deadbyte-mcp 0.13.0 → 0.15.0

package/src/autonomous-runtime.mjs

@@ -3,13 +3,14 @@ import { access, mkdir, open, readFile, readdir, rm, writeFile } from 'node:fs/p
 import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
-import { assertAutonomousArmed, autonomousSessionStatus } from './autonomous-policy.mjs';
+import { assertAutonomousArmed, autonomousSessionStatus, recheckAutonomousAuthority } from './autonomous-policy.mjs';
 import { buildPlannerPrompt, parsePlannerDecision, parseR34PlannerDecision, requestProviderDecision } from './autonomous-planner.mjs';
 import { actionIdentity, reconcileStartedAction } from './autonomous-action-reconcile.mjs';
 import { createPlan, replanPlan, completePlanStep, planIsComplete as r34PlanIsComplete } from './autonomous-plan.mjs';
 import { deriveLoopState, repairFingerprint } from './autonomous-loop-state.mjs';
 import { judgeProgress, stallDisposition } from './autonomous-progress.mjs';
 import { classifyProviderFailure, deriveCircuit, providerCallDisposition, providerCircuitId } from './provider-circuit.mjs';
+import { bindApprovalSubject, deriveEffectiveRigor, taskDagFromPlan, validateBoundApproval } from './agent-governance-r42.mjs';
 import { verifyObservationReceiptFile } from './observation-runtime.mjs';
 import { R36_CAPABILITY_LEDGER } from './capability-ledger.mjs';
 import { deriveAgentMemory } from './agent-memory-plane.mjs';
@@ -129,6 +130,11 @@ function deriveState(goal, events) {
       const binding = { ...p, event_sha256:event.event_sha256 };
       observations.push(binding);
     }
+    if (event.type === 'human_input_provided') {
+      observations.push({kind:'human_input',question:p.question,answer:p.answer,
+        answer_sha256:p.answer_sha256,trust_class:'operator_input',observed_at_utc:event.created_at_utc,
+        event_sha256:event.event_sha256});
+    }
     if (event.type === 'native_diff_committed') {
       mutationEpoch = Number(p.mutation_epoch ?? mutationEpoch + 1); mutationCount += Number(p.mutation_count ?? 1);
       diffs.push({ ...p, event_sha256:event.event_sha256 });
@@ -268,16 +274,24 @@ async function executeProfile({ ctx, events, goalId, actionKey, profileId, epoch
     await appendEvent(ctx,events,signingKeyPath,'profile_completed',payload);
     return { status:outcome.passed ? 'passed' : 'failed', observation:payload, existing:false };
   }
+  const autonomousAuthority = await assertAutonomousArmed(policy,profile.root_id);
+  if (Number.isFinite(autonomousAuthority.remaining_ms) && autonomousAuthority.remaining_ms < 100) {
+    throw new Error('autonomous lease expires too soon to execute profile');
+  }
   await appendEvent(ctx,events,signingKeyPath,'profile_started',{ action_key:actionKey, profile_id:profileId,
-    mutation_epoch:epoch, receipt_id:receiptId, request_sha256:requestSha256 });
+    mutation_epoch:epoch, receipt_id:receiptId, request_sha256:requestSha256,
+    authority_instance_nonce:autonomousAuthority.instance_nonce,
+    authority_expires_at_utc:autonomousAuthority.expires_at_utc });
+  const preExecutionCheck = () => recheckAutonomousAuthority(policy,autonomousAuthority,profile.root_id);
   let result;
   try {
     result = profile.kind === 'command'
       ? await codingRuntime.commandRun({ rootId:profile.root_id, commandId:profile.command_id, scriptPath:profile.script_path,
           scriptSha256:profile.script_sha256, args:profile.args, cwd:profile.cwd, timeoutMs:profile.timeout_ms,
-          receiptId, requestSha256 })
+          executionDeadlineUtc:autonomousAuthority.expires_at_utc, preExecutionCheck, receiptId, requestSha256 })
       : await codingRuntime.benchmarkRun({ rootId:profile.root_id, commandId:profile.command_id, scriptPath:profile.script_path,
           scriptSha256:profile.script_sha256, args:profile.args, cwd:profile.cwd, timeoutMs:profile.timeout_ms,
+          executionDeadlineUtc:autonomousAuthority.expires_at_utc, preExecutionCheck,
           warmups:profile.warmups, iterations:profile.iterations, baselineMedianMs:profile.baseline_median_ms,
           maxRegressionPct:profile.max_regression_pct, receiptId, requestSha256 });
   } catch (error) {
@@ -325,7 +339,31 @@ function releaseReadiness(policy, state) {
   });
   return { ready:results.every(item => item.passed), mutation_epoch:state.mutation_epoch, required_profiles:results };
 }
-function normalizeGoal(policy, { submissionId, rootId, title = '', goal, acceptance = '', maxIterations = null }) {
+function normalizeTaskContract(raw) {
+  const value=raw ?? {schema:'deadbyte.task-contract.v1',scope:[],non_goals:[],constraints:[],
+    evidence_requirements:[],risk_level:'medium',clarification_policy:'ask_when_blocked',
+    project_default:'structured',explicit_override:null};
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('autonomous task contract invalid');
+  const allowed=['schema','scope','non_goals','constraints','evidence_requirements','risk_level','clarification_policy','project_default','explicit_override'];
+  const unknown=Object.keys(value).filter(key=>!allowed.includes(key));
+  if (unknown.length) throw new Error(`autonomous task contract unknown field '${unknown[0]}'`);
+  if (value.schema !== 'deadbyte.task-contract.v1') throw new Error('autonomous task contract schema invalid');
+  const list=(field,maxItems,maxLength)=>{
+    const items=value[field] ?? [];
+    if (!Array.isArray(items) || items.length > maxItems || items.some(item=>typeof item !== 'string' || item.length < 1 || item.length > maxLength || item.includes('\0'))) {
+      throw new Error(`autonomous task contract ${field} invalid`);
+    }
+    return [...items];
+  };
+  if (!['low','medium','high'].includes(value.risk_level)) throw new Error('autonomous task contract risk_level invalid');
+  if (!['ask_when_blocked','fail_closed'].includes(value.clarification_policy)) throw new Error('autonomous task contract clarification_policy invalid');
+  const rigor=deriveEffectiveRigor({project_default:value.project_default??'structured',risk_level:value.risk_level,
+    explicit_override:value.explicit_override??null});
+  return Object.freeze({schema:value.schema,scope:list('scope',32,512),non_goals:list('non_goals',24,512),
+    constraints:list('constraints',32,512),evidence_requirements:list('evidence_requirements',32,512),
+    risk_level:value.risk_level,clarification_policy:value.clarification_policy,...rigor});
+}
+function normalizeGoal(policy, { submissionId, rootId, title = '', goal, acceptance = '', taskContract = null, maxIterations = null }) {
   if (!ID_RE.test(submissionId ?? '')) throw new Error('autonomous submission_id invalid');
   if (!policy.root_ids.includes(rootId)) throw new Error(`autonomous root '${rootId}' is not allowed`);
   if (typeof title !== 'string' || title.length > 160) throw new Error('autonomous title must be <=160 characters');
@@ -335,7 +373,7 @@ function normalizeGoal(policy, { submissionId, rootId, title = '', goal, accepta
   if (!Number.isInteger(iterations) || iterations < 1 || iterations > policy.limits.max_iterations) throw new Error('autonomous max_iterations exceeds policy');
   const body = { schema:AUTONOMOUS_GOAL_SCHEMA, policy_sha256:policy.policy_sha256,
     coding_policy_sha256:policy.coding_policy_sha256, submission_id:submissionId, root_id:rootId,
-    title, goal, acceptance, max_iterations:iterations };
+    title, goal, acceptance, task_contract:normalizeTaskContract(taskContract),max_iterations:iterations };
   return Object.freeze({ ...body, goal_sha256:sha256Object(body) });
 }
 
@@ -389,7 +427,8 @@ async function requestPlanner(ctx, goal, events, state, policy, codingRuntime, c
     return null;
   }
   const view = await plannerView(goal,state,events,codingRuntime,capabilityManifest,desktopMemoryProvider,memoryProvider);
-  let prompt = buildPlannerPrompt({ goal:{ title:goal.title, goal:goal.goal, acceptance:goal.acceptance }, policy, view });
+  let prompt = buildPlannerPrompt({ goal:{ goal_id:goal.goal_id,title:goal.title, goal:goal.goal, acceptance:goal.acceptance,
+    task_contract:goal.task_contract }, policy, view });
   const repair = [...(state.planner_rejections ?? [])].reverse().find(item => item.planner_round === round) ?? null;
   if (repair) {
     const repairState = canonicalJson({ request_id:repair.request_id, response_sha256:repair.response_sha256,
@@ -452,7 +491,24 @@ function legacyPublicLoopPhase(phase) {
   return ({PLAN:'PLANNING',INSPECT:'INSPECTING',ACT:'ACTING',VERIFY:'VERIFYING',CRITIC:'REPLANNING',
     REPAIR:'REPLANNING',RELEASE:'VERIFYING',WAITING:'WAITING',SUCCEEDED:'COMPLETE',FAILED:'WAITING'})[phase] ?? 'WAITING';
 }
-function publicLoopState(loop) {
+function approvalScopeFor(reason){
+  if(reason==='human_input_required') return 'human_clarification';
+  if(String(reason??'').startsWith('desktop_')) return 'desktop_resume';
+  if(['ambiguous_interrupted_action','profile_execution_without_receipt'].includes(reason)) return 'interrupted_effect_resume';
+  return 'resume_goal';
+}
+function pendingApprovalSubject(goal,events,loop){
+  if(!loop?.pending_approval) return null;
+  const waiting=[...events].reverse().find(event=>event.type==='waiting_entered')??null;
+  if(!waiting) return null;
+  const payload=waiting.payload??{};
+  return bindApprovalSubject({
+    goal_id:goal.goal_id,reviewed_event_seq:waiting.seq,reviewed_event_sha256:waiting.event_sha256,
+    journal_head_sha256:events.at(-1)?.event_sha256??ZERO_HASH,scope:approvalScopeFor(payload.reason),
+    subject:{reason:payload.reason??loop.wait_reason??'paused',waiting_payload_sha256:sha256Object(payload)}
+  });
+}
+function publicLoopState(loop,goal=null,events=null) {
   if (!loop) return null;
   const currentStep=loop.current_step ? {
     step_id:loop.current_step.step_id,intent:loop.current_step.intent,status:loop.current_step.status
@@ -468,15 +524,18 @@ function publicLoopState(loop) {
   return {
     schema:'deadbyte.autonomous-loop-state.v1',phase:legacyPublicLoopPhase(loop.phase),plan_id:loop.plan_id,plan_version:loop.plan_version,
     current_step:currentStep,replan_count:loop.replan_count,progress,
-    pending_action:pendingAction,pending_approval:loop.pending_approval,wait_reason:loop.wait_reason
+    pending_action:pendingAction,pending_approval:loop.pending_approval,wait_reason:loop.wait_reason,
+    clarification:loop.clarification ?? null,
+    approval_subject:goal&&events?pendingApprovalSubject(goal,events,loop):null,
+    task_dag:goal&&loop.plan?taskDagFromPlan({run_id:goal.goal_id,goal_id:goal.goal_id,plan:loop.plan}):null
   };
 }
 function withLoopResult(goal,events,result) {
-  const loop=publicLoopState(loopStateOrNull(goal,events));
+  const loop=publicLoopState(loopStateOrNull(goal,events),goal,events);
   return loop ? {...result,loop} : result;
 }
 function providerCircuitSnapshot(policy,events,observedAtUtc=new Date().toISOString()) {
-  if (policy.planner.backend !== 'openai_compatible') return null;
+  if (!['openai_compatible','openai_responses','codex_app_server'].includes(policy.planner.backend)) return null;
   return deriveCircuit(events,providerCircuitId(policy.planner),policy.planner.circuit,observedAtUtc);
 }
 async function enterProviderCircuitWait({ctx,events,goal,policy,signingKeyPath,reason,circuit}) {
@@ -494,7 +553,7 @@ async function enterProviderCircuitWait({ctx,events,goal,policy,signingKeyPath,r
   });
   return {status:'paused',reason,circuit};
 }
-async function requestProviderWithCircuit({ctx,events,goal,policy,pending,signingKeyPath}) {
+async function requestProviderWithCircuit({ctx,events,goal,policy,pending,signingKeyPath,plannerProviderRuntime}) {
   const providerId=providerCircuitId(policy.planner);
   let circuit=providerCircuitSnapshot(policy,events);
   let disposition=providerCallDisposition(circuit);
@@ -515,9 +574,13 @@ async function requestProviderWithCircuit({ctx,events,goal,policy,pending,signin
     });
   }
   try {
-    const response=await requestProviderDecision(policy,pending.prompt);
+    const response=policy.planner.backend==='codex_app_server'
+      ? await plannerProviderRuntime.runPlanner({logicalId:`goal-${goal.goal_id}`,prompt:pending.prompt,timeoutMs:policy.planner.timeout_ms})
+      : await requestProviderDecision(policy,pending.prompt);
     await appendEvent(ctx,events,signingKeyPath,'provider_call_succeeded',{
-      provider_id:providerId,request_id:pending.request_id,probe:disposition.probe===true
+      provider_id:providerId,request_id:pending.request_id,probe:disposition.probe===true,
+      ...(response.response_id?{response_id:response.response_id}:{}),
+      ...(response.usage?{usage:response.usage}:{})
     });
     return {response};
   } catch (error) {
@@ -536,15 +599,15 @@ async function requestProviderWithCircuit({ctx,events,goal,policy,pending,signin
     throw error;
   }
 }
-async function acceptPlannerDecision({ ctx, events, goal, state, policy, codingRuntime, capabilityManifest, desktopMemoryProvider,memoryProvider, signingKeyPath, plannerResponse }) {
+async function acceptPlannerDecision({ ctx, events, goal, state, policy, codingRuntime, capabilityManifest, desktopMemoryProvider,memoryProvider, signingKeyPath, plannerResponse, plannerProviderRuntime }) {
   let currentState = state;
   let pending = currentState.pending_request ?? await requestPlanner(ctx,goal,events,currentState,policy,codingRuntime,capabilityManifest,desktopMemoryProvider,memoryProvider,signingKeyPath);
   if (!pending) return null;
   let suppliedResponse = plannerResponse;
   while (pending) {
     let response;
-    if (policy.planner.backend === 'openai_compatible') {
-      const provider=await requestProviderWithCircuit({ctx,events,goal,policy,pending,signingKeyPath});
+    if (['openai_compatible','openai_responses','codex_app_server'].includes(policy.planner.backend)) {
+      const provider=await requestProviderWithCircuit({ctx,events,goal,policy,pending,signingKeyPath,plannerProviderRuntime});
       if (provider.waiting) return {needs_planner:false,rejected:false,paused:true,provider_waiting:true};
       response=provider.response;
     } else {
@@ -585,6 +648,8 @@ async function acceptPlannerDecision({ ctx, events, goal, state, policy, codingR
     const event = await appendEvent(ctx,events,signingKeyPath,'planner_decision',{
       request_id:pending.request_id, planner_round:pending.planner_round, mutation_epoch:pending.mutation_epoch,
       backend:response.backend, model:response.model ?? 'unknown', response_sha256:sha256Bytes(Buffer.from(response.raw_text,'utf8')),
+      ...(response.response_id?{response_id:response.response_id}:{}),
+      ...(response.usage?{usage:response.usage}:{}),
       ...(pending.working_memory_sha256?{
         working_memory_sha256:pending.working_memory_sha256,memory_snapshot_sha256:pending.memory_snapshot_sha256,
         memory_index_sha256:pending.memory_index_sha256,
@@ -1506,6 +1571,20 @@ async function executeR34Decision({ctx,events,goal,state,decisionEvent,decision,
     return r34EnterWaiting({ctx,events,goal,signingKeyPath,reason:decision.reason,resumePhase:loop.phase});
   }
 
+  if (decision.kind === 'clarify') {
+    await appendEvent(ctx,events,signingKeyPath,'human_input_requested',{
+      decision_event_sha256:decisionEvent.event_sha256,question:decision.question,choices:decision.choices
+    });
+    await appendEvent(ctx,events,signingKeyPath,'waiting_entered',{
+      reason:'human_input_required',requires_approval:true,resume_phase:'PLAN',
+      question:decision.question,choices:decision.choices
+    });
+    await appendEvent(ctx,events,signingKeyPath,'goal_paused',{
+      reason:'human_input_required',decision_event_sha256:decisionEvent.event_sha256
+    });
+    return {status:'paused',reason:'human_input_required'};
+  }
+
   if (decision.kind === 'finish') {
     if (!r34PlanIsComplete(loop.plan)) {
       await appendEvent(ctx,events,signingKeyPath,'plan_guard_blocked',{
@@ -1676,7 +1755,7 @@ function terminalState(state) {
 }
 function pauseState(state) { return state.state === 'paused'; }
 async function resumeProviderWaitIfReady({ctx,journal,goal,state,policy,signingKeyPath}) {
-  if (state.state!=='paused'||state.reason!=='provider_circuit_open'||policy.planner.backend!=='openai_compatible') return state;
+  if (state.state!=='paused'||state.reason!=='provider_circuit_open'||!['openai_compatible','openai_responses'].includes(policy.planner.backend)) return state;
   const circuit=providerCircuitSnapshot(policy,journal);
   const disposition=providerCallDisposition(circuit);
   if (!disposition.allowed||circuit.state!=='HALF_OPEN') return state;
@@ -1696,9 +1775,12 @@ function isAuthorityUnavailable(error) {
 
 export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRuntime, machineFsRuntime = null,
   observationRuntime = null, processRuntime = null, semanticRuntime = null, desktopRuntime = null,
-  desktopMemoryProvider = null,memoryProvider=null, signingKeyPath, verifyKeyPath }) {
+  desktopMemoryProvider = null,memoryProvider=null, plannerProviderRuntime=null, signingKeyPath, verifyKeyPath }) {
   if (!policy || !codingRuntime || !nativeDiffRuntime) throw new Error('autonomous runtime requires policy/coding/native-diff runtimes');
   if (!signingKeyPath || !verifyKeyPath) throw new Error('autonomous runtime requires trust keys');
+  if (policy.planner?.backend==='codex_app_server' && (!plannerProviderRuntime || typeof plannerProviderRuntime.runPlanner!=='function')) {
+    throw new Error('Codex planner provider runtime is required by autonomous policy');
+  }
   const capabilityManifest=configuredCapabilityManifest({machineFsRuntime,observationRuntime,processRuntime,semanticRuntime,desktopRuntime});
   const profileTimeoutCeiling=Math.max(120000,...Object.values(policy.profiles??{}).map(profile=>
     Number.isInteger(profile?.timeout_ms)&&profile.timeout_ms>0?profile.timeout_ms+120000:120000));
@@ -1715,7 +1797,7 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
       coding_policy_sha256:policy.coding_policy_sha256 };
   }
   async function providerCircuitStatus({goalId}) {
-    if (policy.planner.backend!=='openai_compatible') return null;
+    if (!['openai_compatible','openai_responses','codex_app_server'].includes(policy.planner.backend)) return null;
     const ctx=goalContext(policy,goalId);
     await loadGoal(ctx,policy,verifyKeyPath);
     const journal=await readEvents(ctx,verifyKeyPath);
@@ -1730,9 +1812,9 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     return { autonomous, coding };
   }
 
-  async function submit({ submissionId, rootId, title = '', goal, acceptance = '', maxIterations = null }) {
+  async function submit({ submissionId, rootId, title = '', goal, acceptance = '', taskContract = null, maxIterations = null }) {
     await assertRunAuthority(rootId);
-    const normalized = normalizeGoal(policy,{ submissionId,rootId,title,goal,acceptance,maxIterations });
+    const normalized = normalizeGoal(policy,{ submissionId,rootId,title,goal,acceptance,taskContract,maxIterations });
     const goalId = goalIdFor(policy.policy_sha256,submissionId);
     const ctx = goalContext(policy,goalId);
     if (await exists(ctx.dir)) {
@@ -1749,7 +1831,8 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     await writeFile(ctx.goalPath,`${canonicalJson(envelope)}\n`,{flag:'wx'});
     const journal = [];
     await appendEvent(ctx,journal,signingKeyPath,'goal_created',{
-      submission_id:submissionId, root_id:rootId, title, goal_sha256:normalized.goal_sha256,
+      submission_id:submissionId, root_id:rootId, title, acceptance:normalized.acceptance,
+      task_contract:normalized.task_contract,goal_sha256:normalized.goal_sha256,
       max_iterations:normalized.max_iterations,
       ...(memoryProvider?{source_release_manifest:memoryProvider.source_release_manifest}:{})
     });
@@ -1761,7 +1844,7 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     const goal = await loadGoal(ctx,policy,verifyKeyPath);
     const journal = await readEvents(ctx,verifyKeyPath);
     const derived = deriveState(goal,journal);
-    const loop = publicLoopState(loopStateOrNull(goal,journal));
+    const loop = publicLoopState(loopStateOrNull(goal,journal),goal,journal);
     const lock=await runLockStatus(ctx);
     return { status:'ok', goal_id:goalId, goal_sha256:goal.goal_sha256,
       title:goal.title, root_id:goal.root_id, journal_verified:true, ...derived, ...lock,
@@ -1795,8 +1878,11 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
       return { status:'existing', goal_id:goalId, state:current.state };
     }
   }
-  async function approve({ goalId, decision = 'approve' }) {
+  async function approve({ goalId, decision = 'approve', answer = null, approvalSubjectSha256 = null, expiresInMs = 300000 }) {
     if (!['approve','reject'].includes(decision)) throw new Error('autonomous approval decision invalid');
+    if (answer !== null && (typeof answer !== 'string' || answer.length < 1 || answer.length > 4096 || answer.includes('\0'))) {
+      throw new Error('autonomous approval answer invalid');
+    }
     const ctx = goalContext(policy,goalId);
     await acquireLock(ctx);
     try {
@@ -1811,7 +1897,34 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
       }
       if (hasR34Loop(journal)) {
         await assertRunAuthority(goal.root_id);
+        const loopState=loopStateOrNull(goal,journal);
+        const approvalSubject=pendingApprovalSubject(goal,journal,loopState);
+        if(!approvalSubject) throw new Error('autonomous approval subject unavailable');
+        if(typeof approvalSubjectSha256!=='string'||approvalSubjectSha256!==approvalSubject.approval_subject_sha256){
+          throw new Error('autonomous approval subject mismatch');
+        }
+        if(!Number.isInteger(expiresInMs)||expiresInMs<1000||expiresInMs>3_600_000) throw new Error('autonomous approval lifetime invalid');
         const waiting=[...journal].reverse().find(event=>event.type==='waiting_entered') ?? null;
+        if (waiting?.payload?.reason === 'human_input_required' && answer === null) {
+          throw new Error('autonomous clarification answer is required');
+        }
+        if (waiting?.payload?.reason !== 'human_input_required' && answer !== null) {
+          throw new Error('autonomous approval answer is only valid for human clarification');
+        }
+        const issuedAt=new Date();
+        const approval={schema:'deadbyte.bound-approval.v1',approval_subject_sha256:approvalSubjectSha256,
+          reviewed_event_seq:approvalSubject.reviewed_event_seq,reviewed_event_sha256:approvalSubject.reviewed_event_sha256,
+          journal_head_sha256:approvalSubject.journal_head_sha256,scope:approvalSubject.scope,
+          issued_at_utc:issuedAt.toISOString(),expires_at_utc:new Date(issuedAt.getTime()+expiresInMs).toISOString(),
+          provenance:'operator_mcp'};
+        validateBoundApproval({approval,subject:approvalSubject,now:issuedAt});
+        await appendEvent(ctx,journal,signingKeyPath,'approval_granted',approval);
+        if (waiting?.payload?.reason === 'human_input_required') {
+          await appendEvent(ctx,journal,signingKeyPath,'human_input_provided',{
+            request_event_sha256:waiting.event_sha256,question:waiting.payload.question,
+            answer,answer_sha256:sha256Bytes(Buffer.from(answer,'utf8'))
+          });
+        }
         const resumePhase=typeof waiting?.payload?.resume_phase === 'string' ? waiting.payload.resume_phase : 'PLAN';
         await appendEvent(ctx,journal,signingKeyPath,'waiting_resumed',{
           to:resumePhase,reason:waiting?.payload?.reason ?? current.reason ?? 'operator_approved',
@@ -1946,7 +2059,7 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
           continue;
         }
         const accepted = await acceptPlannerDecision({ ctx,events:journal,goal,state,policy,codingRuntime,capabilityManifest,
-          desktopMemoryProvider,memoryProvider,signingKeyPath,plannerResponse:suppliedResponse });
+          desktopMemoryProvider,memoryProvider,signingKeyPath,plannerResponse:suppliedResponse,plannerProviderRuntime });
         suppliedResponse = null;
         if (accepted?.needs_planner) {
           state = deriveState(goal,journal);

package/src/autonomous-supervisor-host.mjs

@@ -7,6 +7,8 @@ import { createCodingRuntime, loadCodingPolicy } from './coding-plane.mjs';
 import { loadAutonomousPolicy } from './autonomous-policy.mjs';
 import { createNativeDiffRuntime } from './native-diff.mjs';
 import { createAutonomousRuntime } from './autonomous-runtime.mjs';
+import { createCodexAppServerR44 } from './codex-app-server-r44.mjs';
+import { DEADBYTE_VERSION } from './version.mjs';
 import { startLocalSupervisorHost } from './autonomous-local-supervisor.mjs';
 
 const packageRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
@@ -30,7 +32,15 @@ const codingPolicy=await loadCodingPolicy(codingPolicyPath);
 const codingRuntime=createCodingRuntime({policy:codingPolicy,signingKeyPath,verifyKeyPath});
 const autonomousPolicy=await loadAutonomousPolicy(autonomousPolicyPath,codingPolicy);
 const nativeDiffRuntime=createNativeDiffRuntime({policy:autonomousPolicy,codingRuntime,signingKeyPath,verifyKeyPath});
-const autonomousRuntime=createAutonomousRuntime({policy:autonomousPolicy,codingRuntime,nativeDiffRuntime,signingKeyPath,verifyKeyPath});
+const plannerProviderRuntime=autonomousPolicy.planner.backend==='codex_app_server'
+  ? await createCodexAppServerR44({
+      stateDir:path.join(autonomousPolicy.evidence_dir,'provider-r44','codex-app-server'),
+      model:autonomousPolicy.planner.model,cwd:codingPolicy.roots[autonomousPolicy.planner.root_id].real_path,
+      clientVersion:DEADBYTE_VERSION,executable:autonomousPolicy.planner.executable,
+      executableSha256:autonomousPolicy.planner.executable_sha256,args:autonomousPolicy.planner.args
+    })
+  : null;
+const autonomousRuntime=createAutonomousRuntime({policy:autonomousPolicy,codingRuntime,nativeDiffRuntime,plannerProviderRuntime,signingKeyPath,verifyKeyPath});
 const markerPath=path.resolve(process.env.DEADBYTE_SUPERVISOR_MARKER||path.join(autonomousPolicy.evidence_dir,'supervisor-owner.json'));
 const host=await startLocalSupervisorHost({runtime:autonomousRuntime,policy:autonomousPolicy,markerPath,
   idleDelayMs:750,maxCycles:32,continuous:onceMode!=='1'});
@@ -43,7 +53,7 @@ let stopping=false;
 async function stopAndExit(code=0){
   if(stopping) return;
   stopping=true;
-  try { await host.stop(); }
+  try { await host.stop(); await plannerProviderRuntime?.close(); }
   catch(error){ process.stderr.write(`DEADBYTE supervisor host stop failed: ${String(error)}\n`); code=1; }
   process.exitCode=code;
 }

package/src/autonomous-supervisor.mjs

@@ -24,7 +24,7 @@ async function listGoalIds(policy) {
 export function startAutonomousSupervisor({ runtime, policy = runtime?.policy,
   idleDelayMs = 750, maxCycles = 32, logger = console, continuous = true } = {}) {
   if (!runtime || !policy) throw new Error('autonomous supervisor requires runtime + policy');
-  const providerBacked = policy.planner.backend === 'openai_compatible';
+  const providerBacked = ['openai_compatible','openai_responses'].includes(policy.planner.backend);
   if (!Number.isInteger(idleDelayMs) || idleDelayMs < 25 || idleDelayMs > 60_000) {
     throw new Error('autonomous supervisor idleDelayMs out of range');
   }

package/src/capability-ledger.mjs

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 export const CAPABILITY_LEDGER_SCHEMA='deadbyte.capability-ledger.v1';
 const AUTHORITIES=new Set(['none','process','coding','autonomous','desktop','host']);
 const PROFILE_ENV='DEADBYTE_CAPABILITY_PROFILE';
-const COMPACT_TOOL_LIMIT=42;
+const COMPACT_TOOL_LIMIT=43;
 
 function sha256(text){return createHash('sha256').update(text,'utf8').digest('hex');}
 function canonicalJson(value){
@@ -81,6 +81,7 @@ const gateway=(id,full_tool,compact_tool,compact_op,runtime_flag,authority,{muta
 
 export const R36_CAPABILITY_ENTRIES=Object.freeze([
   direct('evidence.verify','evidence_verify',null,'none',{receipt_class:'verification'}),
+  direct('skill.catalog','skill_catalog',null,'none',{receipt_class:'skill'}),
   gateway('machine.list','machine_list','machine_observe','machine_list','DEADBYTE_MACHINE_RUNTIME','none',{receipt_class:'machine'}),
   gateway('machine.status','machine_status','machine_observe','machine_status','DEADBYTE_MACHINE_RUNTIME','none',{receipt_class:'machine'}),
   gateway('machine.ping','machine_ping','machine_observe','machine_ping','DEADBYTE_MACHINE_RUNTIME','none',{receipt_class:'machine'}),

package/src/codex-app-server-r44.mjs

@@ -0,0 +1,154 @@
+import path from 'node:path';
+import { createAgentBackendR44 } from './agent-backend-r44.mjs';
+
+const ID=/^[A-Za-z0-9._-]{1,64}$/;
+function insist(ok,message){if(!ok)throw new Error(message);}
+function text(value,label,max=262144){insist(typeof value==='string'&&value.length>=1&&value.length<=max,`${label} invalid`);return value;}
+function threadIdFromResponse(value){
+  const id=value?.thread?.id;insist(typeof id==='string'&&id.length>=1&&id.length<=512,'Codex thread response missing thread.id');return id;
+}
+function turnIdFromResponse(value){
+  const id=value?.turn?.id;insist(typeof id==='string'&&id.length>=1&&id.length<=512,'Codex turn response missing turn.id');return id;
+}
+function safeThreadParams({model,cwd}){
+  return {model,cwd,approvalPolicy:'never',approvalsReviewer:'user',sandbox:'read-only',ephemeral:false};
+}
+function approvalHandler({method}){
+  if(method==='item/commandExecution/requestApproval'||method==='item/fileChange/requestApproval')return {decision:'decline'};
+  if(method==='item/permissions/requestApproval')return {permissions:{},scope:'turn'};
+  if(method==='item/tool/requestUserInput')return {answers:{}};
+  const error=new Error(`Codex server request denied: ${method}`);error.code=-32001;throw error;
+}
+
+export async function createCodexAppServerR44({
+  stateDir,model,cwd,clientVersion='0.15.0',transportFactory=null,
+  executable=null,executableSha256=null,args=['app-server'],env=null
+}={}){
+  insist(typeof stateDir==='string'&&path.isAbsolute(stateDir),'Codex stateDir must be absolute');
+  text(model,'Codex model',128);insist(typeof cwd==='string'&&path.isAbsolute(cwd),'Codex cwd must be absolute');
+  text(clientVersion,'Codex client version',64);
+  const turns=new Map();
+  const attachedThreads=new Set();
+  let initialized=false;
+
+  function turnRecord(turnId,threadId=null){
+    let rec=turns.get(turnId);
+    if(!rec){rec={turn_id:turnId,thread_id:threadId,final_answer:null,unknown_answer:null,status:null,error:null,waiters:[]};turns.set(turnId,rec);}
+    else if(threadId&&rec.thread_id===null)rec.thread_id=threadId;
+    return rec;
+  }
+  function settle(rec){
+    if(!rec.status||!['completed','failed','interrupted'].includes(rec.status))return;
+    const waiters=rec.waiters.splice(0);
+    if(rec.status==='completed'){
+      const raw=rec.final_answer??rec.unknown_answer;
+      for(const waiter of waiters){
+        clearTimeout(waiter.timer);
+        if(typeof raw==='string'&&raw.length>0)waiter.resolve({raw_text:raw});
+        else waiter.reject(new Error('Codex turn completed without agent final response'));
+      }
+    }else{
+      for(const waiter of waiters){clearTimeout(waiter.timer);waiter.reject(new Error(rec.error??`Codex turn ${rec.status}`));}
+    }
+  }
+  async function notificationHandler({method,params}){
+    if(method==='item/completed'){
+      const tid=params?.turnId,threadId=params?.threadId,item=params?.item;
+      if(typeof tid!=='string'||!item||typeof item!=='object')return;
+      const rec=turnRecord(tid,typeof threadId==='string'?threadId:null);
+      if(item.type==='agentMessage'||item.type==='agent_message'){
+        if(typeof item.text!=='string')return;
+        if(item.phase==='final_answer'||item.phase==='finalAnswer')rec.final_answer=item.text;
+        else if(item.phase===null||item.phase===undefined)rec.unknown_answer=item.text;
+      }
+      return;
+    }
+    if(method==='turn/completed'){
+      const turn=params?.turn;const tid=turn?.id;
+      if(typeof tid!=='string')return;
+      const rec=turnRecord(tid,typeof params?.threadId==='string'?params.threadId:null);
+      rec.status=String(turn.status??'completed');
+      if(rec.status==='failed')rec.error=turn.error?.message??'Codex turn failed';
+      settle(rec);
+    }
+  }
+
+  const backend=await createAgentBackendR44({
+    backendId:'codex-app-server',stateDir:path.join(stateDir,'backend'),transportFactory,
+    executable,executableSha256,args,cwd,env,wireMode:'codex-app-server',
+    serverRequestHandler:approvalHandler,notificationHandler
+  });
+
+  async function start(){
+    if(initialized)return {status:'ok',initialized:true};
+    await backend.start();
+    await backend.request({method:'initialize',params:{
+      clientInfo:{name:'deadbyte-mcp',version:clientVersion},
+      capabilities:{experimentalApi:false,requestAttestation:false,optOutNotificationMethods:null}
+    },timeoutMs:30000});
+    await backend.notify({method:'initialized',params:{}});
+    initialized=true;
+    return {status:'ok',initialized:true,backend:'codex_app_server'};
+  }
+  async function ensureStarted(){if(!initialized)await start();}
+  async function ensureThread({logicalId}={}){
+    await ensureStarted();insist(typeof logicalId==='string'&&ID.test(logicalId),'Codex logical thread id invalid');
+    const status=await backend.status();const existing=status.threads[logicalId];
+    if(existing){
+      if(!attachedThreads.has(existing)){
+        const response=await backend.request({method:'thread/resume',params:{threadId:existing,...safeThreadParams({model,cwd}),excludeTurns:true},timeoutMs:60000});
+        const resumed=threadIdFromResponse(response);insist(resumed===existing,'Codex resumed thread identity mismatch');attachedThreads.add(existing);
+      }
+      return {status:'ok',logical_id:logicalId,thread_id:existing,resumed:true};
+    }
+    const response=await backend.request({method:'thread/start',params:safeThreadParams({model,cwd}),timeoutMs:60000});
+    const created=threadIdFromResponse(response);
+    await backend.bindThread({logicalId,threadId:created});attachedThreads.add(created);
+    return {status:'ok',logical_id:logicalId,thread_id:created,resumed:false};
+  }
+  function waitTurn(turnId,threadId,timeoutMs){
+    insist(Number.isInteger(timeoutMs)&&timeoutMs>=100&&timeoutMs<=900000,'Codex turn timeout invalid');
+    const rec=turnRecord(turnId,threadId);
+    if(rec.status&&['completed','failed','interrupted'].includes(rec.status)){
+      return new Promise((resolve,reject)=>{
+        const timer=setTimeout(()=>{},1);rec.waiters.push({resolve,reject,timer});settle(rec);
+      });
+    }
+    return new Promise((resolve,reject)=>{
+      const timer=setTimeout(()=>{
+        const index=rec.waiters.findIndex(x=>x.timer===timer);if(index>=0)rec.waiters.splice(index,1);
+        reject(new Error('Codex turn completion timeout'));
+      },timeoutMs);
+      rec.waiters.push({resolve,reject,timer});
+    });
+  }
+  async function runPlanner({logicalId='planner',prompt,timeoutMs=120000}={}){
+    text(prompt,'Codex planner prompt',1024*1024);
+    const thread=await ensureThread({logicalId});
+    const started=await backend.request({method:'turn/start',params:{
+      threadId:thread.thread_id,input:[{type:'text',text:prompt}],approvalPolicy:'never'
+    },timeoutMs:Math.min(timeoutMs,60000)});
+    const turnId=turnIdFromResponse(started);turnRecord(turnId,thread.thread_id);
+    const completed=await waitTurn(turnId,thread.thread_id,timeoutMs);
+    return {backend:'codex_app_server',model,raw_text:completed.raw_text,response_id:turnId,thread_id:thread.thread_id};
+  }
+  async function steer({threadId,turnId,text:message,timeoutMs=30000}={}){
+    await ensureStarted();text(threadId,'Codex threadId',512);text(turnId,'Codex turnId',512);text(message,'Codex steer text',262144);
+    return backend.request({method:'turn/steer',params:{threadId,expectedTurnId:turnId,input:[{type:'text',text:message}]},timeoutMs});
+  }
+  async function interrupt({threadId,turnId,timeoutMs=30000}={}){
+    await ensureStarted();text(threadId,'Codex threadId',512);text(turnId,'Codex turnId',512);
+    return backend.request({method:'turn/interrupt',params:{threadId,turnId},timeoutMs});
+  }
+  async function modelList({includeHidden=false}={}){
+    await ensureStarted();return backend.request({method:'model/list',params:{includeHidden:includeHidden===true},timeoutMs:30000});
+  }
+  async function status(){const value=await backend.status();return {...value,initialized,attached_threads:[...attachedThreads].sort()};}
+  async function close(){
+    for(const rec of turns.values()){
+      for(const waiter of rec.waiters.splice(0)){clearTimeout(waiter.timer);waiter.reject(new Error('Codex adapter closed before turn completion'));}
+    }
+    initialized=false;attachedThreads.clear();return backend.close();
+  }
+  return Object.freeze({start,ensureThread,runPlanner,steer,interrupt,modelList,status,close,backend});
+}