Add Codex app-server cooperative execution

skills/autopilot/README.md

@@ -21,6 +21,8 @@ changes and rollback notes. Open a PR, but do not merge or deploy it.
 
 When using Pi's process-local backend, load `runtime/dist/src/pi-extension-entry.js` through Pi's documented extension or package mechanism, then start the sealed charter with `/autopilot-start <charter-file>`. The owning Pi process must remain uninterrupted; losing it makes the exact attempt unknown and never triggers a replacement.
 
+Codex offers two explicit charter modes. `codex-app-server` binds an implementation to one per-attempt app-server instance and exact ephemeral thread/turn; connection or server loss becomes unknown. `codex` retains the direct CLI fallback and POSIX process-supervised restart reattachment. App-server independent review still uses the direct read-only CLI path.
+
 Autopilot will:
 
 1. turn the request into explicit work items, completion predicates, budgets, and grants;

skills/autopilot/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 
 # Autopilot
 
-Autopilot delegates bounded coding work to a fresh Claude Code, Codex, Pi, or OpenCode execution. Pi implementations prefer the packaged process-local extension backend; other modes and the Pi fallback use their declared CLI boundaries. The runtime owns lifecycle state, Git commits, verification, remote delivery, and completion decisions.
+Autopilot delegates bounded coding work to a fresh Claude Code, Codex, Pi, or OpenCode execution. Pi implementations prefer the packaged process-local extension backend. Codex charters select either the exact same-instance `codex-app-server` backend or the distinct direct `codex` CLI path. Other modes and fallbacks use their declared CLI boundaries. The runtime owns lifecycle state, Git commits, verification, remote delivery, and completion decisions.
 
 ## New-run preconditions
 
@@ -18,6 +18,7 @@ For a new implementation run:
 3. Confirm Node.js 24+, Git, and the selected harness are available.
 4. Resolve how the repository selects each required build toolchain before sealing command gates. Prefer checked-in wrappers or toolchain configuration; when a gate or hook still requires a named environment selector, forward only that name and authorize it for the runtime.
 5. Do not install tools, download runtimes, authenticate providers, or modify global configuration.
+6. For Codex, select `codex-app-server` only when the operator accepts same-instance cooperative terminality; select `codex` for the distinct direct CLI mode. Never switch between them after admission or infer one mode's guarantees from the other.
 
 Treat “I am going to sleep,” “work overnight,” and “have this ready in the morning” as explicit unattended-run intent. Preserve that intent in `sourceText`, but do not turn it into a deadline, merge grant, deployment grant, or guarantee of completion time.
 

skills/autopilot/docs/2026-08-30-continuity-evidence-implementation-plan.md

@@ -487,7 +487,7 @@ skills/autopilot/runtime/test/fault-injection.test.ts
 
 ## Phase 7: Finish documentation and packaging
 
-**Result:** Implemented for Phases 0–6A. Phase 6B is not promoted under the recorded no-receiver decision and is not a current release blocker. The current validation baseline is 187 Node tests locally after intentional removal of 13 native-helper-specific tests and their production surface. The earlier 200-test Pi process-local, 162-test, and 137-test baselines passed at their recorded revisions on Ubuntu and Windows.
+**Result:** Implemented for Phases 0–6A. Phase 6B is not promoted under the recorded no-receiver decision and is not a current release blocker. The current validation baseline is 205 Node tests locally after adding Codex app-server contract coverage. The earlier 187-test native-free, 200-test Pi process-local, 162-test, and 137-test baselines passed at their recorded revisions on Ubuntu and Windows.
 
 ### Files
 

skills/autopilot/docs/2026-08-31-cooperative-harness-execution-plan.md

@@ -1,6 +1,6 @@
 # Cooperative harness execution implementation plan
 
-- **Status:** Implemented through PR 5: decision/promotion shutdown, execution assurance, fenced unknown-execution recovery, Pi process-local integration, and Windows native-path removal are complete; later provider investigations remain separate
+- **Status:** Implemented through the Codex app-server integration: decision/promotion shutdown, execution assurance, fenced unknown-execution recovery, Pi process-local integration, Windows native-path removal, and exact same-instance Codex turns are complete; OpenCode and Claude investigations remain separate
 - **Date:** 2026-08-31
 - **Audience:** Autopilot implementers and reviewers
 - **Related:** [Architecture](architecture.md), [continuity implementation plan](2026-08-30-continuity-evidence-implementation-plan.md), [durable event engine ADR](adr/0001-durable-event-engine.md)
@@ -364,11 +364,20 @@ Validation:
 - Windows continuity loss deterministically becomes unknown.
 - Ubuntu and Windows typecheck, lint, formatting, full tests, package smoke, and generated-artifact checks pass.
 
+### Codex app-server integration
+
+**Status:** Completed and kept distinct from the direct CLI adapter.
+
+Codex 0.151.0 exposes exact v2 thread and turn identities, streamed lifecycle notifications, and `turn/interrupt` over the default stdio app-server transport. Autopilot starts one app-server process per implementation attempt, uses one initialized connection, creates one ephemeral unattended workspace-write thread, and admits one turn. The subject binds an app-server instance nonce, thread ID, turn ID, and installed Codex version. Only the matching `turn/completed` notification from that uninterrupted connection is terminal. Server requests are denied, malformed or oversized protocol output fails closed, and cancellation remains pending until the same turn reports `interrupted`.
+
+The adapter sets the app-server process working directory to the attempt worktree but omits `thread/start.cwd`. Codex 0.151.0 persists project trust when a writable thread starts with an explicit `cwd`; omitting that field preserves the selected worktree without changing the user's Codex configuration. A live validation confirmed exact completion, exact cancellation, no tracked worktree mutation, and an unchanged `~/.codex/config.toml` digest.
+
+The default stdio transport cannot reconnect after coordinator loss. WebSocket transport is experimental and unsupported, and daemon bootstrap would add separately managed global state. Autopilot therefore does not attempt `thread/resume` on a replacement connection and advertises `same-harness-instance`, cooperative, single-shot assurance rather than durable reattachment. Connection, coordinator, or app-server loss becomes `EXECUTION_STATE_UNKNOWN`. Logical turn completion and interruption do not prove background-terminal or OS process-tree quiescence. Independent review remains on the direct read-only Codex CLI path, while the `codex` charter value retains the previous CLI adapter and its POSIX process supervisor.
+
 ### Later provider work
 
-Investigate each provider as a separate boundary after Pi is proven.
+Investigate each remaining provider as a separate boundary.
 
-- Codex: version-pin a harness-owned app-server and exact thread/turn reconciliation.
 - OpenCode: require exact prompt-attempt correlation and REST reconciliation around live-only events.
 - Claude Code: remain session-scoped until an active execution attachment surface exists.
 
@@ -457,6 +466,7 @@ Pause and revisit the design if implementation shows any of the following:
 
 - Controlled Pi process-local tests cover exact admission, cancellation, terminal-before-shutdown precedence, reload/session invalidation, lost admission, late/mismatched result rejection, direct fallback, and runtime-core completion in one reused local repository fixture. Whole-process live fault evidence remains environment-specific and does not prove OS quiescence or provider parity.
 - No provider currently proves Windows process-tree quiescence through its public subagent contract.
-- Codex app-server live rejoin, OpenCode disconnect reconciliation, and Claude interruption behavior were researched but not exercised for this design.
+- Codex app-server 0.151.0 exact completion and interruption were exercised over one uninterrupted stdio connection. Cross-connection live rejoin is intentionally unimplemented because the default transport is not reconnectable; continuity loss remains unknown.
+- OpenCode disconnect reconciliation and Claude interruption behavior remain researched but unexercised for this design.
 - Cooperative terminality does not prevent external effects performed by worker tools before terminal response.
 - The Pi entry point follows the documented package manifest at `runtime/dist/src/pi-extension-entry.js` and registers `/autopilot-start`, `/autopilot-resume`, and `/autopilot-recover`; callers must load it through Pi's normal package or extension mechanism.

skills/autopilot/docs/README.md

@@ -39,4 +39,4 @@ Both figures use the vendored Diagram Design default profile. The PNG exports ar
 
 ## Verification status
 
-The runtime has 187 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, POSIX descendant process cancellation, native-free package inventory, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository; disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `glab` 1.115.0.
+The runtime has 205 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, POSIX descendant process cancellation, native-free package inventory, Codex app-server continuity contracts, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository. Codex app-server 0.151.0 live completion and interruption passed on one uninterrupted stdio connection without changing the tested Codex config digest; its connection-loss behavior has controlled fault coverage. Disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `glab` 1.115.0.

skills/autopilot/docs/architecture.md

@@ -136,7 +136,7 @@ interface RunCharter {
     readonly baseCommit: string;
     readonly writableRoots: readonly string[];
   };
-  readonly harnessAdapter: "pi" | "claude-code" | "codex" | "opencode";
+  readonly harnessAdapter: "pi" | "claude-code" | "codex" | "codex-app-server" | "opencode";
   readonly mode: "single" | "independent-queue" | "ordered-stack";
   readonly work: readonly WorkItem[];
   readonly delivery: "local-commits" | "change-request-ready" | "merge-verified";
@@ -310,7 +310,9 @@ Capability degradation is explicit:
 - Missing or incomplete attempt-supervisor evidence fails closed as `EXECUTION_STATE_UNKNOWN`; the runtime never spends another attempt on a speculative replacement.
 - Missing a required delivery or enforcement capability stops before edits.
 
-The first adapters target Claude Code, Codex, Pi, and OpenCode. They share one conformance suite.
+The first adapters target Claude Code, Codex, Pi, and OpenCode. They share one conformance suite. The `codex` and `codex-app-server` charter values are distinct execution modes: direct Codex CLI retains runtime-owned POSIX supervision, while app-server implementation turns use harness-owned same-instance cooperative terminality.
+
+The Codex app-server adapter starts one per-attempt stdio server with its process working directory set to the dedicated worktree. After `initialize`, it creates an ephemeral workspace-write thread with unattended approvals and deliberately omits the `cwd` request field, avoiding Codex's persistent project-trust update while still verifying the returned working directory. It journals an exact subject derived from the app-server instance nonce, thread ID, and turn ID. Only the matching `turn/completed` notification on the same connection is terminal; interruption must finish that turn as `interrupted`. Server requests are denied. The stdio connection cannot be reattached, while reconnectable Codex transports remain experimental or require separately managed daemon state, so any coordinator, connection, or server loss is `EXECUTION_STATE_UNKNOWN`. Independent review remains on the direct read-only Codex CLI adapter.
 
 The packaged Pi extension invokes the same runtime core inside the owning Pi process and probes an installed `pi-subagents` 0.53.0+ owner before selecting process-local structured delegation. The runtime persists admission intent before the extension emits one request, then binds the exact request, logical node, subject, and extension-instance identity. Only one matching terminal response from that uninterrupted instance may proceed to repository verification. Extension reload, session replacement, stale context, process loss, or a missing exact response becomes `EXECUTION_STATE_UNKNOWN` and cannot launch a replacement. Pi's ordinary foreground subagent observability remains available, while bounded activity is also projected to stderr. If the compatible owner is absent or inactive, Autopilot selects and reports the distinct direct Pi CLI fallback before admission. Direct POSIX execution keeps process supervision; direct Windows execution remains session-scoped. Independent review remains a separate direct read-only Pi execution.
 

skills/autopilot/docs/getting-started.md

@@ -38,6 +38,8 @@ Autopilot converts the request into a proposed charter. Review the charter when
 
 For the Pi process-local backend, load the packaged runtime extension through Pi's documented package or `--extension` mechanism and start the charter with `/autopilot-start <charter-file>`. The extension checks that the compatible `pi-subagents` owner is active in the same process; otherwise it reports and uses the distinct direct Pi CLI fallback. Autopilot never installs or enables either extension. Leave the owning Pi process running. Extension reload, session replacement, or process loss makes an admitted in-process execution unknown rather than launching a replacement.
 
+For Codex, choose the charter adapter deliberately. `codex-app-server` runs one exact ephemeral thread and turn over a per-attempt stdio app-server connection; losing that coordinator, connection, or server makes the attempt unknown. `codex` keeps the direct CLI boundary, including POSIX process-supervised restart reattachment. The app-server mode never bootstraps a daemon or changes Codex authentication. It starts the server in the worktree and omits explicit thread `cwd` so Codex does not persist project trust.
+
 ## Understand the run
 
 A run uses one of three graph modes:
@@ -70,7 +72,7 @@ Natural requests work too:
 
 `status` rebuilds progress from the sealed charter, hash-linked journal, Git identities, and receipts. It reports the last durable milestone, unmet predicate identities, normalized failure, remaining budgets, repeated no-change attempts, and next legal action. `pause` asks the live coordinator to cancel active implementation work, prove quiescence, retire the exact lease, and enter nonterminal waiting. A cancellation caused solely by pause remains auditable but does not consume an attempt. `resume` continues a paused or interrupted nonterminal run within its original limits. Verified items reconcile their checkpoint and effects without rerunning implementation. It does not restart a run that still has a live coordinator. `stop` asks a live coordinator to cancel active adapter work and record a durable terminal stop; if the coordinator is gone, Autopilot records the stop under the run lock. Branches, worktrees, receipts, and evidence remain intact.
 
-A stopped run cannot be resumed. Changed authority, budgets, or objectives require a sealed successor. After coordinator loss on supported POSIX hosts, Autopilot reattaches built-in supervised implementation executions and waits for terminal process-tree evidence. Autopilot contains no Windows native containment helper, so direct Windows CLI execution is session-scoped and continuity loss becomes `EXECUTION_STATE_UNKNOWN`. Legacy attempts, review executions, and incomplete or mismatched supervisor artifacts also refuse a replacement launch until quiescence can be proven. Pi in-process implementations become unknown when their exact owning extension instance is lost. Resume them through `/autopilot-resume [run-id]` in a loaded Autopilot extension; use fenced `/autopilot-recover` or the runtime CLI to abandon, adopt, or stop an unknown attempt.
+A stopped run cannot be resumed. Changed authority, budgets, or objectives require a sealed successor. After coordinator loss on supported POSIX hosts, Autopilot reattaches built-in supervised implementation executions and waits for terminal process-tree evidence. Autopilot contains no Windows native containment helper, so direct Windows CLI execution is session-scoped and continuity loss becomes `EXECUTION_STATE_UNKNOWN`. Legacy attempts, review executions, and incomplete or mismatched supervisor artifacts also refuse a replacement launch until quiescence can be proven. Pi in-process and Codex app-server implementations become unknown when their exact owning harness instance is lost. Resume them through `/autopilot-resume [run-id]` in a loaded Autopilot extension; use fenced `/autopilot-recover` or the runtime CLI to abandon, adopt, or stop an unknown attempt.
 
 If several runs match, Autopilot lists their title, short ID, state, progress, and last update. It changes nothing until you choose one, for example `resume 1` or `status spring-boot-4`.