lossless-openclaw-orchestrator 1.1.0 → 1.1.2

package/README.md

@@ -14,7 +14,7 @@ safe action without rereading raw transcripts.
 [![License](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE)
 [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)
 
-[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.1.0.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
+[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.1.2.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
 
 ## Why It Matters
 

package/VISION.md

@@ -10,9 +10,9 @@ The stable product should feel like a local orchestration cockpit: OpenClaw can
 
 ## Current Milestone: 1.1 Desktop Collaboration Cockpit
 
-The current release lane is [#387](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/387), which promotes the proven post-1.0 Codex collaboration cockpit and OpenClaw gateway work into stable `1.1.0` on npm `latest` after full check, smoke, scenario, scorecard, release-status, finalization, and post-publish readiness gates pass.
+The current release lane is [#396](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/396), which publishes stable `1.1.2` on npm `latest` after the same full check, smoke, scenario, scorecard, release-status, finalization, and post-publish readiness gates used for `1.1.1`. This patch carries the same stable claim scope while adding the #381 issue-grade public-safe live-control smoke failure report.
 
-The stable 1.0.0 package has shipped on npm `latest` and the GitHub Release is published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The active product tracker is the 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309), with the operating loop [#16](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/16).
+The stable 1.0.0, 1.1.0, and 1.1.1 packages have shipped on npm `latest` and their GitHub Releases are published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The active product tracker is the 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309), with the operating loop [#16](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/16).
 
 The Codex Autonomy Cockpit [#254](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/254) and Eva Operating Picture [#255](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/255) P0 lanes are completed beta foundation, not the current active child-work list. Completed P0 children include shared contracts [#256](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/256), source authority [#258](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/258), watcher/resume requests [#259](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/259), visible Codex map joins [#260](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/260), deterministic GitHub operating inputs [#264](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/264)/[#265](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/265), current-lane source balancing [#269](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/269), GitHub check-state fidelity [#270](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/270), cockpit card cleanup [#271](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/271), and end-to-end Eva cockpit dogfood [#272](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/272). The sprint brief remains the historical handoff for that P0 work: [docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md](docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md).
 
@@ -20,7 +20,7 @@ The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating P
 
 The current target is:
 
-- Promote npm `latest` from stable `1.0.0` to stable `1.1.0` only after #387 passes full check, smoke, scenario, scorecard, release-status, finalization, and post-publish readiness gates; keep `beta` aligned with beta trains and use `next` for future release candidates.
+- Promote npm `latest` from stable `1.1.1` to stable `1.1.2` only after #396 passes full check, smoke, scenario, scorecard, release-status, finalization, and post-publish readiness gates; keep `beta` aligned with beta trains and use `next` for future release candidates.
 - Keep README, VISION, release notes, and scorecards current so completed release gates are recorded as completed proof, not active work.
 - Treat #307/#308 as completed proof for Desktop-visible classification and fallback readiness/status, not as proof of Codex GUI mutation, prompt typing, clicking, refresh/restart automation, or unattended visible collaboration.
 - Use #309 to design the next collaboration cockpit layer from structured public-safe cards, explicit action-bound proof gates, and clear excluded-claim wording.

package/dist/packages/adapters/src/codex-jsonrpc.js

@@ -209,6 +209,26 @@ export function createCodexMcpStdioClient(options = {}) {
             finally {
                 await client.close();
             }
+        },
+        async requestSequence(steps) {
+            const surface = options.surface ?? "control";
+            for (const step of steps)
+                assertCodexMethodAllowed(step.method, surface);
+            const client = new CodexJsonRpcClient(() => new LineProcessTransport(options.command ?? "codex", options.args ?? ["app-server", "--stdio"], options.timeoutMs), { timeoutMs: options.timeoutMs, surface });
+            await client.connect();
+            try {
+                const responses = [];
+                for (const step of steps) {
+                    const response = await client.request(step.method, step.params);
+                    responses.push(response);
+                    if (!response.ok)
+                        break;
+                }
+                return responses;
+            }
+            finally {
+                await client.close();
+            }
         }
     };
 }

package/dist/packages/adapters/src/index.js

@@ -74,7 +74,19 @@ export function createAuditStore(path) {
 export function createCodexControl(options) {
     const execute = async (spec) => {
         assertCodexMethodAllowed(spec.method, "control");
-        const paramsHash = options.audit.fingerprintValue({ action: spec.action, method: spec.method, threadId: spec.threadId, params: spec.params });
+        const steps = spec.steps?.length ? spec.steps : [{ method: spec.method, params: spec.params }];
+        const methodSequence = steps.map((step) => step.method);
+        for (const step of steps)
+            assertCodexMethodAllowed(step.method, "control");
+        const connectionScope = steps.length > 1 ? "same_connection_sequence" : "single_request";
+        const paramsHash = options.audit.fingerprintValue({
+            action: spec.action,
+            method: spec.method,
+            methodSequence,
+            threadId: spec.threadId,
+            params: spec.params,
+            steps
+        });
         const messageHash = spec.message === undefined ? undefined : options.audit.fingerprintText(spec.message);
         if (spec.dryRun !== false) {
             const record = options.audit.append({
@@ -84,7 +96,18 @@ export function createCodexControl(options) {
                 messageHash,
                 live: false
             });
-            return { action: spec.action, threadId: spec.threadId, live: false, approvalAuditId: record.id, paramsHash, messageHash, method: spec.method };
+            return {
+                action: spec.action,
+                threadId: spec.threadId,
+                live: false,
+                approvalAuditId: record.id,
+                paramsHash,
+                messageHash,
+                method: spec.method,
+                methodSequence,
+                connectionScope,
+                loadedThreadReusable: spec.loadedThreadReusable
+            };
         }
         if (!spec.approvalAuditId) {
             throw new Error("approval_audit_id is required for live Codex control actions");
@@ -103,12 +126,28 @@ export function createCodexControl(options) {
         if (!Number.isFinite(dryRunCreatedAtMs) || dryRunCreatedAtMs + CODEX_CONTROL_DRY_RUN_TTL_MS <= Date.now()) {
             throw new Error("approval_audit_id dry-run record expired");
         }
-        const response = await options.client.request(spec.method, spec.params);
+        const response = steps.length > 1
+            ? await requestCodexControlSequence(options.client, steps)
+            : await options.client.request(spec.method, spec.params);
         const liveRecord = options.audit.append({ action: spec.action, target: spec.threadId, paramsHash, messageHash, live: true });
-        return { action: spec.action, threadId: spec.threadId, live: true, approvalAuditId: liveRecord.id, paramsHash, messageHash, method: spec.method, response: redactValue(response) };
+        return {
+            action: spec.action,
+            threadId: spec.threadId,
+            live: true,
+            approvalAuditId: liveRecord.id,
+            paramsHash,
+            messageHash,
+            method: spec.method,
+            methodSequence,
+            connectionScope,
+            loadedThreadReusable: spec.loadedThreadReusable,
+            response: redactValue(response)
+        };
     };
     return {
         sendMessage(input) {
+            const resumeParams = { threadId: input.threadId, excludeTurns: true };
+            const turnStartParams = { threadId: input.threadId, input: [{ type: "text", text: input.message }] };
             return execute({
                 action: "codex_send_message",
                 method: "turn/start",
@@ -116,7 +155,12 @@ export function createCodexControl(options) {
                 message: input.message,
                 dryRun: input.dryRun,
                 approvalAuditId: input.approvalAuditId,
-                params: { threadId: input.threadId, input: [{ type: "text", text: input.message }] }
+                params: turnStartParams,
+                steps: [
+                    { method: "thread/resume", params: resumeParams },
+                    { method: "turn/start", params: turnStartParams }
+                ],
+                loadedThreadReusable: true
             });
         },
         resumeThread(input) {
@@ -126,10 +170,13 @@ export function createCodexControl(options) {
                 threadId: input.threadId,
                 dryRun: input.dryRun,
                 approvalAuditId: input.approvalAuditId,
-                params: { threadId: input.threadId, excludeTurns: true }
+                params: { threadId: input.threadId, excludeTurns: true },
+                loadedThreadReusable: false
             });
         },
         steerThread(input) {
+            if (!input.expectedTurnId)
+                throw new Error("expected_turn_id is required for steer actions");
             return execute({
                 action: "codex_steer_thread",
                 method: "turn/steer",
@@ -137,7 +184,7 @@ export function createCodexControl(options) {
                 message: input.message,
                 dryRun: input.dryRun,
                 approvalAuditId: input.approvalAuditId,
-                params: { threadId: input.threadId, input: [{ type: "text", text: input.message }] }
+                params: { threadId: input.threadId, expectedTurnId: input.expectedTurnId, input: [{ type: "text", text: input.message }] }
             });
         },
         interruptThread(input) {
@@ -152,6 +199,21 @@ export function createCodexControl(options) {
         }
     };
 }
+async function requestCodexControlSequence(client, steps) {
+    if (!client.requestSequence) {
+        throw new Error("same-connection control sequence is required for this Codex control action");
+    }
+    const responses = await client.requestSequence(steps);
+    for (let index = 0; index < responses.length; index += 1) {
+        if (asRecord(responses[index])?.ok === false) {
+            throw new Error(`Codex control sequence step failed: ${steps[index]?.method ?? "unknown"}`);
+        }
+    }
+    if (responses.length !== steps.length) {
+        throw new Error(`Codex control sequence returned ${responses.length} response(s) for ${steps.length} step(s)`);
+    }
+    return responses.at(-1) ?? { ok: true };
+}
 export async function createCodexAppServerStatusReport(options) {
     const transport = options.transport ?? codexTransportStatus({ command: options.command ?? process.env.LOO_CODEX_BIN ?? "codex" });
     const remoteControl = await codexReadRequest(options.client, "remoteControl/status/read", {});

package/dist/packages/cli/src/live-control-smoke.js

@@ -51,13 +51,52 @@ export async function runLiveControlSmoke(options) {
     mkdirSync(options.evidenceDir, { recursive: true });
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const message = options.message ?? DEFAULT_MESSAGE;
-    await options.client.connect();
+    let targetState = {
+        threadId: options.threadId ?? null,
+        source: options.threadId ? "provided_thread" : "unknown"
+    };
+    let dryRunState = null;
+    let liveState = {
+        accepted: false,
+        approvalAuditId: null,
+        method: null,
+        completed: false,
+        status: null,
+        notificationMethods: [],
+        approvalRequestCount: 0,
+        serverRequestCount: 0
+    };
+    let failed = false;
     try {
+        await options.client.connect();
         const target = options.threadId
             ? { threadId: options.threadId, source: "provided_thread" }
             : { threadId: await startEphemeralThread(options.client, options.cwd), source: "ephemeral_thread_start" };
-        const control = createCodexControl({ audit: options.audit, client: { request: (method, params) => options.client.request(method, params) } });
+        targetState = target;
+        const control = createCodexControl({
+            audit: options.audit,
+            client: {
+                request: (method, params) => options.client.request(method, params),
+                requestSequence: async (steps) => {
+                    const responses = [];
+                    for (const step of steps) {
+                        const response = await options.client.request(step.method, step.params);
+                        responses.push(response);
+                        if (isFailedCodexResponse(response)) {
+                            throw new Error(`Codex control sequence step failed: ${step.method}`);
+                        }
+                    }
+                    return responses;
+                }
+            }
+        });
         const dryRun = await control.sendMessage({ threadId: target.threadId, message, dryRun: true });
+        dryRunState = {
+            approvalAuditId: dryRun.approvalAuditId,
+            paramsHash: dryRun.paramsHash,
+            messageHash: dryRun.messageHash,
+            live: false
+        };
         if (!dryRun.messageHash)
             throw new Error("dry-run did not produce a message hash");
         const live = await control.sendMessage({
@@ -66,10 +105,24 @@ export async function runLiveControlSmoke(options) {
             dryRun: false,
             approvalAuditId: dryRun.approvalAuditId
         });
+        liveState = {
+            ...liveState,
+            accepted: true,
+            approvalAuditId: live.approvalAuditId,
+            method: live.method ?? null
+        };
         const turnId = extractTurnId(live.response);
         if (!turnId)
             throw new Error("live Codex control response did not include a turn id");
         const completion = await options.client.waitForTurnCompletion({ threadId: target.threadId, turnId, timeoutMs });
+        liveState = {
+            ...liveState,
+            completed: completion.completed,
+            status: completion.status,
+            notificationMethods: summarizeMethods(completion.notificationMethods),
+            approvalRequestCount: completion.approvalRequestCount,
+            serverRequestCount: completion.serverRequestCount
+        };
         if (completion.approvalRequestCount > 0) {
             throw new Error("live Codex control smoke observed a Codex approval request; harmless smoke must not require approvals");
         }
@@ -122,8 +175,29 @@ export async function runLiveControlSmoke(options) {
         writeJson(reportPath, report);
         return report;
     }
+    catch (error) {
+        failed = true;
+        try {
+            writeFailureReport(options, {
+                error,
+                target: targetState,
+                dryRun: dryRunState,
+                live: liveState
+            });
+        }
+        catch {
+            // Best-effort evidence: never let report-writing failures mask the original smoke failure.
+        }
+        throw error;
+    }
     finally {
-        await options.client.close();
+        try {
+            await options.client.close();
+        }
+        catch (closeError) {
+            if (!failed)
+                throw closeError;
+        }
     }
 }
 export function defaultAppServerArgs() {
@@ -151,6 +225,9 @@ function extractTurnId(response) {
     const turn = objectField(result.turn);
     return stringField(turn, "id");
 }
+function isFailedCodexResponse(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value) && value.ok === false);
+}
 function unwrapResult(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return {};
@@ -178,3 +255,80 @@ function summarizeMethods(methods) {
 function writeJson(path, value) {
     writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
 }
+function writeFailureReport(options, state) {
+    const blocker = classifyFailureBlocker(state.error);
+    const report = {
+        kind: "loo_live_control_smoke_failure",
+        ok: false,
+        proofReady: false,
+        generatedAt: options.now ?? new Date().toISOString(),
+        blocker,
+        command: {
+            action: "send",
+            actionClass: "codex_live_control_send"
+        },
+        target: {
+            source: state.target.source,
+            refClass: state.target.threadId ? "codex_thread" : "unknown",
+            ref: state.target.threadId ? `codex_thread:${state.target.threadId}` : null
+        },
+        dryRun: {
+            attempted: state.dryRun !== null,
+            approvalAuditId: state.dryRun?.approvalAuditId ?? null,
+            paramsHash: state.dryRun?.paramsHash ?? null,
+            messageHash: state.dryRun?.messageHash ?? null,
+            live: state.dryRun ? false : null
+        },
+        transport: {
+            class: "codex_app_server",
+            connection: "single_connection_sequence"
+        },
+        live: state.live,
+        postActionRefresh: {
+            ran: false
+        },
+        nextDiagnosticStep: nextDiagnosticStep(blocker),
+        rawPromptIncluded: false,
+        rawTranscriptIncluded: false,
+        rawSecretIncluded: false,
+        screenshotIncluded: false,
+        sqliteIncluded: false
+    };
+    writeJson(join(options.evidenceDir, "live-control-smoke-failure-report.json"), report);
+}
+function classifyFailureBlocker(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/connect|handshake|spawn|ENOENT|codex.*not found|not connected/i.test(message)) {
+        return "codex_app_server_setup_failed";
+    }
+    if (/thread(?:\/resume| not found)|control sequence step failed:\s*thread\/resume/i.test(message)) {
+        return "same_connection_resume_load_diagnostics_required";
+    }
+    if (/approval request/i.test(message))
+        return "codex_approval_request_observed";
+    if (/server request/i.test(message))
+        return "codex_server_request_observed";
+    if (/turn id/i.test(message))
+        return "live_control_turn_id_missing";
+    if (/did not complete cleanly|timeout/i.test(message))
+        return "live_control_smoke_not_completed_cleanly";
+    return "live_control_smoke_failed";
+}
+function nextDiagnosticStep(blocker) {
+    switch (blocker) {
+        case "codex_app_server_setup_failed":
+            return "Check Codex app-server command availability, stdio handshake, and local transport setup before retrying live control.";
+        case "same_connection_resume_load_diagnostics_required":
+            return "Run same-connection resume/load diagnostics for the selected thread before retrying live control.";
+        case "codex_approval_request_observed":
+            return "Inspect why the harmless smoke triggered a Codex approval request; do not treat this as approved live-control proof.";
+        case "codex_server_request_observed":
+            return "Inspect unexpected server requests from the app-server smoke; do not retry live control until the request class is understood.";
+        case "live_control_turn_id_missing":
+            return "Inspect the app-server turn/start response shape and protocol drift before retrying.";
+        case "live_control_smoke_not_completed_cleanly":
+            return "Inspect turn completion notifications, status, and timeout behavior before retrying live control.";
+        default:
+            return "Inspect the public-safe failure report and route a focused issue before retrying live control.";
+    }
+}

package/dist/packages/mcp-server/src/tools.js

@@ -492,11 +492,12 @@ export function createLooTools(options) {
         tool("loo_codex_control_dry_run", "Create a dry-run audit id for a Codex control action.", {
             action: { type: "string", enum: ["send", "resume", "steer", "interrupt"] },
             thread_id: { type: "string" },
-            message: { type: "string" }
+            message: { type: "string" },
+            expected_turn_id: { type: "string" }
         }, (input) => snakeCaseControlResult(dispatchControl(control, input, true))),
         tool("loo_codex_resume_thread", "Resume or rejoin a Codex thread. Live mode requires approval_audit_id.", controlSchema(), (input) => snakeCaseControlResult(control.resumeThread(controlInput(input)))),
         tool("loo_codex_send_message", "Send a message to a Codex thread. Live mode requires approval_audit_id.", controlSchema(true), (input) => snakeCaseControlResult(control.sendMessage(messageControlInput(input)))),
-        tool("loo_codex_steer_thread", "Steer a running Codex thread. Live mode requires approval_audit_id.", controlSchema(true), (input) => snakeCaseControlResult(control.steerThread(messageControlInput(input)))),
+        tool("loo_codex_steer_thread", "Steer a running Codex thread. Live mode requires approval_audit_id and expected_turn_id.", controlSchema(true, true), (input) => snakeCaseControlResult(control.steerThread(messageControlInput(input, true)))),
         tool("loo_codex_interrupt_thread", "Interrupt a Codex thread. Live mode requires approval_audit_id.", controlSchema(), (input) => snakeCaseControlResult(control.interruptThread(controlInput(input)))),
         tool("loo_desktop_see", "Inspect desktop fallback readiness through direct/CUA/Peekaboo backends.", {
             backend: { type: "string", enum: ["direct", "cua-driver", "peekaboo"] },
@@ -680,7 +681,14 @@ function targetThreadIdFromCoherenceInput(input) {
 }
 function dispatchControl(control, input, dryRun) {
     const action = requiredString(input.action, "action");
-    const common = { threadId: requiredString(input.thread_id, "thread_id"), message: optionalString(input.message) ?? "continue", dryRun };
+    const common = {
+        threadId: requiredString(input.thread_id, "thread_id"),
+        message: action === "send" || action === "steer"
+            ? requiredString(input.message, "message")
+            : optionalString(input.message) ?? "continue",
+        expectedTurnId: optionalString(input.expected_turn_id),
+        dryRun
+    };
     if (action === "send")
         return control.sendMessage(common);
     if (action === "resume")
@@ -691,10 +699,11 @@ function dispatchControl(control, input, dryRun) {
         return control.interruptThread(common);
     throw new Error(`Unsupported control action: ${action}`);
 }
-function controlSchema(message = false) {
+function controlSchema(message = false, expectedTurn = false) {
     return {
         thread_id: { type: "string" },
         ...(message ? { message: { type: "string" } } : {}),
+        ...(expectedTurn ? { expected_turn_id: { type: "string" } } : {}),
         dry_run: { type: "boolean", default: true },
         approval_audit_id: { type: "string" }
     };
@@ -707,10 +716,11 @@ function controlInput(input, message = false) {
         approvalAuditId: optionalString(input.approval_audit_id)
     };
 }
-function messageControlInput(input) {
+function messageControlInput(input, expectedTurn = false) {
     return {
         threadId: requiredString(input.thread_id, "thread_id"),
         message: requiredString(input.message, "message"),
+        ...(expectedTurn ? { expectedTurnId: requiredString(input.expected_turn_id, "expected_turn_id") } : {}),
         dryRun: input.dry_run !== false,
         approvalAuditId: optionalString(input.approval_audit_id)
     };
@@ -728,14 +738,17 @@ async function snakeCaseControlResult(value) {
 }
 function approvalPacketFromControlResult(result) {
     const action = String(result.action ?? "resume");
-    const packetAction = action === "send"
+    const packetAction = action === "send" || action === "codex_send_message"
         ? "send_message"
-        : action === "steer"
+        : action === "steer" || action === "codex_steer_thread"
             ? "steer_thread"
-            : action === "interrupt"
+            : action === "interrupt" || action === "codex_interrupt_thread"
                 ? "interrupt_thread"
                 : "resume_session";
     const expiresAt = new Date(Date.now() + 15 * 60 * 1000).toISOString();
+    const predictedMutation = Array.isArray(result.methodSequence) && result.methodSequence.length
+        ? result.methodSequence.map((method) => String(method))
+        : [String(result.method ?? "codex_control")];
     return {
         schema: "lco.approvalPacket.v1",
         packetId: `ap_${String(result.approvalAuditId ?? "unknown").replace(/^loo_audit_/, "")}`,
@@ -745,7 +758,8 @@ function approvalPacketFromControlResult(result) {
             title: String(result.threadId ?? "unknown")
         },
         intent: `${packetAction} dry-run for ${String(result.threadId ?? "unknown")}`,
-        predictedMutation: [String(result.method ?? "codex_control")],
+        predictedMutation,
+        ...(Array.isArray(result.methodSequence) ? { methodSequence: result.methodSequence } : {}),
         preconditions: ["dry_run_record_exists", "matching_params_hash_required", "approval_packet_not_expired"],
         risk: {
             level: action === "interrupt" ? "high" : "medium",

package/docs/RELEASE_NOTES_1.1.1.md

@@ -0,0 +1,103 @@
+# Release Notes 1.1.1
+
+`1.1.1` is a stable patch release for the post-1.1 Codex collaboration
+cockpit and OpenClaw gateway lane.
+
+It keeps the `1.1.0` stable claim scope and adds three release-train fixes:
+same-connection live-control failure handling, Desktop-first daily skill
+guidance, and a runtime-required daily orchestration scenario contract.
+
+## What Changed
+
+- Hardens same-connection Codex live control from #380 / PR #390:
+  - `loo_codex_send_message` keeps `thread/resume` and `turn/start` on the
+    same Codex app-server connection.
+  - failed or incomplete multi-step responses now fail closed before a live
+    audit success record is appended.
+  - the live-control smoke helper stops after the first failed sequence step,
+    so a failed `thread/resume` cannot be followed by `turn/start`.
+- Updates the packaged OpenClaw agent skill from #385 / PR #391:
+  - replaces private-name approval wording with explicit requesting-user
+    approval for the exact target and action.
+  - clarifies that autonomy tick steps are recommendations until separately
+    requested and approved.
+- Adds the Desktop-first daily orchestration scenario from #382 / PR #392:
+  - app-server status, app-server thread signals, visible Codex map,
+    Desktop coherence, fallback status, collaboration cockpit, runtime Desktop
+    visibility, active-thread state, and autonomy tick appear in one
+    runtime-required scenario contract.
+  - the scenario requires public-safe evidence and explicitly blocks live
+    control, GUI mutation, screenshots, npm publish, and GitHub Release
+    creation during the scenario itself.
+- Carries forward the #160 desktop proof-action release boundary:
+  `loo_desktop_proof_action` / `loo desktop proof-action` validates the
+  action-bound CUA Driver TextEdit scratch proof gate and does not prove
+  generic GUI mutation. The proof action still requires exact backend, target
+  app, target window, action hash, approval ref, permission state, scratch file
+  path, and `execute: true` before the backend can run. Generic gateway
+  invocation without exact proof args fails closed, using the same proof
+  boundary as beta.35.
+  The proof action still requires exact backend, target app, target window, action hash, approval ref, permission state, scratch file path, and `execute: true` before the backend can run.
+  generic gateway invocation without exact proof args fails closed.
+  This release uses the same proof boundary as beta.35.
+- Carries forward strict OpenClaw gateway result handling:
+  plugin output with `output.details.ok: false` is reported as
+  `openclaw_tool_result_not_ok:<tool>` rather than successful tool proof.
+
+## Stable Claim Scope
+
+Allowed stable claim remains:
+
+> Codex-first local orchestration through OpenClaw for local Codex sessions,
+> including local indexing, search, describe, bounded expansion, dry-run control
+> envelopes, read-only collaboration cockpit/autonomy cards, read-only Desktop
+> visibility and fallback status, action-bound proof-packet validation,
+> public-safe scorecards, and installed OpenClaw gateway dogfood.
+
+This patch does not widen the live-control matrix, GUI mutation scope, Claude
+adapter scope, P1 business-adapter scope, or enterprise/customer readiness
+claim. The same excluded-claim boundaries from `1.1.0` remain in force.
+
+## Release Gate Notes
+
+- Stable issue: #393.
+- Included implementation issues: #380, #385, and #382.
+- Parent product tracker: #309.
+- Operating-loop tracker: #16.
+- Baseline stable release: `v1.1.0`.
+- Candidate package: `lossless-openclaw-orchestrator@1.1.1`.
+- Expected git tag: `v1.1.1`.
+- Expected GitHub Release:
+  `https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/releases/tag/v1.1.1`.
+- Required pre-publish stable gates: `npm run check`, `npm pack --dry-run`,
+  strict scenario sweep, strict scorecard sweep, release preflight, release
+  bundle, release demo-status, release status, OpenClaw dogfood, and OpenClaw
+  tool-smoke for the exact stable candidate SHA.
+- Required PR gates: GitHub CI, CodeQL, current-head review threads clear, and
+  any actionable review feedback fixed before merge.
+- Required post-publish stable gates: npm `latest` view, git tag, GitHub
+  non-prerelease Release, `loo release finalization-status --expected-dist-tag
+  latest --expected-github-prerelease false --strict`, fresh npm `@latest`
+  published-smoke, and strict general-readiness before #393 closes.
+- `approved_live_control_smoke_missing` remains the expected blocker when a
+  working-app claim is attempted without approved live-control smoke evidence
+  for the exact candidate SHA.
+- Working-app status example:
+  `loo release status --claim-scope codex-working-app-proof --runtime-proof-dir <path> --approved-live-control-evidence <path> --npm-publish-approval-evidence <path> --github-release-approval-evidence <path> --candidate-sha <sha> --github-ci-evidence <path> --codeql-evidence <path> --evidence-dir <path> --strict`
+- Reduced-scope status example:
+  `loo release status --claim-scope codex-read-search-expand-dry-run --npm-publish-approval-evidence <path> --github-release-approval-evidence <path> --candidate-sha <sha> --github-ci-evidence <path> --codeql-evidence <path> --evidence-dir <path> --strict`
+- Post-publish finalization example:
+  `loo release finalization-status --evidence-dir <path> --candidate-sha <sha> --npm-publish-evidence <path> --git-tag-evidence <path> --github-release-evidence <path> --expected-dist-tag latest --expected-github-prerelease false --strict`
+
+## Explicit Non-Claims
+
+No new live Codex control smoke is run by this release.
+It does not run generic GUI mutation and does not run Codex GUI mutation.
+No automatic gateway authorization.
+No broad gateway scope approval. No prompt typing. No clicking. No arbitrary app control.
+Claude Code remains an adapter stub, not an adapter-equivalence claim.
+Bundle/status/finalization checks do not publish to npm and do not create a GitHub Release.
+No release-grade enterprise security.
+No Claude Code parity, no Notion/support-control/Stripe/Company Brain P1
+adapter proof, no cloud sync, no unattended desktop takeover, and no
+enterprise/customer-ready security is claimed.