tickmarkr 1.61.0 → 1.63.0

package/dist/cli/commands/status.js

@@ -103,14 +103,27 @@ const daemonPid = (events) => {
     }
     return undefined;
 };
+const terminalFailureCause = (events) => {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event !== "run-end" || typeof e.data.error !== "string")
+            continue;
+        const phase = typeof e.data.phase === "string" && e.data.phase.trim()
+            ? `${e.data.phase.trim()} failed`
+            : "run failed";
+        return `${phase}: ${e.data.error.replace(/\s+/g, " ").trim()}`;
+    }
+    return undefined;
+};
 const liveness = (events) => {
     const last = events.at(-1);
     if (!last)
         return "last event unknown · daemon pid unknown";
     const age = fmtAge(Date.now() - Date.parse(last.ts));
     const pid = daemonPid(events);
+    const cause = terminalFailureCause(events);
     if (pid === undefined)
-        return `last event ${age} ago · daemon pid unknown`;
+        return `last event ${age} ago · daemon pid unknown${cause ? ` · ${cause}` : ""}`;
     // a dead pid after run-end is a clean exit, not a crash — "dead" is only alarming (red) while
     // the run is still incomplete (operator's crash indicator)
     const ended = events.some((e) => e.event === "run-end");
@@ -122,7 +135,7 @@ const liveness = (events) => {
     catch (k) {
         state = k.code === "ESRCH" ? (ended ? "finished" : "dead") : "alive";
     } // EPERM ⇒ alive
-    return `last event ${age} ago · daemon pid ${pid} ${state}`;
+    return `last event ${age} ago · daemon pid ${pid} ${state}${cause ? ` · ${cause}` : ""}`;
 };
 const renderFrame = (cwd) => {
     const g = loadGraph(cwd);

package/dist/compile/native.js

@@ -21,6 +21,10 @@ export function compileNative(file) {
     if (!existsSync(file))
         throw new CompileError(`no such native spec file: ${file}`);
     const content = readFileSync(file, "utf8");
+    // Exact shared-template check: init writes specTemplate(), and any edit changes the body.
+    if (content === specTemplate()) {
+        throw new CompileError(`${file} is the unedited tickmarkr init scaffold. Edit ${file} before compiling.`);
+    }
     const drafts = [];
     let plainCount = 0; // v1.19: plain-string acceptance items compiled as judge oracles (compat) — warn once
     let specMode;
@@ -118,24 +122,89 @@ export function compileNative(file) {
         throw new CompileError(`acceptance criteria are required on every task. Missing on: ${missing.join(", ")}.\n` +
             `Add to each section in ${file}:\n- acceptance:\n  - <observable outcome>`);
     }
-    const csv = (value) => (value && value.toLowerCase() !== "none" ? value.split(",").map((item) => item.trim()).filter(Boolean) : []);
+    // v1.62 (OBS-97): commas inside {a,b} alternatives are part of one glob entry, not separators —
+    // split only at brace depth 0 so a brace glob reaches the lint (and the scope gate) intact.
+    const splitTop = (value) => {
+        const parts = [];
+        let depth = 0;
+        let current = "";
+        for (const ch of value) {
+            if (ch === "," && depth === 0) {
+                parts.push(current);
+                current = "";
+                continue;
+            }
+            if (ch === "{")
+                depth++;
+            else if (ch === "}" && depth > 0)
+                depth--;
+            current += ch;
+        }
+        return [...parts, current];
+    };
+    const csv = (value) => (value && value.toLowerCase() !== "none" ? splitTop(value).map((item) => item.trim()).filter(Boolean) : []);
     // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
     // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
     // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
     // consult diagnosed exactly this. Empty files[] stays exempt: no file scope means unrestricted
     // (src/gates/scope.ts). An entry hosts a collectable path iff its glob can produce one — probed by
-    // substituting each wildcard run with a test-shaped segment (also covers literal test-file paths).
+    // substituting each wildcard run with a test-shaped segment (also covers literal test-file paths);
+    // v1.62 extends the probe to {a,b} brace alternatives and ? single-character wildcards.
     const collectable = picomatch(COLLECTABLE_TESTS, { dot: true });
     // Single-token substitution is not a true glob-overlap test (tests/**/*.ts needs "probe.test",
     // a bare ** needs the whole collectable path) — probe with several test-shaped tokens and accept
     // if ANY candidate satisfies both globs. Scopes that truly cannot host one still fail every probe.
     const PROBE_TOKENS = ["probe.test.ts", "probe.test", "tests/probe.test.ts"];
+    // v1.62: {a,b} alternatives expand to concrete branches before probing (innermost group first, so
+    // nesting resolves); an unbalanced brace is literal to picomatch and stays unexpanded. Expansion is
+    // BOUNDED: past BRANCH_CAP branches, further alternatives are dropped — dropping candidates can only
+    // reject, never accept (every accept needs a concrete witness), so the cap stays fail-closed while a
+    // pathological {a,b}{a,b}… entry can no longer balloon compile time.
+    const BRANCH_CAP = 64;
+    const expandBraces = (glob) => {
+        let branches = [glob];
+        for (;;) {
+            let changed = false;
+            const next = [];
+            for (const branch of branches) {
+                const inner = branch.match(/\{([^{}]*)\}/);
+                if (!inner) {
+                    next.push(branch);
+                    continue;
+                }
+                changed = true;
+                for (const alt of inner[1].split(","))
+                    next.push(branch.replace(inner[0], alt));
+            }
+            branches = next.slice(0, BRANCH_CAP);
+            if (!changed)
+                return branches;
+        }
+    };
+    // v1.62: a ? never blocks self-match (it matches any one char), so hosting hinges on the probe
+    // clearing the collectable literals — search ? positions over that alphabet PER POSITION (a mixed
+    // scope like test?/unit.tes?.ts needs different chars at each ?). Every accepted probe is a concrete
+    // path satisfying BOTH globs (a witness), so expansion and substitution can only lift false
+    // rejections — a scope with no witness still fails every probe. Bounded: entries with more than
+    // QMARK_CAP ?s stay fail-closed (4^4 = 256 candidates is the ceiling per probe).
+    const QMARK_CHARS = ["t", "e", "s", "."];
+    const QMARK_CAP = 4;
+    const qmarkVariants = (probe) => {
+        const qCount = (probe.match(/\?/g) ?? []).length;
+        if (qCount === 0 || qCount > QMARK_CAP)
+            return [probe];
+        let variants = [probe];
+        for (let i = 0; i < qCount; i++) {
+            variants = variants.flatMap((v) => QMARK_CHARS.map((ch) => v.replace("?", ch)));
+        }
+        return [probe, ...variants];
+    };
     const canHostTest = (entry) => {
         const self = picomatch(entry, { dot: true });
-        return PROBE_TOKENS.some((token) => {
-            const probe = entry.replace(/\*+/g, token);
-            return self(probe) && collectable(probe);
-        });
+        return expandBraces(entry)
+            .flatMap((branch) => PROBE_TOKENS.map((token) => branch.replace(/\*+/g, token)))
+            .flatMap(qmarkVariants)
+            .some((probe) => self(probe) && collectable(probe));
     };
     const homeless = drafts
         .filter((draft) => {

package/dist/drivers/herdr.d.ts

@@ -1,6 +1,7 @@
 import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
+export declare const DELIVERY_ATTEMPTS = 3;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
 export declare class HerdrDriver implements ExecutorDriver {

package/dist/drivers/herdr.js

@@ -6,6 +6,10 @@ import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName }
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
 export const TRAILER_SAFE_FLOOR_COLS = 108;
 export const TRAILER_WIDTH_MARGIN = 2; // cols below (floor + margin) refuse a rightward first split
+// OBS-85 verified delivery: bounded type→read-back→enter attempts before failing closed.
+export const DELIVERY_ATTEMPTS = 3;
+const DELIVERY_VERIFY_TIMEOUT_MS = 2000; // per attempt — a paste that hasn't rendered in 2s is retyped
+const DELIVERY_READ_LINES = 80;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_COLS, margin = TRAILER_WIDTH_MARGIN) {
     if (paneCols == null || paneCols <= 0)
@@ -273,11 +277,41 @@ export class HerdrDriver {
         await this.renameGroupTab(entry);
         return { id: pane, name, cwd, tabId: entry.tabId, group };
     }
+    // OBS-85 verified delivery: a pane paste can interleave a long dispatch line with itself (codex
+    // `$(git rev-parse…)` mashed into its trailing printf — v1.58 T2 attempts 2-4, v1.61 T10). Never
+    // the atomic `pane run` (text+Enter in one request, uninspectable between the two): type WITHOUT
+    // enter, read the pane back — `wait output --match` checks the same unwrapped transcript pane
+    // read exposes, event-driven so wrap and render timing can't race the check — and press Enter
+    // only when that read-back contains the typed command. A corrupted paste is captured (pane read),
+    // cleared (C-u), and retyped, bounded; persistent corruption fails closed WITH the captured
+    // transcript — the dispatch-time pincer the ledger asks for, not post-hoc `git:` archaeology.
     async run(slot, cmd) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`pane run ${shq(pane)} ${shq(cmd)}`, slot.cwd);
-        if (r.code !== 0)
-            throw new Error(`herdr pane run failed: ${r.stderr || r.stdout}`);
+        let transcript = "";
+        for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
+            if (attempt > 0) {
+                // clear the corrupted input line before retyping; a failed clear must NOT be retyped onto —
+                // corrupt-prefix + clean-retype would concatenate and false-verify by containment
+                const cleared = await this.herdr(`pane send-keys ${shq(pane)} C-u`, slot.cwd);
+                if (cleared.code !== 0)
+                    throw new Error(`herdr delivery clear failed — refusing to retype onto a corrupted line (OBS-85); pane transcript:\n${transcript}`);
+            }
+            const typed = await this.herdr(`pane send-text ${shq(pane)} ${shq(cmd)}`, slot.cwd);
+            if (typed.code !== 0)
+                throw new Error(`herdr pane send-text failed: ${typed.stderr || typed.stdout}`);
+            const back = await this.herdr(`wait output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
+            // ponytail: transcript containment (scrollback included); anchor to the prompt line if a
+            // prior echo of the same command ever false-verifies. Dead pane → error envelope → unverified.
+            if (this.waitOk(back.code, back.stdout)) {
+                const enter = await this.herdr(`pane send-keys ${shq(pane)} Enter`, slot.cwd);
+                if (enter.code !== 0)
+                    throw new Error(`herdr pane send-keys Enter failed: ${enter.stderr || enter.stdout}`);
+                return;
+            }
+            // capture the corrupted delivery BEFORE clearing it — the OBS-85 byte-level evidence
+            transcript = (await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, slot.cwd)).stdout;
+        }
+        throw new Error(`herdr delivery corrupted after ${DELIVERY_ATTEMPTS} attempts — enter never pressed (OBS-85); pane transcript:\n${transcript}`);
     }
     waitOk(code, stdout) {
         if (code !== 0 || !stdout.trim())

package/dist/gates/baseline.d.ts

@@ -4,7 +4,14 @@ export interface Baseline {
     commands: Record<string, {
         exitCode: number;
         fingerprints: string[];
+        missingCommand?: boolean;
     }>;
+    warnings?: BaselineWarning[];
+}
+export interface BaselineWarning {
+    kind: "wrong-environment";
+    commands: string[];
+    reason: string;
 }
 export declare function fingerprint(output: string): string[];
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;

package/dist/gates/baseline.js

@@ -41,12 +41,45 @@ export function detectGateCommands(repoRoot, cfg) {
     }
     return out;
 }
+const shellToken = (cmd) => {
+    for (const raw of cmd.trim().split(/\s+/)) {
+        if (!raw || /^[A-Za-z_][A-Za-z0-9_]*=/.test(raw))
+            continue;
+        if (raw === "env")
+            continue;
+        return raw.replace(/^['"]|['"]$/g, "");
+    }
+    return undefined;
+};
+const reEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function missingConfiguredCommand(cmd, result) {
+    if (result.code !== 127)
+        return false;
+    const token = shellToken(cmd);
+    if (!token)
+        return false;
+    const output = `${result.stdout}\n${result.stderr}`;
+    return new RegExp(`(?:^|[:\\s])${reEscape(token)}:\\s+(?:command not found|No such file or directory)`, "i").test(output);
+}
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
         const r = await sh(cmd, cwd);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
-        base.commands[name] = { exitCode: r.code, fingerprints: fingerprint((r.stdout + "\n" + r.stderr).split(cwd).join("")) };
+        base.commands[name] = {
+            exitCode: r.code,
+            fingerprints: fingerprint((r.stdout + "\n" + r.stderr).split(cwd).join("")),
+            missingCommand: missingConfiguredCommand(cmd, r),
+        };
+    }
+    const names = Object.keys(commands);
+    const missing = names.filter((name) => base.commands[name]?.missingCommand === true);
+    if (names.length > 0 && missing.length === names.length) {
+        base.warnings = [{
+                kind: "wrong-environment",
+                commands: missing,
+                reason: `wrong environment: every configured baseline command was missing (${missing.join(", ")})`,
+            }];
     }
     return base;
 }

package/dist/run/daemon.js

@@ -7,7 +7,7 @@ import { stringify } from "yaml";
 import { trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
 import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
-import { bannerShell } from "../brand.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
@@ -109,6 +109,10 @@ export async function runDaemon(repoRoot, opts = {}) {
     // v1.54 T2: declared before the try so the finally can always deregister (a throw before
     // registration leaves it undefined — the guard below covers that path).
     let onTermination;
+    let journal;
+    let runStarted = false;
+    let taskLoopStarted = false;
+    let branch = "";
     try {
         let graph = loadGraph(repoRoot);
         // v1.51 T2: the routing mode resolves BEFORE any routing input is built — run flag > spec front-matter
@@ -184,12 +188,12 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         process.on("SIGINT", onTermination);
         process.on("SIGTERM", onTermination);
-        const journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
+        journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
         const branchEvent = opts.resume
             ? [...journal.read()].reverse().find((e) => (e.event === "run-start" || e.event === "run-end" || e.event === "merge") && typeof e.data.branch === "string")
             : undefined;
         const recordedBranch = typeof branchEvent?.data.branch === "string" ? branchEvent.data.branch : undefined;
-        const branch = recordedBranch
+        branch = recordedBranch
             ? branchEvent.event === "merge" ? recordedBranch.slice(0, recordedBranch.lastIndexOf("--")) : recordedBranch
             : integrationBranch(cfg, runId);
         if (lock.reclaimed)
@@ -249,9 +253,12 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
             journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source, ...(prior ? { supersedes: prior.runId } : {}) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2; supersedes: v1.53 T5
+            runStarted = true;
             // v1.53 T5: mark the prior run AFTER this run's run-start exists, so the prior journal never
             // names a successor that has no journal. Append-only — the prior journal is never rewritten.
             prior?.append("superseded", undefined, { by: runId });
+            for (const warning of baseline.warnings ?? [])
+                journal.append("baseline-warning", undefined, { ...warning });
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
@@ -575,6 +582,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.append("worker-mode-fallback", t.id, { reason: driver.interactive ? "adapter" : "driver" });
                 }
                 const interactive = icmd !== null;
+                // OBS-85 (v1.62 T1): both dispatch branches deliver ONE short script invocation — banner,
+                // adapter command, and nonce exit marker live in a per-attempt script beside the prompt
+                // artifact (the same paneDispatchCommand pattern judge/review/consult dispatches use). The
+                // delivered pane line carries no command substitution and no trailing shell text, so paste
+                // timing can never interleave a `$(…)` with what follows it (the codex corruption class).
+                const workerCmd = interactive ? icmd : adapter.invoke(t, wt, assignment, { promptFile }).command;
+                const dispatchScript = promptFile.replace(/\.md$/, ".sh");
+                writeFileSync(dispatchScript, [
+                    "export BASH_SILENCE_DEPRECATION_WARNING=1",
+                    bannerShell(),
+                    workerCmd,
+                    exitMarkerCmd,
+                ].join("\n"));
                 // SPEND-01: this attempt's dispatch wall-clock — the usage collect cursor. Captured once here, the
                 // single site, so a test can reason about it; keep Date.now() out of profile.ts (still pure) and
                 // out of adapter module scope (the cursor is a parameter, threaded from the daemon).
@@ -617,9 +637,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (interactive) {
                     // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
                     // The exit wrapper still fires if the TUI dies (crash/quit): fast-fail instead of burning the timeout.
-                    // T5: the pane announces itself first — same brand header (logo + dim identity) as the
-                    // judge/review/consult dispatch scripts; one printf one-liner, dispatch mechanics unchanged.
-                    await driver.run(slot, `${bannerShell()}; ${icmd}; ${exitMarkerCmd}`);
+                    await driver.run(slot, paneDispatchCommand(dispatchScript));
                     let paged = false;
                     // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
                     // Any other blocked/idle dialog still pages the operator (paged latch below).
@@ -708,9 +726,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 else {
-                    const inv = adapter.invoke(t, wt, assignment, { promptFile });
-                    // T5: same brand header as the interactive path and the gate/consult dispatch scripts.
-                    await driver.run(slot, `${bannerShell()}; ${inv.command}; ${exitMarkerCmd}`);
+                    await driver.run(slot, paneDispatchCommand(dispatchScript));
                     // OBS-54: headless workers have the same output-inactivity budget as visible panes.
                     // OBS-82: same normalized-snapshot compare as the interactive site — spinner-only repaints
                     // exhaust the budget here too; harvest below still reads the raw pane.
@@ -970,6 +986,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 return;
             }
         };
+        taskLoopStarted = true;
         const inflight = new Map();
         while (true) {
             // v1.54 T2: a signal that landed while nothing was racing `aborted` (empty inflight window)
@@ -1060,6 +1077,23 @@ export async function runDaemon(repoRoot, opts = {}) {
         await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
         return summary;
     }
+    catch (err) {
+        if (runStarted && !taskLoopStarted && !journal.read().some((e) => e.event === "run-end")) {
+            journal.append("run-end", undefined, {
+                runId,
+                branch,
+                done: [],
+                failed: [],
+                human: [],
+                blocked: [],
+                pending: [],
+                phase: "setup",
+                fatal: true,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        throw err;
+    }
     finally {
         // v1.54 T2: deregister on EVERY exit (normal run end, throw, termination unwind) — the daemon
         // test suite runs runDaemon dozens of times in one process; a leaked handler would close a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.61.0",
+  "version": "1.63.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -16,7 +16,8 @@ When working in a multi-agent terminal environment, decide your role before star
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
   - **Claude Code:** `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --ask-for-approval never --sandbox workspace-write`
+  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 Outside a multi-agent terminal environment, run the loop directly.
 

package/skills/tickmarkr-loop/SKILL.md

@@ -15,7 +15,8 @@ When working in a multi-agent terminal environment, decide your role before star
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
   - **Claude Code:** `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --ask-for-approval never --sandbox workspace-write`
+  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 Outside a multi-agent terminal environment, run the loop directly.
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -29,7 +29,7 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    main name plus at most ONE hot-state token. Vocabulary: ORCH carries the milestone and progress
    fraction (`ORCH · v1.19 4/5`, updated on every task-done); WORKERS carries the task token (tickmarkr
    updates it). Never long context strings or ✓-chains.
-2. **Orchestrator**: Launch the orchestrator with your agent host. For Claude Code, use `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions` (pin a strong model with `--model <m>` if the operator has a policy). For Codex, use `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --ask-for-approval never --sandbox workspace-write` (add `--model <m>` to specify the model). Workers you never spawn — tickmarkr spawns its own visible worker panes.
+2. **Orchestrator**: Launch the orchestrator with your agent host. For Claude Code, use `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions` (pin a strong model with `--model <m>` if the operator has a policy). For Codex, use `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions`, and a read-only codex consultant may use `--sandbox read-only`.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line: