Add Codex app-server cooperative execution

[drafael]

Summary

• add an explicit codex-app-server implementation backend, separate from direct codex
• bind completion and cancellation to one uninterrupted app-server process plus exact thread/turn identity
• fail closed on admission, connection, identity, and protocol loss while preserving direct CLI review
• document the same-instance cooperative assurance and Codex 0.151.0 trust/config constraints

Safety properties

• one per-attempt stdio app-server process and one ephemeral thread
• approvalPolicy: "never", workspace-write, verified returned worktree, thread, and turn
• no explicit thread/start.cwd, preventing the observed persistent Codex project-trust update
• all server-initiated requests rejected
• interrupt acknowledgment is not terminality; cancellation requires the matching interrupted turn terminal
• direct child cleanup is awaited and escalates from SIGTERM to SIGKILL; this does not claim descendant quiescence
• streaming credential redaction precedes stderr bounding

Validation

• npm run typecheck
• npm run lint
• npm run format:check
• npm test — 205 tests: 203 pass, 2 platform skips on macOS
• deterministic dist/ rebuild
• package dry-run: no project-owned .exe or .node artifacts
• Markdown relative-link validation and git diff --check
• live Codex CLI 0.151.0 completion and cancellation
• live completion left the tracked tree clean and preserved the exact ~/.codex/config.toml digest

[Copilot]

🔵 Needs a closer look

It introduces a new process-backed execution backend with subtle lifecycle/identity/termination semantics that warrants final human review despite strong unit-test coverage.

Pull request overview

Adds a new Codex execution backend that runs codex app-server per attempt and binds “completion”/“cancellation” to an exact ephemeral threadId + turnId on one uninterrupted stdio connection, while keeping the existing direct codex CLI adapter for review and fallback behavior.

Changes:

• Introduces a codex-app-server adapter (plus conformance tests) that fails closed on admission/identity/protocol/connection loss.
• Extends charter parsing/schema, adapter factory wiring, and doctor checks to recognize codex-app-server.
• Updates documentation to clearly separate codex-app-server (same-instance cooperative terminality) from codex (direct CLI boundary + POSIX supervision behavior).

File summaries

File	Description
skills/autopilot/SKILL.md	Documents explicit selection between codex-app-server and direct codex modes.
skills/autopilot/runtime/test/codex-app-server.test.ts	Adds a comprehensive contract suite for app-server admission, identity fencing, cancellation semantics, bounds, and cleanup.
skills/autopilot/runtime/test/adapter-compatibility.test.ts	Ensures codex-app-server resolves through the shared adapter factory.
skills/autopilot/runtime/src/process.ts	Exposes StreamingRedactor for streaming stderr redaction use in the new adapter.
skills/autopilot/runtime/src/doctor.ts	Adds a codex app-server --help availability check for the new adapter.
skills/autopilot/runtime/src/charter.ts	Extends charter adapter union + validation to include codex-app-server.
skills/autopilot/runtime/src/adapters.ts	Wires the new adapter into the runtime createAdapter factory.
skills/autopilot/runtime/src/adapter-process.ts	Exposes env/credential/redaction helpers for reuse by the app-server adapter.
skills/autopilot/runtime/schemas/charter.schema.json	Updates the JSON schema enum to include codex-app-server.
skills/autopilot/runtime/dist/src/process.js	Rebuild output for exported StreamingRedactor.
skills/autopilot/runtime/dist/src/process.d.ts	Rebuild types for exported StreamingRedactor.
skills/autopilot/runtime/dist/src/doctor.js	Rebuild output for added codex-app-server doctor check.
skills/autopilot/runtime/dist/src/charter.js	Rebuild output for updated charter adapter validation.
skills/autopilot/runtime/dist/src/charter.d.ts	Rebuild types for updated charter adapter union.
skills/autopilot/runtime/dist/src/adapters.js	Rebuild output for adapter factory wiring (codex-app-server).
skills/autopilot/runtime/dist/src/adapters.d.ts	Rebuild types for adapter name union (codex-app-server).
skills/autopilot/runtime/dist/src/adapter-process.js	Rebuild output for newly exported helper functions.
skills/autopilot/runtime/dist/src/adapter-process.d.ts	Rebuild types for newly exported helper functions.
skills/autopilot/runtime/dist/adapters/codex/index.js	Rebuild output to export createCodexAppServerAdapter() and clarify direct CLI limitations text.
skills/autopilot/runtime/dist/adapters/codex/index.d.ts	Rebuild types to include createCodexAppServerAdapter().
skills/autopilot/runtime/dist/adapters/codex/app-server.js	Generated JS for the new Codex app-server adapter implementation.
skills/autopilot/runtime/dist/adapters/codex/app-server.d.ts	Generated types for the new Codex app-server adapter.
skills/autopilot/runtime/adapters/codex/index.ts	Adds createCodexAppServerAdapter() and updates direct CLI limitations wording.
skills/autopilot/runtime/adapters/codex/app-server.ts	Implements the new stdio app-server adapter with exact-thread/turn terminality and fail-closed behavior.
skills/autopilot/references/charter.md	Documents the new charter adapter value and its semantics vs direct codex.
skills/autopilot/references/adapters.md	Updates the adapter matrix and adds detailed codex-app-server behavioral notes.
skills/autopilot/README.md	Describes the two explicit Codex charter modes and review behavior.
skills/autopilot/docs/runtime-cli.md	Clarifies continuity/reattachment differences for codex-app-server vs direct CLI adapters.
skills/autopilot/docs/README.md	Updates verification-status narrative to include app-server test coverage and live validation.
skills/autopilot/docs/implementation-plan.md	Updates implementation/validation plan text to include the app-server backend and evidence.
skills/autopilot/docs/getting-started.md	Adds guidance for choosing between codex-app-server and codex.
skills/autopilot/docs/architecture.md	Documents the architectural contract for app-server same-instance cooperative execution.
skills/autopilot/docs/2026-08-31-cooperative-harness-execution-plan.md	Updates cooperative execution plan to mark Codex app-server integration complete and described.
skills/autopilot/docs/2026-08-30-continuity-evidence-implementation-plan.md	Updates continuity plan status text to reflect added Codex app-server coverage.

Review details

• Files reviewed: 21/34 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.