trace-to-skill 0.1.65 → 0.1.67

package/docs/USE_CASES.md

@@ -19,13 +19,14 @@ npx trace-to-skill demo deeplink-launch
 npx trace-to-skill demo connector-auth-cache
 npx trace-to-skill demo mcp-discovery-mismatch
 npx trace-to-skill demo terminal-output-integrity
+npx trace-to-skill demo subagent-lifecycle
 ```
 
 What it proves:
 
 - packaged fixtures can produce a real Codex issue report immediately
 - maintainers can inspect the output shape before sharing any private log
-- demos cover remote compact failures, Windows helper path failures, patch overwrite safety, approval friction, latency, Thinking hangs, clipboard/attachment regressions, deeplink/OAuth launch regressions, connector auth-cache regressions, MCP discovery/config-scope mismatches, terminal output/scrollback integrity, token burn, sensitive files, and prompt injection
+- demos cover remote compact failures, Windows helper path failures, patch overwrite safety, approval friction, latency, Thinking hangs, clipboard/attachment regressions, deeplink/OAuth launch regressions, connector auth-cache regressions, MCP discovery/config-scope mismatches, terminal output/scrollback integrity, subagent lifecycle drift, token burn, sensitive files, and prompt injection
 
 See the generated demo output in [docs/DEMO.md](DEMO.md).
 
@@ -48,7 +49,7 @@ What it proves:
 Recommended CI surface:
 
 ```yaml
-- uses: grnbtqdbyx-create/trace-to-skill@v0.1.65
+- uses: grnbtqdbyx-create/trace-to-skill@v0.1.67
   with:
     mode: all
     doctor-threshold: "85"
@@ -91,7 +92,9 @@ npx trace-to-skill diagnostics-bundle ~/.codex --output codex-diagnostics
 
 This catches signals such as Windows sandbox setup refresh failures, `os error 740`, `CodexSandboxOffline` ownership drift, ACL denial, approval-policy mismatch, and Full Access sessions behaving like workspace-write or on-request mode.
 
-`config-audit` is local and read-only: it summarizes legacy `profile` / `[profiles.*]` config, model pins, `sandbox_mode`, `approval_policy`, `[windows].sandbox`, missing `default_permissions` profiles, deprecated `codex_hooks`, machine-local project trust entries, enabled plugins with missing cache directories, and large per-tool MCP approval configs.
+`config-audit` is local and read-only: it summarizes legacy `profile` / `[profiles.*]` config, model pins, Speed/Fast persistence drift between `config.toml` and `.codex-global-state.json`, `sandbox_mode`, `approval_policy`, `[windows].sandbox`, missing `default_permissions` profiles, deprecated `codex_hooks`, machine-local project trust entries, enabled plugins with missing cache directories, and large per-tool MCP approval configs.
+
+For Codex App reports where Speed resets from Fast to Standard after restart, include the `service_tier`, `config default-service-tier`, `global default-service-tier`, `global has-user-changed-service-tier`, and `service_tier_persistence_drift` fields instead of pasting the raw state file.
 
 `plugin-audit` is local and read-only: it summarizes configured bundled plugins, cache directories, plugin manifests, generated runtime marketplaces, optional app-bundle marketplaces, Computer Use helper-app install state, `CODEX_HOME` mismatch, and unsupported feature flags.
 
@@ -162,7 +165,21 @@ This catches signals such as Windows Terminal scrollback lines disappearing, str
 
 Include the Codex CLI/app/extension version, OS, shell, terminal emulator and version, WSL/SSH/tmux/Zellij state, model, whether streaming was active, exact scroll action, terminal dimensions and scrollback settings, first missing or duplicated line id, raw log/transcript proof, terminal capture, numbered-line harness output, control run, `/resume` or transcript recovery behavior, and whether another terminal or downgrade changes the result.
 
-## 11. Codex MCP Runtime Triage
+## 11. Codex Subagent Lifecycle And State Reconciliation
+
+Use this when subagents appear completed, closed, stale, or interrupted but Codex cannot reconcile UI state, live handles, persisted spawn edges, parent discoverability, and active spawn quota.
+
+```bash
+npx trace-to-skill demo subagent-lifecycle
+npx trace-to-skill analyze ./runs --format json
+npx trace-to-skill codex-report ./runs --output openai-codex-subagents.md
+```
+
+This catches signals such as completed subagents remaining visible in the Subagents panel, `close_agent` returning `not_found` or hanging, `thread_spawn_edges` rows staying open, `agent thread limit reached`, child subagent threads showing as top-level recent conversations, and compaction losing the prior subagent id so the parent forks the main session instead of resuming an unbiased reviewer.
+
+Include Codex app/CLI/extension version, OS, surface, model, subscription/workspace, root thread id, subagent ids/nicknames/roles, spawn/close/list commands, `close_agent` results, `list_agents` or `/agents` output, `thread_spawn_edges` status counts, `agents.max_threads` or registry quota evidence, recent-list/sidebar behavior, child-thread archive/top-level status, last-progress or halt reason, MCP server state, compaction/resume timing, redacted UI evidence, restart/reload behavior, and whether stale agents are UI-only or still block spawns.
+
+## 12. Codex MCP Runtime Triage
 
 Use this when MCP tools are configured and visible, but Codex cannot actually call them at runtime.
 
@@ -173,7 +190,7 @@ npx trace-to-skill config-audit ~/.codex --format json
 
 This catches signals such as `user cancelled MCP tool call`, `request_user_input is not supported in exec mode`, `Approve app tool call?`, `tool_call_mcp_elicitation`, routed callable names like `mcp__node_repl__js` becoming `unsupported call`, deferred discovery dropping namespace or `serverName`, `tools/list` succeeding while Codex routing fails, and stdio transport lifecycle failures such as `Transport closed`, `stdin_end`, `stdin_close`, `transport_close`, or stderr backpressure.
 
-## 12. Codex Resume And Session State Triage
+## 13. Codex Resume And Session State Triage
 
 Use this when long Codex sessions become difficult to resume, Desktop history rendering gets sluggish, or local state migrations break goals/projects/history.
 
@@ -190,7 +207,7 @@ This catches signals such as `codex resume` picker hangs, `codex resume <id>` wo
 
 For mixed resume, crash, config, plugin, or history issues, `diagnostics-bundle` writes the session, config, and plugin reports together with a checklist of files not to attach publicly.
 
-## 13. Codex File Tree UI Evidence
+## 14. Codex File Tree UI Evidence
 
 Use this when Codex Desktop cannot reveal project files through the native file tree, folder icon, floating file panel, or built-in preview.
 
@@ -201,7 +218,7 @@ npx trace-to-skill codex-report ./runs --output openai-codex-issue.md
 
 This catches signals such as `View > Toggle File Tree` doing nothing, `Cmd+Shift+E` or `Ctrl+Shift+E` having no visible effect, the folder icon disappearing, the floating file panel showing stale or unclickable entries after add/rename/delete operations, and `.doc`, `.pdf`, or `.ppt` previews failing until restart.
 
-## 14. Codex Token Burn Attribution
+## 15. Codex Token Burn Attribution
 
 Use this when Codex usage drains faster than expected and the trace needs to separate useful model work from orchestration overhead.
 
@@ -212,7 +229,7 @@ npx trace-to-skill codex-report ./runs --output openai-codex-issue.md
 
 This catches signals such as tokens `burning very fast`, usage dropping by visible percentages after one or two prompts, weekly allowance depletion, 5-hour usage reaching 0%, large `input` plus `cached input` totals, `write_stdin` empty polling, background commands repeatedly reporting no new output, idle app usage, compaction tax, retry/tool loops, and missing attribution between normal turns, compaction, background polling, subagents, and retries.
 
-## 15. Usage Reset Drift Evidence
+## 16. Usage Reset Drift Evidence
 
 Use this when Codex reset timing changes unexpectedly or users lose the ability to plan paid usage.
 
@@ -223,7 +240,7 @@ npx trace-to-skill codex-report ./runs --output openai-codex-issue.md
 
 This catches signals such as weekly reset dates moving from one date to another, `reset_at` jumping after the first prompt, saved weekly usage being wiped or pushed into the next window, outage compensation resets changing the anchor, `/status` and dashboard disagreement, and requests for deterministic reset schedules or rollover of unused prior-window usage.
 
-## 16. Quota And Usage-Limit Evidence
+## 17. Quota And Usage-Limit Evidence
 
 Use this when Codex blocks a prompt with a usage-limit message but another surface still shows remaining quota.
 
@@ -233,7 +250,7 @@ npx trace-to-skill analyze ./runs --format json
 
 This catches traces where `/status` or the usage page shows remaining 5h or weekly quota, accounts appear to share limits unexpectedly, a Team account inherits a Plus account's limit state, or quota reset times jump after logout/login.
 
-## 17. Codex Resource Leak Evidence
+## 18. Codex Resource Leak Evidence
 
 Use this when Codex Desktop, the VS Code extension, renderer, app-server, GPU process, shell snapshot, or helper process keeps burning local resources after the useful work should be idle.
 
@@ -246,7 +263,7 @@ This catches signals such as high `Code Helper (Renderer)` or `Code Helper (Plug
 
 Include process names/PIDs, CPU/GPU/RSS samples over time, log-loop snippets, workspace Git-root state, animation/reduce-motion state, and whether closing the panel/app, killing exact PIDs, `git init`, rollback, or restart clears the leak.
 
-## 18. Codex Thinking Hang Evidence
+## 19. Codex Thinking Hang Evidence
 
 Use this when Codex accepts a prompt, finishes a local tool call, or keeps a Responses stream open but the UI/CLI remains on Thinking or Working with no visible assistant follow-up.
 
@@ -260,7 +277,7 @@ This catches signals such as `turn/start`, `task_started`, a completed local too
 
 Include the Codex version, OS, model and reasoning/speed settings, turn or thread id, prompt timestamp, last successful tool output, first `response_item` timestamp, `responses_http` or websocket transport evidence, `time.busy` / `time.idle`, MCP/subagent state, stop/interrupt behavior, and whether a new thread or minimal config recovers.
 
-## 19. Codex Clipboard And Pasted-Text Attachment Evidence
+## 20. Codex Clipboard And Pasted-Text Attachment Evidence
 
 Use this when copy/export, long pasted prompts, or generated `Pasted text.txt` attachments break Codex prompt, `/goal`, or support-report workflows.
 
@@ -274,7 +291,7 @@ This catches signals such as `Copy as Markdown` disappearing from the Copy menu,
 
 Include app version, OS, surface, exact copy menu items, source text size, paste action, visible editor text, generated attachment name/path/size, `pasted-text-attachments.json` or fileAttachments metadata, command path such as `/goal`, preview/edit/revert actions tried, clipboard payload format, and whether paste-as-text, opt-out, explicit file reference, or downgrade changes behavior.
 
-## 20. Codex Deeplink And External Launch Evidence
+## 21. Codex Deeplink And External Launch Evidence
 
 Use this when OAuth callbacks, notification clicks, browser extension activation, mobile pairing, or CLI app-open commands fail to route back into Codex.
 
@@ -288,7 +305,7 @@ This catches signals such as `codex://oauth_callback?code=...` opening an Electr
 
 Include app/CLI/extension version, OS/build, install source, package id/path, affected surface, exact redacted URI shape, browser and connector/plugin name, error dialog text, whether the app was already running, AppX/MSIX evidence such as AppUserModelID and DelegateExecute, HKCU/HKCR `codex` keys, command-line arguments, repair/reinstall/re-register attempts, and whether manual `codex://test` or `Start-Process` reproduces.
 
-## 21. Codex App Connector Auth Cache Evidence
+## 22. Codex App Connector Auth Cache Evidence
 
 Use this when Codex app connectors appear installed but keep stale auth or discovery metadata after a reauth-required response.
 
@@ -302,7 +319,7 @@ This catches signals such as `401: "Server returned 401: 'Reauthentication requi
 
 Include app/CLI version, OS, connector/plugin name and id, installed plugin root, exact tool name, redacted `codex_apps_tools` and `codex_app_directory` metadata, `link_*` id before/after reconnect, `isAccessible` state, restart/remove/re-add/cache-clear/sign-in attempts, ChatGPT app page state, and whether an external MCP workaround succeeds.
 
-## 22. Codex MCP Discovery And Config Scope Evidence
+## 23. Codex MCP Discovery And Config Scope Evidence
 
 Use this when MCP servers work in Codex CLI or one config scope but are missing in VS Code, Desktop, WSL, remote sessions, project-local config, or an older conversation.
 
@@ -316,7 +333,7 @@ This catches signals such as `MCP servers not detected in Codex VS Code extensio
 
 Include app/CLI/extension version, OS, IDE, remote/WSL/SSH state, workspace root, effective `CODEX_HOME`, all config files considered (`~/.codex/config.toml`, project `.codex/config.toml`, `.vscode/mcp.json`, `.mcp.json`), redacted MCP sections, trust/profile/default-permissions state, `codex mcp list`, `codex mcp get <server>`, CLI-versus-Desktop/VS Code comparison, loaded config path/log lines, whether moving the same server to user-global config fixes it, and whether the current session exposes `mcp__*` tools.
 
-## 23. Patch Overwrite Guard
+## 24. Patch Overwrite Guard
 
 Use this before applying a generated patch when you want create/update/delete semantics checked against the actual workspace.
 
@@ -333,7 +350,7 @@ For a public demo report:
 npx trace-to-skill demo patch-overwrite
 ```
 
-## 24. OpenAI Codex Issue Report
+## 25. OpenAI Codex Issue Report
 
 Use this when you want to file or update an OpenAI/Codex issue with a concise, evidence-backed report instead of pasting a full transcript.
 
@@ -346,7 +363,7 @@ The report includes the likely Codex failure class, line-linked evidence, diagno
 
 For a cluster-to-command map of current Codex issue patterns, see [CODEX_ISSUE_MAP.md](CODEX_ISSUE_MAP.md).
 
-## 25. Sensitive File Access Evidence
+## 26. Sensitive File Access Evidence
 
 Use this when a trace suggests an agent read, attached, uploaded, diffed, or indexed credential-bearing files.
 
@@ -359,7 +376,7 @@ This catches signals such as `.env`, `.env.production`, `.npmrc`, `.pypirc`, `.n
 
 Before publishing evidence, run `trace-to-skill redact` and attach only redacted excerpts plus the file path/class.
 
-## 26. GitHub Context Guard
+## 27. GitHub Context Guard
 
 Use this before an agent reads untrusted GitHub text.
 
@@ -376,7 +393,7 @@ Use it when:
 - a bot asks Codex to triage untrusted user reports
 - logs or comments might contain instructions like "ignore previous instructions" or "print secrets"
 
-## 27. Failed Agent Run To Reviewable Rule
+## 28. Failed Agent Run To Reviewable Rule
 
 Use this when a coding agent made a repeated workflow mistake.
 
@@ -394,7 +411,7 @@ Recommended maintainer loop:
 4. Copy only evidence-backed rules into the real policy file.
 5. Run `eval` or `scorecard` in CI so the same failure does not silently return.
 
-## 28. Privacy-Preserving Adoption
+## 29. Privacy-Preserving Adoption
 
 Use this when you want public evidence without leaking private traces.
 

package/fixtures/codex-subagent-lifecycle.md

@@ -0,0 +1,133 @@
+# Codex subagent lifecycle fixture
+
+This fixture uses public, token-free examples of Codex subagent lifecycle state diverging between the UI, live close/readback routes, persisted SQLite spawn edges, recent conversations, and quota accounting.
+
+## Stale subagents in Desktop UI
+
+Environment:
+
+- Codex Desktop 26.527.31326 and related app builds
+- Long-running macOS or Linux sessions with many helper subagents
+- Subagent roles such as researcher, planner, reviewer, coder, and verifier
+
+Observed behavior:
+
+```text
+Completed or closed subagents remain visible in the Subagents panel.
+The app shows stale subagent cards after close/readback reports no live agent handle.
+The visible subagent count grows very large; the panel can show Show 67 more or 100+ stale entries.
+Some close attempts return shutdown, completed, not_found, or pending_init, but the UI still lists the agent.
+It is unclear which subagents are active versus stale UI/cache entries.
+```
+
+Local state evidence:
+
+```text
+SQLite integrity check: ok
+thread_spawn_edges status count: closed=549, open=0
+After restarting Codex Desktop multiple times, the Subagents panel still visually shows stale subagent cards.
+```
+
+## Stale workers poison goal mode
+
+Runtime report:
+
+```text
+Codex subagents have been going stale and refusing to close for the past week.
+One stale agent can halt the entire /goal mode.
+Attempting to close it again can make the whole session stuck again.
+Typically, if 1 agent goes stale and is unable to get closed, more will follow over upcoming hours.
+The issue is reset by quitting and starting Codex again, where the 5 agents quota is back.
+```
+
+Related MCP state:
+
+```text
+MCP startup interrupted. The following servers were not initialized: codex_apps
+Long sessions with stale subagents may hold MCP connections or leave connection lifecycle state unclear.
+```
+
+## Completed agents still consume spawn quota
+
+Reproduction pattern:
+
+```text
+Set a low agents.max_threads value.
+Spawn a subagent and drive it to TurnComplete.
+Attempt to spawn another agent.
+The next spawn fails with collab spawn failed: agent thread limit reached.
+Completed subagents continue to count against the per-session agent thread limit until explicitly closed.
+```
+
+Expected:
+
+```text
+Completed subagents should remain addressable for history/listing, but they should not consume active spawn quota unless restarted and reacquiring a slot.
+```
+
+## close_agent and durable state can diverge
+
+Failure shape:
+
+```text
+multi_agent_v1.close_agent can remain unresolved after marking a subagent closed.
+The persistent thread_spawn_edges row already shows status=closed.
+The child rollout ends with turn_aborted reason="interrupted".
+The in-memory registry slot remains counted, so later spawn_agent calls fail with agent thread limit reached.
+```
+
+Relevant code path names from the report:
+
+```text
+codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs
+codex-rs/core/src/agent/control.rs
+thread.wait_until_terminated().await
+AgentRegistry.release_spawned_thread
+```
+
+## Child threads appear as top-level recent conversations
+
+Local state summary:
+
+```text
+Total threads: 553
+Unarchived threads: 114
+Subagent child threads linked by thread_spawn_edges: 61
+Unarchived subagent child threads: 51
+Unarchived non-child threads: 63
+thread_spawn_edges.status: 56 closed, 5 open
+jobs, agent_jobs, and agent_job_items were empty
+```
+
+Observed behavior:
+
+```text
+Subagent child threads are returned by ordinary recent conversation listing.
+Child threads consume global recent-list slots and make older parent/user conversations look missing from the sidebar.
+Some spawn edges remain open even when there is no obvious active agent job or worker process.
+```
+
+## Compaction loses subagent discoverability
+
+User flow:
+
+```text
+A subagent completed an unbiased review.
+The main thread compacted automatically.
+The user asked the main agent to get back with that subagent for another review round.
+The main agent created a new subagent instead and forked the main session with full conversation history.
+It later explained: the original subagent id was not available in the compacted context.
+It also said it cannot retrieve a list of prior spawned sessions and can only act on an agent id it already knows.
+With the subagent id copied from /agents by the user, it can resume the subagent correctly.
+```
+
+Why this matters:
+
+```text
+Forking the main session defeats an unbiased review request because the reviewer inherits the parent agent's assumptions and the user's prior conversation.
+Prior resumable subagents should be discoverable to the model or clearly unavailable with a structured reason.
+```
+
+## Evidence a good report should include
+
+The report should include Codex app/CLI/extension version, OS, surface, model, subscription/workspace, root thread id, subagent ids/nicknames/roles, spawn/close/list commands or UI actions, `close_agent` results, `list_agents` or `/agents` output, `thread_spawn_edges` status counts, agent registry or `agents.max_threads` evidence, recent-list/sidebar behavior, whether child threads are archived or shown as top-level conversations, last-progress/heartbeat or halt reason, MCP server state for helper agents, resume timing, screenshot or redacted UI state, whether restart/reload/new thread clears it, and whether stale agents are UI-only or still block new spawns.

package/llms.txt

@@ -19,12 +19,13 @@ Runtime: Node.js 20+
 - Codex Windows helper path failures such as bundled `rg.exe`, `node_repl.exe`, Browser, Chrome, or Computer Use helpers resolving through blocked WindowsApps/MSIX package paths, missing `%LOCALAPPDATA%\OpenAI\Codex\bin`, broken LocalCache helper bins, `CodexSandboxUsers` ACL gaps, EFS/copyfile failures, and `missing-helper-path`
 - Codex patch safety failures such as `apply_patch` accepting `*** Add File` for an existing path, misleading `A <path>` summaries, symlink target replacement, and missing preflight checks before generated patches touch the workspace
 - Codex sandbox and permission failures such as setup refresh errors, `os error 740`, `CodexSandboxOffline` ownership drift, ACL denial, and approval-mode downgrades
-- Codex config drift such as Preferences `Unable to save`, `configVersionConflict`, legacy `profile` / `[profiles.*]` config, stale model pins, missing permission profiles, Windows elevated sandbox mode, plugin cache drift, and MCP approval sprawl
+- Codex config drift such as Preferences `Unable to save`, `configVersionConflict`, legacy `profile` / `[profiles.*]` config, Speed/Fast persistence drift between `config.toml` and `.codex-global-state.json`, stale model pins, missing permission profiles, Windows elevated sandbox mode, plugin cache drift, and MCP approval sprawl
 - Codex auth and connectivity failures such as `token_exchange_failed`, `auth.openai.com/oauth/token`, missing `ca-certificates`, proxy or MITM TLS behavior, IPv6 fallback problems, Cloudflare challenge responses, and ChatGPT stream disconnects
 - Codex mobile and remote-control route health failures such as `Waiting for desktop`, `Directory Unavailable`, stale listeners on `127.0.0.1:14567`, stale `server_name` enrollment, empty backend environments, and incomplete helper bundles
 - Codex MCP runtime failures such as cancelled non-interactive approvals, `request_user_input is not supported in exec mode`, dropped namespace or `serverName` metadata, `unsupported call: mcp__...__...`, and closed `StdioServerTransport` sessions
 - Codex MCP discovery and config-scope mismatches where CLI `/mcp` works but VS Code, Desktop, WSL, project `.codex/config.toml`, `CODEX_HOME`, or an older conversation exposes no `mcp__*` tools
 - Codex terminal output and scrollback integrity failures where streamed lines disappear, get overwritten, truncate, duplicate, misalign, snap to the bottom, or only survive in raw logs/transcripts
+- Codex subagent lifecycle failures where completed or closed agents remain visible, `thread_spawn_edges` drift, child threads crowd the recent list, `agent thread limit reached` blocks spawns, or compaction loses prior subagent IDs
 - Codex resume and session-state failures such as frozen resume pickers, large rollout JSONL histories, short `session_index.jsonl`, sluggish Desktop thread rendering, dropped recent context after resume, archived chat loading failures, and `state_5.sqlite` / `goals_1.sqlite` migration drift
 - Codex file tree and workspace navigation UI failures such as `View > Toggle File Tree` doing nothing, missing folder icons, stale floating file panels, and built-in preview failures
 - Codex Thinking or Working hangs after accepted turns, successful local tools, or open Responses streams with no streamed assistant follow-up
@@ -76,6 +77,7 @@ npx trace-to-skill demo deeplink-launch
 npx trace-to-skill demo connector-auth-cache
 npx trace-to-skill demo mcp-discovery-mismatch
 npx trace-to-skill demo terminal-output-integrity
+npx trace-to-skill demo subagent-lifecycle
 npx trace-to-skill lint-agents .
 npx trace-to-skill guard-github-event "$GITHUB_EVENT_PATH"
 npx trace-to-skill guard-patch ./change.patch --root .
@@ -97,7 +99,7 @@ npx trace-to-skill init --comment --sarif
 ## GitHub Action
 
 ```yaml
-- uses: grnbtqdbyx-create/trace-to-skill@v0.1.65
+- uses: grnbtqdbyx-create/trace-to-skill@v0.1.67
   with:
     mode: all
     doctor-threshold: "85"
@@ -126,6 +128,7 @@ npx trace-to-skill init --comment --sarif
 - Codex readiness checker for open-source repositories
 - Codex issue report demo without private traces
 - Codex terminal scrollback output integrity report
+- Codex subagent lifecycle state reconciliation report
 - AGENTS.md linter for Codex and Claude Code
 - turn failed agent runs into AGENTS.md rules
 - prompt injection guard for GitHub issue and PR comments

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trace-to-skill",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "Turn failed AI coding-agent runs into reusable AGENTS.md rules, SKILL.md files, and eval evidence.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -106,6 +106,12 @@
     "codex-terminal",
     "codex-scrollback",
     "terminal-output",
+    "codex-speed",
+    "codex-service-tier",
+    "codex-config-persistence",
+    "codex-subagent",
+    "codex-subagents",
+    "subagent-lifecycle",
     "codex-mcp",
     "codex-mcp-discovery",
     "mcp-config",

package/schemas/analysis-result.schema.json

@@ -82,6 +82,7 @@
         "codex_connectivity",
         "codex_remote_control",
         "codex_terminal_output_integrity",
+        "codex_subagent_lifecycle",
         "codex_mcp_discovery_mismatch",
         "codex_mcp_runtime",
         "codex_plugin_runtime",

package/schemas/config-audit-result.schema.json

@@ -4,7 +4,7 @@
   "title": "trace-to-skill Codex config audit result",
   "type": "object",
   "additionalProperties": false,
-  "required": ["generatedAt", "target", "configPath", "status", "summary", "values", "findings"],
+  "required": ["generatedAt", "target", "configPath", "globalStatePath", "status", "summary", "values", "findings"],
   "properties": {
     "generatedAt": {
       "type": "string",
@@ -16,6 +16,9 @@
     "configPath": {
       "type": "string"
     },
+    "globalStatePath": {
+      "type": "string"
+    },
     "status": {
       "type": "string",
       "enum": ["pass", "warn", "fail"]
@@ -37,11 +40,14 @@
     "summary": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["exists", "sizeBytes", "topLevelKeys", "sections", "mcpServers", "pluginSections"],
+      "required": ["exists", "globalStateExists", "sizeBytes", "topLevelKeys", "sections", "mcpServers", "pluginSections"],
       "properties": {
         "exists": {
           "type": "boolean"
         },
+        "globalStateExists": {
+          "type": "boolean"
+        },
         "sizeBytes": {
           "type": "integer",
           "minimum": 0
@@ -86,6 +92,18 @@
         },
         "defaultPermissions": {
           "type": "string"
+        },
+        "serviceTier": {
+          "type": "string"
+        },
+        "configDefaultServiceTier": {
+          "type": "string"
+        },
+        "globalDefaultServiceTier": {
+          "type": ["string", "null"]
+        },
+        "globalHasUserChangedServiceTier": {
+          "type": "boolean"
         }
       }
     },
@@ -110,7 +128,9 @@
             "deprecated_codex_hooks",
             "machine_local_project_state",
             "plugin_cache_missing",
-            "mcp_approval_sprawl"
+            "mcp_approval_sprawl",
+            "global_state_unreadable",
+            "service_tier_persistence_drift"
           ]
         },
         "line": {