Productionize MonkeyProof as remote coding-agent worker substrate

[rodaddy]

Goal

Make MonkeyProof production-ready as the remote coding-agent worker substrate for Herdr/A2A-controlled runs.

Context

MonkeyProof already exposes REST + WebSocket session control for CLI coding agents:

• POST /sessions
• GET /sessions
• GET /sessions/:id
• POST /sessions/:id/input
• DELETE /sessions/:id
• WS /sessions/:id/ws

For the Herdr controller architecture, MonkeyProof should be the remote execution substrate, while Herdr stays the local cockpit and A2A provides the standard task protocol.

Work

• Verify Codex presets are current and launch the intended Codex binary/flags on the remote host.
• Add or document a standard remote-worker preset for Codex low/no-thinking style implementation work where selectable.
• Harden session lifecycle semantics:
  • list running/exited/killed sessions;
  • kill runaway sessions;
  • preserve recent output and transcript access where applicable;
  • avoid unbounded session/output growth.
• Document the standard request bodies for:
  • one-shot Codex worker;
  • interactive Codex worker;
  • follow-up input;
  • read/kill session.
• Confirm auth/token loading through environment or approved secret source; do not rely on dev defaults for production.
• Add focused tests or smoke scripts for create/list/read/input/kill flows.
• Document host/deployment assumptions for CT 120 and any supported remote hosts.

Acceptance Criteria

• README or docs include a Codex remote-worker recipe that does not require ad hoc curl discovery.
• A one-shot Codex session can be created and read through the API.
• An interactive session can receive follow-up input.
• A session can be killed and later inspected.
• Production service config does not depend on development token defaults.
• Validation evidence is captured in the PR.

[rodaddy]

Part of the Herdr-controlled remote worker orchestration epic:

• rodaddy/rtech-infra#133

This work should feed the PRD/implementation plan there and be coordinated from a Herdr controller session.