flowviant 0.125.30 → 0.125.33

package/bin/lib/orchestrator.mjs

@@ -11,9 +11,11 @@ import { scrub, learnExtraSecrets, forgetExtraSecrets } from './uplinkScrub.mjs'
 import { OrchestratorInputTooLarge, readOrchestratorInput } from './orchestratorInput.mjs';
 import { SAFE_POINT_AFTER_EDIT as AFTER_EDIT } from './orchestratorProtocol.mjs';
 import { MACHINE_MESSAGE_ROUTE_STATES, MESSAGE_ROUTE_FIELD_MAX, OPEN_MESSAGE_ROUTE_STATES, ORCHESTRATOR_SERVER } from './orchestratorProtocol.mjs';
-import { captureToolName, isChildWriteTool, isClaudeStopTool, isDiscoveryTool, isFollowupTool, isPersonQuestionTool, isShellTool, isSpawnTool } from './nativeAgentTools.mjs';
+import { captureToolName, crossCliToolName, isChildWriteTool, isClaudeStopTool, isDiscoveryTool, isFollowupTool, isPersonQuestionTool, isShellTool, isSpawnTool } from './nativeAgentTools.mjs';
 import { childBrain, childChoice, followupTarget, readOnlyShell, readSpawn, spawnReceipt, withChildContract } from './orchestratorNative.mjs';
 import { SETTLED_SUBAGENT_STATUSES, SUBAGENT_CAP, SUBAGENT_FIELD_CAPS } from './subagentBounds.mjs';
+import { readOnlyLookup, splitHold } from './splitGate.mjs';
+import { createCrossCliChildren, CROSS_CLI_ACTIONS, CROSS_CLI_RESULT_WAIT_MAX_S } from './crossCliChild.mjs';
 
 const WAIT = 'Waiting for a free slot on the machine';
 // A research card's children read inside its fence; the orchestrator alone writes and delivers.
@@ -35,7 +37,7 @@ const text = (s, n) => scrubNativeText(s, n, scrub);
  * on Codex, only for a model in `catalog`, the measured spawnable models.
  */
 export async function createOrchestrator({ turnId, runtime, trace, admit, request = fleetRequest, notify = () => false, taken = () => {},
-  interval = 500, hold = 60_000, clock = Date.now, scrubText = text, children = {}, readOnlyRun = null, signal, rootTools = null, assignmentContext = () => '' } = {}) {
+  interval = 500, hold = 60_000, clock = Date.now, scrubText = text, children = {}, readOnlyRun = null, signal, rootTools = null, assignmentContext = () => '', crossCli = null, listen = listenHeldTool } = {}) {
   // Consults belong to a held attempt, never to a card turn. This capability
   // is entirely local; it cannot report routes or borrow an agent principal.
   if (readOnlyRun && (!['plan', 'capture'].includes(readOnlyRun.scope) || !filled(readOnlyRun.id) ||
@@ -73,11 +75,16 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   const emit = update => {
     const id = resolve(update.id), prior = records.get(id) ?? { id };
     const reading = { ...prior, ...update, id };
+    // A nested child's parent is named natively; the trace knows its record.
+    if (typeof update.parent === 'string' && update.parent !== 'lead') reading.parent = resolve(update.parent);
     if (reading.namedKind) reading.kind = reading.namedKind;
     if (reading.namedTitle) reading.title = reading.namedTitle;
     records.set(id, reading); trace.agent(reading); return reading;
   };
   const release = id => { const a = records.get(resolve(id)); a?.release?.(); if (a) a.release = null; };
+  // Subagents on another CLI (crossCliChild.mjs): a code card's lead only.
+  const others = crossCli && !readOnlyRun ? createCrossCliChildren({ lead: runtime, ...crossCli, access, card, split: children.split ?? null,
+    emit, count: () => records.size, admit, announce: m => announce(m), interval }) : null;
   // A wake the root CLI did not take (stdin closed; Codex always) waits for
   // the root's next tool hook, where both CLIs read additionalContext.
   const announce = message => {
@@ -152,6 +159,9 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     const spawn = readSpawn(event);
     if (!spawn) return { deny: 'Give this native spawn a text prompt or message so the run can gate it.' };
     const { callId, brief } = spawn;
+    // A child that may edit files waits for the person's yes (splitGate.mjs).
+    const held = splitHold(children.split ?? null, event, spawn, { runtime, access });
+    if (held) return { deny: held };
     // Above the card's model or effort is refused before any record or slot.
     const chosen = childBrain(event, spawn, card);
     if (chosen.deny) return { deny: chosen.deny };
@@ -166,6 +176,8 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     if (!slot(id)) { a.denied = resumed ? 'resume' : 'spawn'; return { deny: `${WAIT}. Agent id: ${id}. Keep working yourself; you will be told when this spawn can be retried. Do not wait for a child that has not started.` }; }
     // Claude's SendMessage addresses a child by its Agent `name`, Codex V2 by its task name.
     for (const name of spawn.names) if (filled(name) && name.length <= 160) aliases.set(name, id);
+    // Admitted unasked as a read-only lookup: its file writes are refused below.
+    if (readOnlyLookup(children.split ?? null, event, spawn, access)) a.readOnly = true;
     start(a, a.title);
     // A cheaper model or lower effort than the card's is relayed on the child's
     // stream, and the parent is asked to say why in its own update.
@@ -303,11 +315,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
         if (!records.has(id)) return { deny: sealedRun ? `That names no agent in this run.${childContract()}` : 'Use the agent record id in your prompt.' };
         bind(child, id);
       }
+      if (child && crossCliToolName(ev.tool_name)) return { deny: 'Only the card’s lead starts or continues a subagent on another CLI. Return your work to it.' };
       // A sealed child that missed (or never got) its start's words reads
       // them here, whole: an earlier run's follow-up, or a CLI without the hook.
       if (child && !records.has(resolve(child)) && !isDiscoveryTool(ev.tool_name))
         return { deny: sealedRun ? `Register with your orchestrator before working.${childContract()}` : 'Before working, call card_orchestrator.register_agent with the agent record id in your prompt. Tool discovery is allowed.' };
       if ((child && access === 'read' || readOnlyRun) && isChildWriteTool(ev.tool_name)) return { deny: readOnlyRun ? 'This attempt only reads: no file writes.' : READ_ONLY_REFUSAL };
+      if (child && records.get(resolve(child))?.readOnly && isChildWriteTool(ev.tool_name)) return { deny: 'You started as a read-only lookup: no file writes. Return your findings to the orchestrator.' };
       if (rootTools && captureToolName(ev.tool_name)) {
         if (child || !rootSession || ev.session_id !== rootSession) return { deny: 'Only the top-level capture coordinator may call capture tools. Return findings to it.' };
         return rootTools.authorize(ev);
@@ -340,6 +354,7 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
       return held.length ? { ...result, context: [result.context, ...held].filter(Boolean).join('\n\n') } : result;
     }
     if (action === 'route_message') return route(args);
+    if (CROSS_CLI_ACTIONS.includes(action)) { if (!others) throw new Error('This run cannot start a subagent on another CLI.'); return others.handle(action, args); }
     const id = named(args.agentId);
     // A person’s answer starts a new CLI turn. The parent carries the earlier
     // question and native identity in its own conversation; relay that known
@@ -396,13 +411,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   };
   let listener;
   try {
-    listener = await listenHeldTool({ envPrefix: 'FLOWVIANT_ORCHESTRATOR', verb: '__orchestrator-mcp', requestTimeoutMs: 5_000,
+    listener = await listen({ envPrefix: 'FLOWVIANT_ORCHESTRATOR', verb: '__orchestrator-mcp', requestTimeoutMs: others ? (CROSS_CLI_RESULT_WAIT_MAX_S + 30) * 1000 : 5_000,
       capability, isClosed: ended, respond });
   } catch (error) { forgetExtraSecrets(secretKey); throw error; }
   const { server, env: heldEnv, args: argv } = listener;
   // The hook reads it to refuse a research child's write while this is down.
   const env = { ...heldEnv, FLOWVIANT_ORCHESTRATOR_CHILDREN: access,
-    ...(readOnlyRun ? { FLOWVIANT_ORCHESTRATOR_READ_ONLY: '1' } : {}) };
+    ...(readOnlyRun ? { FLOWVIANT_ORCHESTRATOR_READ_ONLY: '1' } : {}), ...(others?.offered().length ? { FLOWVIANT_ORCHESTRATOR_CROSS_CLI: others.offered().join(',') } : {}) };
   const timer = setInterval(() => {
     if (ended() || polling) return;
     polling = true;
@@ -426,7 +441,9 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     } finally { polling = false; }
   }, interval);
   timer.unref?.();
-  return { env, config: { command: process.execPath, args: argv, env }, handle,
+  // Codex's own MCP tool timeout sits above a result call's longest wait.
+  return { env, config: { command: process.execPath, args: argv, env, ...(others ? { toolTimeoutSec: CROSS_CLI_RESULT_WAIT_MAX_S + 30 } : {}) }, handle,
+    crossCli: () => others?.offered() ?? [],
     root(id) { if (typeof id === 'string') rootSession = id; },
     resolve,
     spawnResult(result) {
@@ -460,10 +477,10 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     async close(stopped = false) {
       if (closed) return;
       closed = true; clearInterval(timer);
-      rootTools?.close();
+      rootTools?.close(); others?.close();
       // Only an escalated question waits for the person; any other asked child ended with the run.
       for (const a of records.values()) { release(a.id); const q = questions.get(a.id);
-        if (!terminal(a.status) && !(a.status === 'asked' && !readOnlyRun && !stopped && q?.escalated && !q.answer)) emit({ id: a.id, status: 'stopped', now: stopped ? 'Stopped with the run' : 'Run ended' }); }
+        if (!terminal(a.status) && !(!stopped && others?.asking(a.id)) && !(a.status === 'asked' && !readOnlyRun && !stopped && q?.escalated && !q.answer)) emit({ id: a.id, status: 'stopped', now: stopped ? 'Stopped with the run' : 'Run ended' }); }
       server.close(); server.closeAllConnections();
       forgetExtraSecrets(secretKey);
     },

package/bin/lib/orchestratorClient.mjs

@@ -1,4 +1,4 @@
-import { ORCHESTRATOR_TOOLS } from './orchestratorProtocol.mjs';
+import { CROSS_CLI_TOOLS, ORCHESTRATOR_TOOLS } from './orchestratorProtocol.mjs';
 import { ORCHESTRATOR_REQUEST_BYTES, ORCHESTRATOR_INPUT_TOO_LARGE, OrchestratorInputTooLarge } from './orchestratorInput.mjs';
 import { serveMcpStdio } from './mcpStdio.mjs';
 
@@ -25,6 +25,12 @@ export async function callOrchestrator(action, args, timeoutMs = ORCHESTRATOR_CL
   return result;
 }
 
+/** A result call waits up to its own waitSeconds (crossCliChild.mjs), past the usual bound. */
+export const callTimeoutFor = (action, args) => action === 'cli_agent_result'
+  ? (Math.min(Math.max(Number(args?.waitSeconds) || 60, 0), 300) + 15) * 1000 : ORCHESTRATOR_CLIENT_TIMEOUT_MS;
+
 export function orchestratorMcpMain() {
-  return serveMcpStdio({ serverInfo: { name: 'card-orchestrator', version: '2' }, tools: ORCHESTRATOR_TOOLS, call: callOrchestrator });
+  // Includes stop_cli_agent; all four child actions relay through this capability.
+  const tools = process.env.FLOWVIANT_ORCHESTRATOR_CROSS_CLI ? [...ORCHESTRATOR_TOOLS, ...CROSS_CLI_TOOLS] : ORCHESTRATOR_TOOLS;
+  return serveMcpStdio({ serverInfo: { name: 'card-orchestrator', version: '2' }, tools, call: (action, args) => callOrchestrator(action, args, callTimeoutFor(action, args)) });
 }

package/bin/lib/orchestratorPrompt.mjs

@@ -1,5 +1,6 @@
 import { TESTS_SCOPE } from './testFindingsContract.mjs';
 import { SAFE_POINT_AFTER_EDIT } from './orchestratorProtocol.mjs';
+import { splitContract } from './splitGate.mjs';
 
 /**
  * THE POSTURES A MARKED CARD IS ORCHESTRATED IN, and what their children may
@@ -49,7 +50,10 @@ const CHILD_SPELLING = {
 const atCard = (model, effort) =>
   `This card runs on ${model ? model : 'its CLI’s default model'} at ${effort ? `${effort} effort` : 'its CLI’s default effort'}.`;
 
-const childBrain = ({ runtime, model, effort }) => `CHILD MODEL AND EFFORT. ${atCard(model, effort)} By default every child runs at the card's model and effort${model || effort ? '; the gate names them when your spawn names neither, so a child never falls back to the CLI\'s own global default' : ', which it inherits from this run when your spawn names neither'}. For a simple, well-bounded child — a search, a sweep of file reads, a mechanical edit — you may choose a cheaper model or a lower effort. Keep the card's model and effort for hard or judgment-heavy work. Never choose a model or effort above the card's, and only models of this card's own CLI; the gate refuses an effort above the card's. ${CHILD_SPELLING[runtime] ?? ''} When you choose anything other than the card's model or effort for a child, name the choice and why in your update.`.replace('  ', ' ');
+/** Another CLI's children (E7, crossCliChild.mjs), where the controller offers them. */
+const CROSS_CLI_SPELLING = 'start_cli_agent starts a child on another CLI, at a model and effort of that CLI no higher than the card\'s effort; use it only for a batch the person put on that CLI';
+
+const childBrain = ({ runtime, model, effort, crossCli = [] }) => `CHILD MODEL AND EFFORT. ${atCard(model, effort)} By default every child runs at the card's model and effort${model || effort ? '; the gate names them when your spawn names neither, so a child never falls back to the CLI\'s own global default' : ', which it inherits from this run when your spawn names neither'}. For a simple, well-bounded child — a search, a sweep of file reads, a mechanical edit — you may choose a cheaper model or a lower effort. Keep the card's model and effort for hard or judgment-heavy work. Never choose a model or effort above the card's, and only models of this card's own CLI${crossCli.length ? ` for a native child (${CROSS_CLI_SPELLING})` : ''}; the gate refuses an effort above the card's. ${CHILD_SPELLING[runtime] ?? ''} When you choose anything other than the card's model or effort for a child, name the choice and why in your update.`.replace('  ', ' ');
 
 /** Investigators do not propose separate plans. Only this coordinator sees
  * and reconciles the complete selection before the existing JSON validator. */
@@ -126,15 +130,19 @@ ${childBrain(brain).replaceAll('card', 'capture turn')}`;
  * rules, the card's own model and effort, then the gate, routing and child
  * prompt rules every orchestrated card shares.
  */
-export function orchestratorContract({ posture = 'build', taskType = null, runtime = 'claude', model = null, effort = null } = {}) {
+export function orchestratorContract({ posture = 'build', taskType = null, runtime = 'claude', model = null, effort = null, split = null, crossCli = [] } = {}) {
   const reads = ORCHESTRATED_POSTURES[posture] === 'read';
+  // The person's yes before children edit files (splitGate.mjs): a research
+  // card's children only read, so nothing there waits or is proposed.
+  const asks = reads ? '' : splitContract(split, { runtime, model, effort, crossCli });
   return `CARD ORCHESTRATOR — this applies to this card's one CLI and worktree.
 You are the model the person chose and remain responsible for the card and its final JSON.
 When an agent queue snapshot is supplied, use it across resumed and fresh turns. Execute only the active card. A person's instruction keeps its stated scope across later cards; its recorded card is provenance, not an implicit target. Give each child a focused assignment with relevant prior findings, decisions and exact prerequisite references. Upcoming work never expands a child's assignment or the active card's product/write contract.
-${SPLIT}${reads ? '' : `\n${SHARED_FIRST}`}${taskType === 'tests' ? `\n${TESTS_SCOPE} Give every child this Tests scope explicitly.` : ''}${reads ? `\n${RESEARCH}` : ''}
-${childBrain({ runtime, model, effort })}
+${SPLIT}${reads ? '' : `\n${SHARED_FIRST}`}${asks ? `\n${asks}` : ''}${taskType === 'tests' ? `\n${TESTS_SCOPE} Give every child this Tests scope explicitly.` : ''}${reads ? `\n${RESEARCH}` : ''}
+${childBrain({ runtime, model, effort, crossCli })}
+${crossCli.length ? 'SUBAGENTS ON ANOTHER CLI. Use start_cli_agent for another CLI, cli_agent_result to read it, followup_cli_agent to continue by its agentId or key even in a later turn, and stop_cli_agent to interrupt just that child. A lost native session refuses in words. An asking result carries a question and options: answer with followup_cli_agent from known facts, or end your own turn through the existing person-question path. Never route a child question directly to the person. Research children only read and return findings; they never edit files.' : ''}
 
-The daemon gates every native spawn against this project's Turns at once pool, shared with its other turns. Claude children run in the background so you remain available for messages and their questions; Codex spawns are already asynchronous. A refused spawn with a waiting id has not started. Keep working yourself; do not wait for it. When notified of a free slot, retry its native spawn (the same or a reworded prompt) or its native follow-up; the slot is held for about a minute, then offered again later. Never bypass this gate with another CLI process. The orchestrator itself also holds a slot. If no slot becomes available, finish the work yourself.
+The daemon gates every native spawn against this project's Turns at once pool, shared with its other turns. Claude children run in the background so you remain available for messages and their questions; Codex spawns are already asynchronous. A refused spawn with a waiting id has not started. Keep working yourself; do not wait for it. When notified of a free slot, retry its native spawn (the same or a reworded prompt) or its native follow-up; the slot is held for about a minute, then offered again later. Never bypass this gate with another CLI process${crossCli.length ? '; start_cli_agent is not one: its child takes a slot from this same pool and waits while none is free' : ''}. The orchestrator itself also holds a slot. If no slot becomes available, finish the work yourself.
 On Claude you may end your turn while native children run: Claude keeps this process alive and wakes you on each child's completion and on the person's notes. Follow-ups and answers to a Claude child go through SendMessage to its agent id. Write the card's final JSON only after every child has finished or been stopped; your last answer is the card's answer.
 
 The card_orchestrator MCP tools report routing and child questions. A live person’s note has a Message id. Report each note using route_message:

package/bin/lib/orchestratorProtocol.mjs

@@ -34,4 +34,22 @@ export const ORCHESTRATOR_TOOLS = [
   { name: 'answer_agent', description: 'Answer a child question from known facts, or mark it for escalation to the person. An escalation returns the attribution to put on the existing blocked question card.',
     inputSchema: { type: 'object', properties: { agentId: { type: 'string' }, answer: { type: 'string' }, escalate: { type: 'boolean' },
       question: { type: 'string' }, nativeAgentId: { type: 'string' }, kind: { type: 'string' }, title: { type: 'string' } }, required: ['agentId'], additionalProperties: false } },
+
+];
+
+/** SUBAGENTS ON ANOTHER CLI (2026-11-06, D21, E7; crossCliChild.mjs): listed
+ *  only on a run that may start one (`FLOWVIANT_ORCHESTRATOR_CROSS_CLI`, the
+ *  CLIs offered). The daemon starts and fences the child itself. */
+export const CROSS_CLI_TOOLS = [
+  { name: 'start_cli_agent', description: 'Start a subagent on another CLI than yours (claude or codex) in this card\'s worktree, for a part of the card the person approved for that CLI. Returns its agentId at once; it works in the background. Read its outcome with cli_agent_result. The daemon fences it with the card\'s posture for that CLI; it cannot start subagents of its own.',
+    inputSchema: { type: 'object', properties: { cli: { enum: ['claude', 'codex'] }, title: { type: 'string' }, kind: { type: 'string', description: 'Backend, UI, Tests or the area of work.' },
+      brief: { type: 'string', description: 'The whole assignment: the part, the files it owns, the shared code it must not change, and what to return.' },
+      model: { type: 'string', description: 'A model of that CLI; leave it out for the person\'s batch choice or the default.' }, effort: { type: 'string' } },
+    required: ['cli', 'title', 'kind', 'brief'], additionalProperties: false } },
+  { name: 'followup_cli_agent', description: 'Send a finished subagent on another CLI a follow-up in its own conversation. Use the same agentId or stable key across turns. Refused while it is still working; a missing native session refuses in words. Returns at once; read it with cli_agent_result.',
+    inputSchema: { type: 'object', properties: { agentId: { type: 'string' }, message: { type: 'string' } }, required: ['agentId', 'message'], additionalProperties: false } },
+  { name: 'cli_agent_result', description: 'Wait up to waitSeconds (at most 300) for a subagent on another CLI, then return its status (waiting, running, done, asking, stopped or limited), the model and effort its own session names, its final message as result, the files it changed and the CLI\'s own words on a failure or plan limit.',
+    inputSchema: { type: 'object', properties: { agentId: { type: 'string' }, waitSeconds: { type: 'number', minimum: 0, maximum: 300 } }, required: ['agentId'], additionalProperties: false } },
+  { name: 'stop_cli_agent', description: 'Interrupt only this child, then kill its process group after the grace period if needed. Records stopped and releases its slot. Its files and conversation remain.',
+    inputSchema: { type: 'object', properties: { agentId: { type: 'string' } }, required: ['agentId'], additionalProperties: false } },
 ];

package/bin/lib/outsideCli.mjs

@@ -0,0 +1,124 @@
+/**
+ * A LEAD THAT SHELLS OUT TO ANOTHER CLI IS SHOWN, TAGGED "OUTSIDE" (D23,
+ * 2026-11-06, S4.6). `codex exec …` or `claude -p …` from a card's shell is
+ * a second model working on the card, and the person sitting at the keyboard
+ * would see it start. It is not one of the CLI's own subagents: it is never
+ * blocked, never counted toward the 32 and never given a subagent record.
+ * Each one is an `outside` row on the turn's trace (trace.mjs `outside`).
+ *
+ * THE MATCHER IS SMALL AND CONSERVATIVE ON PURPOSE. It reads only the first
+ * command of the line, after leading `cd … &&` steps, environment
+ * assignments and an `env`, inside one `bash -lc '…'` wrapper (Codex's exec
+ * spelling): its first word is `codex` with `exec`/`e`, `claude` with
+ * `-p`/`--print`, or `gemini`, directly or through `npx`/`bunx`/`pnpm dlx`/
+ * `npm exec` of that CLI's package. A pipeline, a loop or a script that
+ * starts one is not recognized: an unmatched line is an ordinary command,
+ * which the lead's stream relays as it always did. The asked model is what
+ * the command names (`--model`/`-m`); what ran is that CLI's business.
+ */
+
+const PACKAGES = Object.freeze({
+  '@openai/codex': 'codex',
+  '@anthropic-ai/claude-code': 'claude',
+  '@google/gemini-cli': 'gemini',
+});
+const RUNNERS = new Set(['npx', 'bunx']);
+const MODEL_RE = /^[A-Za-z0-9._:\-/]{1,80}$/;
+
+/** Shell words, with quotes honored and no expansion. */
+function words(line) {
+  const out = [];
+  let word = '', quote = null, any = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else if (ch === '\\' && quote === '"' && i + 1 < line.length) word += line[++i];
+      else word += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; any = true; continue; }
+    if (ch === '\\' && i + 1 < line.length) { word += line[++i]; any = true; continue; }
+    if (/\s/.test(ch)) { if (word || any) out.push(word); word = ''; any = false; continue; }
+    word += ch;
+  }
+  if (word || any) out.push(word);
+  return out;
+}
+
+/** The first command of a line, past `cd … &&`/`;` steps, as words. */
+function firstCommand(line) {
+  let text = String(line ?? '').trim();
+  const wrapped = text.match(/^(?:\S*\/)?(?:bash|sh|zsh)\s+-l?c\s+(['"])([\s\S]*)\1$/);
+  if (wrapped) text = wrapped[2].trim();
+  for (const step of text.split(/\s*(?:&&|;)\s*/)) {
+    const w = words(step);
+    if (!w.length || w[0] === 'cd' || w[0] === 'pushd') continue;
+    let i = 0;
+    if (w[i] === 'env') i++;
+    while (i < w.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(w[i])) i++;
+    return w.slice(i);
+  }
+  return [];
+}
+
+const base = word => String(word ?? '').split('/').at(-1);
+
+/** `{ cli, model? }` when the command starts another CLI, else null. */
+export function matchOutsideCli(command) {
+  let w = firstCommand(Array.isArray(command) ? command.join(' ') : command);
+  // A package runner names the CLI by its package.
+  const runner = base(w[0]);
+  const dlx = (runner === 'pnpm' && w[1] === 'dlx') || (runner === 'npm' && w[1] === 'exec');
+  let cli = null;
+  if (RUNNERS.has(runner) || dlx) {
+    let i = dlx ? 2 : 1;
+    while (i < w.length && w[i].startsWith('-')) i++;
+    cli = PACKAGES[String(w[i] ?? '').replace(/(?<=.)@[^/]*$/, '')] ?? null;
+    if (!cli) return null;
+    w = [cli, ...w.slice(i + 1).filter(x => x !== '--')];
+  } else cli = ['codex', 'claude', 'gemini'].includes(base(w[0])) ? base(w[0]) : null;
+  if (!cli) return null;
+  const args = w.slice(1);
+  if (cli === 'codex' && !['exec', 'e'].includes(args[0])) return null;
+  if (cli === 'claude' && !args.some(a => a === '-p' || a === '--print')) return null;
+  let model = null;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === '--model' || a === '-m') model = args[i + 1] ?? null;
+    else if (a.startsWith('--model=')) model = a.slice(8);
+  }
+  return { cli, ...(model && MODEL_RE.test(model) ? { model } : {}) };
+}
+
+/**
+ * The lead's tool events, watched for Outside rows. `observe` takes the
+ * same (name, input, meta) the lane's tool sink does: a shell call opens a
+ * row by its call id, its result settles it. A background shell's result is
+ * only its launch, so its row keeps no status it cannot know.
+ */
+export function createOutsideRuns(trace) {
+  const open = new Map();
+  return {
+    observe(name, input, meta) {
+      if (!meta?.id) return;
+      if (meta.result) {
+        if (!open.has(meta.id)) return;
+        const background = open.get(meta.id);
+        open.delete(meta.id);
+        if (background) return;
+        const failed = meta.isError === true || (Number.isInteger(meta.exitCode) && meta.exitCode !== 0);
+        trace.outside(meta.id, { status: failed ? 'failed' : 'done' });
+        return;
+      }
+      if (name !== 'Bash' || typeof input?.command !== 'string' && !Array.isArray(input?.command)) return;
+      const match = matchOutsideCli(input.command);
+      if (!match) return;
+      const background = input.run_in_background === true;
+      open.set(meta.id, background);
+      if (open.size > 64) open.delete(open.keys().next().value);
+      trace.outside(meta.id, { ...match, command: Array.isArray(input.command) ? input.command.join(' ') : input.command,
+        ...(background ? {} : { status: 'running' }) });
+    },
+  };
+}

package/bin/lib/prompts.mjs

@@ -1,3 +1,4 @@
+import { CONVERSATION_OUTPUT } from './conversationOutput.mjs';
 import { TESTS_SCOPE, TESTS_REPORT } from './testFindingsContract.mjs';
 import { randomBytes } from 'node:crypto';
 import { REGRESSION_INVESTIGATION } from './discoveryContract.mjs';
@@ -28,13 +29,14 @@ import { ARTIFACT_CONTRACT_TAIL, HELP_THEM_DECIDE, LOOK_HEADLESS, SYSTEM_AGENT_D
 import { isLibraryReference } from './knowledgeLibrary.mjs';
 import { readCardThread } from './cardThread.mjs';
 import { AGENT_FILE_LINE_MAX, AGENT_FILES_PER_MESSAGE_MAX, CARD_FILES_PER_TURN_MAX } from './agentFiles.mjs';
+import { SYSTEM_ARCHITECTURE_CONTRACT } from './architectureContract.mjs';
 
 // Wiki-gen turn: the local Claude READS the repo (cwd) and writes/maintains the
 // knowledge VAULT — a plain directory of markdown files with [[wikilinks]]
 // (Obsidian-style). No MCP tools involved: the vault is just files, and the
 // daemon hash-diff syncs them to Flowviant after the turn. The repo itself is
 // strictly read-only.
-const WIKI_MAINTENANCE = `
+const WIKI_MAINTENANCE = `${SYSTEM_ARCHITECTURE_CONTRACT}
 OWNERSHIP AND PROVENANCE — this directory is a disposable draft of GENERATED
 output, separate from project Knowledge, uploaded/reference vault snapshots and
 human standing Instructions. Never write to any original source. In this draft,
@@ -2037,12 +2039,12 @@ XHR, sockets, forms and popups are all closed. Never commit these files.`;
 /**
  * The system prompt a turn actually runs under: the contract it picked, plus
  * whatever project context this box holds. `knowledgeDir` null or absent and
- * `artifacts` false leave the contract byte-for-byte what it was, which is what
- * every turn did before either existed — and what an older server still gets.
- * Knowledge first, artifacts after: what to READ, then where to WRITE.
+ * `artifacts` false omit their paragraphs. The shared conversation output guide
+ * always follows the base contract. Knowledge then says what to READ, and the
+ * artifact paragraph says where to WRITE when that surface accepts files.
  */
 export const withProjectContext = (system, { knowledgeDir, artifacts = false } = {}) => {
-  let out = system;
+  let out = `${system}\n\n${CONVERSATION_OUTPUT}`;
   if (knowledgeDir) out = `${out}\n\n${KNOWLEDGE_PARAGRAPH(knowledgeDir)}`;
   if (artifacts) out = `${out}\n\n${ARTIFACTS_PARAGRAPH}`;
   return out;

package/bin/lib/runTurn.mjs

@@ -27,6 +27,7 @@ import { createTurnOutput } from './turnOutput.mjs';
 import { createObservedLines } from './observedLines.mjs';
 import { startTurnDiagnostics } from './turnDiagnostics.mjs';
 import { createClaudeInput } from './claudeInput.mjs';
+import { codexAppArgs, createCodexInput } from './codexInput.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
 import { createTurnSubagents } from './turnSubagents.mjs';
 import { withPublicReference } from './publicReferenceRuntime.mjs';
@@ -79,7 +80,7 @@ const MAX_ARG_BYTES = 128 * 1024;
 
 export function runTurn(opts) {
   if (workLanesStopped()) return never();
-  if ((opts.profile === 'research' || opts.researchIdentity) && ['claude', 'codex'].includes(opts.runtime ?? 'claude'))
+  if (!opts.crossCliChild && (opts.profile === 'research' || opts.researchIdentity) && ['claude', 'codex'].includes(opts.runtime ?? 'claude'))
     return withPublicReference(opts, runProfileTurn);
   return runProfileTurn(opts);
 }
@@ -88,7 +89,7 @@ function runProfileTurn(opts) {
   // A Codex write-up runs over an isolated copy of its worktree
   // (codexResearch.mjs). After the teardown it copies nothing either: the
   // stand-down gate below is asked before the copy, not only before the spawn.
-  if (opts.runtime === 'codex' && opts.profile === 'research')
+  if (!opts.crossCliChild && opts.runtime === 'codex' && opts.profile === 'research')
     return workLanesStopped() ? never() : runIsolatedResearch(opts, prepared => runResearchWithReceipt(prepared, runPlainTurn));
   if (opts.profile === 'research' && opts.researchHandoff)
     return prepareResearchLaunch(opts).then(prepared => runResearchWithReceipt(prepared, runPlainTurn));
@@ -208,6 +209,8 @@ function runPlainTurn(opts) {
       verifiedWorktree: opts.verifiedWorktree === true,
       orchestration: opts.orchestration === true,
       readOnlyCoordination: opts.readOnlyCoordination === true,
+      // A subagent on another CLI's card (crossCliChild.mjs, crossCliPosture.mjs).
+      crossCliChild: opts.crossCliChild === true,
       // The lane's own measurement when it decided to orchestrate, so the
       // hooks and the controller cannot disagree (workAgentTurnExecution.mjs).
       codexVersion: opts.codexVersion ?? measuredRuntimeVersion('codex')?.version,
@@ -303,8 +306,13 @@ function runPlainTurn(opts) {
      * so no throw on the way leaves that file behind: the sweep takes only a
      * dead process's leftovers, and this one names the daemon's own pid.
      */
+    const nativeVersion = opts.codexVersion ?? measuredRuntimeVersion('codex')?.version;
+    // Only a measured native protocol switches transport. Unknown/older CLIs
+    // still receive the original prompt and durable next-turn queue via exec.
+    const appArgs = rt.id === 'codex' && opts.liveMessages && nativeVersion ? codexAppArgs(args, nativeVersion) : null;
+    const codexApp = Boolean(appArgs);
     let transport;
-    try { transport = promptTransport(rt.id, args, stdinText); }
+    try { transport = appArgs ? { args: appArgs, text: null, cleanup() {} } : promptTransport(rt.id, args, stdinText); }
     catch (error) { rt.releaseArgs?.(args); throw error; }
     args.splice(0, args.length, ...transport.args);
     let argsReleased = false;
@@ -403,7 +411,13 @@ function runPlainTurn(opts) {
     const spawnedAt = Date.now();
     let out = '';
     let stdinError = null;
-    const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken, onContext: opts.onContext ?? null }) : null;
+    const input = codexApp ? createCodexInput(child, { cwd, threadId: resumeThreadId,
+      onTaken: id => { if (!id.startsWith('recovery-')) opts.liveMessages.onTaken(id); },
+      onThread: id => opts.liveMessages.onInit(id),
+      onEvent: event => onLine(JSON.stringify(event), Date.now(), true),
+      onFailure: () => { cliFailed = true; opts.onCliFailure?.(); },
+      onContext: opts.onContext ?? null,
+    }) : !rt.parse && rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken, onContext: opts.onContext ?? null }) : null;
     // EVERY TURN IS LINE-PARSED (2026-10-10, the audit). Claude's adapter
     // always asks for `--output-format stream-json` and every other runtime
     // brings its own `parse` — for Codex the JSONL stream is the only output
@@ -436,7 +450,7 @@ function runPlainTurn(opts) {
     };
     // The native children this CLI starts, observed (turnSubagents.mjs).
     const natives = createTurnSubagents({ runtime: rt.id, cwd, since: spawnedAt, env: { ...process.env, ...(mcpEnv ?? {}) },
-      owned: opts.orchestration === true, onSubagent: opts.onSubagent, onSpawnResult: opts.onSpawnResult, resumeThreadId,
+      owned: opts.orchestration === true, onSubagent: opts.onSubagent, onWorkflow: opts.onWorkflow, onSpawnResult: opts.onSpawnResult, resumeThreadId, knownSubagents: opts.knownSubagents,
       sinks: { emit, onActivity, onToolEvent, appendText, onDetail: output.detail } });
     let codexThread = rt.id === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;
     /**
@@ -471,14 +485,18 @@ function runPlainTurn(opts) {
     const taskPlan = new Map();
     /** One line of the child's stdout, in whichever dialect it speaks. */
     let cliFailed = false;
-    const onLine = (line, observedAt) => {
+    const onLine = (line, observedAt, nativeEvent = false) => {
+      if (codexApp && !nativeEvent) {
+        try { input.event(JSON.parse(line)); } catch { /* non-protocol stdout */ }
+        return;
+      }
       const emitObserved = (text, meta) => emit(text, { ...meta, observedAt });
       const toolObserved = (name, input, meta) => onToolEvent(name, input, meta, observedAt);
       try {
         const event = JSON.parse(line);
         const parentEvent = event.parent_tool_use_id == null && !event.isSidechain;
         opts.researchReceipt?.event(event);
-        if (input && parentEvent) {
+        if (input && !codexApp && parentEvent) {
           input.event(event);
           if (event.type === 'system' && event.subtype === 'init' && event.session_id) opts.liveMessages.onInit(event.session_id);
           // A message written just before result may become a second native
@@ -486,6 +504,7 @@ function runPlainTurn(opts) {
           // structured objects joined together; every result still reports spend.
           if (event.type === 'result') out = '';
         }
+        if (codexApp && event.type === 'turn.started') out = '';
         if (parentEvent && ((event.type === 'result' && event.is_error === true) ||
             event.type === 'error' || event.type === 'turn.failed')) {
           cliFailed = true;
@@ -500,7 +519,9 @@ function runPlainTurn(opts) {
       // thread.started). Purely additive: callers that pass no onThreadId —
       // every dispatch path — see zero behavior change.
       if (ev.threadId) {
-        if (rt.id === 'codex') { codexThread = ev.threadId; natives.thread(ev.threadId); }
+        if (rt.id === 'codex') { codexThread = ev.threadId; natives.thread(ev.threadId);
+          if (!input && opts.liveMessages) opts.liveMessages.onTaken(opts.liveMessages.turnId);
+        }
         onThreadId?.(ev.threadId);
       }
       // The runtime's own token count (codex's `turn.completed`) — the same
@@ -657,6 +678,7 @@ function runPlainTurn(opts) {
     if (input) {
       const initial = opts.liveMessages.initialPrompt(prompt, resumeThreadId, resume, opts.liveContinuation === true);
       input.send(opts.liveMessages.initialId || opts.liveMessages.turnId, initial);
+      if (codexApp) input.start();
       opts.liveMessages.connect(input.send);
     }
   });

package/bin/lib/runtimeClaude.mjs

@@ -21,6 +21,7 @@ import { withSettings } from './claudeSettingsArg.mjs';
 import { orchestratorHooks, claudeOrchestrationSafe } from './orchestratorHooks.mjs';
 import { orchestratesPosture } from './orchestratorPrompt.mjs';
 import { versionAtLeast } from './versionOrder.mjs';
+import { crossCliClaudePerm } from './crossCliPosture.mjs';
 
 /** The release the agent lane first measured `--system-prompt-snapshot` on
  *  (decisions.md, 2026-09-24). */
@@ -123,7 +124,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ managedBrowser = false, writableDirs = [], prompt, system, model, effort, resume, perm: postureList, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false, readOnlyCoordination = false, claudeVersion = null }) {
+  args({ managedBrowser = false, writableDirs = [], prompt, system, model, effort, resume, perm: postureList, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false, readOnlyCoordination = false, claudeVersion = null, crossCliChild = false, cwd }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -195,7 +196,10 @@ export const CLAUDE_RUNTIME = {
     // a research card's list then admits the children its fence denied.
     const readCoordinator = orchestration && readOnlyCoordination && ['consult', 'plan'].includes(profile) && claudeOrchestrationSafe(claudeVersion);
     const gated = readCoordinator || orchestration && orchestratesPosture(profile);
-    const perm = readCoordinator ? withReadOnlyCoordination(postureList) : gated && fenced ? withNativeChildren(postureList) : postureList;
+    // A subagent on another CLI's card runs the build fenced to its worktree,
+    // with no children of its own (crossCliPosture.mjs).
+    const perm = readCoordinator ? withReadOnlyCoordination(postureList) : gated && fenced ? withNativeChildren(postureList)
+      : crossCliChild ? crossCliClaudePerm(postureList, cwd, profile) : postureList;
     if (fenced) a.push(...NO_SETTING_SOURCES);
     // A FENCED POSTURE NAMES ITS OWN MODE (2026-10-10). Its lists fence only
     // under the CLI's `default` mode, where a tool the list does not name is
@@ -205,7 +209,7 @@ export const CLAUDE_RUNTIME = {
     // classifier that may approve what the list never named. So the posture
     // states `default` itself, unless its own list names a mode (plan-mode).
     if (fenced && !perm.includes('--permission-mode')) a.push('--permission-mode', 'default');
-    else if (agentTools) a.push('--setting-sources', 'user');
+    else if (agentTools || crossCliChild) a.push('--setting-sources', 'user');
     // EVERY TURN RENDERS ITS OWN SYSTEM PROMPT (2026-10-19). By default the
     // CLI records a conversation's first system prompt and resends that record
     // on every resume "even when a later launch passes different text" —

package/bin/lib/runtimeCodex.mjs

@@ -19,6 +19,7 @@ import { projectReadBoundary, projectReadFence } from './codexProjectRead.mjs';
 import { versionAtLeast } from './versionOrder.mjs';
 import { codexOrchestratorArgs } from './orchestratorHooks.mjs';
 import { orchestratesPosture } from './orchestratorPrompt.mjs';
+import { CROSS_CLI_TMP_FENCE } from './crossCliPosture.mjs';
 
 /**
  * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
@@ -215,7 +216,7 @@ export const CODEX_RUNTIME = {
   bin: 'codex',
   install: 'npm i -g @openai/codex',
   login: 'codex login',
-  liveInput: false,
+  liveInput: true,
   /**
    * BUILD AND CONSULT. See `args()` below for how consult is expressed — the
    * short version is that Codex keeps the promise at the kernel rather than in
@@ -281,7 +282,7 @@ export const CODEX_RUNTIME = {
    * limit even when its argv plus environment is far below ARG_MAX. Both exec
    * and exec resume support `-` (verified on Codex 0.160.0, 2026-10-16).
    */
-  args({ managedBrowser = false, streamInput = false, writableDirs = [], prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation, knowledgeDir, projectReads, cardTurn = false, verifiedWorktree = false, codexVersion, orchestration = false, readOnlyCoordination = false }) {
+  args({ managedBrowser = false, streamInput = false, writableDirs = [], prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation, knowledgeDir, projectReads, cardTurn = false, verifiedWorktree = false, codexVersion, orchestration = false, readOnlyCoordination = false, crossCliChild = false }) {
     // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
     // agy moves) — codex has no adoptable store wired yet. Reaching here
     // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -319,7 +320,7 @@ export const CODEX_RUNTIME = {
     // the parent's sandbox (2026-10-19, orchestratorPrompt.mjs).
     const gated = orchestration && (orchestratesPosture(fenced ? profile : 'build') || readOnlyCoordination && ['consult', 'plan'].includes(profile)) && codexSubagentsSafe(codexVersion);
     if (fenced) {
-      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads, subagents: gated, codexVersion }));
+      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads, subagents: gated, codexVersion, crossCliChild }));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -334,7 +335,9 @@ export const CODEX_RUNTIME = {
       if (writableDirs.length) a.push('-c', `sandbox_workspace_write.writable_roots=${JSON.stringify(writableDirs)}`);
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
       if (cardTurn) a.push('-c', 'approval_policy="never"', ...(agentTools?.codexApprovals ?? []));
-      a.push(...(cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion) ? CARD_SUBAGENTS : noSubagents(codexVersion)));
+      // A subagent on another CLI's card has none of its own (crossCliPosture.mjs).
+      a.push(...(crossCliChild ? [...noSubagents(codexVersion), ...(SAFE ? CROSS_CLI_TMP_FENCE : [])]
+        : cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion) ? CARD_SUBAGENTS : noSubagents(codexVersion)));
     }
 
     /**
@@ -521,9 +524,12 @@ const CODEX_FENCES = {
   // An orchestrated research card's children (2026-10-19) inherit this same
   // permission profile, approval policy and cwd (0.160.0 child_config.rs);
   // the gate refuses their writes.
-  research: ({ researchIsolation, subagents = false, codexVersion }) => {
+  research: ({ researchIsolation, subagents = false, codexVersion, crossCliChild = false }) => {
     if (!researchIsolation) throw new Error('Codex research requires its isolated input copy.');
-    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true, subagents, codexVersion })];
+    const fence = researchFence(researchIsolation);
+    // A child returns findings to its lead: even the artifact/scratch roots read only.
+    return [...(crossCliChild ? fence.map(a => a.startsWith('permissions.flowviantresearch.filesystem=') ? a.replaceAll('="write"', '="read"') : a) : fence),
+      ...fencedTail({ web: true, imageGeneration: !crossCliChild, subagents: !crossCliChild && subagents, codexVersion })];
   },
 };
 /** The fenced profile names — for the test that holds both tables to one set. */