lossless-openclaw-orchestrator 1.1.4 → 1.2.0-beta.0

package/README.md

@@ -14,7 +14,7 @@ safe action without rereading raw transcripts.
 [![License](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE)
 [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)
 
-[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
+[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.2.0-beta.0.md) · [1.1.4 Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
 
 ## Why It Matters
 
@@ -148,10 +148,17 @@ For normal agent workflows, use the MCP/OpenClaw tools:
 - `loo_codex_final_messages`
 - `loo_codex_touched_files`
 - `loo_codex_control_dry_run`
+- `loo_codex_start_thread`
 
 `loo_codex_control_dry_run` returns the audit id and hashes an agent should show
-before any live resume/send/steer/interrupt call. Live control requires the
-matching `approval_audit_id`.
+before any live start/resume/send/steer/interrupt call. Live control requires
+the matching `approval_audit_id`.
+
+Live Codex control results include `proof_state` fields for
+`accepted_by_transport`, `started`, `completed`, `persisted`, and
+`unverified_pending`. Transport acceptance is not durable execution: when
+`unverified_pending` is true, run the returned `next_proof` read-only tool call
+before claiming the turn or thread completed, persisted, or is safe to build on.
 
 The packaged agent playbook is
 [skills/lossless-openclaw-orchestrator/SKILL.md](skills/lossless-openclaw-orchestrator/SKILL.md).
@@ -207,7 +214,12 @@ Default behavior:
 - bounded expansion profiles
 - read-only OpenClaw LCM peer DB access
 - direct Codex protocol before desktop fallback
-- dry-run plus matching `approval_audit_id` before live Codex control
+- dry-run plus matching `approval_audit_id` before live Codex control,
+  including new-thread creation
+- explicit mutation classes: pure reads use empty `mutationClasses`, and
+  LCO-owned indexing/audit/prepared-state writes use `mode: "local_cache_write"`
+  with `derived_cache` instead of mutating Codex source stores, external
+  systems, live control, or GUI state
 
 Not claimed:
 
@@ -274,11 +286,25 @@ The stable public product is Codex-first local orchestration: index, search,
 describe, expand, OpenClaw/MCP tools, and approval-gated dry-run/live-control
 boundaries.
 
-Current deeper product work is tracked in GitHub issues and summarized in
-[VISION.md](VISION.md). Keep sprint and agent-operator details there, in
-[AGENTS.md](AGENTS.md), and in the packaged
-[agent skill](skills/lossless-openclaw-orchestrator/SKILL.md), not in this
-public landing page.
+Current deeper product work is the 1.2 prepared-state and summary-leaves lane.
+It is tracked in GitHub issues, summarized in [VISION.md](VISION.md), and
+handed off in
+[docs/sprints/brief-lco-1.2-prepared-state-summary-leaves-2026-07-03.md](docs/sprints/brief-lco-1.2-prepared-state-summary-leaves-2026-07-03.md).
+Keep sprint and agent-operator details there, in [AGENTS.md](AGENTS.md), and in
+the packaged [agent skill](skills/lossless-openclaw-orchestrator/SKILL.md), not
+in this public landing page.
+
+The 1.2 lane is local, deterministic, and opt-in. It is building
+source-ref-backed ranges, summary leaves, prepared cards, persisted watcher
+observations, execute-false local attention queue items, and hook capture so an
+OpenClaw/Eva agent can start from compact prepared state rather than rereading
+huge Codex transcripts. Summary leaves are advisory
+routing/evidence cards over prepared ranges; they are not authority, hidden
+autonomy, GUI mutation, Claude parity, or true Codex compaction-summary capture.
+The hook sidecar CLI lives under `loo hook closeout-capture`,
+`loo hook state-prep`, and `loo hook compaction-capture --mode marker`; those
+commands write only LCO-owned derived cache and treat transcript paths as
+hash/redact-only inputs.
 
 ## Maintainer Proof
 

package/VISION.md

@@ -8,28 +8,27 @@ An OpenClaw agent can understand, search, summarize, and safely coordinate a use
 
 The stable product should feel like a local orchestration cockpit: OpenClaw can see what Codex sessions exist, what each session is working on, which plans and final messages matter, which files were touched, and which next action would be safe to dry-run or execute only after explicit approval.
 
-## Current Milestone: 1.1 Desktop Collaboration Cockpit
+## Current Milestone: 1.2 Prepared State And Summary Leaves
 
-The current release lane is [#396](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/396), which publishes stable `1.1.2` on npm `latest` after the same full check, smoke, scenario, scorecard, release-status, finalization, and post-publish readiness gates used for `1.1.1`. This patch carries the same stable claim scope while adding the #381 issue-grade public-safe live-control smoke failure report.
+The current design/build lane is LCO 1.2: prepared state, summary leaves, watcher observations, and hook capture foundations. The sprint brief is [docs/sprints/brief-lco-1.2-prepared-state-summary-leaves-2026-07-03.md](docs/sprints/brief-lco-1.2-prepared-state-summary-leaves-2026-07-03.md). GitHub milestone, tracker, and child issues own implementation truth once filed; this file owns the product and eval boundary.
 
-The stable 1.0.0, 1.1.0, and 1.1.1 packages have shipped on npm `latest` and their GitHub Releases are published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The active product tracker is the 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309), with the operating loop [#16](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/16).
+The stable 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, and 1.1.4 packages have shipped on npm `latest` and their GitHub Releases are published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309) is completed proof for read-only collaboration summaries and execute-false next steps, not the current active child-work list.
 
 The Codex Autonomy Cockpit [#254](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/254) and Eva Operating Picture [#255](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/255) P0 lanes are completed beta foundation, not the current active child-work list. Completed P0 children include shared contracts [#256](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/256), source authority [#258](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/258), watcher/resume requests [#259](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/259), visible Codex map joins [#260](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/260), deterministic GitHub operating inputs [#264](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/264)/[#265](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/265), current-lane source balancing [#269](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/269), GitHub check-state fidelity [#270](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/270), cockpit card cleanup [#271](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/271), and end-to-end Eva cockpit dogfood [#272](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/272). The sprint brief remains the historical handoff for that P0 work: [docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md](docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md).
 
-The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating Picture P0 paths, release metadata, package/gateway setup proof, docs truth, release gates, public-safe scorecards, post-publish fresh npm `@latest` install proof, and stable `1.0.0` publication are no longer the main gap. The current release train is complete; #302/#304/#305/#306 close the stable `1.0.0` promotion, publication, and post-GA claim-validation gates. The next gap is 1.1 product polish: richer active-thread state, autonomous thread-management recommendations, and user-visible Desktop collaboration cockpit workflows without weakening 1.0 safety boundaries. `loo_codex_desktop_coherence` distinguishes `cli_visible`, `desktop_visible`, `desktop_refresh_required`, `desktop_restart_required`, and `unknown`; `loo_codex_desktop_fallback_status` reports the CUA-first and Peekaboo-secondary readiness path without performing live control or GUI mutation; `loo_codex_collaboration_cockpit` composes those structured reports with recent-session cards, inbox urgency, and watcher requests into one read-only active-lane summary; `loo_codex_runtime_desktop_visibility_status` summarizes which lanes have runtime Desktop visibility or action-bound proof coverage and which read-only `execute=false` probe remains next; `loo_codex_active_thread_state` classifies active threads as running, blocked, needs-nudge, stale, waiting, approval-needed, idle, or unknown from public-safe indexed, watcher, app-server, and visible-map signals, exposes per-item attention coverage plus non-executed read-only probes, and can include non-executed `loo_codex_control_dry_run` recommendation packets for safe nudge handoff; `loo_codex_autonomy_tick` turns that state into one deterministic ordered loop tick of `execute:false` read-only probes and control dry-run recommendations without executing anything.
+The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating Picture P0 paths, 1.1 Desktop collaboration cockpit paths, release metadata, package/gateway setup proof, docs truth, release gates, public-safe scorecards, post-publish fresh npm `@latest` install proof, and stable publication lanes are no longer the main gap. The next gap is reducing reread cost for huge local Codex histories: make an OpenClaw/Eva agent start from deterministic prepared state, summary leaves, source ranges, freshness, confidence, and authority coverage before it asks for bounded expansion.
 
 The current target is:
 
-- Promote npm `latest` from stable `1.1.1` to stable `1.1.2` only after #396 passes full check, smoke, scenario, scorecard, release-status, finalization, and post-publish readiness gates; keep `beta` aligned with beta trains and use `next` for future release candidates.
+- File and execute the 1.2 prepared-state tracker and child issues from the sprint brief, using test/eval-first slices and public-safe evidence.
+- Keep prepared state as advisory cache: cards, inbox items, and summary leaves route an agent to source refs; they do not become authority for PR/CI/release/runtime/customer truth.
+- Classify mutations explicitly: pure reads use empty `mutationClasses`, LCO-owned indexing/audit/prepared-state writes use `mode: "local_cache_write"` with `derived_cache`, and source-store, external-system, live-control, GUI, release, and npm mutations stay non-default.
+- Add source ranges and summary leaves as an additive DB layer behind the existing search/describe/expand tools instead of rewriting the current session-level DB in one migration. Source ranges are the first 1.2 proof slice; summary leaves sit on top as metadata-only routing/evidence cards with bounded DAG expansion.
+- Treat Codex compaction hooks outside Codex as marker capture only. True compaction-summary capture waits for Codex-native sanitized summary support.
+- Keep model compaction opt-in and behind a later spike. It must not receive raw transcripts or current `safe_text` by default.
 - Keep README, VISION, release notes, and scorecards current so completed release gates are recorded as completed proof, not active work.
 - Treat #307/#308 as completed proof for Desktop-visible classification and fallback readiness/status, not as proof of Codex GUI mutation, prompt typing, clicking, refresh/restart automation, or unattended visible collaboration.
-- Use #309 to design the next collaboration cockpit layer from structured public-safe cards, explicit action-bound proof gates, and clear excluded-claim wording.
-- Use #313 as the first read-only collaboration cockpit primitive: it may summarize attention, Desktop state boundaries, fallback readiness, source coverage, and false action flags, but it must not select, click, type, refresh, restart, or mutate Codex Desktop.
-- Use #314 to make active-thread ranking honest for Eva: fresh approval, running, and waiting lanes should outrank stale low-confidence blocked residue, and readable empty PLAN_STATE input should be reported as `empty` rather than hidden as `not_configured`.
-- Use #326 to make the collaboration cockpit actionable without becoming mutating: `loo_codex_collaboration_next_steps` emits exact execute=false packets for watcher resume requests, Desktop coherence probes, and fallback-status checks.
-- Use #333 to validate exact action-bound Codex Desktop collaboration proof packets with `loo_codex_desktop_collaboration_proof`. The tool binds target ref, backend, target app/window, action, hash, approval packet, freshness, source coverage, and no-screenshot policy in dry-run mode; it still does not run live control or GUI mutation.
-- Use #342 to give agents one read-only runtime Desktop visibility status report across cockpit lanes. It may report covered, partial, or blocked lanes and exact `execute=false` next tool calls, but it must not run live control, refresh/restart Desktop, mutate the GUI, capture screenshots, publish npm, or create GitHub releases.
-- Use #351/#359/#367 to give agents one read-only active-thread state report across cockpit lanes. It may report running, blocked, needs-nudge, stale, waiting, approval-needed, idle, or unknown state with reason codes, confidence, freshness, source coverage, attention coverage, non-executed read-only probe recommendations, and non-executed control dry-run recommendations, but it must not run live control, mutate Codex Desktop, capture screenshots, publish npm, or create GitHub releases.
+- Treat the 1.1 collaboration cockpit as completed proof for `loo_codex_desktop_coherence`, `loo_codex_desktop_fallback_status`, `loo_codex_collaboration_cockpit`, `loo_codex_collaboration_next_steps`, `loo_codex_runtime_desktop_visibility_status`, `loo_codex_active_thread_state`, and `loo_codex_autonomy_tick`. The completed Desktop coherence states remain `cli_visible`, `desktop_visible`, `desktop_refresh_required`, `desktop_restart_required`, and `unknown`.
 - Use the Codex Autonomy Cockpit and Eva Operating Picture P0 tools as the foundation for tester workflows: recent sessions, compact session cards, deterministic cockpit inbox, watcher/resume-request packets, app-server status, visible Codex map joins, project digest, attention inbox, business pulse, explicit source coverage, and explicit source-authority coverage.
 - Keep `PLAN_STATE.md` demoted to bootloader, manual pins, approval boundaries, stop conditions, and exception ledger. It is not canonical current-state truth.
 - Keep P0 sources to LCO/Codex state, optional structured GitHub items, and explicit PLAN_STATE pins.
@@ -38,6 +37,16 @@ The current target is:
 
 The sprint remains Codex-first, local-first, read-only-first, and public-safe by default. It does not claim full business truth, customer readiness, Claude Code parity, remote sync, generic GUI mutation, unattended desktop control, permission bypass, or enterprise/customer-ready security. npm `latest` promotion and GitHub Release creation are complete for 1.0.0. Desktop-visible classification and fallback readiness/status are proven by #307/#308; actual Codex GUI mutation remains excluded until a future action-bound proof gate records the exact backend, target, action hash, approval, and observation.
 
+What 1.2 should let a local OpenClaw agent do next:
+
+- Start from `loo_prepared_inbox` instead of rerunning broad search for every resume.
+- Inspect `loo_prepared_cards` for public-safe thread/project/blocker/next-action cards with source refs, freshness, confidence, privacy class, and authority coverage.
+- Follow `loo_summary_leaves` and `loo_summary_expand` through a source-range-backed summary DAG when a huge thread needs more detail.
+- See persisted watcher observations and local attention queue items through `loo_watcher_events` without executing live control.
+- Capture closeout/state-prep/compaction-marker hook packets into LCO-owned state without writing Codex source stores.
+- Distinguish "compaction observed" from "compaction summary captured" until Codex provides a sanitized compaction-summary event.
+- Treat optional model compaction as an explicit later capability, not the default prepared-state engine.
+
 What a local OpenClaw agent can do today:
 
 - Discover the installed LCO plugin and declared `loo_*` tools.
@@ -50,7 +59,7 @@ What a local OpenClaw agent can do today:
 - Read cockpit cards whose user-facing `title`, `objective`, `summary`, and `nextAction` fields are deterministic presentation text, not raw directive fragments, markdown tables, duplicated `Title:`/`Final:` prefixes, or transcript-shaped excerpts.
 - Preserve caller-provided GitHub PR/check fidelity in `loo_github_operating_items`, including pending `statusCheckRollup` entries, failing checks, passed checks that can be omitted as green by default, and open PRs whose check data is genuinely unknown.
 - Rank current-lane GitHub PR/check signals ahead of old low-confidence Codex cards when no customer/runtime/security red card is present, using inspectable reason codes such as `current_lane`, `fresh_signal`, and `low_confidence_downgraded`.
-- Use `loo_watchers_list`, `loo_watcher_status`, `loo_watcher_dry_run`, and `loo_resume_request_packet` to represent read-only watcher attention and approval-bounded resume requests without running live control.
+- Use `loo_watchers_list`, `loo_watcher_status`, `loo_watcher_dry_run`, `loo_watcher_events`, and `loo_resume_request_packet` to represent read-only watcher attention, persisted watcher observations, execute-false local attention queue items, and approval-bounded resume requests without running live control.
 - Use `loo_codex_app_server_status`, `loo_codex_app_server_threads`, and `loo_visible_codex_map` to inspect read-only Codex app-server readiness and correlate sanitized visible Codex candidates with indexed session cards, including source coverage, confidence, and ambiguity markers.
 - Use `loo_codex_desktop_coherence` to classify whether a target Codex thread is only CLI/direct/app-server visible or also Desktop visible. `cli_visible` is a useful proof state but not a Desktop-visible collaboration claim; `desktop_refresh_required` and `desktop_restart_required` are explicit gap states.
 - Use `loo_codex_desktop_fallback_status` to inspect CUA-first and Peekaboo-secondary readiness, blocker codes, focus status, and screen-takeover warnings before suggesting a visible Codex Desktop fallback. If called with a target but no coherence report, it returns `coherence_input_missing` plus the exact `loo_codex_desktop_coherence` args to run first.
@@ -60,6 +69,7 @@ What a local OpenClaw agent can do today:
 - Use `loo_codex_runtime_desktop_visibility_status` when the agent needs a compact answer to "which active lanes have Desktop visibility or proof coverage, and what read-only proof step remains?" The status report returns covered/partial/blocked lane counts, source coverage, false action flags, and any next tool call with `execute=false`.
 - Use `loo_codex_active_thread_state` when the agent needs a compact answer to "which active Codex threads are running, blocked, stale, or need a nudge?" The report returns state counts, confidence, freshness, reason codes, source coverage, per-item attention coverage, non-executed read-only probe recommendations, non-executed `loo_codex_control_dry_run` recommendation packets, and false action flags without reading raw transcripts or mutating Codex.
 - Use `loo_codex_autonomy_tick` when the agent needs the next deterministic loop step after active-thread state. It returns prioritized `execute:false` tool-call packets, source coverage, reason codes, stop conditions, and idempotency keys, with read-only probes ordered ahead of control dry-run recommendations.
+- Use `loo hook closeout-capture`, `loo hook state-prep`, and `loo hook compaction-capture --mode marker` as local CLI sidecar capture paths. They write only LCO-owned derived cache, hash/redact transcript paths, and record compaction lifecycle markers without claiming true compaction-summary capture.
 - Inspect `authorityCoverage` on operating-picture outputs before trusting GitHub, PLAN_STATE, or future P1 source claims.
 - Classify package and gateway readiness with `loo onboard status`, `loo openclaw dogfood`, `loo openclaw tool-smoke`, and `loo openclaw published-smoke`.
 - Follow the packaged agent skill and M9 dogfood scenario to produce a public-safe recommendation from source refs, bounded expansion, detail lookups, and dry-run audit hashes.
@@ -86,6 +96,12 @@ Completed proof does not mean 1.0 or broad automation parity. Generic GUI mutati
 
 The strongest product direction is an OpenClaw orchestrator agent that can act like a local product-management operator across hundreds of local agent sessions while spending the least context possible. The orchestrator should know which Codex, OpenClaw, and future adapter sessions exist; what project each belongs to; current status; priority; owner or driving agent; blocker state; final closeout; proposed plan; touched files; source refs; and safest next action.
 
+The 1.2 prepared-state layer is the next leverage step for this mode. It should
+store local, deterministic, public-safe prepared cards and summary leaves so an
+agent can operate from compact source-ref-backed state rather than repeatedly
+searching and expanding the same large threads. Summary leaves route the agent
+to the right source range; they do not replace authoritative sources.
+
 Features should be prioritized by the `orchestrator-leverage-prioritization.json` scorecard when they change roadmap order. High-priority work gives the agent more session-management leverage per token: thread metadata, closeout hooks, project/status/priority tagging, archive and fork workflows, cited bounded expansion, and hybrid search when it improves top-k retrieval quality. Lower-priority work can still matter, but should wait when it makes the product more visually complete without reducing the orchestrator's rereading burden.
 
 Expected product-management workflows:

package/dist/packages/adapters/src/index.js

@@ -106,7 +106,8 @@ export function createCodexControl(options) {
                 method: spec.method,
                 methodSequence,
                 connectionScope,
-                loadedThreadReusable: spec.loadedThreadReusable
+                loadedThreadReusable: spec.loadedThreadReusable,
+                proofState: dryRunProofState()
             };
         }
         if (!spec.approvalAuditId) {
@@ -130,6 +131,8 @@ export function createCodexControl(options) {
             ? await requestCodexControlSequence(options.client, steps)
             : await options.client.request(spec.method, spec.params);
         const liveRecord = options.audit.append({ action: spec.action, target: spec.threadId, paramsHash, messageHash, live: true });
+        const createdThreadId = spec.createdThreadFromResponse ? extractControlThreadId(response) : undefined;
+        const proofThreadId = createdThreadId ?? spec.threadId;
         return {
             action: spec.action,
             threadId: spec.threadId,
@@ -141,10 +144,28 @@ export function createCodexControl(options) {
             methodSequence,
             connectionScope,
             loadedThreadReusable: spec.loadedThreadReusable,
+            createdThreadId,
+            proofState: liveProofState({
+                method: spec.method,
+                methodSequence,
+                threadId: proofThreadId,
+                response
+            }),
             response: redactValue(response)
         };
     };
     return {
+        startThread(input = {}) {
+            return execute({
+                action: "codex_start_thread",
+                method: "thread/start",
+                threadId: "new_thread",
+                dryRun: input.dryRun,
+                approvalAuditId: input.approvalAuditId,
+                params: {},
+                createdThreadFromResponse: true
+            });
+        },
         sendMessage(input) {
             const resumeParams = { threadId: input.threadId, excludeTurns: true };
             const turnStartParams = { threadId: input.threadId, input: [{ type: "text", text: input.message }] };
@@ -199,6 +220,102 @@ export function createCodexControl(options) {
         }
     };
 }
+function dryRunProofState() {
+    return {
+        acceptedByTransport: false,
+        started: false,
+        completed: false,
+        persisted: false,
+        unverifiedPending: false,
+        status: "dry_run",
+        callerInstruction: "Dry-run only. Live Codex control still requires the matching approval_audit_id for the exact params_hash.",
+        proofBoundary: "A dry-run approval packet does not execute Codex control and cannot prove transport acceptance, execution, completion, or persistence."
+    };
+}
+function liveProofState(input) {
+    const acceptedByTransport = asRecord(input.response)?.ok === false ? false : true;
+    const turnId = extractControlTurnId(input.response);
+    const responseThreadId = extractControlThreadId(input.response);
+    const responseStatus = extractControlStatus(input.response);
+    const normalizedStatus = normalizeControlStatus(responseStatus);
+    const started = acceptedByTransport && Boolean(turnId
+        || responseThreadId
+        || normalizedStatus === "in_progress"
+        || normalizedStatus === "running"
+        || normalizedStatus === "started"
+        || normalizedStatus === "pending"
+        || normalizedStatus === "queued");
+    const completed = acceptedByTransport && Boolean(normalizedStatus === "completed"
+        || normalizedStatus === "complete"
+        || normalizedStatus === "done");
+    const persisted = false;
+    const unverifiedPending = acceptedByTransport && !persisted && (started || completed || normalizedStatus !== null);
+    const status = !acceptedByTransport
+        ? "transport_rejected"
+        : persisted
+            ? "persisted"
+            : unverifiedPending
+                ? "unverified_pending"
+                : completed
+                    ? "completed"
+                    : started
+                        ? "started"
+                        : "accepted_by_transport";
+    const proofThreadId = responseThreadId ?? input.threadId;
+    return {
+        acceptedByTransport,
+        started,
+        completed,
+        persisted,
+        unverifiedPending,
+        status,
+        threadId: proofThreadId,
+        ...(turnId ? { turnId } : {}),
+        ...(responseStatus ? { responseStatus } : {}),
+        ...(acceptedByTransport && !persisted && proofThreadId !== "new_thread" ? { nextProof: {
+                tool: "loo_codex_app_server_threads",
+                execute: false,
+                args: { read_thread_id: proofThreadId, limit: 20 },
+                reason: "Bounded read-only follow-up proof is required before treating transport acceptance as durable Codex execution or persistence.",
+                stopConditions: ["execute_false_only", "raw_transcript_not_read", "do_not_claim_completed_or_persisted_until_durable_read"]
+            } } : {}),
+        callerInstruction: acceptedByTransport
+            ? "Transport acceptance is not durable execution. Run the bounded follow-up proof before claiming the turn or thread completed, persisted, or is safe to build on."
+            : "Codex transport did not accept the control request. Do not retry live control without a fresh dry-run and approval.",
+        proofBoundary: "This proof state is public-safe transport/output classification only. It does not read raw transcripts, prove durable local-session persistence, mutate the GUI, or claim completed orchestration without follow-up evidence."
+    };
+}
+function extractControlTurnId(value) {
+    const turn = nestedRecord(value, ["result", "turn"]) ?? nestedRecord(value, ["turn"]);
+    return stringField(turn?.id) ?? undefined;
+}
+function extractControlThreadId(value) {
+    const thread = nestedRecord(value, ["result", "thread"]) ?? nestedRecord(value, ["thread"]);
+    return stringField(thread?.id) ?? undefined;
+}
+function extractControlStatus(value) {
+    const turn = nestedRecord(value, ["result", "turn"]) ?? nestedRecord(value, ["turn"]);
+    const thread = nestedRecord(value, ["result", "thread"]) ?? nestedRecord(value, ["thread"]);
+    return stringField(turn?.status)
+        ?? stringField(thread?.status)
+        ?? stringField(nestedRecord(value, ["result"])?.status)
+        ?? stringField(asRecord(value)?.status);
+}
+function nestedRecord(value, path) {
+    let current = value;
+    for (const segment of path) {
+        const record = asRecord(current);
+        if (!record)
+            return null;
+        current = record[segment];
+    }
+    return asRecord(current);
+}
+function normalizeControlStatus(value) {
+    if (!value)
+        return null;
+    return value.trim().replace(/([a-z])([A-Z])/g, "$1_$2").replace(/[\s-]+/g, "_").toLowerCase();
+}
 async function requestCodexControlSequence(client, steps) {
     if (!client.requestSequence) {
         throw new Error("same-connection control sequence is required for this Codex control action");
@@ -1734,11 +1851,13 @@ function threadIdsFromLoadedResult(result) {
 function appServerThreadSignal(thread, loadedThreadIds) {
     const threadId = capTextValue(stringField(thread.id) ?? "unknown", 160);
     const title = publicTextField(thread.name, 160);
+    const titleAliases = publicTitleAliases(thread, title);
     const loaded = loadedThreadIds ? loadedThreadIds.has(threadId) : null;
     return {
         appServerRef: codexAppThreadRef(threadId),
         threadId,
         titleSanitized: title ?? null,
+        titleAliases,
         titleHash: title ? shortHash(title) : null,
         status: threadStatus(thread.status),
         loaded,
@@ -1748,6 +1867,21 @@ function appServerThreadSignal(thread, loadedThreadIds) {
         confidence: title ? 0.9 : 0.62
     };
 }
+function publicTitleAliases(thread, primaryTitle) {
+    const aliases = [
+        thread.displayName,
+        thread.display_name,
+        thread.title,
+        thread.titleSanitized,
+        ...(Array.isArray(thread.titleAliases) ? thread.titleAliases : []),
+        ...(Array.isArray(thread.title_aliases) ? thread.title_aliases : [])
+    ];
+    const sanitized = aliases
+        .map((alias) => publicTextField(alias, 160))
+        .filter((alias) => Boolean(alias && alias.trim()))
+        .filter((alias) => alias !== primaryTitle);
+    return [...new Set(sanitized)].slice(0, 12);
+}
 function threadStatus(value) {
     if (typeof value === "string")
         return capTextValue(value, 80);

package/dist/packages/adapters/src/policy.js

@@ -16,13 +16,13 @@ export const CODEX_READ_METHODS = new Set([
     "gitDiffToRemote"
 ]);
 export const CODEX_CONTROL_METHODS = new Set([
+    "thread/start",
     "thread/resume",
     "turn/start",
     "turn/steer",
     "turn/interrupt"
 ]);
 export const CODEX_FORBIDDEN_METHODS = new Set([
-    "thread/start",
     "thread/fork",
     "thread/archive",
     "thread/delete",
@@ -80,59 +80,84 @@ export const CODEX_FORBIDDEN_METHODS = new Set([
     "feedback/upload",
     "externalAgentConfig/import"
 ]);
+function commandSafety(mode, source, requiresApproval, mutationClasses = []) {
+    return { mode, source, requiresApproval, mutationClasses: [...mutationClasses] };
+}
+function readOnly(source, mutationClasses = []) {
+    return commandSafety("read_only", source, false, mutationClasses);
+}
+function localCacheWrite(source, mutationClasses = ["derived_cache"]) {
+    return commandSafety("local_cache_write", source, false, mutationClasses);
+}
+function approvalGatedControl(source, mutationClasses = ["derived_cache", "live_control"]) {
+    return commandSafety("approval_gated_control", source, true, mutationClasses);
+}
+function dryRunOnly(source, mutationClasses = []) {
+    return commandSafety("dry_run_only", source, true, mutationClasses);
+}
+// This table is the manually reviewed safety contract for tool side effects.
+// Any execute-path change that adds or removes a write/control/publish behavior
+// must update this table, the manifests, and the focused policy tests together.
 export const LOO_COMMAND_POLICY = {
-    loo_index_sessions: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_grep: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_search_sessions: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_describe_ref: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_describe_session: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_expand_session: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_expand_query: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_thread_map: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_session_management_map: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_recent_sessions: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_cockpit_inbox: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_collaboration_cockpit: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_collaboration_next_steps: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_desktop_collaboration_proof: { mode: "read_only", source: "desktop_fallback", requiresApproval: false },
-    loo_codex_runtime_desktop_visibility_status: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_active_thread_state: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_autonomy_tick: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_watchers_list: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_watcher_status: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_watcher_dry_run: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_resume_request_packet: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_app_server_status: { mode: "read_only", source: "codex_direct", requiresApproval: false },
-    loo_codex_app_server_threads: { mode: "read_only", source: "codex_direct", requiresApproval: false },
-    loo_visible_codex_map: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_desktop_coherence: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_desktop_fallback_status: { mode: "read_only", source: "desktop_fallback", requiresApproval: false },
-    loo_plan_state_pins: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_github_operating_items: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_project_digest: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_attention_inbox: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_business_pulse: { mode: "read_only", source: "structured_operating_inputs", requiresApproval: false },
-    loo_codex_final_messages: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_plans: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_touched_files: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_tool_calls: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_closeout_dry_run: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_session_sanitizer: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_sqlite_stores: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_lcm_peer_dbs: { mode: "read_only", source: "local_index", requiresApproval: false },
-    loo_codex_control_dry_run: { mode: "read_only", source: "audit", requiresApproval: false },
-    loo_codex_resume_thread: { mode: "approval_gated_control", source: "codex_direct", requiresApproval: true },
-    loo_codex_send_message: { mode: "approval_gated_control", source: "codex_direct", requiresApproval: true },
-    loo_codex_steer_thread: { mode: "approval_gated_control", source: "codex_direct", requiresApproval: true },
-    loo_codex_interrupt_thread: { mode: "approval_gated_control", source: "codex_direct", requiresApproval: true },
-    loo_desktop_see: { mode: "read_only", source: "desktop_fallback", requiresApproval: false },
-    loo_desktop_act: { mode: "dry_run_only", source: "desktop_fallback", requiresApproval: true },
-    loo_desktop_proof_action: { mode: "approval_gated_control", source: "desktop_fallback", requiresApproval: true },
-    loo_desktop_proof_report: { mode: "read_only", source: "desktop_fallback", requiresApproval: false },
-    loo_desktop_live_proof_harness: { mode: "read_only", source: "desktop_fallback", requiresApproval: false },
-    loo_doctor: { mode: "read_only", source: "audit", requiresApproval: false },
-    loo_permissions: { mode: "read_only", source: "audit", requiresApproval: false },
-    loo_audit_tail: { mode: "read_only", source: "audit", requiresApproval: false }
+    loo_index_sessions: localCacheWrite("local_index"),
+    loo_grep: readOnly("local_index"),
+    loo_search_sessions: readOnly("local_index"),
+    loo_describe_ref: readOnly("local_index"),
+    loo_describe_session: readOnly("local_index"),
+    loo_expand_session: readOnly("local_index"),
+    loo_expand_query: readOnly("local_index"),
+    loo_summary_leaves: readOnly("local_index"),
+    loo_summary_expand: readOnly("local_index"),
+    loo_prepared_state_status: readOnly("local_index"),
+    loo_prepared_cards: readOnly("local_index"),
+    loo_prepared_inbox: readOnly("local_index"),
+    loo_codex_thread_map: readOnly("local_index"),
+    loo_codex_session_management_map: readOnly("local_index"),
+    loo_recent_sessions: readOnly("local_index"),
+    loo_cockpit_inbox: readOnly("local_index"),
+    loo_codex_collaboration_cockpit: readOnly("structured_operating_inputs"),
+    loo_codex_collaboration_next_steps: readOnly("structured_operating_inputs"),
+    loo_codex_desktop_collaboration_proof: readOnly("desktop_fallback"),
+    loo_codex_runtime_desktop_visibility_status: readOnly("structured_operating_inputs"),
+    loo_codex_active_thread_state: readOnly("structured_operating_inputs"),
+    loo_codex_autonomy_tick: readOnly("structured_operating_inputs"),
+    loo_watchers_list: readOnly("structured_operating_inputs"),
+    loo_watcher_status: readOnly("structured_operating_inputs"),
+    loo_watcher_dry_run: readOnly("structured_operating_inputs"),
+    loo_watcher_events: readOnly("structured_operating_inputs"),
+    loo_resume_request_packet: readOnly("structured_operating_inputs"),
+    loo_codex_app_server_status: readOnly("codex_direct"),
+    loo_codex_app_server_threads: readOnly("codex_direct"),
+    loo_visible_codex_map: readOnly("structured_operating_inputs"),
+    loo_codex_desktop_coherence: readOnly("structured_operating_inputs"),
+    loo_codex_desktop_fallback_status: readOnly("desktop_fallback"),
+    loo_plan_state_pins: readOnly("structured_operating_inputs"),
+    loo_github_operating_items: readOnly("structured_operating_inputs"),
+    loo_project_digest: readOnly("structured_operating_inputs"),
+    loo_attention_inbox: readOnly("structured_operating_inputs"),
+    loo_business_pulse: readOnly("structured_operating_inputs"),
+    loo_codex_final_messages: readOnly("local_index"),
+    loo_codex_plans: readOnly("local_index"),
+    loo_codex_touched_files: readOnly("local_index"),
+    loo_codex_tool_calls: readOnly("local_index"),
+    loo_closeout_dry_run: readOnly("local_index"),
+    loo_session_sanitizer: readOnly("local_index"),
+    loo_codex_sqlite_stores: readOnly("local_index"),
+    loo_lcm_peer_dbs: readOnly("local_index"),
+    loo_codex_control_dry_run: localCacheWrite("audit"),
+    loo_codex_start_thread: approvalGatedControl("codex_direct"),
+    loo_codex_resume_thread: approvalGatedControl("codex_direct"),
+    loo_codex_send_message: approvalGatedControl("codex_direct"),
+    loo_codex_steer_thread: approvalGatedControl("codex_direct"),
+    loo_codex_interrupt_thread: approvalGatedControl("codex_direct"),
+    loo_desktop_see: readOnly("desktop_fallback"),
+    loo_desktop_act: dryRunOnly("desktop_fallback"),
+    loo_desktop_proof_action: approvalGatedControl("desktop_fallback", ["derived_cache", "desktop_gui"]),
+    loo_desktop_proof_report: readOnly("desktop_fallback"),
+    loo_desktop_live_proof_harness: readOnly("desktop_fallback"),
+    loo_doctor: readOnly("audit"),
+    loo_permissions: readOnly("audit"),
+    loo_audit_tail: readOnly("audit")
 };
 export function assertCodexMethodAllowed(method, surface = "generic") {
     if (surface === "smoke_setup" && method === "thread/start")