PR-D: Codex worker lane: Codex's own config writer, RTK text inline with exceptions, max-effort stack-worker profile - #389

The GPT-6 re-check of 8780d93 resolved the snapshot and search findings. It
left one low finding open: after [mcp_servers.demo], an env table written as
[mcp_servers.'demo'.env] or [ mcp_servers . demo . env ] was dropped
silently, because the check compared server names only.
- The check now compares the parsed mcp_servers table of the extraction with
  the whole rendered config's, nested settings included. Any difference names
  the servers and fails staging closed.
- The header pattern accepts TOML's literal-quoted names and spaces around
  the dots, so those spellings are kept rather than refused.
- Without tomllib (Python 3.11+), staging refuses instead of skipping the
  check.
The failing control: both new tests fail against 8780d93's build_args.py.
The real template rendered for this host still extracts all 7 servers, env
tables included, equal to the full parse.
The other open medium (default worker profile absent) resolves when #389
lands the profile, and #389 merges first.
Tests: 166 run, OK (3 skipped); validate.py passed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5

…ith the token stack at max effort (#387)

build_args.py --gpt6-provider omniroute --codex-host HOST stages a lane-local
Codex home. Its config.toml holds:
- the OmniRoute provider block (loopback /v1, env_key, requires_openai_auth
  false, wire_api responses);
- max effort;
- shell_snapshot off;
- standalone web search on;
- the host's rendered token-stack MCP servers.
The worker profile is copied beside it (default:
adoption/templates/codex.stack-worker.config.toml from #389).
codex_job.py runs the lane with CODEX_HOME and -p stack-worker, without
--ignore-user-config. It uses a keyless-loopback placeholder key unless
--omniroute-require-key is given.
Guards:
- a loopback URL only;
- no quota gate with a gateway;
- the provider is recorded in inputs.json;
- MCP extraction fails closed on any table difference.

Review: two GPT-6 rounds.
- r1: 1 high, 2 medium, 1 low. The high was the shell snapshot writing the
  key at 0644.
- r2: the remaining low fixed in 1e81cce with a red control. The profile
  medium is resolved by #389.

Parity on OmniRoute 3.8.51 a58000c7 + #14904 + #13788 (BUILD_SHA dd6e9607e):
- stage rc 0 with the default profile; codex rc 0;
- shell, MCP ctx_execute, --output-schema and usage all pass;
- effort max in the rollout, and max/max in the gateway's call_logs;
- web.run reaches /v1/alpha/search. Its duckduckgo-free backend returns few
  or no results, which the sweep records as a lane limit.

Tests: 206 run, OK (5 skipped), including tests.test_codex_worker_lane.
validate.py passed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5

… are an allowed dispatch mode (#388)

Practice gap #6: tools/adoption/install_skills.py now says what it
checked. The SKILL.md sha256 matches the pin, and the lock records the tree.
Practice gap #8: agent teams are an allowed dispatch mode, per the current
Claude Code docs (agent-teams, context and communication).
- examples/claude-native/CLAUDE.md gains one word-neutral sentence
  (924 words).
- scripts/adoption_status.py reports agent_teams_opt_in (0 or 1) as
  information, not agent_teams_off as a wiring requirement.
- docs/token-efficiency-stack.md is updated to match.
- docs/harness-rules-convergence-20260922.md marks WH-3 superseded.

GPT-6 cross-family review: accept, no findings (213 tests, OK). After main
(#389, #387) was merged in: validate.py passed; tests.test_adoption_status
and tests.test_landscape_sweep_harness OK; CI full suite green.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5

…ks --required; move merge-guard mechanics to the decision record

The round-one verifier showed the documented statusCheckRollup filter prints superseded runs, so 'none failed' could not be judged with it (merged #389, #411 and #413 each show an earlier sota-sources failure and a later success on the final head). gh pr checks --required lists only the required checks with the latest run of each; measured exit 0 (all passed), 1 (one failed, none pending) and 8 (pending). The implementation-level citations move to the decision record, the stale-approval comparison is called an analogy, and 'today' leaves the dated record.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…uire sota-sources (#430)

* docs/lanes.md: merge with the reviewed head pinned (--match-head-commit)

Strict up-to-date checks stay off and this User-owned repository cannot use
a merge queue (docs/decisions/2026-09-22-github-automation-closure.md), so
`gh pr merge <N> --squash --match-head-commit <SHA>` is the guard against
merging a head nobody reviewed (https://cli.github.com/manual/gh_pr_merge).
It was practised but not written down: grep for match-head-commit across
docs, recipes, adoption, examples and AGENTS.md returned nothing.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Decision record: close the sota-sources ruleset drift with dated GETs

The live ruleset 23739774 now requires the committed eight checks. Before-GET
21:00:04Z (seven, no sota-sources); PUT of .github/main-ruleset.json at main
e82e6be at 21:00:13Z; after-GET matches the committed file. Records the open
PRs affected at PUT time and the rollback.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* docs/lanes.md merge guard: pin the checked and reviewed head read just before merge (B1, B2)

B1: <SHA> is the full 40-character headRefOid read with gh pr view <N> --json headRefOid,statusCheckRollup immediately before the merge, on which the review completed and every required check ran with none running or failed. The hot-file protocol's rebase or merge of main comes before that read; if main changed a shared hot file after <SHA>, merge main again, wait for the checks on the new head and pin it; the review carries over only if the reviewed files are byte-identical (GitHub's stale-approval rule, available-rules-for-rulesets). Sources: gh 2.101.0 'gh pr merge --help'; cli/cli v2.101.0 pkg/cmd/pr/merge/http.go L77-80 (expectedHeadOid); GraphQL MergePullRequestInput.expectedHeadOid read by schema introspection and in github/docs src/graphql/data/fpt/schema-pulls.json.

B2: the flag guards the head, not the base: with strict up-to-date checks off and no merge queue, two PRs green against an older main can still break it together (GitHub docs, loose required status checks).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Drift closed entry: measured live-ruleset comparison, historical labels, executable rollback (B3, B4, B5)

B4: the before-GET, PUT, after-GET and PR-status claims are labelled historical, recorded by the PR author, output not retained. Measured today (2026-09-29T03:18:04Z, read-only): the recorded diff of the live ruleset 23739774 against origin/main (b0fb65b, GitHub's main tip then) exited 0 after stripping eight response-metadata keys and sorting rules by type; the rules order is the only other difference; the 57fb6d8 negative control exits 1 on the sota-sources context only; updated_at is still the recorded PUT second. packet.md L90-92 cited as historical corroboration.

B3: rollback is git show 57fb6d8:.github/main-ruleset.json | gh api --method PUT .../rulesets/23739774 --input - (not run); verified 57fb6d8's file equals 7bbb021's minus sota-sources (jq -S, cmp exit 0) and main still carries 7bbb021's file.

B5: a rebase is not the only way to get a sota-sources run (validate.yml L6-9 reopened/edited; docs/lanes.md merge path), GitHub starts no pull_request run while a PR conflicts, and reporting is not passing (the job reads only the description, L517-521); #205/#216 measured CONFLICTING with no sota-sources run.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file step: re-register docs/lanes.md and the automation-closure record in manifests/evidence.json

Registered with host_receipts.register_file; component_matrix.py --write and new_host_grand_list.py --write left the four generated reports unchanged; scripts/validate.py passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs/lanes.md: read the pinned head's required checks with gh pr checks --required; move merge-guard mechanics to the decision record

The round-one verifier showed the documented statusCheckRollup filter prints superseded runs, so 'none failed' could not be judged with it (merged #389, #411 and #413 each show an earlier sota-sources failure and a later success on the final head). gh pr checks --required lists only the required checks with the latest run of each; measured exit 0 (all passed), 1 (one failed, none pending) and 8 (pending). The implementation-level citations move to the decision record, the stale-approval comparison is called an analogy, and 'today' leaves the dated record.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

### Scope

Route catalog lookup through QMD's lexical queries and bounded document retrieval; use SocratiCode for semantic catalog search at the main checkout's projectPath. Keep reranking available and prohibit qmd embed/pull. Update current maintenance recipes and native instruction carriers through the repository renderers.

Existing Serena consumers read its manual before navigation, and jCodeMunch consumers obtain the current guide before a typed route with the actual caller model and execution off. Four existing Claude roles gain only Serena's manual tool. Reviewer/builder keep their no-menu boundary, and a focused read of a known path and line remains valid.

This landing repair appends the preregistration's Amendment4 to bind the deliberately changed role bodies and compacts lane-authored RTK explanations within the unchanged compact and startup budgets. The entire composed pre-RTK prefix, upstream awareness, owner's blocks, exact SKILL line, seven exceptions, models and effort are preserved. Prior amendment rows, observations, seals and RUNBOOK bytes remain unchanged.

The canonical code-graph rename is prepared as a separate patch and is excluded from this head under command-center ruling081016Z. Main's existing names remain in both templates, the map, fixtures and carriers. The protected lane token requires the owner's word before the rename can land. Until that follow-up, this host's Claude code-graph access is through the vendor's hook channel only; the stale MCP carrier id is a recorded limitation and is not claimed fixed.

- Base commit: `c44993b379da25fae923dbbe70188978af5104aa` (verified native source; #803 already landed).
- Lane: `lane:foundation`; draft.
- Head: `9985e468fa4997d22630714b2fa6a76666e3cda9`. Native bytes: compact 8076 <8192, rendered 9142, three-file startup 20101 <=20103; full Claude block 4087 <=4100. These are byte gates, not token-use measurements.
- Owned paths: token-lane carriers and their paired handbook text, minimal manual grants and mirrors, Codex template/rendered copies, native loader/routing/sequence tests, current recipes and generated handbook, append-only decisions/preregistration amendment, follow-up receipts and checksum/registry projections.
- ROLE-CARRIER-GAPS and ROLE-GRANTS are separate future work and stay out of this change.

Landing path: explicit command-center cue070358Z and fallback ruling081016Z permit one pushed rebase/content repair onto then-current main while #802/#813/#830 land. The co-op performs the new-head delta read with its CI result; the command center ACKs; 5f lands. A further pushed rebase requires the separate dated landing-conflict cue. Host configuration, cutover and fresh-session/working-day acceptance belong to their owners.

## SOTA sources

- [QMD v2.8.3 lexical query](https://github.com/tobi/qmd/blob/v2.8.3/src/mcp/server.ts#L294), [typed searches/rerank](https://github.com/tobi/qmd/blob/v2.8.3/src/mcp/server.ts#L321) and [document retrieval](https://github.com/tobi/qmd/blob/v2.8.3/src/mcp/server.ts#L412): native lexical subqueries, retrieval and optional rerank. Rerank defaults true (:334-335). [README maintenance syntax:1033-1037](https://github.com/tobi/qmd/blob/v2.8.3/README.md#L1033-L1037) supplies bounded commands.
- [SocratiCode v1.15.0 codebase_search](https://github.com/giancarloerra/SocratiCode/blob/v1.15.0/src/index.ts#L138): semantic search at an absolute projectPath. Owner ruling224125Z selects the routing and preserves rerank-on acceptance; this PR performs no host cutover.
- [Serena c6fbd1c5 manual order](https://github.com/oraios/serena/blob/c6fbd1c5932df2494ffa0020af5a9fbe80b82143/src/serena/resources/config/prompt_templates/system_prompt.yml#L5-L6), [manual tool:28-40](https://github.com/oraios/serena/blob/c6fbd1c5932df2494ffa0020af5a9fbe80b82143/src/serena/tools/workflow_tools.py#L28-L40) and [project/session binding:44-49](https://github.com/oraios/serena/blob/c6fbd1c5932df2494ffa0020af5a9fbe80b82143/src/serena/tools/config_tools.py#L44-L49): manual first, active cwd project and returned session id for switches.
- [jCodeMunch 1.108.330, 28803366, typed route:446-463](https://github.com/jgravelle/jcodemunch-mcp/blob/288033668f0425ab0547f420dd647c14bd186c7f/src/jcodemunch_mcp/server.py#L446-L463), [guide:4743-4752](https://github.com/jgravelle/jcodemunch-mcp/blob/288033668f0425ab0547f420dd647c14bd186c7f/src/jcodemunch_mcp/server.py#L4743-L4752) and [policy:101-128](https://github.com/jgravelle/jcodemunch-mcp/blob/288033668f0425ab0547f420dd647c14bd186c7f/src/jcodemunch_mcp/cli/policy.py#L101-L128): guide-first and typed task/model route. These files are unchanged at target1.108.331/d94049d0. The executable schema corrects the guide's query example; no new adaptive-tier setting or upstream rebuild.
- `native-agent-stack@c44993b:tests/test_token_e2e_preregistration.py:637-663,905-909`: later dated role-pin amendment and sealed RUNBOOK contracts. Amendment4 preserves every earlier row/seal and extends the current-row selector. The command center records merge chronology at landing; this is a structural repair and authorizes no run.
- [DeusData/codebase-memory-mcp v0.11.0 release](https://github.com/DeusData/codebase-memory-mcp/releases/tag/v0.11.0), the repository's pinned component, and the command center's native-client read-back identify the canonical server name. Its proposed client-key/wire-id/owner-token correction is kept in the separate patch, preserving every payload and strict fixture. Ruling081016Z explicitly keeps main's names in this publication while the owner's instruction-token decision remains open.
- RTK explanation provenance: `native-agent-stack@2d849ba` (#726) and `@50b9579` (#389), `adoption/templates/codex.AGENTS.template.md` after its exceptions marker. The eight explanations shorten while all facts and protected bytes remain. Command-center064832Z accepted their class and scoped wording.
- Native helpers at `native-agent-stack@c44993b`: `tools/adoption/managed_block.py:169` (`codex_block`), `tools/adoption/codex_roles.py:287` (`f4_block`), `scripts/host_receipts.py:710` (`register_file`), `docs/lanes.md:94-128`. Current generated inventory/handbook and checksum bindings use those repository tools; historical receipts and the frozen catalog passage are preserved.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Documented native routing/manual/guide interfaces | source_review | Pinned upstream files above |
| Carrier rendering, protected bytes, new body pins and tool ids | local_integration | Existing native helpers, hashes and required modules |
| Permission/sequence/byte-mutant/frozen-row controls | synthetic | Existing tests with assertions preserved |
| Deployed use and token savings | Pending owner evidence | No model, host apply or working-day measurement in this repair |

### Local commands run

```text
$ CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_token_lanes_session_start tests.test_token_lanes_subagent_start tests.test_scaffold_repo tests.test_new_wsl_handbook tests.test_adoption_docs_consistency tests.test_codex_agents tests.test_codex_roles tests.test_codex_worker_lane tests.test_token_e2e_preregistration tests.test_new_wsl_client_config.RecordTests tests.test_install_claude_profile tests.test_managed_block tests.test_task_model_routing tests.test_new_wsl_client_config.MapTests tests.test_new_wsl_client_config.AgentGapTests tests.test_new_wsl_client_config.RenderTests tests.test_new_wsl_client_config.ApplyTests.test_the_first_run_writes_what_the_wired_pieces_name_and_nothing_else
exit 0; Ran 595 tests in 109.929s; OK (skipped=14)

$ CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_install_claude_profile tests.test_adoption_docs_consistency tests.test_new_wsl_client_config.RecordTests
exit 0; Ran 150 tests in 16.306s; OK (skipped=2)

$ CI=true nice -n 19 ionice -c3 node examples/claude-native/workflows/test-envelope.mjs
exit 0; SUMMARY passed=254 failed=0 total=254

$ CI=true nice -n 19 ionice -c3 python3 -B tools/adoption/new_wsl_client_config.py --check --markdown
exit 0

$ CI=true nice -n 19 ionice -c3 python3 -B scripts/build_new_wsl_handbook.py --check
exit 0
```

The passing 595-test run is retained on unchanged source/assertion inputs from the pre-window checkpoint; the 150-test run checks the concrete relocation-fixture and workflows-README changes in the new main base. Their counts overlap and are not added. The fresh Node run passes 254/254. Strict checksums in both Codex directories and the Claude hook directory, plus `git diff --check`, exit 0. All three Amendment-4 role digests were re-derived in both copies and are unchanged from the previous published head.

```text
$ CI=true nice -n 19 ionice -c3 python3 -B scripts/validate.py
exit 0; 69 components, 10,482 hashed files, 4 profiles, 224 receipts, status passed
```

The earlier landing composition used source `630b6ece8485a7710ea51321682d5a12e364e25c` and hot commit `5703ef1061b982078038425fada888fd35153868`; its native checks and source-critic result are retained. The authorized locator follow-up changes only `catalogs/foundation/upstream-surface-dispositions.json` and that file's registry row: the `otel.environment` citation now points to the command at `examples/codex-native/README.md:214`. Source commit `2b36cfee` is followed by registry-last commit `9985e468fa4997d22630714b2fa6a76666e3cda9`, with no further rebase. Claude/Codex instruction bytes, role hashes, historical records, namespace and byte budgets remain unchanged.

The registry starts from exact main `c44993b379da25fae923dbbe70188978af5104aa`, registers the same 67 changed-file rows through the native producer, and preserves main's receipt and convergence arrays. The two-file correction passed the 114-test citation module, the two exact failing methods and a second native validator run. The worktree is clean; the shifted-citation scan found no other current target to repair. Historical before/after references remain intact.

```text
$ CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_upstream_surface_watch
exit 0; 114 tests, 6 skipped

$ CI=true nice -n 19 ionice -c3 python3 -B -m unittest tests.test_upstream_surface_watch.DispositionCitationTests.test_every_cited_line_names_the_key tests.test_upstream_surface_watch.DispositionCitationTests.test_a_dotted_key_has_its_parent_near_the_citation
exit 0; 2 tests

$ CI=true nice -n 19 ionice -c3 python3 -B scripts/validate.py
exit 0; integrity and scope passed
```

The hosted run at5703 returned two failures in11,495 tests because the documentation locator moved. A reviewed locator still gates when its repository test fails. This follow-up closes that exact contract; it adds no assertion waiver or namespace change.

Read-only overlap metadata checked all 47 open PRs, including full file pagination where needed. Source overlaps: #645, #706, #709, #754, #769, #770, #775, #776, #795, #810, #821, #826, #829. Shared registry/checksum paths use the hot-file protocol; no peer branch is changed.

Earlier failed CI at3ba ran11,381tests and failed six role-body-pin subcases; its complete failed log is retained privately. The failed 560-test and earlier 595-test preparation runs also remain retained. This repair uses a dated amendment, preserves the older source evidence and strict current-body comparison, and performs no full-suite or provider acceptance run. Validator results are integrity and scope evidence only.

### Decision record

`docs/decisions/2026-10-06-qmd-lexical-catalog-instructions.md` and `docs/decisions/2026-10-07-serena-jcodemunch-native-navigation-wiring.md`, with appended clarifications and the new landing follow-up, explain the behavior and limits. The preregistration README gains Amendment4 only; its RUNBOOK and earlier sealed records stay byte-identical. No prior result is recast as a new run.

### Host evidence

Repository-only change. No live instruction file, MCP registration, hook trust, client setting, gateway setting/key or model session changed. Source/render checks and synthetic fixtures remain distinct from the configuration owner's read-back and organic-use acceptance.

### Checklist

- [x] No GitHub Actions or paid service change.
- [x] No credentials, raw conversations or live client configuration committed.
- [x] Models, effort, owner's blocks and historical observations preserved.
- [x] Peer-owned worktrees and source preserved.
- [x] Native validation passed; changed checksums/registry committed last at the final head.