and binding checks. Never search later payload fields for raw tokens and
+never copy credentials into evidence.
 
 When a passed final Task review routes to `task result-set`, pass the active writer credential and,
 for claimed C1 posture, the exact claimant as `--actor`. A successful `result-set` consumes that
-execution lease before entering `awaiting_final_acceptance`; never reuse the old token and never
+execution lease before entering `awaiting_final_acceptance`; never reuse the old reference and never
 leave or manufacture a lease while waiting for the Human decision. After `task accept`, follow fresh
 `next`: local merge or external merge confirmation normally advertises
 `task writer-credential-replace`, which acquires a new bounded lease for the exact recovery actor.
@@ -319,9 +329,11 @@ A Milestone chat and its Task chats are separate user-visible execution contexts
 conversation. Create every Task chat as a brand-new Codex task with `create_thread`, an explicit
 Task-only prompt, and an explicit title. Never use `fork_thread`, thread handoff, or a continuation
 of the Milestone chat to create a Task chat: those paths carry parent history into the child. A
-failure to create a new task is a routing blocker. Check the thread list for an already-created
-exact Task ID, retry `create_thread` once sequentially when none exists, and then stop; never fall
-back to a fork.
+confirmed failure to create a new task is a routing blocker. A pending `clientThreadId`, timeout,
+lost response, or absence from `list_threads` does not establish failure and never permits a
+second creation. Persist the attempt before calling the App, resolve its actual ID and confirm
+it with `read_thread`; never fall back to a fork. Read and follow
+`../../references/chat-dispatch.md` for the executable dispatch/recovery and model-selection contract.
 
 Codex App may wrap the supplied prompt in a host-generated `codex_delegation` envelope containing
 only routing provenance such as `source_thread_id`. That envelope is permitted and is not parent
@@ -366,6 +378,22 @@ chat type, Milestone/Task/Step membership ordinals, semantic title, authoritativ
 review attempt. Use returned `requestedTitle` verbatim. Never derive its prefix from
 `list_threads`, sidebar order, a count, or `count + 1`: allocation atomically reserves the
 project-wide monotonically increasing `#NNN`, and an abandoned number is never reused.
+Allocation reuses an existing matching reservation. For a new dispatch, call `dispatch-begin`
+with the closed packet and explicit model request, then call the App exactly once only when
+`createAllowed=true`, using returned `createArgs` unchanged. Record the full result via
+`dispatch-result`, resolve/read back via `dispatch-discover` and `dispatch-observe`, and bind.
+After restart use `dispatch-status`; an unresolved creation cannot be abandoned to create another.
+For legacy reservations without a dispatch marker, first reconcile existing App/source evidence;
+absence of the new marker does not prove no earlier creation occurred.
+
+When the user authorizes model selection, use the versioned role/phase/complexity matrix rather
+than coordinator inheritance. Both `model` and App `thinking` must be explicit in create arguments.
+Use the destination host's current supported model/effort catalog; no guessed aliases or silent
+fallback. Before a materially different phase, `model-select` returns explicit follow-up settings
+for the same bound thread. Routine lifecycle work should not retain planning/review reasoning by
+accident; security-sensitive and complex work must not be classified as routine to save tokens.
+Without user authorization for model selection, do not manufacture it from a registry field;
+resolve that policy choice before starting a new dispatch.
 
 The builder owns these compact title families; callers must not hand-compose variants:
 
@@ -387,7 +415,7 @@ Put `#NNN` and membership ordinals first so clipped sidebar titles remain distin
 inherit the parent title, use a generic title such as `Milestone recovery` / `Task execution`, or
 reuse one title for different entity IDs. Maintain the registry-backed
 `Task ID -> thread ID -> title` mapping in
-the Milestone chat. Before dispatch, verify from the thread list that the title contains the exact
+the Milestone chat. Before supervision, verify from actual `read_thread` evidence that the title contains the exact
 ordinal and entity ID, is unique, and the new chat input contains only its TaskContextPacket plus
 the permitted host routing envelope. Never trust the `create_thread` title argument without a
 readback: pass the observed title to registry `readback`. If it returns `renameRequired=true`,
@@ -396,6 +424,12 @@ compact the role while preserving `#NNN`, membership ordinals, attempt, and the
 Never invent another fallback or abbreviate the ID. Bind the verified entry to `threadId` and
 `hostId`; if all candidates fail, mark it blocked and stop routing. Visual sidebar clipping is
 harmless only when exact API readback still matches. Do not dispatch while title/context is wrong.
+Persist the single supervisor, cursor and next action using `supervision-record`. Large tool/CLI
+JSON must be saved completely to a private local file and parsed there, with only bounded non-secret
+summaries printed. For an uncertain mutation outcome, run fresh `status -> next` before recovery;
+never replay a mutation merely because displayed output was truncated. Review the exact serialized
+external-review envelope passed to Core, not a separately reconstructed object. Public CREF expiry
+is independent of lease expiry and must be checked before every credential-consuming transition.
 
 After every significant Task Step boundary—completion, failure, block, skip, sealed-review result,
 or corrective decision—the Task chat prints a compact Task progress Markdown table from fresh
@@ -571,6 +605,19 @@ When `next` returns a derived C1 Worker or corrective Auditor actor, use that ex
 asking the user to name one. Derivation removes a routing pause; handoff claim, writer lease,
 strict review, and auditor-independence checks remain mandatory.
 
+The beta.13.2 pending strict-review update exception is documented in
+`docs/pending-review-update.md` in the exact package. An exact external target runner may run
+only `update pending-review-source-preflight` against the known beta.13.1 source. Require its
+verified runtime build, exact Task/revision/Plan/HEAD/pending binding and no blockers. If it
+returns an exact stale Task lease repair, run that `locks repair` with the installed source and
+repeat preflight. Preserve the eligible receipt outside the checkout; transport only the two
+bound dependency commits on base and Task, then install the target locally. Fresh local `next`
+must advertise `update pending-review-dependency-recover`; run its matching read-only preflight
+with `--file <source-receipt>` before recovery. Recovery does not approve Knowledge or review.
+Use the original pending product SHA through the newly sealed external packet and record,
+then follow fresh credential/context-refresh/ordinary lifecycle actions. Never treat this as
+permission for other external-runner mutations, product transport, or manual state repair.
+
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.