codex-workflow-v2 2.0.0-beta.13.2 → 2.0.0-beta.13.3

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -463,7 +463,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает `packageVersion=2.0.0-beta.13.2`, protocol 2, state schema 2 и beta.13
+- handshake подтверждает `packageVersion=2.0.0-beta.13.3`, protocol 2, state schema 2 и beta.13
   capabilities;
 - routine observation начинается с компактного `status`; `status --full` запрашивается только для
   расследования, которому действительно нужна полная historical projection;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -57,7 +57,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.2`, `protocolVersion=2`,
+Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.3`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy, host-safe credential reference, failed-Step continuation transaction,
 cause-bound rolling refinement, structural production edge, compact status, reviewer runtime preflight,
@@ -482,7 +482,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 # 14. Итоговый checklist пользователя
 
 - beta.13.1 exact package и новый bundled gateway установлены; handshake показывает
-  `packageVersion=2.0.0-beta.13.2`, protocol/state schema `2/2` и beta.13 capabilities;
+  `packageVersion=2.0.0-beta.13.3`, protocol/state schema `2/2` и beta.13 capabilities;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -15,7 +15,7 @@ authority сами: mutating permission определяется runtime state
 
 | Параметр beta.13 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.13.2` |
+| npm package | `codex-workflow-v2@2.0.0-beta.13.3` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -333,7 +333,7 @@ local reviewer внутри Codex App sandbox.
 | Повтор stable reviewer `causeId` с `planConflict=true` | Root-cause replan той же Task обязателен |
 | Похожий prose, номер попытки или reviewer cause без Plan conflict | Не создаёт replan authority |
 | Finding `route=fix` или route отсутствует | Продолжить ту же Task/Step независимо от attempt count |
-| Finding `route=replan` с exact Plan conflict | `task plan-set`; меняются только implementation Steps |
+| Finding `route=replan` с exact Plan conflict, включая первый провал | Штатный corrective yield/replan; повторный run запрещён, меняются только implementation Steps |
 | `route=replan` без exact conflict | Невалидный review result, state не меняется |
 | Explicit `split-required` | Structural replacement stop |
 | Exact beta.11 attempt-four `stop-escalate` | Append-only Human-confirmed compatibility override |
@@ -767,7 +767,7 @@ dirty update.
 observed-route matrix/compact-status/reviewer-runtime tests, legacy compatibility regressions,
 `npm run test:signal-t10-check-support-e2e`, `npm run test:signal-remediation-e2e`,
 `npm run pack:check`, `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
-`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.2` tag binding и append-only
+`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.3` tag binding и append-only
 real-agent lifecycle log. Candidate проверяется из clean source checkout; missing built module не должен
 превращаться в stack trace, а обязан быть детерминированно собран или диагностирован release gate.
 

package/docs/release.md

@@ -4,6 +4,20 @@ The npm package is `codex-workflow-v2` with public visibility. Consumers must pi
 an exact version. Stable compatibility covers the latest minor release of the current
 major only; older minors are unsupported unless a release note explicitly says otherwise.
 
+## beta.13.3 explicit Plan conflict recovery
+
+A first independently recorded reviewer `route=replan` with a validated Plan conflict
+blocks current execution immediately and exposes corrective replan. Historical
+rolling-cause classification remains unchanged; valid older histories are not
+reclassified as corrupt. Ordinary new fix findings still continue in the same Task.
+The failure transaction yields C1 and releases the exact writer lease. An older
+failed Task with a retained C1 claim follows credential recovery and
+`task corrective-yield` before planning; it cannot run or change its Plan while
+the claim remains. Recovery binds the validated remediation event and preserves
+the Task, review evidence, and existing worker identity.
+The release also includes durable App dispatch and explicit role/phase model selection;
+see the packaged `references/chat-dispatch.md`.
+
 ## beta.13.2 review recovery gate
 
 The patch preserves protocol 2 and canonical entity schema 2. In addition to the
@@ -63,8 +77,8 @@ surface and fails unless all of these release contracts remain present:
   adds C1 yield before root-cause replan; the Signal-shaped E2E continues through recovery, the next
   ordinary Step, Task completion, and next-Task dispatch;
 - five distinct or unclassified review findings continue in the same Task without a numeric cap,
-  while root-cause replan requires either a repeated normalized mechanical failure or the same
-  stable external reviewer `causeId` with `planConflict=true`;
+  while repeated normalized mechanical failures still require root-cause replan; a current
+  explicit external reviewer Plan conflict requires replan immediately, without a synthetic retry;
 - a transitive same-component check owner may refine the same Task only under the unchanged semantic
   boundary; for a multi-Step `runtime-composition` consumer the independent PRA classification,
   not a planner opt-in, requires an edge from a transitive owner to an exact executable consumer

package/docs/updating-existing-project.md

@@ -636,8 +636,16 @@ title в registry readback и применяйте только возвращё
 быть уникален и содержать exact `#NNN`, membership ordinal и ID. Input должен состоять из
 TaskContextPacket; допустима только добавленная Codex App служебная `codex_delegation`-обёртка с
 `source_thread_id`, но не parent turns или transcript. Если title отсутствует или нормализован
-неверно, переименуйте и перепроверьте. Ошибка `create_thread` допускает один
-последовательный retry после проверки списка, но не разрешает fallback на `fork_thread`.
+неверно, переименуйте и перепроверьте. Pending `clientThreadId`, тайм-аут или отсутствие в
+`list_threads` не доказывают, что создание не состоялось, и не разрешают повторный `create_thread`.
+До первого вызова сохраните `dispatch-begin`; после него используйте `dispatch-result/status`,
+поиск коррелированного сеанса и `dispatch-observe` с фактическим `read_thread`. На одну
+резервацию выдаётся только одно разрешение создания. Не обходите его новой резервацией или fork.
+Полный контракт восстановления, сохранения supervisor/cursor и явного выбора `model`/`thinking`
+по роли, фазе и сложности находится в
+`plugins/codex-workflow-gateway/references/chat-dispatch.md`. Выбор модели требует соответствующего
+поручения пользователя и актуального списка поддерживаемых пар на целевом host; нельзя молча
+наследовать дорогую конфигурацию координатора или снижать уровень независимого аудита.
 Создавайте или переиспользуйте Task-чат непосредственно перед dispatch этой Task, а не как пустой
 placeholder для всего membership; `T<NN>` берите только из утверждённого membership order.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13.2",
+  "version": "2.0.0-beta.13.3",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/chat-dispatch.md

@@ -0,0 +1,128 @@
+# Durable App dispatch and explicit model selection
+
+This is an App orchestration journal, not Workflow authority. It does not call the App, approve
+Git writes, renew grants, mint credentials, or replace Core status/next. All commands below use
+`node <exact-package>/plugins/codex-workflow-gateway/scripts/chat-registry.mjs` and the existing
+24-hex Workflow `--project-id`. The App project ID is a separate field.
+
+## One reservation, one creation attempt
+
+`allocate` reuses the same non-abandoned role/entity/membership/attempt reservation. Task and
+Coordinator allocations also reuse it when a caller changes the attempt number. Review attempts
+advance only after the actual Workflow review cycle advances. Never invent a new attempt or
+reservation to bypass unresolved creation. Existing v1 registries remain readable; legacy bound
+threads remain usable with explicit model/thinking arguments from the same policy; `model-select`
+and `supervision-record` currently require a tracked dispatch and do not retrofit legacy evidence.
+Legacy unbound reservations may have already created a chat: reconcile
+those using real App/source evidence before using the new dispatch flow.
+
+1. Save the closed context packet to a private local file. Do not include bearer credentials,
+   parent transcript, or approval narratives. Prepare a private dispatch request JSON:
+
+   ```json
+   {
+     "repositoryRoot": "/absolute/canonical/repository",
+     "appProjectId": "project-id-from-list-projects",
+     "hostId": "local",
+     "promptFile": "/private/tmp/task-context.txt",
+     "modelRequest": {
+       "phase": "planning",
+       "complexity": "standard",
+       "highRisk": false,
+       "rationale": "New multi-file implementation plan with established requirements.",
+       "availableModels": [
+         {"id": "gpt-5.6-sol", "reasoningEfforts": ["low", "medium", "high", "xhigh", "max", "ultra"]}
+       ]
+     }
+   }
+   ```
+
+   Populate `availableModels` from the destination App tool's actual model/effort contract, not
+   this example, the parent's settings, API pricing pages, or a guessed alias. Explicit user
+   authorization to select models is required; journal input is not user authorization.
+2. Run `dispatch-begin --reservation-id ID --file request.json` **before** `create_thread`.
+   Save its complete output to a mode-600 file. It atomically persists a creation marker, packet
+   hashes, repository binding and requested model selection, then returns `createAllowed:true`
+   and exact `createArgs` including `model` and App field `thinking`.
+3. Only the process receiving that one permission may make **one** `create_thread(createArgs)`
+   call. A second begin, even after restart or timeout, returns `createAllowed:false` and no
+   create arguments. Do not reissue the external call after a lost/ambiguous response. The marker
+   prepended to the packet is routing provenance, not parent history.
+4. Save the full App result locally, normalize its successful tool text JSON to
+   `{"result":{"clientThreadId":"client-new-thread:...","hostId":"local"}}` or
+   `{"result":{"threadId":"actual-uuid","hostId":"local"}}`, and run `dispatch-result`.
+   Preserve raw evidence separately. Never parse truncated displayed stdout as the full receipt.
+   Invalid JSON cannot change the journal. A pending client ID is never a usable thread ID.
+5. Use `dispatch-status` to resume. Missing `list_threads` results are not proof of failure.
+   If the actual ID is unavailable, identify candidate rollout files from creation-time/worktree
+   evidence and run `dispatch-discover --file candidates.json`, where the file is
+   `{"sessionFiles":["/absolute/rollout.jsonl"]}`. The helper reads only supplied files, checks
+   actual session metadata, exact original dispatched prompt (including the App's routing XML),
+   and the Git common directory. It ignores guardian/subagent sessions and unrelated prompts.
+   It prints candidate IDs/paths only, never transcripts or reasoning. Use bounded candidate
+   lists, not vault searches. Malformed, oversized or partially written files need a later fresh
+   read; they never authorize another creation.
+6. Confirm a correlated candidate using `read_thread`. Save its full response as
+   `{"observation": <parsed read_thread JSON>}` and run `dispatch-observe`. It checks actual UUID,
+   host, repository/worktree and App project when supplied. One candidate still requires App
+   readback; several candidates produce a duplicate conflict and require explicit disposition,
+   not arbitrary selection. After confirming one canonical child, inspect every other candidate,
+   reconcile any work it performed, and archive only idle duplicates. Record
+   `dispatch-resolve-duplicates` with `canonicalThreadId` and `dispositions`, one object per duplicate:
+   `{threadId, observation: <read_thread JSON>, archiveResult: {threadId, archived: true}}`.
+   Preserve the actual archive tool receipt; never fabricate it. Repeat canonical readback and bind.
+   Candidate history is retained and no creation permit is restored. This is a local evidence
+   check, not independent App attestation.
+7. Run ordinary title `readback`/rename until exact match. After any rename, repeat
+   `dispatch-observe` with fresh App readback, then `readback` and `bind`. Binding a tracked
+   dispatch requires the same actual ID, host and observed title. Rebinding it to another child,
+   binding a client ID or sharing one child between reservations is rejected.
+8. Run `supervision-record --file report.json` with `threadId`, `ownerThreadId`, `state`
+   (`active|attention|completed`), `cursor` and `nextAction`. Persist significant wait boundaries;
+   only that supervisor waits for this child. The journal stores routing state, not a Workflow
+   verdict. Do not put secrets, CREFs or confirmation codes in it. On restart, read the child and
+   fresh Core status/next before continuing. Worker reports stay local; the coordinator pulls.
+
+A crash between durable begin and actual submission is deliberately ambiguous. There is no
+App idempotency-key API here, so this provides **at most one create permit per reservation**,
+not an exactly-once guarantee. Never clear the marker, abandon it, or expire it by time to retry.
+If no positive creation evidence can be found, report that exact unresolved App operation. A
+permission denial is a separate real gate; do not reroute it through another chat. Fresh user
+approval does not establish that an ambiguous prior creation never happened.
+
+## Model matrix
+
+The versioned policy is `scripts/chat-model-policy.mjs`. It expresses a conservative relative
+cost/latency preference, not measured savings or guaranteed account availability:
+
+| Work | Preferred model | App thinking | Compatible fallback |
+| --- | --- | --- | --- |
+| Routine mechanical transitions, formatting, retrieval | gpt-5.4-mini | low | gpt-5.6-luna / low |
+| Coordinator supervision; small implementation | gpt-5.6-luna | medium | gpt-5.6-terra / medium |
+| Standard implementation | gpt-5.6-terra | medium | gpt-5.6-sol / medium |
+| Task planning | gpt-5.6-sol | medium | gpt-6-astra / medium |
+| Routine Step review | gpt-5.6-terra | medium | gpt-5.6-sol / medium |
+| Standard Step review, final review, plan/corrective audit | gpt-5.6-sol | high | gpt-6-astra / high |
+| Complex work or high risk, any role | gpt-6-astra | high | gpt-5.6-sol / high |
+
+`routine` means a small, well-specified change or mechanical action with an existing check;
+`standard` is ordinary multi-file work; `complex` covers new architecture, unresolved concurrency,
+recovery/provenance or distributed state. Mark `highRisk` for authorization, security-sensitive
+paths, data-loss exposure or irreversible migrations. The coordinator records the concrete
+rationale; classification is a human/agent judgment, not an automatic risk detector. Unknown
+complexity is not routine. Review/audit role floors override a falsely mechanical phase. No
+automatic xhigh/max/ultra, and no escalation merely because a review failed or a tool timed out.
+
+The policy chooses only a listed supported pair. If neither preferred nor fallback pair is
+available, stop selection rather than silently inheriting the coordinator or lowering the review
+floor. API docs explain the reasoning/latency tradeoff, while App availability and accepted field
+names come from the live App tool contract:
+https://developers.openai.com/api/docs/guides/latest-model
+
+For a phase change in an existing bound chat, call `model-select` with its same `threadId` and
+fresh `modelRequest`; copy the returned `followUpArgs` into `send_message_to_thread` with the
+closed follow-up prompt. For example, planning uses Sol/medium, implementation Terra/medium,
+then mechanical lifecycle work Mini/low. Do not create another Task just to switch model.
+Keep the previous selection unless the phase/risk/scope changes materially. The journal records
+requested settings; tool acceptance/runtime readback, when available, is required to claim the
+actual model used. A model change never changes role, scope, credentials or approval authority.

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -67,6 +67,10 @@
   progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
 - `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title
   families, verifies exact readback, supplies deterministic fallbacks, and binds the verified chat.
+  It also journals a single creation permit, pending/actual IDs, evidence-based resolution and
+  supervision cursors. Missing App listings never permit a retry. See `chat-dispatch.md` for
+  dispatch commands and the explicit role/phase model + thinking policy. These are App routing
+  helpers; they do not change Workflow protocol/state schema or grant approval authority.
 
 ## Handshake
 

package/plugins/codex-workflow-gateway/scripts/chat-dispatch.mjs

@@ -0,0 +1,185 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { selectChatModel } from './chat-model-policy.mjs';
+
+const hash = text => createHash('sha256').update(text).digest('hex');
+const text = (value, name) => {
+  if (typeof value !== 'string' || !value.trim()) throw new Error(`${name} is required.`);
+  return value.trim();
+};
+const actualId = value => {
+  const id = text(value, 'actual threadId');
+  if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)) throw new Error('Expected actual thread UUID, not clientThreadId.');
+  return id;
+};
+function jsonFile(file) {
+  if (statSync(file).size > 16 * 1024 * 1024) throw new Error('Input file exceeds 16 MiB.');
+  return JSON.parse(readFileSync(file, 'utf8'));
+}
+function commonGitDir(cwd) {
+  return realpathSync(execFileSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
+    cwd, encoding: 'utf8', timeout: 5000, maxBuffer: 1024 * 1024,
+  }).trim());
+}
+function promptMatches(value, digest) {
+  if (typeof value !== 'string') return false;
+  if (hash(value) === digest) return true;
+  const wrapped = /^<codex_delegation>\s*<source_thread_id>[^<]+<\/source_thread_id>\s*<input>([\s\S]*)<\/input>\s*<\/codex_delegation>$/.exec(value);
+  return wrapped !== null && hash(wrapped[1]) === digest;
+}
+function view(entry) {
+  const d = entry.dispatch;
+  return {
+    reservationId: entry.reservationId, state: d?.state ?? (entry.threadId ? 'legacy-bound' : 'untracked'),
+    createAllowed: false, dispatchId: d?.id ?? null, clientThreadId: d?.clientThreadId ?? null,
+    threadId: entry.threadId ?? d?.candidateThreadId ?? null, hostId: d?.hostId ?? entry.hostId ?? null,
+    selection: d?.selection ?? null, supervision: d?.supervision ?? null,
+    candidates: d?.candidates ?? [],
+    nextAction: entry.threadId ? 'supervise-existing' : d?.state === 'resolved' ? 'title-readback-and-bind'
+      : d ? 'resolve-existing-creation' : 'dispatch-begin',
+  };
+}
+export function dispatchAction(action, entry, input = {}) {
+  if (action === 'dispatch-status') return view(entry);
+  if (action === 'dispatch-begin') {
+    // A durable marker is committed BEFORE the external call. Even a lost response never permits another call.
+    if (entry.dispatch || entry.threadId) return view(entry);
+    if (entry.status === 'abandoned' || entry.status === 'blocked') throw new Error('Reservation is not dispatchable.');
+    const repositoryRoot = realpathSync(text(input.repositoryRoot, 'repositoryRoot'));
+    const gitDir = commonGitDir(repositoryRoot);
+    const appProjectId = text(input.appProjectId, 'appProjectId');
+    const hostId = text(input.hostId, 'hostId');
+    const promptPath = realpathSync(text(input.promptFile, 'promptFile'));
+    if (statSync(promptPath).size > 1024 * 1024) throw new Error('TaskContextPacket exceeds 1 MiB.');
+    const prompt = readFileSync(promptPath, 'utf8');
+    if (!prompt.trim() || !prompt.includes(entry.entityId)) throw new Error('Prompt must include the exact entity ID.');
+    const selection = selectChatModel(entry.type, input.modelRequest);
+    const id = randomUUID();
+    const marker = `[workflow-dispatch:${id}:${hash(prompt)}]`;
+    const dispatchedPrompt = `${marker}\n${prompt}`;
+    entry.dispatch = {
+      version: 1, id, state: 'creating', appProjectId, hostId, repositoryRoot, gitDir,
+      promptPath, promptHash: hash(prompt), dispatchedPromptHash: hash(dispatchedPrompt), marker,
+      selection, selectionHistory: [selection], clientThreadId: null, candidateThreadId: null,
+      candidates: [], observations: [], createdAt: new Date().toISOString(),
+    };
+    return { ...view(entry), createAllowed: true, nextAction: 'create-thread-once', createArgs: {
+      target: { type: 'project', projectId: appProjectId, environment: { type: 'worktree' } },
+      title: entry.requestedTitle, prompt: dispatchedPrompt, model: selection.model, thinking: selection.thinking,
+    } };
+  }
+  const d = entry.dispatch;
+  if (!d) throw new Error('No tracked dispatch; reconcile legacy chats manually, never assume creation failed.');
+  if (action === 'dispatch-result') {
+    const result = input.result;
+    if (!result || result.hostId !== d.hostId) throw new Error('Create result host mismatch.');
+    if (result.threadId && result.clientThreadId) throw new Error('Ambiguous create result.');
+    if (result.threadId) {
+      const id = actualId(result.threadId);
+      if (d.candidateThreadId && d.candidateThreadId !== id) throw new Error('Conflicting actual thread IDs.');
+      d.candidateThreadId = id;
+    } else {
+      const id = text(result.clientThreadId, 'clientThreadId');
+      if (!id.startsWith('client-new-thread:')) throw new Error('Invalid pending clientThreadId.');
+      if (d.clientThreadId && d.clientThreadId !== id) throw new Error('Conflicting creation attempts; reconcile duplicates.');
+      d.clientThreadId = id;
+    }
+    if (d.state === 'creating') d.state = 'pending';
+    return view(entry);
+  }
+  if (action === 'dispatch-discover') {
+    // Read only specifically supplied session files; never scan credential stores or print transcripts/reasoning.
+    if (!Array.isArray(input.sessionFiles) || input.sessionFiles.length > 200) throw new Error('Supply at most 200 candidate session files.');
+    const found = new Map(d.candidates.map(c => [c.threadId, c]));
+    for (const file of input.sessionFiles) {
+      if (statSync(file).size > 16 * 1024 * 1024) throw new Error('Session exceeds 16 MiB; narrow evidence required.');
+      const lines = readFileSync(file, 'utf8').split('\n');
+      const meta = JSON.parse(lines[0]).payload;
+      if (!meta || !['vscode', 'cli'].includes(meta.source) || typeof meta.cwd !== 'string') continue;
+      const rows = lines.slice(1).filter(Boolean).map(line => JSON.parse(line));
+      const bound = rows.some(row => {
+        if (row.type !== 'response_item') return false;
+        const p = row.payload;
+        // Actual App rollout format: a create_thread function output containing routing-only XML.
+        if (p?.type === 'function_call_output' && p.name === 'create_thread' && p.namespace === 'codex_app') {
+          return promptMatches(p.output, d.dispatchedPromptHash);
+        }
+        return p?.type === 'message' && p.role === 'user' && p.content?.some(c =>
+          ['input_text', 'text'].includes(c.type) && promptMatches(c.text, d.dispatchedPromptHash));
+      });
+      if (!bound) continue;
+      if (commonGitDir(meta.cwd) !== d.gitDir) throw new Error('Session belongs to another repository.');
+      const id = actualId(meta.id);
+      found.set(id, { threadId: id, cwd: realpathSync(meta.cwd), sourceFile: realpathSync(file) });
+    }
+    d.candidates = [...found.values()];
+    if (d.candidates.length > 1) d.state = 'duplicate-conflict';
+    return view(entry);
+  }
+  if (action === 'dispatch-resolve-duplicates') {
+    const canonical = actualId(input.canonicalThreadId);
+    if (entry.threadId && entry.threadId !== canonical) throw new Error('Cannot replace a bound child.');
+    if (d.candidateThreadId && d.candidateThreadId !== canonical) throw new Error('Cannot replace the correlated create result.');
+    if (!d.candidates.some(c => c.threadId === canonical)) throw new Error('Canonical child must be a discovered candidate.');
+    const others = d.candidates.filter(c => c.threadId !== canonical);
+    if (!others.length || !Array.isArray(input.dispositions) || input.dispositions.length !== others.length) {
+      throw new Error('Require one idle readback and archive receipt for every duplicate.');
+    }
+    const receipts = others.map(candidate => {
+      const matching = input.dispositions.filter(x => x?.threadId === candidate.threadId);
+      if (matching.length !== 1) throw new Error('Duplicate disposition missing or repeated.');
+      const item = matching[0];
+      const t = item.observation?.thread;
+      if (t?.id !== candidate.threadId || t.kind !== 'codex' || t.hostId !== d.hostId
+        || t.status?.type !== 'idle' || realpathSync(text(t.cwd, 'duplicate cwd')) !== candidate.cwd
+        || commonGitDir(t.cwd) !== d.gitDir || item.archiveResult?.threadId !== candidate.threadId
+        || item.archiveResult?.archived !== true) throw new Error('Duplicate requires matching idle readback and successful archive receipt.');
+      return { threadId: candidate.threadId, archived: true, recordedAt: new Date().toISOString() };
+    });
+    d.duplicateDisposition = { canonicalThreadId: canonical, archived: receipts };
+    d.state = 'pending';
+    return view(entry);
+  }
+  if (action === 'dispatch-observe') {
+    const observation = input.observation;
+    const t = observation?.thread;
+    if (!t || t.kind !== 'codex' || t.hostId !== d.hostId) throw new Error('Require actual Codex read_thread observation on the bound host.');
+    const id = actualId(t.id);
+    if (d.candidates.length > 1 && (d.duplicateDisposition?.canonicalThreadId !== id
+      || d.candidates.some(c => c.threadId !== id && !d.duplicateDisposition.archived.some(a => a.threadId === c.threadId)))) {
+      throw new Error('Multiple candidates: explicit duplicate disposition required before binding.');
+    }
+    const candidate = d.candidates.find(c => c.threadId === id);
+    if (id !== d.candidateThreadId && !candidate) throw new Error('Uncorrelated thread; require create result or exact session prompt evidence.');
+    if (commonGitDir(text(t.cwd, 'thread cwd')) !== d.gitDir
+      || (candidate && realpathSync(t.cwd) !== candidate.cwd)) throw new Error('Readback repository/cwd mismatch.');
+    if (t.projectId !== undefined && t.projectId !== d.appProjectId) throw new Error('Readback App project mismatch.');
+    if (d.candidateThreadId && d.candidateThreadId !== id) throw new Error('Readback differs from create result.');
+    d.candidateThreadId = id;
+    d.state = 'resolved';
+    d.observations.push({ threadId: id, hostId: t.hostId, cwd: realpathSync(t.cwd),
+      title: text(t.title, 'observed title'), observedAt: new Date().toISOString() });
+    return view(entry);
+  }
+  if (action === 'supervision-record') {
+    if (!entry.threadId || input.threadId !== entry.threadId || input.ownerThreadId === entry.threadId) throw new Error('Require bound child and separate supervisor.');
+    const owner = actualId(input.ownerThreadId);
+    if (d.supervision && d.supervision.ownerThreadId !== owner) throw new Error('Supervisor already assigned; no parallel wait owner.');
+    if (!['active', 'attention', 'completed'].includes(input.state)) throw new Error('Invalid supervision state.');
+    d.supervision = { ownerThreadId: owner, state: input.state, cursor: input.cursor == null ? null : text(input.cursor, 'cursor'),
+      nextAction: text(input.nextAction, 'nextAction'), updatedAt: new Date().toISOString() };
+    return view(entry);
+  }
+  if (action === 'model-select') {
+    if (!entry.threadId || input.threadId !== entry.threadId) throw new Error('Phase changes require the same bound thread.');
+    const selection = selectChatModel(entry.type, input.modelRequest);
+    d.selection = selection;
+    d.selectionHistory.push(selection);
+    return { ...view(entry), followUpArgs: { threadId: entry.threadId, hostId: entry.hostId,
+      model: selection.model, thinking: selection.thinking } };
+  }
+  throw new Error(`Unknown dispatch action: ${action}`);
+}
+export function dispatchInput(file) { return jsonFile(file); }

package/plugins/codex-workflow-gateway/scripts/chat-model-policy.mjs

@@ -0,0 +1,43 @@
+// Relative cost/latency policy, not a price list or an availability oracle.
+export const MODEL_POLICY_VERSION = 'chat-model-policy-v1';
+const PROFILES = {
+  mechanical: [['gpt-5.4-mini', 'low'], ['gpt-5.6-luna', 'low']],
+  scoped: [['gpt-5.6-luna', 'medium'], ['gpt-5.6-terra', 'medium']],
+  implementation: [['gpt-5.6-terra', 'medium'], ['gpt-5.6-sol', 'medium']],
+  planning: [['gpt-5.6-sol', 'medium'], ['gpt-6-astra', 'medium']],
+  review: [['gpt-5.6-sol', 'high'], ['gpt-6-astra', 'high']],
+  'scoped-review': [['gpt-5.6-terra', 'medium'], ['gpt-5.6-sol', 'medium']],
+  complex: [['gpt-6-astra', 'high'], ['gpt-5.6-sol', 'high']],
+};
+const TYPES = ['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit'];
+export function selectChatModel(type, request) {
+  if (!TYPES.includes(type)) throw new Error('Unknown chat type.');
+  if (!request || !['routine', 'standard', 'complex'].includes(request.complexity)
+    || !['planning', 'implementation', 'mechanical', 'review', 'coordination'].includes(request.phase)
+    || typeof request.rationale !== 'string' || !request.rationale.trim()
+    || typeof request.highRisk !== 'boolean') throw new Error('Explicit phase, complexity, highRisk and rationale are required.');
+  if (!Array.isArray(request.availableModels) || request.availableModels.length === 0
+    || request.availableModels.some(m => !m || typeof m.id !== 'string' || !Array.isArray(m.reasoningEfforts)
+      || m.reasoningEfforts.some(e => typeof e !== 'string'))
+    || new Set(request.availableModels.map(m => m.id)).size !== request.availableModels.length) {
+    throw new Error('Provide the destination host model/effort catalog; never infer availability.');
+  }
+  const reviewRole = type.endsWith('review') || type.endsWith('audit');
+  let profile;
+  if (request.highRisk || request.complexity === 'complex') profile = 'complex';
+  else if (type === 'step-review' && request.complexity === 'routine') profile = 'scoped-review';
+  else if (reviewRole || request.phase === 'review') profile = 'review';
+  else if (request.phase === 'planning') profile = 'planning';
+  else if (request.phase === 'mechanical') {
+    if (request.complexity !== 'routine') throw new Error('Mechanical phase requires routine complexity.');
+    profile = 'mechanical';
+  } else if (type === 'coordinator' || request.phase === 'coordination' || request.complexity === 'routine') profile = 'scoped';
+  else profile = 'implementation';
+  const selected = PROFILES[profile].find(([id, effort]) => request.availableModels.some(m => m.id === id && m.reasoningEfforts.includes(effort)));
+  if (!selected) throw new Error(`No supported model/effort for ${profile}; explicit policy revision required, never inherit coordinator settings.`);
+  return {
+    policyVersion: MODEL_POLICY_VERSION, profile, model: selected[0], thinking: selected[1],
+    phase: request.phase, complexity: request.complexity, highRisk: request.highRisk,
+    rationale: request.rationale.trim(), fallback: selected !== PROFILES[profile][0],
+  };
+}

package/plugins/codex-workflow-gateway/scripts/chat-registry.mjs

@@ -12,6 +12,7 @@ import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { randomUUID } from 'node:crypto';
+import { dispatchAction, dispatchInput } from './chat-dispatch.mjs';
 
 const TYPES = new Set(['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit']);
 const LOCK_STALE_MS = 30_000;
@@ -25,6 +26,14 @@ export function allocateChat(options) {
     const sequence = registry.nextSequence;
     const reservationId = randomUUID();
     const candidates = buildTitleCandidates({ ...options, sequence });
+    const existing = registry.entries.find(entry => entry.status !== 'abandoned'
+      && entry.type === options.type && entry.entityId === options.entityId
+      && entry.milestoneOrdinal === requiredOrdinal(options.milestoneOrdinal, 'M')
+      && entry.taskOrdinal === optionalOrdinal(options.taskOrdinal, 'T')
+      && entry.stepOrdinal === optionalOrdinal(options.stepOrdinal, 'S')
+      && (['task', 'coordinator'].includes(options.type)
+        || entry.attempt === positiveInteger(options.attempt ?? 1, 'attempt')));
+    if (existing) return { ...publicEntry(existing), reused: true };
     const entry = {
       sequence,
       reservationId,
@@ -92,6 +101,17 @@ export function bindChat(options) {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
     if (!entry.titleVerified) throw new Error('Chat title must pass exact readback before binding.');
+    if (options.threadId?.startsWith('client-')) throw new Error('Cannot bind a pending clientThreadId.');
+    if (entry.threadId && (entry.threadId !== options.threadId || entry.hostId !== options.hostId)) {
+      throw new Error('Reservation already bound to another thread.');
+    }
+    if (registry.entries.some(other => other !== entry && other.threadId === options.threadId
+      && other.hostId === options.hostId)) throw new Error('Thread already belongs to another reservation.');
+    if (entry.dispatch && (entry.dispatch.state !== 'resolved' || entry.dispatch.candidateThreadId !== options.threadId
+      || entry.dispatch.hostId !== options.hostId
+      || entry.dispatch.observations.at(-1)?.title !== entry.observedTitle)) {
+      throw new Error('Tracked creation must pass correlated read_thread observation before binding.');
+    }
     entry.threadId = requiredText(options.threadId, 'threadId');
     entry.hostId = requiredText(options.hostId, 'hostId');
     entry.status = 'bound';
@@ -106,6 +126,9 @@ export function retitleChat(options) {
   return withRegistryLock(options.projectId, options.registryHome, (file) => {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
+    if (entry.dispatch && options.entityId !== entry.entityId) {
+      throw new Error('Tracked dispatch entity is immutable; retitle cannot replace its identity.');
+    }
     entry.entityId = requiredText(options.entityId, 'entityId');
     entry.semanticTitle = requiredText(options.semanticTitle, 'semanticTitle');
     entry.candidates = buildTitleCandidates({
@@ -134,6 +157,7 @@ export function abandonChat(options) {
   return withRegistryLock(options.projectId, options.registryHome, (file) => {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
+    if (entry.dispatch || entry.threadId) throw new Error('Cannot abandon a started creation or bound chat to enable a duplicate.');
     entry.status = 'abandoned';
     entry.updatedAt = new Date().toISOString();
     writeRegistry(file, registry);
@@ -141,6 +165,20 @@ export function abandonChat(options) {
   });
 }
 
+export function dispatchChat(options) {
+  validateProjectId(options.projectId);
+  return withRegistryLock(options.projectId, options.registryHome, file => {
+    const registry = readRegistry(file, options.projectId);
+    const entry = requireEntry(registry, options.reservationId);
+    const result = dispatchAction(options.action, entry, options.input);
+    if (options.action !== 'dispatch-status') {
+      entry.updatedAt = new Date().toISOString();
+      writeRegistry(file, registry);
+    }
+    return result;
+  });
+}
+
 export function showRegistry(options) {
   validateProjectId(options.projectId);
   const file = registryFile(options.projectId, options.registryHome);
@@ -217,7 +255,10 @@ function withRegistryLock(projectId, registryHome, operation) {
 
 function lockIsStale(lock) {
   try {
-    return Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS;
+    if (Date.now() - statSync(lock).mtimeMs <= LOCK_STALE_MS) return false;
+    const owner = JSON.parse(readFileSync(path.join(lock, 'owner.json'), 'utf8'));
+    if (!Number.isSafeInteger(owner.pid) || owner.pid < 1) return false;
+    try { process.kill(owner.pid, 0); return false; } catch (error) { return error?.code === 'ESRCH'; }
   } catch {
     return false;
   }
@@ -253,7 +294,7 @@ function readRegistry(file, projectId) {
 
 function writeRegistry(file, registry) {
   const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { flag: 'wx' });
+  writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   renameSync(temporary, file);
 }
 
@@ -275,6 +316,7 @@ function publicEntry(entry) {
     threadId: entry.threadId,
     hostId: entry.hostId,
     status: entry.status,
+    dispatchState: entry.dispatch?.state ?? null,
   };
 }
 
@@ -334,6 +376,11 @@ function cli() {
     projectId: option(args, 'project-id'),
     registryHome: option(args, 'registry-home'),
   };
+  if (action?.startsWith('dispatch-') || action === 'supervision-record' || action === 'model-select') {
+    const file = option(args, 'file');
+    return dispatchChat({ ...common, action, reservationId: option(args, 'reservation-id'),
+      input: file ? dispatchInput(file) : {} });
+  }
   if (action === 'allocate') return allocateChat({
     ...common,
     type: option(args, 'type'),
@@ -363,7 +410,7 @@ function cli() {
   });
   if (action === 'abandon') return abandonChat({ ...common, reservationId: option(args, 'reservation-id') });
   if (action === 'show') return showRegistry(common);
-  throw new Error('Use allocate, retitle, readback, bind, abandon, or show.');
+  throw new Error('Use allocate, retitle, readback, bind, abandon, show, dispatch-begin/result/discover/resolve-duplicates/observe/status, supervision-record, or model-select.');
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(new URL(import.meta.url).pathname)) {