omnilane 0.42.7 → 0.42.8

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "One routing table, native-first or CLI delegation, supervised completion workflows.",
-    "version": "0.42.7"
+    "version": "0.42.8"
   },
   "plugins": [
     {
       "name": "omnilane",
       "source": "./",
       "description": "Route each subtask to the model that fits, then delegate through a compatible caller-owned native agent or vendor CLI.",
-      "version": "0.42.7",
+      "version": "0.42.8",
       "category": "development",
       "keywords": [
         "routing",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.7",
+  "version": "0.42.8",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs.",
   "author": {
     "name": "Seraphim0916"

package/CHANGELOG.md

@@ -6,6 +6,48 @@ semantic version tags.
 
 ## [Unreleased]
 
+## [0.42.8] - 2026-09-12
+
+### Fixed
+
+- When ancestor inspection fails under `CODEX_SANDBOX=seatbelt`, `whoami` now explains that Codex blocked process inspection and that dispatch must be rerun outside the sandbox because omnilane also needs `~/.omnilane` writes and network access; non-sandbox refusals are unchanged.
+
+- Codex `app-server` caller identity always comes from the latest host-written
+  `turn_context`, never its startup defaults. Other Codex launches use rollout
+  evidence only when no explicit model was selected (profiles are not selectors).
+- Bind `CODEX_THREAD_ID` in the current process to the codex direct child's
+  initial environment. macOS reads argv and environment separately through
+  `KERN_PROCARGS2`; Linux reads `/proc`. Look the rollout up as
+  `rollout-*-<thread>.jsonl` and, for a resumed thread,
+  `rollout-*-<thread>_<session>.jsonl`, read the most recently written match, and
+  require a matching `session_meta.id`, non-empty model/effort/turn id, and no
+  later `task_complete`, its `turn_complete` read alias, or `turn_aborted`
+  carrying that same turn id. A refusal names both turn ids and how long ago the
+  rollout was last written. Missing, malformed or stale evidence refuses.
+- Stream JSONL records and retain only identity metadata and event types;
+  diagnostics never include message content. `whoami` reports thread and turn ids.
+- Accept Codex `-c model=...` / `--config` overrides, including attached/equals
+  forms and TOML strings (Python 3.11+); explicit `-m` / `--model` still wins
+  outside app-server. Other vendors and caller-context/inherited/human priority
+  remain unchanged. `OMNILANE_AA_CALLER_FROM_PROCESS=0` disables both readers.
+- The test suite no longer inherits the dispatcher's AA environment. Run inside
+  an omnilane worker it kept the exported `OMNILANE_AA_*`, so the authorizer
+  identity and the transport overlay hash pin outranked each fixture's own human
+  exemption and six tests failed for that reason alone.
+
+### Verification
+
+- Accepted on real Codex desktop threads on 2026-09-12: `whoami` and
+  `dispatch.sh --dry-run` both exited 0 in a fresh thread and in a resumed thread
+  whose original rollout had stopped the previous day, reporting
+  `codex/gpt-6-astra-xhigh (score 54)` and `"allowed":true` with no job created.
+- Source contract verified earlier in five real turns with bundled app-server
+  0.153.4. 較新版本若延後寫檔，過期保護會讓它拒絕，而不是讀到舊的一輪。
+- Metadata-only check of the two 0.154.0 worker rollouts: thread
+  `01a08f9e-6450-7f82-85e9-af534954b4ac` was absent from both active and archived
+  directories; `01a08fb4-fd1a-7811-a457-c21a4a6ff4d8` existed in active sessions,
+  created 2026-09-11 17:03:18 Asia/Taipei. Neither file's contents were opened.
+
 ## [0.42.7] - 2026-09-10
 
 ### Added
@@ -1016,7 +1058,8 @@ work to the wrong model, and records the evidence behind the shipped defaults.
 - Initial shared routing table, cross-vendor dispatcher, runners, installer,
   and baseline lint fixes.
 
-[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.7...HEAD
+[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.8...HEAD
+[0.42.8]: https://github.com/Seraphim0916/omnilane/compare/v0.42.7...v0.42.8
 [0.42.7]: https://github.com/Seraphim0916/omnilane/compare/v0.42.6...v0.42.7
 [0.42.6]: https://github.com/Seraphim0916/omnilane/compare/v0.42.5...v0.42.6
 [0.42.5]: https://github.com/Seraphim0916/omnilane/compare/v0.42.4...v0.42.5

package/README.ja.md

@@ -577,6 +577,35 @@ work の別名ではありません。サービス管理など、work の境界
 
 ## 📜 リリース履歴
 
+## v0.42.8 の新機能
+
+- **Codex の現在ターンの身元。** `app-server` は起動時のモデル・強度を常に無視します。
+  それ以外の Codex は明示的な `-m` / `--model` / `-c model=...` / `--config` を維持し、
+  モデル指定がない場合（プロファイルのみを含む）は現在ターンの記録を使います。
+  TOML のモデル指定には Python 3.11 以降が必要です。
+- **曖昧なら拒否。** 現在のプロセス環境と Codex 直下の子プロセスの初期環境に、同じ UUID 形式の
+  `CODEX_THREAD_ID` が必要です。記録は `$CODEX_HOME/sessions`（既定 `~/.codex`）から
+  `rollout-*-<スレッド>.jsonl`、再開後は `rollout-*-<スレッド>_<セッション>.jsonl` として探し、
+  最後に書き込まれたものを読み、`session_meta.id` が一致する必要があります。最後の `turn_context`
+  にはモデル・強度・ターン ID が必要です。その後に**同じターン ID** の `task_complete` /
+  `turn_complete`（読み取り時の別名）/ `turn_aborted` があれば古い身元として拒否し、
+  両方のターン ID と、その記録が最後に書かれてからの経過時間を示します。
+- **Codex サンドボックスでの拒否。** 祖先検索は従来どおり先に実行します。`CODEX_SANDBOX=seatbelt`
+  で失敗した場合、`whoami` はプロセス検査、`~/.omnilane` への書き込み、ネットワーク接続に
+  サンドボックス外での再実行が必要だと案内します。
+- **追跡可能性と互換性。** JSONL は逐次読み込み、メッセージ本文を診断に含めません。
+  `whoami` はスレッドとターン ID を表示します。設定既定値・モデル一覧・アーカイブ・他の会話は
+  代用しません。他社 CLI、明示・継承した身元、人間の宣言の優先順位は変更しません。
+  `OMNILANE_AA_CALLER_FROM_PROCESS=0` は両方の読み取りを無効にします。
+- **テストの環境分離。** テストはディスパッチ元のワーカーから `OMNILANE_AA_*` を
+  引き継がなくなりました。ワーカー内で実行すると、承認者の身元と転送オーバーレイの
+  ハッシュ固定が各フィクスチャ自身の人間宣言を上書きし、6 件が失敗していました。
+- **実機での受け入れ。** 2026-09-12 に Codex デスクトップで実測：新規スレッドと、
+  元の記録が前日で止まっていた再開スレッドの両方で `whoami` と
+  `dispatch.sh --dry-run` が終了コード 0、`codex/gpt-6-astra-xhigh (score 54)` と
+  `"allowed":true` を返し、ジョブは作成されませんでした。
+  更新は `npm i -g omnilane@0.42.8`。
+
 ## v0.42.7 の新機能
 
 - **モデルのセッションは識別ファイルなしでディスパッチできます。** `--caller-context` が無い場合、dispatch はプロセスツリーを遡って最も近いベンダー CLI を見つけ、その起動時のモデルと effort を読み取ります。これまで omnilane のチェックアウト外のセッションは `missing-caller-context` で止まり、判断をオペレーターに差し戻していました（2026-09-08 と 2026-09-10 に 3 件）。

package/README.ko.md

@@ -562,6 +562,34 @@ doctor가 파일과 벤더를 지목하며, 재서명 절차는 디스패치 스
 
 ## 📜 릴리스 기록
 
+## v0.42.8 새 기능
+
+- **Codex 현재 턴 신원.** `app-server`는 시작 시 모델·강도 기본값을 항상 무시합니다.
+  다른 Codex 실행은 명시적인 `-m` / `--model` / `-c model=...` / `--config`를 유지하며,
+  모델 지정이 없으면(프로필만 지정한 경우 포함) 현재 턴 기록을 사용합니다.
+  TOML 모델 지정에는 Python 3.11 이상이 필요합니다.
+- **불확실하면 거부.** 현재 프로세스 환경과 Codex의 직계 자식 프로세스 초기 환경에 같은 UUID 형식의
+  `CODEX_THREAD_ID`가 있어야 합니다. 기록은 `$CODEX_HOME/sessions`(기본 `~/.codex`)에서
+  `rollout-*-<스레드>.jsonl`로, 재개한 뒤에는 `rollout-*-<스레드>_<세션>.jsonl`로 찾으며,
+  가장 최근에 기록된 파일을 읽고 `session_meta.id`가 일치해야 합니다. 마지막 `turn_context`에는
+  모델·강도·턴 ID가 필요하며, 그 뒤에 **같은 턴 ID**의 `task_complete` / `turn_complete`(읽기 별칭) /
+  `turn_aborted`가 있으면 오래된 신원으로 거부하고, 두 턴 ID와 그 기록이 마지막으로 기록된 뒤
+  지난 시간을 함께 알려 줍니다.
+- **Codex 샌드박스 거부.** 조상 조회는 기존처럼 먼저 실행합니다. `CODEX_SANDBOX=seatbelt`에서
+  실패하면 `whoami`는 프로세스 조회, `~/.omnilane` 쓰기 및 네트워크 연결을 위해 샌드박스
+  밖에서 명령을 다시 실행해야 한다고 안내합니다.
+- **추적성과 호환성.** JSONL을 순차적으로 읽고 메시지 본문은 진단에 포함하지 않습니다.
+  `whoami`는 스레드와 턴 ID를 표시합니다. 설정 기본값·모델 목록·보관 기록·다른 대화로
+  추정하지 않습니다. 다른 공급자, 명시적·상속된 신원과 사람 선언의 우선순위는 유지합니다.
+  `OMNILANE_AA_CALLER_FROM_PROCESS=0`은 두 읽기 경로를 모두 끕니다.
+- **테스트 환경 격리.** 테스트는 더 이상 디스패치 워커가 내보낸 `OMNILANE_AA_*`를
+  물려받지 않습니다. 워커 안에서 실행하면 승인자 신원과 전송 오버레이 해시 고정이 각
+  픽스처의 사람 선언을 덮어써 6개가 실패했습니다.
+- **실제 환경 검증.** 2026-09-12 Codex 데스크톱에서 확인: 새 스레드와, 원래 기록이 전날
+  멈춰 있던 재개 스레드 모두에서 `whoami`와 `dispatch.sh --dry-run`이 종료 코드 0으로
+  `codex/gpt-6-astra-xhigh (score 54)`와 `"allowed":true`를 보고했고 작업은 생성되지
+  않았습니다. 업데이트: `npm i -g omnilane@0.42.8`.
+
 ## v0.42.7 새 기능
 
 - **모델 세션은 신원 파일 없이 디스패치할 수 있습니다.** `--caller-context` 가 없으면 dispatch 가 프로세스 트리를 거슬러 올라가 가장 가까운 벤더 CLI 를 찾고, 그 CLI 가 실행될 때의 모델과 effort 를 읽습니다. 지금까지 omnilane 체크아웃 밖의 세션은 `missing-caller-context` 에서 멈추고 판단을 운영자에게 되돌렸습니다(2026-09-08, 2026-09-10 에 3건).

package/README.md

@@ -71,8 +71,9 @@ omnilane route hardest-coding "fix the flaky auth token refresh"
 > capability score, so a dispatch has to say who is asking. A human at a terminal
 > asserts that once with `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1`, or per call with
 > `--operator-asserted-human`. A model driving omnilane cannot assert it for
-> itself. Its identity is read from the CLI that launched it — the model and
-> effort flags that CLI was started with — so an ordinary session passes nothing,
+> itself. Its identity is read from the nearest launching CLI: explicit model and
+> effort flags, or for Codex app-server/no-model launches, a bound current-turn
+> rollout (never app-server startup defaults). An ordinary session passes nothing,
 > and `omnilane whoami` prints that identity as a `--caller-context FILE`. With
 > neither an assertion nor a readable identity, the dispatch is refused with
 > `missing-caller-context` before any job is created.
@@ -629,8 +630,9 @@ machine's configuration or your request.
 
 `missing-caller-context` — no identity reached the gate. A human adds
 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` or `--operator-asserted-human`. A model
-normally needs nothing: dispatch reads its identity from the CLI that launched
-it. When that fails, run `omnilane whoami` — it either prints a
+normally needs nothing: dispatch reads its identity from the nearest launching
+CLI, using a bound current-turn rollout for Codex app-server/no-model launches.
+When that fails, run `omnilane whoami` — it either prints a
 `--caller-context FILE` to pass, or says exactly why it cannot (a missing
 `--effort`, a model alias, no scored row). A model must not assert the human
 exemption for itself.
@@ -704,6 +706,38 @@ working notes, including per-benchmark caveats, live in
 
 ## 📜 Release history
 
+## What's new in v0.42.8
+
+- **Codex current-turn identity.** `app-server` always ignores startup model and
+  effort defaults. Other Codex launches keep explicit `-m` / `--model` or
+  `-c model=...` / `--config` selectors (TOML model overrides require Python 3.11+);
+  no model, including profile-only launches, uses the rollout path.
+- **Bound, fail-closed evidence.** The current process environment and the codex
+  direct-child initial environment must carry the same UUID-shaped
+  `CODEX_THREAD_ID`. The rollout is looked up under `$CODEX_HOME/sessions`
+  (default `~/.codex`) as `rollout-*-<thread>.jsonl` and, after a resume,
+  `rollout-*-<thread>_<session>.jsonl`; the most recently written match is read
+  and its `session_meta.id` must match. Its latest `turn_context` needs model,
+  effort and turn id; a later `task_complete`, `turn_complete` (read alias) or
+  `turn_aborted` carrying that same turn id refuses stale identity, and the
+  refusal names both turn ids and how long ago the rollout was written. No config,
+  model-list, archive or other-session fallback; JSONL is streamed and message
+  content is never included in diagnostics. `whoami` reports thread and turn ids.
+- **Codex sandbox refusal.** Ancestor lookup still runs first. If it fails under
+  `CODEX_SANDBOX=seatbelt`, `whoami` explains that process inspection,
+  `~/.omnilane` writes and networking require rerunning outside the sandbox.
+- **Hermetic tests.** The suite no longer inherits `OMNILANE_AA_*` from a
+  dispatching worker, where the authorizer identity and the overlay hash pin used
+  to outrank each fixture's own human exemption and fail six tests.
+- **Compatibility.** Other vendors, explicit/inherited caller identity and human
+  assertion precedence are unchanged. `OMNILANE_AA_CALLER_FROM_PROCESS=0` disables
+  both argv and rollout reading.
+- **Accepted on a real desktop thread.** On 2026-09-12 `whoami` and
+  `dispatch.sh --dry-run` both exited 0 from the Codex desktop app — in a fresh
+  thread and in a resumed one whose original rollout had stopped the day before,
+  reporting `codex/gpt-6-astra-xhigh (score 54)` and `"allowed":true`.
+- **Upgrade.** Run `npm i -g omnilane@0.42.8`.
+
 ## What's new in v0.42.7
 
 - **A model session no longer needs an identity file to dispatch.** When no `--caller-context` is given, dispatch walks up the process tree to the nearest vendor CLI and reads the model and effort it was launched with. Sessions outside the omnilane checkout used to stop on `missing-caller-context` and hand the question back to the operator; three did so on 2026-09-08 and 2026-09-10.

package/README.zh-CN.md

@@ -556,6 +556,29 @@ codex 记在 session rollout，agy 写进 `cli.log`。这是 CLI 自己抄的订
 
 ## 📜 版本历程
 
+## v0.42.8 新功能
+
+- **Codex 当前轮次身份。** `app-server` 始终忽略启动参数中的模型和强度默认值。
+  其他 Codex 启动保留明确的 `-m` / `--model` / `-c model=...` / `--config`；
+  未指定模型（包括只指定 profile）时读取当前轮次记录。TOML 模型覆盖需要 Python 3.11+。
+- **证据不明就拒绝。** 本进程的当前环境与 Codex 直属子进程的初始环境必须有相同、符合 UUID 格式的
+  `CODEX_THREAD_ID`。记录文件在 `$CODEX_HOME/sessions`（默认 `~/.codex`）下按
+  `rollout-*-<对话串>.jsonl` 查找，对话串续用后还会有 `rollout-*-<对话串>_<会话>.jsonl`；
+  取最后写入的那一个，`session_meta.id` 必须一致。最后一个 `turn_context` 必须包含模型、强度和轮次 ID；
+  后面若出现**同一个轮次 ID** 的 `task_complete` / `turn_complete`（读取别名）/ `turn_aborted`，
+  就拒绝使用过期身份，并在消息里写出两个轮次 ID，以及该记录多久没有被写入。
+- **Codex 沙箱拒绝。** 仍会先查询祖先进程；若在 `CODEX_SANDBOX=seatbelt` 下查询失败，
+  `whoami` 会说明进程查询、写入 `~/.omnilane` 和联网都需要在沙箱外重新执行命令。
+- **隐私与兼容。** 逐行读取 JSONL，诊断不含消息正文；`whoami` 会报告对话串和轮次 ID。
+  不从配置默认值、模型列表、归档或其他对话推断。其他供应商、明确或继承的身份、人类声明
+  的优先级不变；`OMNILANE_AA_CALLER_FROM_PROCESS=0` 同时关闭两种读取路径。
+- **测试自己清环境。** 测试不再沿用派工工人带进来的 `OMNILANE_AA_*`；在工人里运行时，
+  授权者身份与传输对照表的哈希锁定会盖掉各夹具自己的人类豁免，导致 6 个测试失败。
+- **实机验收。** 2026-09-12 在 Codex 桌面版实测：新建对话串与续用对话串（原始记录文件
+  前一天就停止写入）各跑一次，`whoami` 与 `dispatch.sh --dry-run` 都退出 0，读出
+  `codex/gpt-6-astra-xhigh (score 54)`、`"allowed":true`，且没有创建任何任务。
+  升级：`npm i -g omnilane@0.42.8`。
+
 ## v0.42.7 新功能
 
 - **模型 session 派工不再需要身份文件。** 没给 `--caller-context` 时，dispatch 会沿进程树往上找到最近的厂商 CLI，读取它启动时带的模型与强度。以前不在 omnilane 目录下的 session 会卡在 `missing-caller-context`，把问题丢回给操作者——2026-09-08 与 2026-09-10 就有三个 session 这样停下来。

package/README.zh-TW.md

@@ -597,6 +597,29 @@ codex 記在 session rollout，agy 寫進 `cli.log`。這是 CLI 自己抄的訂
 
 ## 📜 版本歷程
 
+## v0.42.8 新功能
+
+- **Codex 本輪身分。** `app-server` 一律忽略啟動參數的模型與強度預設值。
+  其他 Codex 啟動保留明確的 `-m` / `--model` / `-c model=...` / `--config`；
+  沒有指定模型（包括只指定 profile）時，改讀本輪記錄。TOML 模型覆寫需要 Python 3.11+。
+- **證據不明就拒絕。** 本程序的現行環境與 Codex 直屬子程序的初始環境，必須有相同且符合 UUID 形狀的
+  `CODEX_THREAD_ID`。記錄檔在 `$CODEX_HOME/sessions`（預設 `~/.codex`）底下找
+  `rollout-*-<對話串>.jsonl`，對話串續用之後還會有 `rollout-*-<對話串>_<工作階段>.jsonl`；
+  取最後寫入的那一份，`session_meta.id` 必須一致。最後一筆 `turn_context` 必須有模型、強度與回合 ID；
+  後面若出現**同一個回合 ID** 的 `task_complete` / `turn_complete`（讀取別名）/ `turn_aborted`，
+  就拒絕沿用過期身分，並在訊息裡寫出兩個回合 ID，以及那份記錄多久沒有被寫入。
+- **Codex 沙箱拒絕。** 仍會先查詢祖先程序；若在 `CODEX_SANDBOX=seatbelt` 下查詢失敗，
+  `whoami` 會說明程序查詢、寫入 `~/.omnilane` 與連網都必須把指令移到沙箱外重新執行。
+- **隱私與相容。** 逐行讀取 JSONL，不把訊息內容放進診斷；`whoami` 會回報對話串與回合 ID。
+  不從設定預設值、模型清單、封存或其他對話推斷。其他廠商、明確或繼承的身分、真人聲明
+  的優先順序不變；`OMNILANE_AA_CALLER_FROM_PROCESS=0` 同時關閉兩條讀取路徑。
+- **測試自己清環境。** 測試不再沿用派工工人帶進來的 `OMNILANE_AA_*`；在工人裡跑時，
+  授權者身分與傳輸對照表的雜湊釘選會蓋掉各夾具自己的真人豁免，害 6 個測試失敗。
+- **實機驗收。** 2026-09-12 在 Codex 桌面版實測：新開的對話串與續用的對話串（原始記錄檔
+  前一天就停筆）各跑一次，`whoami` 與 `dispatch.sh --dry-run` 都退出 0，讀出
+  `codex/gpt-6-astra-xhigh (score 54)`、`"allowed":true`，而且沒有建立任何工作。
+  升級：`npm i -g omnilane@0.42.8`。
+
 ## v0.42.7 新功能
 
 - **模型 session 派工不再需要身分檔。** 沒給 `--caller-context` 時，dispatch 會沿行程樹往上找到最近的廠商 CLI，讀它啟動時帶的模型與強度。以前不在 omnilane 目錄下的 session 會卡在 `missing-caller-context`，把問題丟回給操作者——2026-09-08 與 2026-09-10 就有三個 session 這樣停下來。

package/VERSION

@@ -1 +1 @@
-0.42.7
+0.42.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.7",
+  "version": "0.42.8",
   "description": "One routing table, every harness — classify subtasks into lanes and delegate each lane through a compatible caller-owned native agent or vendor CLI.",
   "bin": {
     "omnilane": "bin/omnilane"

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.42.7",
+  "version": "0.42.8",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/scripts/lib/caller_identity.py

@@ -1,35 +1,56 @@
 #!/usr/bin/env python3
 """Read the exact AA caller identity of the CLI this process runs under.
 
-Walks up the process tree to the nearest vendor CLI, reads the model and effort
-it was launched with, and maps them onto the one scored configuration they
-select. Launch flags are the harness's request selector: the same class of
-evidence the transport overlay carries, and unlike a hand-written caller-context
-file, not something the model can edit.
+Walks up the process tree to the nearest vendor CLI and maps its selector onto
+one scored configuration. Codex app-server always uses the host-written current
+turn; other Codex launches do so only without an explicit model. The rollout is
+bound to the codex direct child's initial environment, never another session.
 
 Prints the path of a caller-context file for that identity. Exits 3 with the
-reason on stderr when it cannot decide. It never guesses: a missing flag, an
-alias, or an identity the frozen registry does not score exactly once is a
+reason on stderr when it cannot decide. It never guesses: missing selector
+evidence, an alias, or an identity not scored exactly once is a
 refusal, not a fallback.
 """
 from __future__ import annotations
 
 import argparse
+import ctypes
 import json
 import os
+import re
+import struct
 import subprocess
 import sys
+from datetime import datetime, timezone
 from pathlib import Path
-from typing import Callable, Optional
+from typing import Callable, Mapping, Optional
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import aa_policy  # noqa: E402
 
+try:
+    import tomllib
+except ImportError:  # Explicit-model callers still work on Python 3.9/3.10.
+    tomllib = None
+
 REPO = Path(__file__).resolve().parents[2]
 MAX_DEPTH = 64
 ENCODED_EFFORTS = ("xhigh", "high", "medium", "low")
 Selector = tuple[str, Optional[str], Optional[str]]
 Lookup = Callable[[int], Optional[tuple[int, list[str]]]]
+EnvironmentLookup = Callable[[int], dict[str, str]]
+UUID_PATTERN = re.compile(r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}\Z")
+TURN_END_EVENTS = frozenset(("task_complete", "turn_complete", "turn_aborted"))
+CODEX_SANDBOX_REFUSAL = (
+    "Codex sandbox (CODEX_SANDBOX=seatbelt) blocked process inspection; omnilane also "
+    "needs to write ~/.omnilane and access the network, which this sandbox does not allow; "
+    "rerun this command outside the sandbox (approve running outside the sandbox when Codex "
+    "asks, or use a conversation with full access)"
+)
+
+
+class _ProcessQueryUnavailable(Exception):
+    """Keep a swallowed platform process-query failure available to read_caller()."""
 
 
 def _vendor(executable: str) -> str | None:
@@ -58,16 +79,52 @@ def _flag(argv: list[str], *names: str) -> str | None:
     return value
 
 
-def _codex_effort(argv: list[str]) -> str | None:
-    effort = None
-    for index, token in enumerate(argv[:-1]):
+def _codex_config(argv: list[str], name: str) -> str | None:
+    selected = None
+    tokens = iter(argv)
+    for token in tokens:
+        if token == "--":
+            break
         if token in ("-c", "--config"):
-            key, _, value = argv[index + 1].partition("=")
-            if key.strip() == "model_reasoning_effort":
-                effort = value.strip().strip("'\"")
-    return effort
+            override = next(tokens, "")
+        elif token.startswith("--config="):
+            override = token.partition("=")[2]
+        elif token.startswith("-c"):
+            override = token[2:].removeprefix("=")
+        else:
+            continue
+        key, sep, value = override.partition("=")
+        if sep and key.strip() == name:
+            selected = value.strip()
+    if selected is None:
+        return None
+    if tomllib is None:
+        if name == "model_reasoning_effort":
+            return selected.strip("'\"")
+        raise ValueError("model config decoding requires Python 3.11+ (tomllib)")
+    try:
+        value = tomllib.loads("value = " + selected)["value"]
+    except ValueError:
+        value = selected  # Codex treats invalid TOML as a literal string.
+    if not isinstance(value, str) or not value.strip():
+        raise ValueError(f"{name} config must be a non-empty string")
+    return value
 
 
+def _codex_subcommand(argv: list[str]) -> str | None:
+    takes_value = {"-c", "--config", "-m", "--model", "-p", "--profile", "-C", "--cd",
+                   "-s", "--sandbox", "-a", "--ask-for-approval", "-i", "--image",
+                   "--enable", "--disable", "--add-dir", "--local-provider"}
+    tokens = iter(argv[1:])
+    for token in tokens:
+        if token == "--":
+            return None
+        if token in takes_value:
+            next(tokens, None)
+        elif not token.startswith("-"):
+            return token
+    return None
+
 def read_selector(argv: list[str]) -> Selector | None:
     """(vendor, model, effort) when argv launches a vendor CLI, otherwise None."""
     if not argv:
@@ -77,7 +134,14 @@ def read_selector(argv: list[str]) -> Selector | None:
     if vendor == "claude":
         return vendor, _flag(rest, "--model"), _flag(rest, "--effort")
     if vendor == "codex":
-        return vendor, _flag(rest, "-m", "--model"), _codex_effort(rest)
+        if _codex_subcommand(argv) == "app-server":
+            return vendor, None, None
+        model = _flag(rest, "-m", "--model")
+        if model is None:
+            model = _codex_config(rest, "model")
+        if model is None:
+            return vendor, None, None
+        return vendor, model, _codex_config(rest, "model_reasoning_effort")
     if vendor == "grok":
         return vendor, _flag(rest, "-m", "--model"), _flag(rest, "--reasoning-effort")
     if vendor == "gemini":
@@ -120,6 +184,61 @@ def resolve(registry: dict, vendor: str, model: str | None,
     return None, f"no scored configuration for {vendor} {model} at effort {effort}"
 
 
+def _thread_environment(entries: list[bytes]) -> dict[str, str]:
+    values = [entry.partition(b"=")[2] for entry in entries
+              if entry.partition(b"=")[0] == b"CODEX_THREAD_ID"]
+    if len(values) > 1:
+        raise ValueError("duplicate CODEX_THREAD_ID in initial environment")
+    return {"CODEX_THREAD_ID": values[0].decode(errors="replace")} if values else {}
+
+
+def _parse_procargs2(data: bytes) -> tuple[list[str], dict[str, str]]:
+    if len(data) < 4:
+        raise ValueError("truncated KERN_PROCARGS2 header")
+    argc = struct.unpack_from("=i", data)[0]
+    offset = data.find(b"\0", 4)
+    if argc <= 0 or offset < 0:
+        raise ValueError("invalid KERN_PROCARGS2 header")
+    while offset < len(data) and data[offset] == 0:
+        offset += 1
+    argv = []
+    for _ in range(argc):
+        end = data.find(b"\0", offset)
+        if end < 0:
+            raise ValueError("truncated KERN_PROCARGS2 argv")
+        argv.append(data[offset:end].decode(errors="replace"))
+        offset = end + 1
+    # argc, not a KEY=value search, separates argv from the initial environment.
+    entries = []
+    while offset < len(data) and data[offset] != 0:
+        end = data.find(b"\0", offset)
+        if end < 0:
+            raise ValueError("truncated KERN_PROCARGS2 environment")
+        entries.append(data[offset:end])
+        offset = end + 1
+    return argv, _thread_environment(entries)
+
+
+def _darwin_procargs(pid: int) -> tuple[list[str], dict[str, str]]:
+    libc = ctypes.CDLL(None, use_errno=True)
+    argmax = ctypes.c_int()
+    size = ctypes.c_size_t(ctypes.sizeof(argmax))
+    if libc.sysctlbyname(b"kern.argmax", ctypes.byref(argmax), ctypes.byref(size), None, 0):
+        raise OSError(ctypes.get_errno(), "cannot read kern.argmax")
+    buffer = ctypes.create_string_buffer(argmax.value)
+    size = ctypes.c_size_t(len(buffer))
+    mib = (ctypes.c_int * 3)(1, 49, pid)  # CTL_KERN, KERN_PROCARGS2.
+    if libc.sysctl(mib, 3, buffer, ctypes.byref(size), None, 0):
+        raise OSError(ctypes.get_errno(), "cannot read KERN_PROCARGS2")
+    return _parse_procargs2(buffer.raw[:size.value])
+
+
+def _initial_environment(pid: int) -> dict[str, str]:
+    if sys.platform == "darwin":
+        return _darwin_procargs(pid)[1]
+    return _thread_environment(Path(f"/proc/{pid}/environ").read_bytes().split(b"\0"))
+
+
 def _process(pid: int) -> tuple[int, list[str]] | None:
     """(ppid, argv) for pid. /proc keeps argv exact; ps joins it with spaces, so
     argv[0] comes from `comm`, which keeps a path like `Application Support` whole."""
@@ -133,26 +252,34 @@ def _process(pid: int) -> tuple[int, list[str]] | None:
             return None
         return ppid, argv
     try:
-        head = subprocess.run(["ps", "-o", "ppid=", "-o", "comm=", "-p", str(pid)],
-                              capture_output=True, text=True, timeout=5).stdout.strip()
-        args = subprocess.run(["ps", "-o", "args=", "-p", str(pid)],
-                              capture_output=True, text=True, timeout=5).stdout.strip()
+        head_result = subprocess.run(
+            ["ps", "-o", "ppid=", "-o", "comm=", "-p", str(pid)],
+            capture_output=True, text=True, timeout=5)
+        args_result = subprocess.run(
+            ["ps", "-o", "args=", "-p", str(pid)],
+            capture_output=True, text=True, timeout=5)
     except (OSError, subprocess.SubprocessError):
-        return None
+        raise _ProcessQueryUnavailable from None
+    head = head_result.stdout.strip()
+    args = args_result.stdout.strip()
     parts = head.split(None, 1)
     if len(parts) != 2 or not parts[0].isdigit():
         return None
     comm = parts[1].strip()
+    if sys.platform == "darwin" and _vendor(comm) == "codex":
+        argv, _ = _darwin_procargs(pid)
+        return int(parts[0]), argv
     rest = args[len(comm):] if args.startswith(comm) else args.partition(" ")[2]
     return int(parts[0]), [comm, *rest.split()]
 
 
-def find_launcher(pid: int, lookup: Lookup = _process) -> tuple[int, Selector] | None:
+def _launcher(pid: int, lookup: Lookup) -> tuple[int, Selector, int | None] | None:
     """The nearest process at or above pid that is a vendor CLI, with its selector.
 
     Nearest wins: a codex worker started by a Claude session is a codex caller.
     """
     seen: set[int] = set()
+    child = None
     for _ in range(MAX_DEPTH):
         if pid <= 0 or pid in seen:
             return None
@@ -163,11 +290,165 @@ def find_launcher(pid: int, lookup: Lookup = _process) -> tuple[int, Selector] |
         ppid, argv = entry
         selector = read_selector(argv)
         if selector is not None:
-            return pid, selector
+            return pid, selector, child
+        child = pid
         pid = ppid
     return None
 
 
+def find_launcher(pid: int, lookup: Lookup = _process) -> tuple[int, Selector] | None:
+    try:
+        found = _launcher(pid, lookup)
+    except _ProcessQueryUnavailable:
+        return None
+    return found[:2] if found else None
+
+
+def _rollout_age_hint(timestamp: object, now: Callable[[], datetime] | None) -> str:
+    """Describe the last record without letting unusable time data change a refusal."""
+    if not isinstance(timestamp, str):
+        return ""
+    try:
+        recorded = datetime.fromisoformat(timestamp[:-1] + "+00:00" if timestamp.endswith("Z") else timestamp)
+        current = now() if now is not None else datetime.now(timezone.utc)
+        if recorded.tzinfo is None or current.tzinfo is None:
+            return ""
+        seconds = (current - recorded).total_seconds()
+    except (AttributeError, TypeError, ValueError, OverflowError):
+        return ""
+    if seconds < 0:
+        return ""
+    # Floor display units; compare the unrounded duration against the hint threshold.
+    if seconds < 3600:
+        age = f"{int(seconds // 60)}m"
+    elif seconds < 86400:
+        age = f"{int(seconds // 3600)}h"
+    else:
+        age = f"{int(seconds // 86400)}d"
+    hint = f"; that rollout's last record is {timestamp}, {age} before now"
+    if seconds > 600:
+        hint += ", so CODEX_THREAD_ID may name an earlier conversation than the one running this command"
+    return hint
+
+
+def _rollout_candidates(home: Path, thread: str) -> list[Path]:
+    """Resuming a thread opens a second rollout named <thread>_<session>, so match both forms."""
+    sessions = home / "sessions"
+    found = set(sessions.glob(f"*/*/*/rollout-*-{thread}.jsonl"))
+    found |= set(sessions.glob(f"*/*/*/rollout-*-{thread}_*.jsonl"))
+    return sorted(found, key=lambda path: (path.stat().st_mtime, path.name))
+
+
+def _rollout_selector(thread: str,
+                      current_environment: Mapping[str, str] = os.environ,
+                      now: Callable[[], datetime] | None = None) -> tuple[Selector, str]:
+    home = Path(current_environment.get("CODEX_HOME") or Path.home() / ".codex")
+    try:
+        paths = _rollout_candidates(home, thread)
+    except OSError as error:
+        raise ValueError(f"cannot read rollout (errno {error.errno})") from None
+    if not paths:
+        raise ValueError("expected an active rollout for this thread; found 0")
+    # The most recently written file is the live one; older files belong to earlier sessions.
+    path = paths[-1]
+    metadata = 0
+    latest = None
+    ended = None
+    last_timestamp = None
+    try:
+        with path.open(encoding="utf-8") as stream:
+            for line in stream:
+                record = json.loads(line)
+                if not isinstance(record, dict):
+                    raise ValueError("invalid rollout record")
+                last_timestamp = record.get("timestamp")
+                kind = record.get("type")
+                if kind not in ("session_meta", "turn_context", "event_msg"):
+                    continue
+                payload = record.get("payload")
+                if not isinstance(payload, dict):
+                    raise ValueError("invalid rollout payload")
+                if kind == "session_meta":
+                    metadata += 1
+                    if payload.get("id") != thread:
+                        raise ValueError("session_meta id does not match CODEX_THREAD_ID")
+                elif kind == "turn_context":
+                    latest = {key: payload.get(key) for key in ("turn_id", "model", "effort")}
+                    ended = None
+                elif kind == "event_msg":
+                    event = payload.get("type")
+                    if not isinstance(event, str):
+                        raise ValueError("invalid rollout event type")
+                    if latest is not None and event in TURN_END_EVENTS:
+                        event_turn = payload.get("turn_id")
+                        if not isinstance(event_turn, str) or not event_turn.strip():
+                            event_turn = None
+                        context_turn = latest["turn_id"]
+                        if not isinstance(context_turn, str) or not context_turn.strip():
+                            context_turn = None
+                        if event_turn is None or context_turn is None or event_turn == context_turn:
+                            ended = (event, context_turn or "unknown", event_turn or "unknown")
+    except (json.JSONDecodeError, UnicodeError):
+        raise ValueError("rollout contains incomplete or invalid JSON") from None
+    except OSError as error:
+        raise ValueError(f"cannot read rollout (errno {error.errno})") from None
+    if metadata != 1:
+        raise ValueError("expected exactly one matching session_meta")
+    if latest is None:
+        raise ValueError("rollout has no turn_context")
+    if ended:
+        event, context_turn, event_turn = ended
+        raise ValueError(f"latest turn_context turn {context_turn} has already ended "
+                         f"({event}, turn {event_turn})" + _rollout_age_hint(last_timestamp, now))
+    for key, value in latest.items():
+        if not isinstance(value, str) or not value.strip():
+            detail = " (turn unknown)" if key == "turn_id" else ""
+            raise ValueError(f"latest turn_context {key} must be a non-empty string{detail}")
+    return ("codex", latest["model"], latest["effort"]), f"thread {thread}, turn {latest['turn_id']}"
+
+
+def read_caller(pid: int, lookup: Lookup = _process,
+                environment: EnvironmentLookup = _initial_environment,
+                current_environment: Mapping[str, str] = os.environ,
+                now: Callable[[], datetime] | None = None) -> tuple[int, Selector, str]:
+    if current_environment.get("OMNILANE_AA_CALLER_FROM_PROCESS") == "0":
+        raise ValueError("caller identity from process is disabled")
+    try:
+        found = _launcher(pid, lookup)
+    except _ProcessQueryUnavailable:
+        if current_environment.get("CODEX_SANDBOX") == "seatbelt":
+            raise ValueError(CODEX_SANDBOX_REFUSAL) from None
+        found = None
+    except OSError as error:
+        if current_environment.get("CODEX_SANDBOX") == "seatbelt":
+            raise ValueError(CODEX_SANDBOX_REFUSAL) from None
+        raise ValueError(f"cannot query caller process (errno {error.errno})") from None
+    if found is None:
+        if current_environment.get("CODEX_SANDBOX") == "seatbelt":
+            raise ValueError(CODEX_SANDBOX_REFUSAL)
+        raise ValueError("no vendor CLI among this process's ancestors; a model caller passes "
+                         "--caller-context FILE and a human operator --operator-asserted-human")
+    launcher, selector, child = found
+    if selector[0] != "codex" or selector[1] is not None:
+        return launcher, selector, ""
+    thread = current_environment.get("CODEX_THREAD_ID")
+    if not thread or not UUID_PATTERN.fullmatch(thread):
+        raise ValueError("current process CODEX_THREAD_ID is missing or not a UUID")
+    if child is None:
+        raise ValueError("cannot find the codex direct child in the ancestor chain")
+    try:
+        inherited = environment(child).get("CODEX_THREAD_ID")
+    except (OSError, ValueError) as error:
+        detail = f"errno {error.errno}" if isinstance(error, OSError) else "invalid environment block"
+        raise ValueError(f"cannot read codex direct child initial environment ({detail})") from None
+    if not inherited or not UUID_PATTERN.fullmatch(inherited):
+        raise ValueError("codex direct child CODEX_THREAD_ID is missing or not a UUID")
+    if inherited != thread:
+        raise ValueError("CODEX_THREAD_ID mismatch between current process and codex direct child")
+    selector, source = _rollout_selector(thread, current_environment, now)
+    return launcher, selector, source
+
+
 def load_registry(path: str | Path) -> tuple[dict, str]:
     """The approved registry without the transport overlay, which says nothing
     about the caller and must not stop one from learning who it is."""
@@ -203,7 +484,9 @@ def write_context(row: dict, registry: dict, home: Path) -> Path:
     return path
 
 
-def main(argv: list[str] | None = None) -> int:
+def main(argv: list[str] | None = None, environment: Mapping[str, str] = os.environ,
+         lookup: Lookup = _process,
+         process_environment: EnvironmentLookup = _initial_environment) -> int:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     parser.add_argument("--registry",
                         default=os.environ.get("OMNILANE_AA_POLICY_FILE")
@@ -215,20 +498,20 @@ def main(argv: list[str] | None = None) -> int:
     except (aa_policy.PolicyError, OSError, ValueError) as error:
         print(f"omnilane: cannot read the AA registry: {error}", file=sys.stderr)
         return 3
-    found = find_launcher(os.getpid())
-    if found is None:
-        print("omnilane: no vendor CLI among this process's ancestors; a model caller passes "
-              "--caller-context FILE and a human operator --operator-asserted-human",
-              file=sys.stderr)
+    try:
+        pid, (vendor, model, effort), source = read_caller(
+            os.getpid(), lookup, process_environment, environment)
+    except ValueError as error:
+        print(f"omnilane: cannot read the caller identity: {error}", file=sys.stderr)
         return 3
-    pid, (vendor, model, effort) = found
     row, reason = resolve(registry, vendor, model, effort)
     if row is None:
         print(f"omnilane: cannot read the caller identity from pid {pid}: {reason}", file=sys.stderr)
         return 3
     home = Path(os.environ.get("OMNILANE_HOME") or Path.home() / ".omnilane")
     path = write_context(row, registry, home)
-    print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}",
+    provenance = f", {source}" if source else ""
+    print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}{provenance}",
           file=sys.stderr)
     print(path)
     return 0

package/scripts/runners/run-codex.sh

@@ -142,7 +142,13 @@ if [[ "$RC" -eq 142 || "$RC" -eq 124 ]]; then
     thread_id="$(head -1 "${OUTPUT_FILE}.progress.log" 2>/dev/null |
       sed -n 's/.*"thread_id":"\([^"]*\)".*/\1/p')"
     if [[ -n "$thread_id" ]]; then
-      rollout="$(find "${CODEX_HOME:-$HOME/.codex}/sessions" -name "rollout-*-${thread_id}.jsonl" 2>/dev/null | head -1)"
+      # A resumed thread writes rollout-*-<thread>_<session>.jsonl, so match both names and keep the newest.
+      rollout=""
+      while IFS= read -r candidate; do
+        [[ -z "$candidate" ]] && continue
+        if [[ -z "$rollout" || "$candidate" -nt "$rollout" ]]; then rollout="$candidate"; fi
+      done < <(find "${CODEX_HOME:-$HOME/.codex}/sessions" \
+        \( -name "rollout-*-${thread_id}.jsonl" -o -name "rollout-*-${thread_id}_*.jsonl" \) 2>/dev/null)
       echo "omnilane: rollout: ${rollout:-not found (thread ${thread_id})}"
     else
       echo "omnilane: rollout: unknown — no thread_id in the progress log, so codex died before its first event"

package/skills/omnilane/SKILL.md

@@ -19,13 +19,14 @@ You (the main loop) may be Claude, GPT, Grok, or Gemini. The procedure is identi
    Read-only work uses advise; edits require `--mode work --workdir <repo>`.
    `<repo>/scripts/dispatch.sh --caller-context FILE [--executor auto|native|cli] [--native-context FILE] [--vendor V] [--mode work] [--workdir DIR] <lane> "<task>"`
 
-   A model caller needs a caller identity. Dispatch reads it from the CLI that
-   launched you when that CLI names its model and effort, so an ordinary session
-   passes nothing. When it cannot, dispatch is refused with
-   `missing-caller-context` before a job exists: run `omnilane whoami` (or
-   `<repo>/bin/omnilane whoami`) and pass the file it prints as
-   `--caller-context`. See **Frozen exact-AA downward gate** for the schema and
-   what to do when your effort is genuinely unverifiable.
+   A model caller needs a verifiable caller identity. Codex app-server reads the
+   current turn from its rollout; other launches read the model and effort from
+   the CLI that launched you, so an ordinary session passes nothing. When that
+   identity cannot be read, dispatch is refused with `missing-caller-context`
+   before a job exists: run `omnilane whoami` (or `<repo>/bin/omnilane whoami`)
+   and pass the file it prints as `--caller-context`. See **Frozen exact-AA
+   downward gate** for the schema and what to do when effort is genuinely
+   unverifiable.
 
    Add `--background` for long tasks; poll with `scripts/jobs.sh status|result <id>`.
    Use `--thread NAME` when later claude, codex, grok or gemini dispatches
@@ -358,21 +359,35 @@ and `snapshot_id` must equal the registry's own `snapshot.id`.
 Set `inherited_ceiling` to your own row's score when you are the root caller, or
 to the ceiling you were handed when you are a child.
 
-**Your identity is read from the CLI that launched you.** When no
-`--caller-context` is given, dispatch walks up the process tree to the nearest
-vendor CLI and reads the selector it was started with: `--model` / `--effort`
-for claude, `-m` and `-c model_reasoning_effort` for codex, `--reasoning-effort`
-for grok, the effort-encoded model id for agy. `omnilane whoami` runs the same
-walk and prints the resulting caller-context file, for a retry or to see what
-you will be held to. Nearest wins, so a codex worker started by a Claude session
-is a codex caller, and another session of the same CLI elsewhere on the host is
-never consulted. It does not guess: a missing flag, a model alias, or a Claude
-effort whose only scored row is non-reasoning is refused with the reason. This
-is request-selector evidence, the same class the transport overlay carries; it
-does not certify upstream identity, but unlike a hand-written file the model
-cannot edit it. An explicit `--caller-context` or `--operator-asserted-human`
-still wins, and `OMNILANE_AA_CALLER_FROM_PROCESS=0` restores the file-only
-contract.
+**Your identity is read from the CLI that launched you.** Without explicit or
+inherited caller-context, dispatch finds the nearest vendor CLI. Claude, Grok
+and Agy retain their launch selectors. Codex outside app-server retains explicit
+`-m` / `--model` or `-c model=...` / `--config` selectors; TOML model overrides
+require Python 3.11+. A profile is not an explicit model selector.
+
+Codex app-server always ignores startup selectors, even explicit model flags;
+other Codex launches without a model use the same current-turn rollout reader.
+It requires matching UUID-shaped `CODEX_THREAD_ID` values in this process and the
+codex direct child's initial environment (not text embedded in argv). Exactly
+one active rollout under `$CODEX_HOME/sessions` (default `~/.codex`) must have
+matching `session_meta.id`. The last `turn_context` must provide non-empty model,
+effort and turn id, with no later `task_complete`, `turn_complete` or
+`turn_aborted` event.
+Missing, ambiguous, malformed or stale evidence refuses: no config defaults,
+model-list, archive or other-thread fallback. JSONL is streamed; only identity
+metadata and event types reach diagnostics, never message content.
+
+`omnilane whoami` prints the resulting caller-context path and reports thread
+and turn ids for rollout evidence. The existing scored-row resolver still makes
+the decision; this is host request-selector evidence, not proof of upstream
+provider identity. Nearest wins, including workers launched by another vendor.
+Explicit `--caller-context`, inherited identity and `--operator-asserted-human`
+retain their precedence; `OMNILANE_AA_CALLER_FROM_PROCESS=0` disables both readers.
+
+Ancestor lookup still runs first. If it fails under `CODEX_SANDBOX=seatbelt`,
+`whoami` explains that process inspection, `~/.omnilane` writes and networking
+require rerunning the command outside the Codex sandbox; do not retry with a
+caller-context inside that sandbox.
 
 Only when `omnilane whoami` refuses: ask the operator, or declare the
 lowest-scoring row of your model and say so in your report. Understating only