codex-workflow-v2 2.0.0-beta.13.2 → 2.0.0-beta.13.5

package/plugins/codex-workflow-gateway/scripts/chat-registry.mjs

@@ -12,6 +12,7 @@ import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { randomUUID } from 'node:crypto';
+import { dispatchAction, dispatchInput } from './chat-dispatch.mjs';
 
 const TYPES = new Set(['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit']);
 const LOCK_STALE_MS = 30_000;
@@ -25,6 +26,14 @@ export function allocateChat(options) {
     const sequence = registry.nextSequence;
     const reservationId = randomUUID();
     const candidates = buildTitleCandidates({ ...options, sequence });
+    const existing = registry.entries.find(entry => entry.status !== 'abandoned'
+      && entry.type === options.type && entry.entityId === options.entityId
+      && entry.milestoneOrdinal === requiredOrdinal(options.milestoneOrdinal, 'M')
+      && entry.taskOrdinal === optionalOrdinal(options.taskOrdinal, 'T')
+      && entry.stepOrdinal === optionalOrdinal(options.stepOrdinal, 'S')
+      && (['task', 'coordinator'].includes(options.type)
+        || entry.attempt === positiveInteger(options.attempt ?? 1, 'attempt')));
+    if (existing) return { ...publicEntry(existing), reused: true };
     const entry = {
       sequence,
       reservationId,
@@ -92,6 +101,17 @@ export function bindChat(options) {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
     if (!entry.titleVerified) throw new Error('Chat title must pass exact readback before binding.');
+    if (options.threadId?.startsWith('client-')) throw new Error('Cannot bind a pending clientThreadId.');
+    if (entry.threadId && (entry.threadId !== options.threadId || entry.hostId !== options.hostId)) {
+      throw new Error('Reservation already bound to another thread.');
+    }
+    if (registry.entries.some(other => other !== entry && other.threadId === options.threadId
+      && other.hostId === options.hostId)) throw new Error('Thread already belongs to another reservation.');
+    if (entry.dispatch && (entry.dispatch.state !== 'resolved' || entry.dispatch.candidateThreadId !== options.threadId
+      || entry.dispatch.hostId !== options.hostId
+      || entry.dispatch.observations.at(-1)?.title !== entry.observedTitle)) {
+      throw new Error('Tracked creation must pass correlated read_thread observation before binding.');
+    }
     entry.threadId = requiredText(options.threadId, 'threadId');
     entry.hostId = requiredText(options.hostId, 'hostId');
     entry.status = 'bound';
@@ -106,6 +126,9 @@ export function retitleChat(options) {
   return withRegistryLock(options.projectId, options.registryHome, (file) => {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
+    if (entry.dispatch && options.entityId !== entry.entityId) {
+      throw new Error('Tracked dispatch entity is immutable; retitle cannot replace its identity.');
+    }
     entry.entityId = requiredText(options.entityId, 'entityId');
     entry.semanticTitle = requiredText(options.semanticTitle, 'semanticTitle');
     entry.candidates = buildTitleCandidates({
@@ -134,6 +157,7 @@ export function abandonChat(options) {
   return withRegistryLock(options.projectId, options.registryHome, (file) => {
     const registry = readRegistry(file, options.projectId);
     const entry = requireEntry(registry, options.reservationId);
+    if (entry.dispatch || entry.threadId) throw new Error('Cannot abandon a started creation or bound chat to enable a duplicate.');
     entry.status = 'abandoned';
     entry.updatedAt = new Date().toISOString();
     writeRegistry(file, registry);
@@ -141,6 +165,20 @@ export function abandonChat(options) {
   });
 }
 
+export function dispatchChat(options) {
+  validateProjectId(options.projectId);
+  return withRegistryLock(options.projectId, options.registryHome, file => {
+    const registry = readRegistry(file, options.projectId);
+    const entry = requireEntry(registry, options.reservationId);
+    const result = dispatchAction(options.action, entry, options.input);
+    if (options.action !== 'dispatch-status') {
+      entry.updatedAt = new Date().toISOString();
+      writeRegistry(file, registry);
+    }
+    return result;
+  });
+}
+
 export function showRegistry(options) {
   validateProjectId(options.projectId);
   const file = registryFile(options.projectId, options.registryHome);
@@ -217,7 +255,10 @@ function withRegistryLock(projectId, registryHome, operation) {
 
 function lockIsStale(lock) {
   try {
-    return Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS;
+    if (Date.now() - statSync(lock).mtimeMs <= LOCK_STALE_MS) return false;
+    const owner = JSON.parse(readFileSync(path.join(lock, 'owner.json'), 'utf8'));
+    if (!Number.isSafeInteger(owner.pid) || owner.pid < 1) return false;
+    try { process.kill(owner.pid, 0); return false; } catch (error) { return error?.code === 'ESRCH'; }
   } catch {
     return false;
   }
@@ -253,7 +294,7 @@ function readRegistry(file, projectId) {
 
 function writeRegistry(file, registry) {
   const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { flag: 'wx' });
+  writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   renameSync(temporary, file);
 }
 
@@ -275,6 +316,7 @@ function publicEntry(entry) {
     threadId: entry.threadId,
     hostId: entry.hostId,
     status: entry.status,
+    dispatchState: entry.dispatch?.state ?? null,
   };
 }
 
@@ -334,6 +376,11 @@ function cli() {
     projectId: option(args, 'project-id'),
     registryHome: option(args, 'registry-home'),
   };
+  if (action?.startsWith('dispatch-') || action === 'supervision-record' || action === 'model-select') {
+    const file = option(args, 'file');
+    return dispatchChat({ ...common, action, reservationId: option(args, 'reservation-id'),
+      input: file ? dispatchInput(file) : {} });
+  }
   if (action === 'allocate') return allocateChat({
     ...common,
     type: option(args, 'type'),
@@ -363,7 +410,7 @@ function cli() {
   });
   if (action === 'abandon') return abandonChat({ ...common, reservationId: option(args, 'reservation-id') });
   if (action === 'show') return showRegistry(common);
-  throw new Error('Use allocate, retitle, readback, bind, abandon, or show.');
+  throw new Error('Use allocate, retitle, readback, bind, abandon, show, dispatch-begin/result/discover/resolve-duplicates/observe/status, supervision-record, or model-select.');
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(new URL(import.meta.url).pathname)) {

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -92,6 +92,29 @@ active writer token when the C1 contract requires it. The recovery records only
 `task run` merely to manufacture the second failure, and never invoke this recovery for a generic
 test failure, a writable manifest, or unconfined changes.
 
+When fresh `next` includes `preExecutionReplanOption.state=eligible`, an independent Plan auditor
+may stop a `ready` Task before its next Step because the current implementation Plan is obstructed.
+Use only `task preexecution-replan` with the exact advertised Task revision, Brief hash, Plan hash,
+current Plan Risk Audit event hash, and HEAD. The audit file must be a genuine independent
+`stop-escalate` replacement audit: its planner remains the original planner, its auditor is the
+transition actor, and it retains current guarded categories, review requirements, failure modes,
+evidence commands, and proof bindings while recording the obstruction. This transition requires a
+clean checkout with no Step in progress, C1 posture, or writer lease. It appends immutable audit and
+provenance records, supersedes only current execution authorization, preserves completed Step
+authority and existing delegation scope, and does not require a new approval. After success, run
+sequential `status` then `next`; Core must advertise ordinary `task plan-set`, not audited-remediation
+topology. Submit a semantically changed Plan with the exact Task objective, requirements, and
+acceptance, preserve completed Steps and prior safety boundaries, attach a fresh Plan Risk Audit,
+then obtain fresh execution authorization. Never append an approved audit to the unchanged Plan,
+rebind context around the marker, invent a failure/corrective cause, or invoke the command when the
+option is absent or blocked.
+
+For this route, Core treats each `(Step ID, failureMode, evidence)` tuple as the immutable proof
+binding. It does not claim to understand whether revised `counterexample` or `expectedResult` prose
+is semantically stronger. Changing that prose therefore requires an independent
+`approved-with-rationale` audit, a changed substantive summary, and an explicit rationale; the
+earlier audit remains immutable history for human review.
+
 When fresh `next` advertises `task downstream-proof-recover`, the active proof Step has produced
 uncommitted files inside its own `allowedWrites` and has also exposed required changes owned by one
 or more completed transitive predecessor Steps. Do not invoke `task step-complete`: its scope is
@@ -329,9 +352,11 @@ A Milestone chat and its Task chats are separate user-visible execution contexts
 conversation. Create every Task chat as a brand-new Codex task with `create_thread`, an explicit
 Task-only prompt, and an explicit title. Never use `fork_thread`, thread handoff, or a continuation
 of the Milestone chat to create a Task chat: those paths carry parent history into the child. A
-failure to create a new task is a routing blocker. Check the thread list for an already-created
-exact Task ID, retry `create_thread` once sequentially when none exists, and then stop; never fall
-back to a fork.
+confirmed failure to create a new task is a routing blocker. A pending `clientThreadId`, timeout,
+lost response, or absence from `list_threads` does not establish failure and never permits a
+second creation. Persist the attempt before calling the App, resolve its actual ID and confirm
+it with `read_thread`; never fall back to a fork. Read and follow
+`../../references/chat-dispatch.md` for the executable dispatch/recovery and model-selection contract.
 
 Codex App may wrap the supplied prompt in a host-generated `codex_delegation` envelope containing
 only routing provenance such as `source_thread_id`. That envelope is permitted and is not parent
@@ -376,6 +401,22 @@ chat type, Milestone/Task/Step membership ordinals, semantic title, authoritativ
 review attempt. Use returned `requestedTitle` verbatim. Never derive its prefix from
 `list_threads`, sidebar order, a count, or `count + 1`: allocation atomically reserves the
 project-wide monotonically increasing `#NNN`, and an abandoned number is never reused.
+Allocation reuses an existing matching reservation. For a new dispatch, call `dispatch-begin`
+with the closed packet and explicit model request, then call the App exactly once only when
+`createAllowed=true`, using returned `createArgs` unchanged. Record the full result via
+`dispatch-result`, resolve/read back via `dispatch-discover` and `dispatch-observe`, and bind.
+After restart use `dispatch-status`; an unresolved creation cannot be abandoned to create another.
+For legacy reservations without a dispatch marker, first reconcile existing App/source evidence;
+absence of the new marker does not prove no earlier creation occurred.
+
+When the user authorizes model selection, use the versioned role/phase/complexity matrix rather
+than coordinator inheritance. Both `model` and App `thinking` must be explicit in create arguments.
+Use the destination host's current supported model/effort catalog; no guessed aliases or silent
+fallback. Before a materially different phase, `model-select` returns explicit follow-up settings
+for the same bound thread. Routine lifecycle work should not retain planning/review reasoning by
+accident; security-sensitive and complex work must not be classified as routine to save tokens.
+Without user authorization for model selection, do not manufacture it from a registry field;
+resolve that policy choice before starting a new dispatch.
 
 The builder owns these compact title families; callers must not hand-compose variants:
 
@@ -397,7 +438,7 @@ Put `#NNN` and membership ordinals first so clipped sidebar titles remain distin
 inherit the parent title, use a generic title such as `Milestone recovery` / `Task execution`, or
 reuse one title for different entity IDs. Maintain the registry-backed
 `Task ID -> thread ID -> title` mapping in
-the Milestone chat. Before dispatch, verify from the thread list that the title contains the exact
+the Milestone chat. Before supervision, verify from actual `read_thread` evidence that the title contains the exact
 ordinal and entity ID, is unique, and the new chat input contains only its TaskContextPacket plus
 the permitted host routing envelope. Never trust the `create_thread` title argument without a
 readback: pass the observed title to registry `readback`. If it returns `renameRequired=true`,
@@ -406,6 +447,12 @@ compact the role while preserving `#NNN`, membership ordinals, attempt, and the
 Never invent another fallback or abbreviate the ID. Bind the verified entry to `threadId` and
 `hostId`; if all candidates fail, mark it blocked and stop routing. Visual sidebar clipping is
 harmless only when exact API readback still matches. Do not dispatch while title/context is wrong.
+Persist the single supervisor, cursor and next action using `supervision-record`. Large tool/CLI
+JSON must be saved completely to a private local file and parsed there, with only bounded non-secret
+summaries printed. For an uncertain mutation outcome, run fresh `status -> next` before recovery;
+never replay a mutation merely because displayed output was truncated. Review the exact serialized
+external-review envelope passed to Core, not a separately reconstructed object. Public CREF expiry
+is independent of lease expiry and must be checked before every credential-consuming transition.
 
 After every significant Task Step boundary—completion, failure, block, skip, sealed-review result,
 or corrective decision—the Task chat prints a compact Task progress Markdown table from fresh
@@ -562,7 +609,13 @@ When `next.strictStepReview.recommendedMode` is `external-sealed`, do not launch
 reviewer from inside a Codex App sandbox. Run the advertised read-only `task step-review-packet`,
 create a separate user-visible reviewer chat for that exact packet, and require one closed
 `ReviewInput` JSON result bound to its reviewed commit. The reviewer must not modify repository or
-Workflow state. Then run only the advertised `task step-review-record` with the unchanged packet
+Workflow state. The `--file` passed to `task step-review-record` must be the full
+`ExternalStrictStepReviewInput` envelope: top-level `protocol`, `packetHash`,
+`repositorySealHash`, `reviewerThreadId`, and `reviewMode` (`ordinary` or `security`), plus the
+nested `review` object containing `status`, `reviewer`, `summary`, and `findings`. Copy both hashes
+and the mode from the packet; do not flatten `review`, and do not pass `--review-mode` to the record
+command because it reads the mode from the JSON file. Run `task step-review-record --help` for a
+complete minimal example. Then run only the advertised `task step-review-record` with the unchanged packet
 and repository-seal hashes, the separate reviewer thread ID, the lifecycle actor from `next`, and
 the active writer token when required. Never author the independent review in the Worker or
 Delivery Coordinator chat, never alter the packet, and never treat an unverified local reviewer
@@ -573,7 +626,11 @@ When `next.strictTaskReview.recommendedMode` is `external-sealed`, apply the sam
 the final submitted-Task review. Run the advertised read-only `task review-packet`, send the exact
 packet to a separate user-visible Independent Reviewer chat, and accept only a closed `ReviewInput`
 bound to the unchanged packet and repository-seal hashes. Record it only through the advertised
-`task review-sealed-record`, using the lifecycle actor from `next` and the active writer token when
+`task review-sealed-record`. Its `--file` must be the analogous full
+`ExternalStrictTaskReviewInput` envelope using protocol
+`codex-workflow-external-strict-task-review-v1`, the packet and repository-seal hashes,
+`reviewerThreadId`, top-level `reviewMode`, and nested `review`; its `--help` contains a minimal
+example. Use the lifecycle actor from `next` and the active writer token when
 required. Do not call `task review-launch` from inside a Codex App sandbox, do not use the Worker or
 Delivery Coordinator as reviewer, and discard the result if a fresh packet changes either hash.
 

package/schemas/preexecution-replan-event.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/preexecution-replan-event.schema.json",
+  "title": "Codex Workflow V2 Pre-execution Replan Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId", "taskId", "sourceTaskRevision", "resultTaskRevision", "briefHash",
+    "sourcePlanHash", "knowledgeMapRevision", "knowledgeMapHash",
+    "sourcePlanRiskAuditEventId", "sourcePlanRiskAuditEventHash",
+    "obstructionPlanRiskAuditEventId", "obstructionPlanRiskAuditEventHash",
+    "sourceExecutionAuthorizationHash", "sourceHeadCommit", "completedStepIds",
+    "completedStepsHash", "actor", "reason", "recordedAt", "previousEventHash", "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "pattern": "^PER-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "sourceTaskRevision": { "type": "integer", "minimum": 1 },
+    "resultTaskRevision": { "type": "integer", "minimum": 2 },
+    "briefHash": { "$ref": "#/$defs/hash64" },
+    "sourcePlanHash": { "$ref": "#/$defs/hash64" },
+    "knowledgeMapRevision": { "type": "integer", "minimum": 1 },
+    "knowledgeMapHash": { "$ref": "#/$defs/hash64" },
+    "sourcePlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "sourcePlanRiskAuditEventHash": { "$ref": "#/$defs/hash64" },
+    "obstructionPlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "obstructionPlanRiskAuditEventHash": { "$ref": "#/$defs/hash64" },
+    "sourceExecutionAuthorizationHash": { "$ref": "#/$defs/hash64" },
+    "sourceHeadCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+    "completedStepIds": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" }
+    },
+    "completedStepsHash": { "$ref": "#/$defs/hash64" },
+    "actor": { "type": "string", "minLength": 1 },
+    "reason": { "type": "string", "minLength": 1, "maxLength": 2048 },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "previousEventHash": { "anyOf": [{ "$ref": "#/$defs/hash64" }, { "type": "null" }] },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+  }
+}