delegation-layer 0.1.22 → 0.1.27

package/README.md

@@ -164,7 +164,10 @@ Dispatching a task requires:
 
 The release contains the supervisor client and daemon and starts a private
 instance under the state root, recovering it when a control command finds it
-stopped. An explicit `--pueue-config` or
+stopped. A reachable compatible daemon is adopted across CLI upgrades without
+stopping it or rewriting its launch record. An explicit supervisor repair
+command is available for a real logical/configuration migration; it preserves
+active work and the legacy journal. An explicit `--pueue-config` or
 `DELEGATE_PUEUE_CONFIG` can still select an existing compatible supervisor for
 advanced integrations. Node.js 18 or newer is needed only for the npm-based
 installers; it is not a runtime requirement for the released Go CLI. Provider
@@ -225,6 +228,26 @@ choices. Per-model effort metadata is independent of the harness-wide list.
 Discovery exits `0` for `available` or `partial`, `2` for `blocked` or
 `unavailable`, and `1` for `failed`.
 
+For Codex's native read-only review command, select `codex:review` and make
+the Git state explicit:
+
+```sh
+delegate --root "$HOME/delegation-state" dispatch \
+  --provider codex:review \
+  --review-target uncommitted \
+  --brief "$PWD/review-brief.txt" \
+  --cwd "$HOME/delegation-workspace" \
+  --permission read-only \
+  --budget 30m \
+  --json
+```
+
+Use `base:BRANCH` or `commit:SHA` for a different review target. Review tasks
+are persisted as read-only tasks and do not support continuation or active-turn
+interaction. The brief is retained in the task evidence; Codex's explicit
+review target supplies the native review scope because the Codex CLI does not
+accept a prompt together with these target flags.
+
 If a task reports `status: "timed_out"` and
 `continuation.resumable: true`, continue the exact session:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "delegation-layer",
-  "version": "0.1.22",
+  "version": "0.1.27",
   "description": "Multi-provider AI agent delegation CLI and Agent Skill for running bounded coding tasks across provider CLIs.",
   "keywords": [
     "ai-agents",

package/plugins/delegation-layer/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "delegation-layer",
   "displayName": "Delegation Layer",
-  "version": "0.1.22",
+  "version": "0.1.27",
   "description": "Consult external AI harnesses and CCR-configured models for reviews, research, implementation, and debate through the resumable Delegate CLI.",
   "author": {
     "name": "Hesham Karam",

package/plugins/delegation-layer/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "delegation-layer",
-  "version": "0.1.22",
+  "version": "0.1.27",
   "description": "Consult external AI harnesses and CCR-configured models for reviews, research, implementation, and debate through the resumable Delegate CLI.",
   "author": {
     "name": "Hesham Karam",

package/plugins/delegation-layer/skills/agent-integration/SKILL.md

@@ -34,14 +34,27 @@ Do not inspect, authenticate, install, or repair provider CLIs to bypass a
 Delegate blocker.
 
 A reported blocker is a valid final response to a delegation request. It does
-not turn that request into an environment-repair task. When a response says
-`failure.next_action: "stop_and_report"`, that attempt is finished. Include its
-failure in your final response without opening a clarification dialog to choose
-a fallback. For `task_record: not_created`, identify the requested destination
-and include the saved JSON failure response verbatim. A `task_id` can be returned
-even when no task record was created. Do not infer that an unavailable provider
-is uninstalled or unauthenticated. Do not append inferred state paths or
-provider-setup diagnoses, run diagnostic commands, retry it, or use another integration.
+not turn that request into an environment-repair task. The one lifecycle
+exception is `failure.code: "supervisor_upgrade_required"` with
+`next_action: "run_supervisor_migrate"`: run Delegate's own
+`supervisor migrate` command once with the exact same state root, then retry the
+exact original admission command once only when migration succeeds. Preserve
+its argv and intent: `dispatch` remains `dispatch`, and `continue` remains
+`continue`. The migration response field `next_action: "retry_dispatch"` is a
+protocol name for this command-neutral retry; it never authorizes replacing a
+failed `continue` with a fresh dispatch. This is internal Delegate recovery,
+not Pueue administration. Never run `pueue`, `pueued`, socket inspection,
+process searches, root deletion, or a provider CLI during recovery. Executable
+path or hash drift alone is handled by normal adoption and does not require
+this command.
+When a response says `failure.next_action: "stop_and_report"`, that attempt is
+finished. Include its failure in your final response without opening a
+clarification dialog to choose a fallback. For `task_record: not_created`,
+identify the requested destination and include the saved JSON failure response
+verbatim. A `task_id` can be returned even when no task record was created. Do
+not infer that an unavailable provider is uninstalled or unauthenticated. Do
+not append inferred state paths or provider-setup diagnoses, run diagnostic
+commands, or use another integration.
 Troubleshooting requires a separate user request. Other independently requested
 tasks may proceed; the failed attempt must remain reported as failed or blocked.
 
@@ -77,12 +90,16 @@ tasks may proceed; the failed attempt must remain reported as failed or blocked.
    foreground until all requested tasks reach a terminal result or an explicit
    blocker. Do not end a headless turn promising a background notification.
    Pending publication (exit 3) means keep waiting, not success. When the JSON
+   reports `pending.kind: "lifetime-finalization"`, the resident guardian still
+   owns cleanup; keep observing that same task without supervisor repair,
+   process commands, redispatch, or provider fallback. When the JSON
    includes an outstanding `interaction.pending_requests` batch, follow
    [active-task interaction](references/interaction.md) before waiting again. Only detach
    when the user explicitly requests it, retaining the exact task IDs.
-   Collection may recover the
-   saved supervisor only to observe an already-requested budget stop; it never
-   launches a provider or retries a task.
+   Collection may reconcile the saved Pueue binding and recover the guardian
+   lifetime only for an already-requested stop. A queue-row end alone cannot
+   publish terminal facts; collection never launches a provider or retries a
+   task.
 6. If `failure.next_action` is `recheck`, follow
    [offline recovery](references/result-handling.md#offline-recovery) once for
    that task. Rechecking saved evidence does not run the provider again.
@@ -96,15 +113,25 @@ tasks may proceed; the failed attempt must remain reported as failed or blocked.
 9. Never put credentials, tokens, or unrestricted provider output in a brief,
    option, receipt, or agent message.
 10. Permission modes select provider-native behavior, not an independent sandbox.
-   Providers load their own configuration and extensions. If a task is rejected,
-   report delegate's evidence; do not assume the user's configuration is faulty
-   or remove MCP servers, plugins, settings, or credentials to make it pass.
+    Providers load their own configuration and extensions. If a task is rejected,
+    report delegate's evidence; do not assume the user's configuration is faulty
+    or remove MCP servers, plugins, settings, or credentials to make it pass.
 11. The model chooses ordinary-task fan-out by issuing independent `dispatch`
     commands concurrently. The private supervisor does not impose a task-count
     or CPU-based limit. Use this for independent investigation, debate, review,
     or provider comparison. Concurrent write tasks must use separate workspaces
     or explicit coordination to avoid file conflicts.
 
+For an explicit Codex code review, use the discoverable `codex:review` profile
+with one persisted target: `--review-target uncommitted`,
+`--review-target base:BRANCH`, or `--review-target commit:SHA`. It is read-only
+and does not support `--interactive`, continuation, or workspace-write. Use
+ordinary `codex:exec` when the request is a general investigation or asks the
+provider to edit files; the review profile is for Codex's native review
+operation and keeps the reviewed Git state explicit. The brief is retained as
+task evidence; the review target supplies Codex's review scope because its
+native command does not accept a prompt with the target flag.
+
 ## Operating procedure
 
 ### 1. Verify the control CLI
@@ -139,7 +166,8 @@ normal task. For an explicitly requested readiness check, see
 The catalog and `capabilities` response expose supported permission modes,
 request options, continuation, native interaction, and the read-only mechanism. A read-only
 capability with `containment: "provider-owned"` selects the provider's native
-behavior but is not an independent delegate-owned sandbox. Static discovery
+behavior but is not an independent delegate-owned sandbox. This is separate
+from guardian-owned process-lifetime containment. Static discovery
 does not prove authentication or live acceptance; use the dispatch or live
 acceptance result for that evidence.
 
@@ -257,6 +285,7 @@ for **each attempt**, including requests issued together:
 | Response | Next action |
 |---|---|
 | Usage error, no JSON response | Correct the reported syntax using Delegate help or `providers --json`, then invoke that request again. Parsing failed before admission. |
+| `task_record: not_created`, `failure.code: supervisor_upgrade_required`, and `failure.next_action: run_supervisor_migrate` | Run `delegate --root "<the exact absolute state root used by the failed command>" supervisor migrate --json` once. Retry the exact original admission argv once only after `supervisor_control.state: migrated` and `supervisor_control.next_action: retry_dispatch`; otherwise stop and report the migration response. Preserve an explicit custom root exactly. A failed `continue` must be retried as the same `continue`; never replace it with a fresh `dispatch` or a direct provider call. |
 | `task_record: not_created` and `failure.next_action: correct_request` | Correct that request and retry it. |
 | `task_record: not_created` with any other next action | Report that attempt's failure and stop it. Do not diagnose provider setup or substitute an integration. |
 | `task_record: created` | Use `status` before taking any other action. Do not dispatch again. |

package/plugins/delegation-layer/skills/agent-integration/evals/evals.json

@@ -27,6 +27,11 @@
       "prompt": "The result says status timed_out and continuation.resumable is true.",
       "expected": ["delegate continue --task", "new task id", "collect successor", "no fresh unrelated dispatch"]
     },
+    {
+      "name": "continue-supervisor-migration",
+      "prompt": "An exact-session delegate continue command returned task_record not_created with failure.code supervisor_upgrade_required and failure.next_action run_supervisor_migrate. Migration then returned supervisor_control.state migrated and supervisor_control.next_action retry_dispatch.",
+      "expected": ["run same-root supervisor migrate exactly once", "retry the argv-equivalent continue exactly once", "one linked successor", "zero fresh dispatch commands", "zero direct provider calls"]
+    },
     {
       "name": "blocked-auth",
       "prompt": "Capability output says live_acceptance.status is blocked.",

package/plugins/delegation-layer/skills/agent-integration/evals/routing.json

@@ -5,7 +5,7 @@
       "name": "codex-review",
       "prompt": "Ask Codex to review pricing.py for correctness. Return the finding without editing files.",
       "external": true,
-      "provider": "codex:exec",
+      "provider": "codex:review",
       "split": "development",
       "native_alternative_for": "codex"
     },

package/plugins/delegation-layer/skills/agent-integration/references/command-reference.md

@@ -21,18 +21,27 @@ All paths passed to `--root`, `--cwd`, and `--brief` must be absolute. Add
 | `delegate logs TASK --json` | Return validated output descriptors | No |
 | `delegate cancel TASK --json` | Record one explicit stop request | Stops, does not relaunch |
 
+`delegate supervisor migrate --json` is the single command-neutral recovery
+step for a `supervisor_upgrade_required` admission response. Run it once with
+the failed command's exact root. A successful response names its next action
+`retry_dispatch`, but the original command and argv remain authoritative:
+retry `dispatch` as `dispatch` or `continue` as `continue`, exactly once.
+
 The bundled supervisor is managed by the released CLI under the state root.
 Collection remains observational. Provider authentication remains the
 provider’s own responsibility and is never performed by this skill.
 
 Dispatch flags:
 
-- `--brief FILE`: bounded task instructions;
+- `--brief FILE`: bounded task instructions; for `codex:review`, the brief is
+  retained as task evidence and the explicit review target supplies Codex's
+  native scope;
 - `--cwd ABS`: workspace for the delegated turn;
 - `--permission read-only|workspace-write`: read-only investigation or authorized unattended write execution, including commands (not independent containment);
 - `--budget DURATION`: finite turn budget;
 - `--auto`: let the CLI select a ready provider;
 - `--provider ID`: preserve the caller’s named harness or provider, resolved through the catalog;
+- `--review-target uncommitted|base:BRANCH|commit:SHA`: select the explicit Git state for `codex:review`; it is required for that read-only profile and unsupported by other profiles;
 - `--model MODEL` and `--effort VALUE`: provider-advertised choices (CCR requires a model alias);
   Codex maps effort to TOML `model_reasoning_effort` for ordinary turns or a native
   turn parameter for interactive turns, while Claude and AGY
@@ -102,7 +111,8 @@ delegate preflight --provider PROVIDER_ID --cwd ABSOLUTE_WORKSPACE \
 ```
 
 Use `read-only` for investigation or `workspace-write` for authorized edits.
-Supply any required provider options, including `--model ALIAS` for `ccr:print`.
+Supply any required provider options, including `--model ALIAS` for `ccr:print`
+and `--review-target TARGET` for `codex:review`.
 Preflight does not create a task, start the supervisor, or launch a provider.
 Its result is not proof of live authentication or successful execution. Report
 `blocked` or `unsupported` results; a readiness request does not authorize

package/plugins/delegation-layer/skills/agent-integration/references/continuation.md

@@ -32,8 +32,13 @@ The follow-up brief is optional. If it is omitted, Delegation Layer reuses the
 validated predecessor brief. A successful continuation returns a new task ID
 and links it to the predecessor. Observe and collect the new ID separately. Always retain the original state
 root, even if a returned command hint omits it. Permission is inherited; do not
-add `--permission` to `continue`. Apply the dispatch `task_record` error rules
-in [result handling](result-handling.md) before retrying or observing.
+add `--permission` to `continue`. If this exact `continue` returns the
+migration-required `not_created` response, run the same-root supervisor
+migration once and then repeat that argv-equivalent `continue` once after the
+successful migration response. The response field is named `retry_dispatch`,
+but it does not authorize a fresh dispatch. Apply the remaining `task_record`
+error rules in [result handling](result-handling.md) before retrying or
+observing.
 
 `mode` describes the provider contract:
 
@@ -44,6 +49,7 @@ in [result handling](result-handling.md) before retrying or observing.
 
 Do not use a guessed session ID, a provider-specific resume command, or a new
 independent dispatch to recover a timeout. The CLI accepts either a validated
-terminal outcome or durable supervisor-ended budget-stop evidence for the
+terminal outcome or a durable Pueue-ended observation backed by a guardian
+lifetime-termination record with independently proven empty scope for the
 session handoff; without one of those proofs it refuses continuation. Inspect
 the predecessor again rather than bypassing that boundary.

package/plugins/delegation-layer/skills/agent-integration/references/result-handling.md

@@ -5,11 +5,20 @@ the same as a successful provider result.
 
 1. Save `task_id` immediately after dispatch or continue.
 2. For a dispatch or continue error, inspect `task_record` first. When it is
-   `created`, observe the returned ID with `status`. When it is `not_created`,
-   do not poll; correct the request only if `failure.next_action` is
-   `correct_request`, otherwise report and stop. When it is `unknown`, stop and
-   report without polling or retrying. Status and collect can report
-   `admission: "unknown"` alongside valid terminal evidence for an existing task.
+   `created`, observe the returned ID with `status`. Before applying the generic
+   `not_created` stop rule, handle the sole migration exception: when
+   `failure.code` is `supervisor_upgrade_required` and `failure.next_action` is
+   `run_supervisor_migrate`, run `supervisor migrate` once with the same root.
+   Only after it reports `supervisor_control.state: "migrated"` and
+   `supervisor_control.next_action: "retry_dispatch"`, retry the exact original
+   admission argv once. The retry is command-neutral: `dispatch` remains
+   `dispatch`, and `continue` remains `continue`; never create a fresh dispatch
+   or call a provider directly to replace a failed continuation. For every
+   other `not_created` response, do not poll; correct the request only if
+   `failure.next_action` is `correct_request`, otherwise report and stop. When
+   `task_record` is `unknown`, stop and report without polling or retrying.
+   Status and collect can report `admission: "unknown"` alongside valid terminal
+   evidence for an existing task.
 3. If `status` is `timed_out`, follow the continuation procedure before treating
    pending publication as a reason to wait. `continuation.resumable: true`
    permits a linked successor even when no outcome has been published.
@@ -19,14 +28,23 @@ the same as a successful provider result.
    follow [offline recovery](#offline-recovery) once. Otherwise report the
    terminal rejection with its diagnostic and evidence. Do not redispatch.
 6. If `pending.kind` is `interaction`, handle the returned questions using
-   [interaction guidance](interaction.md) before waiting again. Otherwise, if
-   `liveness` is queued or running or publication is pending, observe the same
-   task with a finite watch interval.
+   [interaction guidance](interaction.md) before waiting again. If
+   `pending.kind` is `lifetime-finalization`, the resident guardian still owns
+   cleanup; observe the same task with a finite watch interval and do not run
+   supervisor or process commands, redispatch, or call the provider directly.
+   Otherwise, if `liveness` is queued or running or publication is pending,
+   observe the same task with a finite watch interval.
 7. If authentication is `blocked`, preserve that neutral state and tell the
    caller what prerequisite is unavailable without inventing a login command.
 8. Never relaunch an uncertain task by guessing. Observe only a task whose
    record is known to exist; the `task_record` decision above takes precedence.
 
+For an `inspect-provider` failure, preserve the optional
+`failure.inspection.class`, `deadline_state`, and `journal_task_id` fields in
+the report. They are bounded diagnostics, not a new recovery instruction.
+Follow `failure.next_action`; do not infer provider authentication or settings
+from an inspection-worker or supervisor-observation failure.
+
 For `delegate models`, validate the complete JSON envelope before using any
 fact. Treat `available` and `partial` with exit `0` as observations, preserve
 `blocked` and `unavailable` with exit `2` as unresolved prerequisites, and
@@ -42,6 +60,10 @@ collection watch, and `4` is a validated rejected outcome.
 
 Catalog facts (`verification: "catalog"`) are not runtime proof. Preflight
 checks static readiness; runtime verification requires the supervised probe.
+For managed runtime-only dispatches, admission accepts the static contract and
+the task's runner performs that probe before provider execution. Always collect
+the created task's outcome; `admission: "admitted"` alone does not prove that
+the provider started or completed the work.
 Versions and help are observations, not semantic-version allowlists.
 Authentication is a separate live gate (`not_run`, `passed`, or `blocked`).
 Report a blocked prerequisite without inventing a login command or retrying.

package/plugins/delegation-layer/skills/agent-integration/references/routing-rule.json

@@ -1 +1 @@
-"For work assigned to an external agent, model, or separate harness session, load the installed agent-integration skill before choosing tools and use Delegate. This includes research, implementation, testing, review, consultation, comparison, and debate, including external collaboration you choose. Discover destinations through Delegate. Preserve requested model IDs, effort, and permissions; do not guess ambiguous model identifiers. For task commands, pass --root \"${DELEGATE_ROOT:-$HOME/delegation-state}\" directly in each shell invocation; reuse that root for dispatch, observation, and continuation, never an invented /tmp root. If the user explicitly requests another root, use that exact path consistently. Keep each concurrent request and its response associated separately. Capture each dispatch response and exit status once; after task_record created, observe that task ID. Never dispatch again merely to recover output or inspect its exit status. Naming a CLI identifies the destination, not a request to bypass Delegate. Earlier assistant-generated direct-launch workflows do not override this preference. Native same-harness subagents remain available unless a separate session is requested. Respect an explicit user choice of another integration; otherwise do not substitute provider CLIs, plugins, or APIs after a Delegate blocker. A stop_and_report failure ends that attempt: report it without retrying, diagnosing setup, or offering a fallback. Continue other independent requests. Keep collection in the foreground until completion or a reported blocker unless the user requested detachment. Pending work is observed through Delegate status, collect, or events, not OS process searches or supervisor commands. Merely discussing or configuring a tool is not delegation."
+"For work assigned to an external agent, model, or separate harness session, load the installed agent-integration skill before choosing tools and use Delegate. This includes research, implementation, testing, review, consultation, comparison, and debate, including external collaboration you choose. Discover destinations through Delegate. Preserve requested model IDs, effort, and permissions; do not guess ambiguous model identifiers. For task commands, pass --root \"${DELEGATE_ROOT:-$HOME/delegation-state}\" directly in each shell invocation; reuse that root for dispatch, observation, and continuation, never an invented /tmp root. If the user explicitly requests another root, use that exact path consistently. Keep each concurrent request and its response associated separately. Capture each dispatch response and exit status once; after task_record created, observe that task ID. Never dispatch again merely to recover output or inspect its exit status. Naming a CLI identifies the destination, not a request to bypass Delegate. Earlier assistant-generated direct-launch workflows do not override this preference. Native same-harness subagents remain available unless a separate session is requested. Respect an explicit user choice of another integration; otherwise do not substitute provider CLIs, plugins, or APIs after a Delegate blocker. Before the generic task_record:not_created stop rule, handle only supervisor_upgrade_required with run_supervisor_migrate: migrate the same root once, then retry the exact original admission argv once after migrated/retry_dispatch; dispatch remains dispatch and continue remains continue, with no fresh dispatch or direct provider call replacing a failed continue. A stop_and_report failure ends that attempt: report it without retrying, diagnosing setup, or offering a fallback. Continue other independent requests. Keep collection in the foreground until completion or a reported blocker unless the user requested detachment. Pending work is observed through Delegate status, collect, or events, not OS process searches or supervisor commands. Merely discussing or configuring a tool is not delegation."

package/skills/agent-integration/SKILL.md

@@ -34,14 +34,27 @@ Do not inspect, authenticate, install, or repair provider CLIs to bypass a
 Delegate blocker.
 
 A reported blocker is a valid final response to a delegation request. It does
-not turn that request into an environment-repair task. When a response says
-`failure.next_action: "stop_and_report"`, that attempt is finished. Include its
-failure in your final response without opening a clarification dialog to choose
-a fallback. For `task_record: not_created`, identify the requested destination
-and include the saved JSON failure response verbatim. A `task_id` can be returned
-even when no task record was created. Do not infer that an unavailable provider
-is uninstalled or unauthenticated. Do not append inferred state paths or
-provider-setup diagnoses, run diagnostic commands, retry it, or use another integration.
+not turn that request into an environment-repair task. The one lifecycle
+exception is `failure.code: "supervisor_upgrade_required"` with
+`next_action: "run_supervisor_migrate"`: run Delegate's own
+`supervisor migrate` command once with the exact same state root, then retry the
+exact original admission command once only when migration succeeds. Preserve
+its argv and intent: `dispatch` remains `dispatch`, and `continue` remains
+`continue`. The migration response field `next_action: "retry_dispatch"` is a
+protocol name for this command-neutral retry; it never authorizes replacing a
+failed `continue` with a fresh dispatch. This is internal Delegate recovery,
+not Pueue administration. Never run `pueue`, `pueued`, socket inspection,
+process searches, root deletion, or a provider CLI during recovery. Executable
+path or hash drift alone is handled by normal adoption and does not require
+this command.
+When a response says `failure.next_action: "stop_and_report"`, that attempt is
+finished. Include its failure in your final response without opening a
+clarification dialog to choose a fallback. For `task_record: not_created`,
+identify the requested destination and include the saved JSON failure response
+verbatim. A `task_id` can be returned even when no task record was created. Do
+not infer that an unavailable provider is uninstalled or unauthenticated. Do
+not append inferred state paths or provider-setup diagnoses, run diagnostic
+commands, or use another integration.
 Troubleshooting requires a separate user request. Other independently requested
 tasks may proceed; the failed attempt must remain reported as failed or blocked.
 
@@ -77,12 +90,16 @@ tasks may proceed; the failed attempt must remain reported as failed or blocked.
    foreground until all requested tasks reach a terminal result or an explicit
    blocker. Do not end a headless turn promising a background notification.
    Pending publication (exit 3) means keep waiting, not success. When the JSON
+   reports `pending.kind: "lifetime-finalization"`, the resident guardian still
+   owns cleanup; keep observing that same task without supervisor repair,
+   process commands, redispatch, or provider fallback. When the JSON
    includes an outstanding `interaction.pending_requests` batch, follow
    [active-task interaction](references/interaction.md) before waiting again. Only detach
    when the user explicitly requests it, retaining the exact task IDs.
-   Collection may recover the
-   saved supervisor only to observe an already-requested budget stop; it never
-   launches a provider or retries a task.
+   Collection may reconcile the saved Pueue binding and recover the guardian
+   lifetime only for an already-requested stop. A queue-row end alone cannot
+   publish terminal facts; collection never launches a provider or retries a
+   task.
 6. If `failure.next_action` is `recheck`, follow
    [offline recovery](references/result-handling.md#offline-recovery) once for
    that task. Rechecking saved evidence does not run the provider again.
@@ -96,15 +113,25 @@ tasks may proceed; the failed attempt must remain reported as failed or blocked.
 9. Never put credentials, tokens, or unrestricted provider output in a brief,
    option, receipt, or agent message.
 10. Permission modes select provider-native behavior, not an independent sandbox.
-   Providers load their own configuration and extensions. If a task is rejected,
-   report delegate's evidence; do not assume the user's configuration is faulty
-   or remove MCP servers, plugins, settings, or credentials to make it pass.
+    Providers load their own configuration and extensions. If a task is rejected,
+    report delegate's evidence; do not assume the user's configuration is faulty
+    or remove MCP servers, plugins, settings, or credentials to make it pass.
 11. The model chooses ordinary-task fan-out by issuing independent `dispatch`
     commands concurrently. The private supervisor does not impose a task-count
     or CPU-based limit. Use this for independent investigation, debate, review,
     or provider comparison. Concurrent write tasks must use separate workspaces
     or explicit coordination to avoid file conflicts.
 
+For an explicit Codex code review, use the discoverable `codex:review` profile
+with one persisted target: `--review-target uncommitted`,
+`--review-target base:BRANCH`, or `--review-target commit:SHA`. It is read-only
+and does not support `--interactive`, continuation, or workspace-write. Use
+ordinary `codex:exec` when the request is a general investigation or asks the
+provider to edit files; the review profile is for Codex's native review
+operation and keeps the reviewed Git state explicit. The brief is retained as
+task evidence; the review target supplies Codex's review scope because its
+native command does not accept a prompt with the target flag.
+
 ## Operating procedure
 
 ### 1. Verify the control CLI
@@ -139,7 +166,8 @@ normal task. For an explicitly requested readiness check, see
 The catalog and `capabilities` response expose supported permission modes,
 request options, continuation, native interaction, and the read-only mechanism. A read-only
 capability with `containment: "provider-owned"` selects the provider's native
-behavior but is not an independent delegate-owned sandbox. Static discovery
+behavior but is not an independent delegate-owned sandbox. This is separate
+from guardian-owned process-lifetime containment. Static discovery
 does not prove authentication or live acceptance; use the dispatch or live
 acceptance result for that evidence.
 
@@ -257,6 +285,7 @@ for **each attempt**, including requests issued together:
 | Response | Next action |
 |---|---|
 | Usage error, no JSON response | Correct the reported syntax using Delegate help or `providers --json`, then invoke that request again. Parsing failed before admission. |
+| `task_record: not_created`, `failure.code: supervisor_upgrade_required`, and `failure.next_action: run_supervisor_migrate` | Run `delegate --root "<the exact absolute state root used by the failed command>" supervisor migrate --json` once. Retry the exact original admission argv once only after `supervisor_control.state: migrated` and `supervisor_control.next_action: retry_dispatch`; otherwise stop and report the migration response. Preserve an explicit custom root exactly. A failed `continue` must be retried as the same `continue`; never replace it with a fresh `dispatch` or a direct provider call. |
 | `task_record: not_created` and `failure.next_action: correct_request` | Correct that request and retry it. |
 | `task_record: not_created` with any other next action | Report that attempt's failure and stop it. Do not diagnose provider setup or substitute an integration. |
 | `task_record: created` | Use `status` before taking any other action. Do not dispatch again. |

package/skills/agent-integration/evals/evals.json

@@ -27,6 +27,11 @@
       "prompt": "The result says status timed_out and continuation.resumable is true.",
       "expected": ["delegate continue --task", "new task id", "collect successor", "no fresh unrelated dispatch"]
     },
+    {
+      "name": "continue-supervisor-migration",
+      "prompt": "An exact-session delegate continue command returned task_record not_created with failure.code supervisor_upgrade_required and failure.next_action run_supervisor_migrate. Migration then returned supervisor_control.state migrated and supervisor_control.next_action retry_dispatch.",
+      "expected": ["run same-root supervisor migrate exactly once", "retry the argv-equivalent continue exactly once", "one linked successor", "zero fresh dispatch commands", "zero direct provider calls"]
+    },
     {
       "name": "blocked-auth",
       "prompt": "Capability output says live_acceptance.status is blocked.",

package/skills/agent-integration/evals/routing.json

@@ -5,7 +5,7 @@
       "name": "codex-review",
       "prompt": "Ask Codex to review pricing.py for correctness. Return the finding without editing files.",
       "external": true,
-      "provider": "codex:exec",
+      "provider": "codex:review",
       "split": "development",
       "native_alternative_for": "codex"
     },

package/skills/agent-integration/references/command-reference.md

@@ -21,18 +21,27 @@ All paths passed to `--root`, `--cwd`, and `--brief` must be absolute. Add
 | `delegate logs TASK --json` | Return validated output descriptors | No |
 | `delegate cancel TASK --json` | Record one explicit stop request | Stops, does not relaunch |
 
+`delegate supervisor migrate --json` is the single command-neutral recovery
+step for a `supervisor_upgrade_required` admission response. Run it once with
+the failed command's exact root. A successful response names its next action
+`retry_dispatch`, but the original command and argv remain authoritative:
+retry `dispatch` as `dispatch` or `continue` as `continue`, exactly once.
+
 The bundled supervisor is managed by the released CLI under the state root.
 Collection remains observational. Provider authentication remains the
 provider’s own responsibility and is never performed by this skill.
 
 Dispatch flags:
 
-- `--brief FILE`: bounded task instructions;
+- `--brief FILE`: bounded task instructions; for `codex:review`, the brief is
+  retained as task evidence and the explicit review target supplies Codex's
+  native scope;
 - `--cwd ABS`: workspace for the delegated turn;
 - `--permission read-only|workspace-write`: read-only investigation or authorized unattended write execution, including commands (not independent containment);
 - `--budget DURATION`: finite turn budget;
 - `--auto`: let the CLI select a ready provider;
 - `--provider ID`: preserve the caller’s named harness or provider, resolved through the catalog;
+- `--review-target uncommitted|base:BRANCH|commit:SHA`: select the explicit Git state for `codex:review`; it is required for that read-only profile and unsupported by other profiles;
 - `--model MODEL` and `--effort VALUE`: provider-advertised choices (CCR requires a model alias);
   Codex maps effort to TOML `model_reasoning_effort` for ordinary turns or a native
   turn parameter for interactive turns, while Claude and AGY
@@ -102,7 +111,8 @@ delegate preflight --provider PROVIDER_ID --cwd ABSOLUTE_WORKSPACE \
 ```
 
 Use `read-only` for investigation or `workspace-write` for authorized edits.
-Supply any required provider options, including `--model ALIAS` for `ccr:print`.
+Supply any required provider options, including `--model ALIAS` for `ccr:print`
+and `--review-target TARGET` for `codex:review`.
 Preflight does not create a task, start the supervisor, or launch a provider.
 Its result is not proof of live authentication or successful execution. Report
 `blocked` or `unsupported` results; a readiness request does not authorize

package/skills/agent-integration/references/continuation.md

@@ -32,8 +32,13 @@ The follow-up brief is optional. If it is omitted, Delegation Layer reuses the
 validated predecessor brief. A successful continuation returns a new task ID
 and links it to the predecessor. Observe and collect the new ID separately. Always retain the original state
 root, even if a returned command hint omits it. Permission is inherited; do not
-add `--permission` to `continue`. Apply the dispatch `task_record` error rules
-in [result handling](result-handling.md) before retrying or observing.
+add `--permission` to `continue`. If this exact `continue` returns the
+migration-required `not_created` response, run the same-root supervisor
+migration once and then repeat that argv-equivalent `continue` once after the
+successful migration response. The response field is named `retry_dispatch`,
+but it does not authorize a fresh dispatch. Apply the remaining `task_record`
+error rules in [result handling](result-handling.md) before retrying or
+observing.
 
 `mode` describes the provider contract:
 
@@ -44,6 +49,7 @@ in [result handling](result-handling.md) before retrying or observing.
 
 Do not use a guessed session ID, a provider-specific resume command, or a new
 independent dispatch to recover a timeout. The CLI accepts either a validated
-terminal outcome or durable supervisor-ended budget-stop evidence for the
+terminal outcome or a durable Pueue-ended observation backed by a guardian
+lifetime-termination record with independently proven empty scope for the
 session handoff; without one of those proofs it refuses continuation. Inspect
 the predecessor again rather than bypassing that boundary.

package/skills/agent-integration/references/result-handling.md

@@ -5,11 +5,20 @@ the same as a successful provider result.
 
 1. Save `task_id` immediately after dispatch or continue.
 2. For a dispatch or continue error, inspect `task_record` first. When it is
-   `created`, observe the returned ID with `status`. When it is `not_created`,
-   do not poll; correct the request only if `failure.next_action` is
-   `correct_request`, otherwise report and stop. When it is `unknown`, stop and
-   report without polling or retrying. Status and collect can report
-   `admission: "unknown"` alongside valid terminal evidence for an existing task.
+   `created`, observe the returned ID with `status`. Before applying the generic
+   `not_created` stop rule, handle the sole migration exception: when
+   `failure.code` is `supervisor_upgrade_required` and `failure.next_action` is
+   `run_supervisor_migrate`, run `supervisor migrate` once with the same root.
+   Only after it reports `supervisor_control.state: "migrated"` and
+   `supervisor_control.next_action: "retry_dispatch"`, retry the exact original
+   admission argv once. The retry is command-neutral: `dispatch` remains
+   `dispatch`, and `continue` remains `continue`; never create a fresh dispatch
+   or call a provider directly to replace a failed continuation. For every
+   other `not_created` response, do not poll; correct the request only if
+   `failure.next_action` is `correct_request`, otherwise report and stop. When
+   `task_record` is `unknown`, stop and report without polling or retrying.
+   Status and collect can report `admission: "unknown"` alongside valid terminal
+   evidence for an existing task.
 3. If `status` is `timed_out`, follow the continuation procedure before treating
    pending publication as a reason to wait. `continuation.resumable: true`
    permits a linked successor even when no outcome has been published.
@@ -19,14 +28,23 @@ the same as a successful provider result.
    follow [offline recovery](#offline-recovery) once. Otherwise report the
    terminal rejection with its diagnostic and evidence. Do not redispatch.
 6. If `pending.kind` is `interaction`, handle the returned questions using
-   [interaction guidance](interaction.md) before waiting again. Otherwise, if
-   `liveness` is queued or running or publication is pending, observe the same
-   task with a finite watch interval.
+   [interaction guidance](interaction.md) before waiting again. If
+   `pending.kind` is `lifetime-finalization`, the resident guardian still owns
+   cleanup; observe the same task with a finite watch interval and do not run
+   supervisor or process commands, redispatch, or call the provider directly.
+   Otherwise, if `liveness` is queued or running or publication is pending,
+   observe the same task with a finite watch interval.
 7. If authentication is `blocked`, preserve that neutral state and tell the
    caller what prerequisite is unavailable without inventing a login command.
 8. Never relaunch an uncertain task by guessing. Observe only a task whose
    record is known to exist; the `task_record` decision above takes precedence.
 
+For an `inspect-provider` failure, preserve the optional
+`failure.inspection.class`, `deadline_state`, and `journal_task_id` fields in
+the report. They are bounded diagnostics, not a new recovery instruction.
+Follow `failure.next_action`; do not infer provider authentication or settings
+from an inspection-worker or supervisor-observation failure.
+
 For `delegate models`, validate the complete JSON envelope before using any
 fact. Treat `available` and `partial` with exit `0` as observations, preserve
 `blocked` and `unavailable` with exit `2` as unresolved prerequisites, and
@@ -42,6 +60,10 @@ collection watch, and `4` is a validated rejected outcome.
 
 Catalog facts (`verification: "catalog"`) are not runtime proof. Preflight
 checks static readiness; runtime verification requires the supervised probe.
+For managed runtime-only dispatches, admission accepts the static contract and
+the task's runner performs that probe before provider execution. Always collect
+the created task's outcome; `admission: "admitted"` alone does not prove that
+the provider started or completed the work.
 Versions and help are observations, not semantic-version allowlists.
 Authentication is a separate live gate (`not_run`, `passed`, or `blocked`).
 Report a blocked prerequisite without inventing a login command or retrying.

package/skills/agent-integration/references/routing-rule.json

@@ -1 +1 @@
-"For work assigned to an external agent, model, or separate harness session, load the installed agent-integration skill before choosing tools and use Delegate. This includes research, implementation, testing, review, consultation, comparison, and debate, including external collaboration you choose. Discover destinations through Delegate. Preserve requested model IDs, effort, and permissions; do not guess ambiguous model identifiers. For task commands, pass --root \"${DELEGATE_ROOT:-$HOME/delegation-state}\" directly in each shell invocation; reuse that root for dispatch, observation, and continuation, never an invented /tmp root. If the user explicitly requests another root, use that exact path consistently. Keep each concurrent request and its response associated separately. Capture each dispatch response and exit status once; after task_record created, observe that task ID. Never dispatch again merely to recover output or inspect its exit status. Naming a CLI identifies the destination, not a request to bypass Delegate. Earlier assistant-generated direct-launch workflows do not override this preference. Native same-harness subagents remain available unless a separate session is requested. Respect an explicit user choice of another integration; otherwise do not substitute provider CLIs, plugins, or APIs after a Delegate blocker. A stop_and_report failure ends that attempt: report it without retrying, diagnosing setup, or offering a fallback. Continue other independent requests. Keep collection in the foreground until completion or a reported blocker unless the user requested detachment. Pending work is observed through Delegate status, collect, or events, not OS process searches or supervisor commands. Merely discussing or configuring a tool is not delegation."
+"For work assigned to an external agent, model, or separate harness session, load the installed agent-integration skill before choosing tools and use Delegate. This includes research, implementation, testing, review, consultation, comparison, and debate, including external collaboration you choose. Discover destinations through Delegate. Preserve requested model IDs, effort, and permissions; do not guess ambiguous model identifiers. For task commands, pass --root \"${DELEGATE_ROOT:-$HOME/delegation-state}\" directly in each shell invocation; reuse that root for dispatch, observation, and continuation, never an invented /tmp root. If the user explicitly requests another root, use that exact path consistently. Keep each concurrent request and its response associated separately. Capture each dispatch response and exit status once; after task_record created, observe that task ID. Never dispatch again merely to recover output or inspect its exit status. Naming a CLI identifies the destination, not a request to bypass Delegate. Earlier assistant-generated direct-launch workflows do not override this preference. Native same-harness subagents remain available unless a separate session is requested. Respect an explicit user choice of another integration; otherwise do not substitute provider CLIs, plugins, or APIs after a Delegate blocker. Before the generic task_record:not_created stop rule, handle only supervisor_upgrade_required with run_supervisor_migrate: migrate the same root once, then retry the exact original admission argv once after migrated/retry_dispatch; dispatch remains dispatch and continue remains continue, with no fresh dispatch or direct provider call replacing a failed continue. A stop_and_report failure ends that attempt: report it without retrying, diagnosing setup, or offering a fallback. Continue other independent requests. Keep collection in the foreground until completion or a reported blocker unless the user requested detachment. Pending work is observed through Delegate status, collect, or events, not OS process searches or supervisor commands. Merely discussing or configuring a tool is not delegation."