Summary

Make native Codex session supervision a configurable capability of the official codex plugin. Show non-archived Codex sessions in OpenClaw, let an operator open a safe Codex-backed Chat branch from a stored or idle Gateway-local session, and archive eligible local sessions with explicit no-other-runner confirmation.

Problem to solve

The current codex-supervisor plugin and Codex Sessions page expose useful fleet metadata, but the product stops at a read-only list. The split also leaves two Codex integrations with separate App Server clients and configuration.

For a user who has both Codex and OpenClaw installed on macOS, eligible native Codex sessions should appear automatically in OpenClaw and remain Codex sessions when work continues. OpenClaw must not route a supervised Chat through another model or silently take over a source thread that another Codex process may own.

Proposed solution

• Move supervision into the official codex plugin under plugins.entries.codex.config.supervision.
• Use the Codex plugin's App Server runtime for the harness, native thread tools, and supervision UI.
• List only non-archived CLI and VS Code Codex sessions from the Gateway and opted-in paired nodes.
• Let a stored or idle Gateway-local row create or reopen a model-locked OpenClaw Chat branch.
• On the branch's first turn, pin a source snapshot through Codex App Server, start a canonical full Codex harness thread using the model/provider selected by Codex, inject bounded visible user/assistant history, and leave the source unchanged.
• Keep every later supervised turn on the private supervision connection; reject OpenClaw model changes, resets, binding replacement, fallback, and agent-home substitution.
• Allow archive only for freshly verified idle or activity-unknown Gateway-local sources after explicit no-other-runner confirmation.
• Keep active sources and paired-node rows visible but read-only. Current node invocation is unary; safe remote continuation needs a correlated streaming runner bridge, while remote archive needs runner-ownership fencing.
• Make guided Codex setup enable supervision unless the source config explicitly opts out.
• Add a doctor migration from shipped codex-supervisor configuration and policy entries, while retaining bounded compatibility for shipped tool/MCP names.
• Update the Control UI, macOS node catalog bridge, docs, generated inventories, and tests.

Product boundary

This issue does not claim exact-thread takeover or simultaneous writers. Codex App Server status is process-local, so an independent Desktop or CLI process may still own a thread that another stdio server reports as not loaded. Branching avoids mutating the source; archive requires informed confirmation.

Paired nodes are metadata-only in this phase. A separate duplex node-runner/lease design is required before remote rows can safely continue, interrupt, or archive.

Archived sessions are intentionally absent from the OpenClaw catalog. Native Codex surfaces remain the recovery/unarchive path.

Alternatives considered

1. Keep codex-supervisor separate and add mutations there. This preserves duplicate protocol/runtime ownership.
2. Import Codex sessions as generic OpenClaw sessions. This can continue a Codex-looking session through the wrong model or runtime.
3. Resume the exact source from an independent App Server. This lacks cross-process runner/approval ownership and cannot add the full OpenClaw harness tool surface to an existing native thread.
4. Keep the fleet page read-only. Safe, but it does not solve the local continuation workflow.

Impact

• A normal Codex plus OpenClaw installation can expose native non-archived sessions after the Codex backend passes guided setup.
• Existing codex-supervisor users receive a doctor migration.
• Supervised Chats remain Codex-native and model locked.
• Unsafe active or remote takeover remains unavailable rather than guessed.

Evidence and related work

• [Feature]: View Codex sessions across Gateway and paired nodes #102503 defined the fleet catalog foundation as read-only.
• feat: show Codex sessions across Gateway and paired nodes #102586 implemented the current Gateway/node catalog and UI foundation.
• Feature: adopt existing local Codex session into OpenClaw (handoff loop) #30995 established command-level Codex session adoption.
• [Feature]: Make OpenClaw sessions first-class in the Codex plugin #103621 is complementary work in the opposite direction: exposing OpenClaw sessions to Codex.