flowviant 0.125.7 → 0.125.12

package/bin/lib/runTurn.mjs

@@ -11,6 +11,8 @@
  */
 
 import { promptTransport } from './promptTransport.mjs';
+import { prepareResearchLaunch } from './researchHandoff.mjs';
+import { runResearchWithReceipt } from './researchRestoration.mjs';
 import { runIsolatedResearch } from './codexResearch.mjs';
 import { spawn } from 'node:child_process';
 import { runtimeById } from './runtimes.mjs';
@@ -21,7 +23,8 @@ import { never, workLanesStopped } from './standDownGate.mjs';
 import { learnCodexLimits, recordClaudeRateLimit } from './runtimeLimits.mjs';
 import { initHarvestFor, recordMcpServers, recordSkills } from './runtimeCapabilities.mjs';
 import { codexTurnModel } from './turnModel.mjs';
-import { printableText } from './printable.mjs';
+import { createTurnOutput } from './turnOutput.mjs';
+import { createObservedLines } from './observedLines.mjs';
 import { startTurnDiagnostics } from './turnDiagnostics.mjs';
 import { createClaudeInput } from './claudeInput.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
@@ -29,6 +32,8 @@ import { createTurnSubagents } from './turnSubagents.mjs';
 
 /** How long a Codex turn's answer may wait on its rollout's model line. */
 const CODEX_MODEL_READ_MS = 1_500;
+/** How long an exited CLI's turn waits for its streams to close (see the `exit` handler). */
+export const EXIT_CLOSE_GRACE_MS = 2_000;
 
 /**
  * THE ENVIRONMENT A CLI TURN IS SPAWNED WITH — the daemon's own, plus the
@@ -61,7 +66,7 @@ export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
 }
 
 // One CLI turn. Output is captured (for sentinel detection) and streamed
-// through, line-prefixed with the worker label so a fleet stays legible.
+// through as complete timestamped records carrying work and turn identity.
 //
 // The event stream is parsed, always: only the humanized tool activity reaches
 // the console (a legible stream of `read …`, `grep …`, `+ node …`), assistant
@@ -76,12 +81,14 @@ export function runTurn(opts) {
   // (codexResearch.mjs). After the teardown it copies nothing either: the
   // stand-down gate below is asked before the copy, not only before the spawn.
   if (opts.runtime === 'codex' && opts.profile === 'research')
-    return workLanesStopped() ? never() : runIsolatedResearch(opts, runPlainTurn);
+    return workLanesStopped() ? never() : runIsolatedResearch(opts, prepared => runResearchWithReceipt(prepared, runPlainTurn));
+  if (opts.profile === 'research' && opts.researchHandoff)
+    return prepareResearchLaunch(opts).then(prepared => runResearchWithReceipt(prepared, runPlainTurn));
   return runPlainTurn(opts);
 }
 
 function runPlainTurn(opts) {
-  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
+  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', onSpawn, answerFromResult, onActivity, onToolEvent: callerOnToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
   /**
    * AFTER THE TEARDOWN, NO TURN STARTS AND NO TURN ENDS (standDownGate.mjs).
    * A stand-down that drains a deploy keeps this process alive; without this
@@ -90,11 +97,19 @@ function runPlainTurn(opts) {
    * Both answers stay pending instead, as `process.exit` left them.
    */
   if (workLanesStopped()) return never();
+  const output = createTurnOutput(opts);
+  const emit = output.emit;
+  const onToolEvent = (name, input, meta, observedAt) => {
+    output.tool(name, input, meta, observedAt);
+    callerOnToolEvent?.(name, input, meta);
+  };
   return new Promise((resolveTurn, rejectTurn) => {
     const resolve = (v) => {
+      output.close();
       if (!workLanesStopped()) resolveTurn(v);
     };
     const reject = (error) => {
+      output.close();
       if (!workLanesStopped()) rejectTurn(error);
     };
     const rt = runtimeById(runtime);
@@ -105,7 +120,7 @@ function runPlainTurn(opts) {
     // lane's `unsupported` check). Here the daemon log names the id and the
     // turn answers nothing — never Claude wearing the other runtime's name.
     if (!rt) {
-      console.error(`\nerror: cannot run '${runtime}' — this daemon does not know that runtime; update flowviant`);
+      output.error(`error: cannot run '${runtime}' — this daemon does not know that runtime; update flowviant`);
       resolve('');
       return;
     }
@@ -116,7 +131,7 @@ function runPlainTurn(opts) {
      */
     const turnProfile = resolveTurnProfile(opts);
     if (turnProfile.error) {
-      console.error(`\nerror: ${turnProfile.error}`);
+      output.error(`error: ${turnProfile.error}`);
       resolve('');
       return;
     }
@@ -131,7 +146,7 @@ function runPlainTurn(opts) {
     // adapter learns to express one this opens by itself.
     const offRuntime = turnProfile.onlyOn?.(rt);
     if (offRuntime) {
-      console.error(`\nerror: ${offRuntime}`);
+      output.error(`error: ${offRuntime}`);
       resolve('');
       return;
     }
@@ -140,7 +155,7 @@ function runPlainTurn(opts) {
       // drive. Fail as a turn with no sentinel — the loop already treats that as
       // "the protocol did not complete" and retries, rather than inventing a
       // completion for work that never started.
-      console.error(`\nerror: cannot run '${rt.label}' — ${rt.blocked}`);
+      output.error(`error: cannot run '${rt.label}' — ${rt.blocked}`);
       resolve('');
       return;
     }
@@ -371,28 +386,13 @@ function runPlainTurn(opts) {
       child.once('close', browser.cleanup);
       child.once('error', browser.cleanup);
     }
-    if (child.pid) onSpawn?.(child);
+    if (child.pid) { output.event(`${rt.label} started`, 'start'); onSpawn?.(child); }
     // When this turn began, for the Codex rollout read: a `turn_context` older
     // than this is a previous turn's (turnModel.mjs).
     const spawnedAt = Date.now();
     let out = '';
     let stdinError = null;
     const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken, onContext: opts.onContext ?? null }) : null;
-    const pfx = label ? `${label} ` : '';
-    /**
-     * THE ONE SINK FOR WHAT A CLI OR A MODEL WROTE (2026-10-10, the audit's
-     * F133): activity labels — a Bash command, a Codex `say`, a file path —
-     * and the CLI's raw stderr. A prompt-injected agent can put an OSC 52 in
-     * a tool command as easily as in prose, and this wrote it to the
-     * operator's terminal as-is. Scrubbed HERE, before the daemon's own
-     * coloured `label` is added, so the prefix keeps its colour and nothing
-     * the model wrote keeps an escape sequence (printable.mjs, `printableText`).
-     */
-    const emit = (s) => {
-      const text = printableText(String(s));
-      process.stdout.write(pfx ? text.replace(/\n/g, `\n${pfx}`) : text);
-    };
-
     // EVERY TURN IS LINE-PARSED (2026-10-10, the audit). Claude's adapter
     // always asks for `--output-format stream-json` and every other runtime
     // brings its own `parse` — for Codex the JSONL stream is the only output
@@ -401,7 +401,6 @@ function runPlainTurn(opts) {
     // already drifted once (it called process.exit(1)); both are gone. A line
     // that is not JSON is still kept as text (claudeStream.mjs), and stderr
     // still lands in the haystack the sentinels read.
-    let buf = '';
     const appendText = (t) => {
       out += t;
     };
@@ -419,13 +418,15 @@ function runPlainTurn(opts) {
      * waits on a file read. See runtimeLimits.mjs.
      */
     const onRate = (info) => {
+      if (info?.status === 'rejected' || info?.status === 'allowed_warning')
+        output.event(`${rt.label} plan limit: ${info.status}${typeof info.rateLimitType === 'string' ? ` (${info.rateLimitType})` : ''}`, 'limit');
       recordClaudeRateLimit(info);
       onRateLimit?.(info);
     };
     // The native children this CLI starts, observed (turnSubagents.mjs).
     const natives = createTurnSubagents({ runtime: rt.id, cwd, since: spawnedAt, env: { ...process.env, ...(mcpEnv ?? {}) },
       owned: opts.orchestration === true, onSubagent: opts.onSubagent, onSpawnResult: opts.onSpawnResult, resumeThreadId,
-      sinks: { emit, onActivity, onToolEvent, appendText } });
+      sinks: { emit, onActivity, onToolEvent, appendText, onDetail: output.detail } });
     let codexThread = rt.id === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;
     /**
      * THE MODEL THIS SPAWN RAN ON, ONCE (2026-09-29, turnModel.mjs). Claude
@@ -459,10 +460,13 @@ function runPlainTurn(opts) {
     const taskPlan = new Map();
     /** One line of the child's stdout, in whichever dialect it speaks. */
     let cliFailed = false;
-    const onLine = (line) => {
+    const onLine = (line, observedAt) => {
+      const emitObserved = (text, meta) => emit(text, { ...meta, observedAt });
+      const toolObserved = (name, input, meta) => onToolEvent(name, input, meta, observedAt);
       try {
         const event = JSON.parse(line);
         const parentEvent = event.parent_tool_use_id == null && !event.isSidechain;
+        opts.researchReceipt?.event(event);
         if (input && parentEvent) {
           input.event(event);
           if (event.type === 'system' && event.subtype === 'init' && event.session_id) opts.liveMessages.onInit(event.session_id);
@@ -478,7 +482,7 @@ function runPlainTurn(opts) {
         }
       } catch { /* ordinary non-JSON CLI output */ }
       if (!rt.parse)
-        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector, tasks: taskPlan });
+        return handleStreamLine(line, { cwd, emit: emitObserved, onActivity, onToolEvent: toolObserved, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector, tasks: taskPlan, onDetail: (text, meta) => output.detail(text, { ...meta, observedAt }) });
       const ev = rt.parse(line, cwd);
       if (!ev) return;
       // The conversation id, when the runtime announces one (codex's
@@ -495,14 +499,17 @@ function runPlainTurn(opts) {
       // A receipt the controller cannot take never ends this line's handling,
       // as when the lane parsed the line again itself (2026-10-18).
       if (ev.spawnResult) try { opts.onSpawnResult?.(ev.spawnResult); } catch { /* the controller's own failure */ }
-      if (ev.toolEvent) onToolEvent?.(...ev.toolEvent);
+      if (ev.toolEvent) toolObserved(...ev.toolEvent);
+      for (const tool of ev.toolEvents ?? []) toolObserved(...tool);
       if (ev.usage) onUsage?.(ev.usage);
       // One agent MESSAGE, alone — see parseCodexLine's `answer`. Last call
       // wins at the caller, which is what "the final answer" means.
       if (typeof ev.answer === 'string') onAnswer?.(ev.answer);
+      if (ev.detail) output.detail(ev.detail.text, { source: ev.detail.source, observedAt });
       if (ev.text) appendText(ev.text);
       if (ev.activity) {
-        emit(`${ev.activity.label}\n`);
+        emitObserved(ev.activity.kind === 'error' ? ev.activity.full ?? ev.activity.label : ev.activity.label + '\n', ev.activity);
+        if (ev.activity.error) emitObserved(ev.activity.error, { ...ev.activity, kind: 'error', full: ev.activity.error });
         onActivity?.(ev.activity);
       }
     };
@@ -513,19 +520,18 @@ function runPlainTurn(opts) {
     // `setEncoding` holds the partial bytes over to the next chunk.
     child.stdout.setEncoding('utf8');
     child.stderr.setEncoding('utf8');
+    let ended = false;
+    const stdoutLines = createObservedLines((line, at) => { if (line.trim()) onLine(line, at); });
+    const stderrLines = createObservedLines((line, observedAt) => emit(line + '\n', { observedAt, source: 'stderr' }));
     child.stdout.on('data', (d) => {
-      buf += d;
-      let nl;
-      while ((nl = buf.indexOf('\n')) >= 0) {
-        const line = buf.slice(0, nl);
-        buf = buf.slice(nl + 1);
-        if (line.trim()) onLine(line);
-      }
+      if (ended) return;
+      stdoutLines.push(d);
     });
     // stderr is not JSON (warnings/errors) — pass through and keep for sentinels.
     child.stderr.on('data', (s) => {
+      if (ended) return;
       out += s;
-      emit(s);
+      stderrLines.push(s);
     });
     /**
      * A SPAWN THAT FAILS FAILS THE TURN, NOT THE DAEMON — the one copy of the
@@ -541,32 +547,42 @@ function runPlainTurn(opts) {
      * this turn with the native reason; the lane records a failed report.
      */
     const onSpawnError = (e) => {
+      opts.researchReceipt?.fail();
       input?.close();
+      stdoutLines.end();
+      stderrLines.end();
       natives.abandon();
       if (opts.liveMessages) void opts.liveMessages.stop();
       finishDiagnostics({ pid: child.pid, spawnError: typeof e.code === 'string' ? e.code : 'SPAWN_ERROR' });
       releaseArgs();
       if (e.code === 'ENOENT') {
-        console.error(`\nerror: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
+        output.error(`error: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
         resolve('');
         return;
       }
-      console.error(e);
+      output.error(e);
       reject(e);
     };
     child.on('error', onSpawnError);
-    child.on('close', (code, signal) => {
+    const onClose = (code, signal) => {
+      if (ended) return;
+      ended = true;
       input?.close();
       releaseArgs();
       opts.onExit?.(code, signal);
-      if (buf.trim()) onLine(buf);
+      stdoutLines.end();
+      stderrLines.end();
+      if (code !== 0 || signal) opts.researchReceipt?.fail();
       finishDiagnostics({ code, signal, pid: child.pid, output: out, cliFailed, inputError: stdinError?.code });
       const handBack = async () => {
         if (opts.liveMessages) await opts.liveMessages.stop();
         await natives.drain(CODEX_MODEL_READ_MS);
         natives.sweep();
+        if (signal) output.event(`${rt.label} interrupted (${signal})`, 'interrupted');
+        else if (code !== 0) output.event(`${rt.label} exited with code ${code}`, 'error');
         if (stdinError) {
-          if (!workLanesStopped()) rejectTurn(stdinError);
+          output.error(stdinError);
+          reject(stdinError);
           return;
         }
         resolve(out);
@@ -598,12 +614,29 @@ function runPlainTurn(opts) {
         return;
       }
       handBack();
+    };
+    child.on('close', onClose);
+    /**
+     * THE CLI'S EXIT ENDS ITS TURN (2026-10-19). `close` waits for every
+     * stdio stream, and anything the CLI started that inherited them holds
+     * them open after the CLI is gone. A New task chat's Codex aborted its
+     * turn and exited; its turn stayed pending under a renewed lease for six
+     * and a half hours, until the machine restarted. An exited CLI says
+     * nothing more, so a turn its streams still hold settles with what it
+     * said. The streams keep draining, since the holder is not this turn's
+     * to break (`interruptThenKill`): a later line is dropped, never parsed
+     * into a settled turn.
+     */
+    child.once('exit', (code, signal) => {
+      const timer = setTimeout(() => onClose(code, signal), EXIT_CLOSE_GRACE_MS);
+      child.once('close', () => clearTimeout(timer));
     });
     if (transport.text !== null) {
       // end() buffers with backpressure and closes at EOF; Codex reads the
       // entire prompt before starting. An early close must not accept output
       // from a turn whose complete authorized input never reached the CLI.
       child.stdin.on('error', (error) => {
+        opts.researchReceipt?.fail('input_error');
         stdinError = Object.assign(new Error(`${rt.label} could not receive the complete turn input (${error.code || 'PIPE_ERROR'}).`), { code: error.code || 'PIPE_ERROR' });
         opts.onCliFailure?.();
         child.kill('SIGTERM');

package/bin/lib/runtimeClaude.mjs

@@ -16,9 +16,10 @@ import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
 import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings, writeTurnSettings } from './claudePersonal.mjs';
 import { machineMcpServers } from './claudeMachineMcp.mjs';
-import { claudePermFor, withMachineMcp } from './claudePosture.mjs';
+import { claudePermFor, withMachineMcp, withNativeChildren } from './claudePosture.mjs';
 import { withSettings } from './claudeSettingsArg.mjs';
 import { orchestratorHooks } from './orchestratorHooks.mjs';
+import { orchestratesPosture } from './orchestratorPrompt.mjs';
 import { versionAtLeast } from './versionOrder.mjs';
 
 /** The release the agent lane first measured `--system-prompt-snapshot` on
@@ -122,7 +123,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false, claudeVersion = null }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, perm: postureList, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false, claudeVersion = null }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -131,7 +132,7 @@ export const CLAUDE_RUNTIME = {
     if (profile === 'wiki' && !vaultDir) {
       throw new Error("a wiki turn needs its vault to fence — none reached claude's builder");
     }
-    if (profile === 'wiki' && !Array.isArray(perm)) {
+    if (profile === 'wiki' && !Array.isArray(postureList)) {
       throw new Error(`a wiki turn's vault must be a path a Claude Code permission rule can name — ${JSON.stringify(vaultDir)} is not`);
     }
     const a = [];
@@ -190,6 +191,10 @@ export const CLAUDE_RUNTIME = {
      * agent renders the CURRENT base snapshot, not the first turn's cache.
      */
     const fenced = profile !== 'build';
+    // THE GATE RIDES A CODE OR RESEARCH CARD (2026-10-19, orchestratorPrompt.mjs);
+    // a research card's list then admits the children its fence denied.
+    const gated = orchestration && orchestratesPosture(profile);
+    const perm = gated && fenced ? withNativeChildren(postureList) : postureList;
     if (fenced) a.push(...NO_SETTING_SOURCES);
     // A FENCED POSTURE NAMES ITS OWN MODE (2026-10-10). Its lists fence only
     // under the CLI's `default` mode, where a tool the list does not name is
@@ -274,7 +279,7 @@ export const CLAUDE_RUNTIME = {
     const mounted = machine ? withMachineMcp(perm, machineMcp) : perm;
     // The orchestrator's hooks join that same `--settings`: the CLI applies
     // only the last one it is handed (claudeSettingsArg.mjs `withSettings`).
-    const postured = orchestration && !fenced ? withSettings(mounted, { hooks: orchestratorHooks(), disableAllHooks: false }) : mounted;
+    const postured = gated ? withSettings(mounted, { hooks: orchestratorHooks(), disableAllHooks: false }) : mounted;
     let tail;
     try {
       tail = fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured;

package/bin/lib/runtimeCodex.mjs

@@ -18,6 +18,7 @@ import { researchFence } from './codexResearch.mjs';
 import { projectReadBoundary, projectReadFence } from './codexProjectRead.mjs';
 import { versionAtLeast } from './versionOrder.mjs';
 import { codexOrchestratorArgs } from './orchestratorHooks.mjs';
+import { orchestratesPosture } from './orchestratorPrompt.mjs';
 
 /**
  * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
@@ -84,8 +85,31 @@ export const NO_REACH_OUT = Object.freeze([
  */
 export const NO_WEB = Object.freeze(['-c', 'tools.web_search=false', '-c', 'web_search="disabled"']);
 
-/** Fenced lanes and non-card turns never delegate. */
-export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '-c', 'features.goals=false']);
+/** Fenced lanes and non-card turns never delegate — but an orchestrated
+ *  research card, whose children read under the gate (2026-10-19).
+ *  `features.multi_agent_v2=false` closes a person's own V2 switch, which
+ *  beats every other key (measured on 0.163; harmless on 0.144). */
+export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '-c', 'features.goals=false', '-c', 'features.multi_agent_v2=false']);
+
+/**
+ * …AND ON A CATALOG V2 MODEL, `agents.enabled=false` (2026-10-19). Measured on
+ * codex-cli 0.163.0, offline: `features.multi_agent=false` did not remove
+ * native subagents on gpt-6.1-sol, gpt-6-luna or gpt-5.6-sol, whose catalog
+ * entry names multi-agent V2 — a stock research turn listed `collaboration`
+ * and a spawn really started a child no gate saw (core/src/config/mod.rs:
+ * V2 if `features.multi_agent_v2`, else disabled only by `agents.enabled =
+ * false`, else the model's catalog version, and only then the feature).
+ * With the pair the namespace is gone and the call fails "unsupported call".
+ * `agents.enabled` first exists in 0.145.0: 0.144.x reads `[agents]` as a role
+ * map and refuses to start ("invalid type: boolean `false`, expected struct
+ * AgentRoleToml"), and there the catalog does not outrank the feature yet.
+ * So it rides only a CLI measured at 0.145.0 or later.
+ */
+export const AGENTS_ENABLED_MIN = '0.145.0';
+export const noSubagents = (codexVersion) => [...NO_SUBAGENTS,
+  ...(versionAtLeast(String(codexVersion ?? '').replace(/^codex-cli\s+/, ''), AGENTS_ENABLED_MIN) ? ['-c', 'agents.enabled=false'] : [])];
+/** A card turn whose children the gate admits: native multi-agent on, goals off. */
+export const CARD_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=true', '-c', 'features.goals=false']);
 
 /** rust-v0.160.0 core/src/agent/child_config.rs applies the invoking turn's
  * approval policy, permission profile and cwd AFTER role overrides, for V1
@@ -111,10 +135,11 @@ export const HERMETIC = Object.freeze(['--ignore-user-config', '--ignore-rules']
  * needs the isolated research read fence because broad-read tools can read
  * host credentials. Feature flags do not prove account/model entitlement.
  */
-export const fencedTail = ({ imageGeneration = false, web = false } = {}) => [
+export const fencedTail = ({ imageGeneration = false, web = false, subagents = false, codexVersion } = {}) => [
   // Native web is paired with the copied, root-denied read fence.
   ...(web ? [] : NO_WEB),
-  ...NO_SUBAGENTS,
+  // Only an orchestrated research card's fence admits children (CODEX_FENCES).
+  ...(subagents ? CARD_SUBAGENTS : noSubagents(codexVersion)),
   ...NO_REACH_OUT,
   imageGeneration ? '--enable' : '--disable',
   'image_generation',
@@ -165,11 +190,11 @@ export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
  * config: `codex exec` (0.156.1) has no `-P`, so every Codex wiki turn was
  * refused before it started (0.114.0).
  */
-const codexWikiFence = (vaultDir) => [
+const codexWikiFence = (vaultDir, codexVersion) => [
   '-c', 'permissions.flowviantwiki.extends=":read-only"',
   '-c', `permissions.flowviantwiki.filesystem={${JSON.stringify(vaultDir)}="write"}`,
   '-c', 'default_permissions="flowviantwiki"',
-  ...fencedTail(),
+  ...fencedTail({ codexVersion }),
 ];
 
 function codexPrompt({ system, prompt, profile = 'build' }) {
@@ -287,8 +312,11 @@ export const CODEX_RUNTIME = {
     // THE FENCE, picked by the same keys as `codexIgnoresUserConfig`: a fenced
     // posture builds its own (CODEX_FENCES below); anything else is a build.
     const fenced = codexIgnoresUserConfig({ profile, vaultDir });
+    // THE GATE RIDES A CODE OR RESEARCH CARD on a CLI whose children inherit
+    // the parent's sandbox (2026-10-19, orchestratorPrompt.mjs).
+    const gated = orchestration && orchestratesPosture(fenced ? profile : 'build') && codexSubagentsSafe(codexVersion);
     if (fenced) {
-      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads }));
+      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads, subagents: gated, codexVersion }));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -303,9 +331,7 @@ export const CODEX_RUNTIME = {
       if (writableDirs.length) a.push('-c', `sandbox_workspace_write.writable_roots=${JSON.stringify(writableDirs)}`);
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
       if (cardTurn) a.push('-c', 'approval_policy="never"', ...(agentTools?.codexApprovals ?? []));
-      a.push(...(cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion)
-        ? ['-c', 'features.multi_agent=true', '-c', 'features.goals=false']
-        : NO_SUBAGENTS));
+      a.push(...(cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion) ? CARD_SUBAGENTS : noSubagents(codexVersion)));
     }
 
     /**
@@ -321,7 +347,7 @@ export const CODEX_RUNTIME = {
     if (a.includes('--ignore-user-config')) a.push(...(personal?.args ?? []));
 
     a.push(...mcp, ...resultSchemaArgs);
-    if (orchestration && !fenced && codexSubagentsSafe(codexVersion)) a.push(...codexOrchestratorArgs());
+    if (gated) a.push(...codexOrchestratorArgs());
     a.push(streamInput ? '-' : codexPrompt({ system, prompt, profile }));
     return a;
   },
@@ -401,7 +427,7 @@ export const CODEX_RUNTIME = {
  * Claude's research list was fenced to prevent. Codex research (0.117.0) runs
  * under its own fence instead, over a copied view (CODEX_FENCES `research`).
  */
-export function codexArtifactFence(cwd, { name, imageGeneration = false, what }) {
+export function codexArtifactFence(cwd, { name, imageGeneration = false, what, codexVersion }) {
   if (!cwd || !isAbsolute(cwd)) {
     throw new Error(`${what} needs its worktree to fence — none reached codex's builder`);
   }
@@ -423,14 +449,14 @@ export function codexArtifactFence(cwd, { name, imageGeneration = false, what })
     '-c', `default_permissions="${name}"`,
     // Nobody is on this end of the pipe to approve an escalation.
     '-c', 'approval_policy="never"',
-    ...fencedTail({ imageGeneration }),
+    ...fencedTail({ imageGeneration, codexVersion }),
   ];
 }
 
 /** The design card's fence — `codexArtifactFence` under its own profile name,
  *  with native image generation available for supporting assets. */
-export const codexDesignFence = (cwd) =>
-  codexArtifactFence(cwd, { name: 'flowviantdesign', imageGeneration: true, what: 'a design turn' });
+export const codexDesignFence = (cwd, codexVersion) =>
+  codexArtifactFence(cwd, { name: 'flowviantdesign', imageGeneration: true, what: 'a design turn', codexVersion });
 
 /**
  * EVERY FENCED POSTURE'S ARGV, by the keys of CODEX_FENCED (a test holds the
@@ -440,7 +466,7 @@ const CODEX_FENCES = {
   // A CONSULT, EXPRESSED THE ONLY WAY CODEX CAN EXPRESS IT — a different
   // shape from Claude's verb allowlist, which is the whole reason `profile` is
   // a promise rather than a flag list. See codexProjectRead.mjs.
-  consult: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
+  consult: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail({ codexVersion: opts.codexVersion })],
   // A PLANNING SESSION. Read-only on the filesystem, exactly like a consult —
   // the writes it makes go through the control plane, not through this box —
   // and for the same reason: its prompt is steered by anything a project
@@ -449,8 +475,8 @@ const CODEX_FENCES = {
   // turn's scoped token. The plan token has the planning tools; a capture
   // token has only staging and transcript tools. The server refuses
   // everything outside that scope.
-  plan: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
-  wiki: ({ vaultDir }) => codexWikiFence(vaultDir),
+  plan: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail({ codexVersion: opts.codexVersion })],
+  wiki: ({ vaultDir, codexVersion }) => codexWikiFence(vaultDir, codexVersion),
   // AN IMAGE CARD (0.114.0): read the repo, write ONLY the worktree's
   // `.flowviant/artifacts/`, generate pictures, and nothing else. MEASURED on
   // codex-cli 0.156.1 (Linux, bubblewrap), with no model turn spent: under
@@ -477,18 +503,21 @@ const CODEX_FENCES = {
   //
   // Native images support every artifact kind; this profile still delivers
   // PNG/WebP, while design/model/deck still deliver their self-contained page.
-  image: ({ cwd }) => codexArtifactFence(cwd, { name: 'flowviantimage', imageGeneration: true, what: 'an image turn' }),
+  image: ({ cwd, codexVersion }) => codexArtifactFence(cwd, { name: 'flowviantimage', imageGeneration: true, what: 'an image turn', codexVersion }),
   // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
   // `codexDesignFence`'s, argued and measured at `codexArtifactFence` above.
-  design: ({ cwd }) => codexDesignFence(cwd),
+  design: ({ cwd, codexVersion }) => codexDesignFence(cwd, codexVersion),
   // A WRITE-UP CARD (0.117.0): live web over a COPIED view of the worktree,
   // never the checkout or the login store, under a root-denied tool fence
   // (codexResearch.mjs `researchFence`, built by runTurn's
   // `runIsolatedResearch`). It is the one fence that keeps the web, so its
   // tail leaves NO_WEB out and closes everything else.
-  research: ({ researchIsolation }) => {
+  // An orchestrated research card's children (2026-10-19) inherit this same
+  // permission profile, approval policy and cwd (0.160.0 child_config.rs);
+  // the gate refuses their writes.
+  research: ({ researchIsolation, subagents = false, codexVersion }) => {
     if (!researchIsolation) throw new Error('Codex research requires its isolated input copy.');
-    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true })];
+    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true, subagents, codexVersion })];
   },
 };
 /** The fenced profile names — for the test that holds both tables to one set. */

package/bin/lib/runtimeEvents.mjs

@@ -29,12 +29,13 @@ const oneLine = (s, n = 140) =>
  * terminal console and a one-line pulse that is overwritten every two seconds,
  * and neither can show a paragraph. The turn TRACE is a third consumer with the
  * opposite need: it is scrollback, and clipping a sentence at 140 characters
- * there is the product summarizing its own agent.
+ * there is the product summarizing its own agent. Errors also use `full` in
+ * the native daemon console (2026-10-19), preserving their words and lines.
  *
  * So a prose activity may ALSO carry `full`: the text EXACTLY as the CLI
- * emitted it, uncollapsed and unclipped. Nothing derives it and nothing but the
- * trace reads it — `label` is untouched, so the console and the pulse are
- * byte-identical to before. Absent means there was no fuller text than the
+ * emitted it, uncollapsed and unclipped. Nothing derives it. The trace and
+ * the console's errors read it; routine console activity and the pulse still
+ * read `label`. Absent means there was no fuller text than the
  * label (a tool line, a bare thinking marker), and the trace falls back to the
  * label — which is what every pre-0.87.0 daemon does for everything.
  *
@@ -367,7 +368,14 @@ function codexEventOf(ev, cwd) {
         exitCode: item.exit_code, isError: item.status === 'failed',
         output: item.aggregated_output ?? '',
       }] : null;
-      return { activity, text, ...(toolEvent ? { toolEvent } : {}), ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
+      const mcp = (item.item_type ?? item.type) === 'mcp_tool_call';
+      const toolEvents = mcp ? [
+        ...(item.arguments !== undefined ? [[`${item.server ?? 'mcp'}.${item.tool ?? ''}`, item.arguments, { id: item.id, runtime: 'codex' }]] : []),
+        [null, {}, { id: item.id, result: true, runtime: 'codex', isError: item.status === 'failed',
+          output: item.error?.message ?? (item.result === undefined ? '' : JSON.stringify(item.result)),
+          detail: item.error?.message ?? item.result ?? '' }],
+      ] : [];
+      return { activity, text, ...(toolEvent ? { toolEvent } : {}), ...(toolEvents.length ? { toolEvents } : {}), ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
     }
     // THE TURN'S OWN TOKEN COUNT (2026-09-24). `codex exec --json` closes a
     // turn with `turn.completed` carrying `usage` — the codex twin of Claude's
@@ -500,18 +508,19 @@ export function parseAgyLine(line, cwd) {
     const ti = su.tool_info;
     if (!ti) return null;
     const err = ti.error?.message;
+    const toolEvent = ti.name && ti.parameters !== undefined ? [ti.name, ti.parameters, { runtime: 'antigravity', ...(ti.id ? { id: ti.id } : {}) }] : null;
     // Same rule as codex's error lines: the label is the console's, `full` is
     // the trace's, and a tool error's message is exactly the kind of sentence a
     // 140-char clamp cuts the cause out of.
     if (err)
       return {
         activity: { kind: 'error', label: oneLine(err), full: String(err) },
-        text: '',
+        ...(toolEvent ? { toolEvent } : {}), text: '',
       };
     // Each tool is reported twice — once ACTIVE, once DONE — so only the
     // terminal state emits, otherwise every action appears in the thread twice.
     if (su.state && su.state !== 'DONE') return null;
-    return { activity: humanizeAgyTool(ti.name, ti.parameters ?? {}, cwd), text: '' };
+    return { activity: humanizeAgyTool(ti.name, ti.parameters ?? {}, cwd), ...(toolEvent ? { toolEvent } : {}), text: '' };
   }
   if (ev.event === 'result') {
     const r = ev.result ?? {};
@@ -521,6 +530,7 @@ export function parseAgyLine(line, cwd) {
       activity: r.error
         ? { kind: 'error', label: oneLine(r.error), full: String(r.error) }
         : null,
+      ...(typeof r.response === 'string' && r.response ? { detail: { source: 'answer', text: r.response } } : {}),
       text: `${r.response ?? ''}${r.error ? `\n${r.error}` : ''}\n`,
     };
   }