[K6] Runtime port and Codex app-server adapter

kilo commented

2026-09-22 16:49:35 +00:00

Member

Goal

Implement the Runtime port and Codex app-server reference adapter for immutable Attempt start, observation, interruption, candidate retrieval, identity attestation, and recovery/reconciliation.

Why

Codex is replaceable; one existing harness is needed for the first live slice without making its protocol a core dependency.

Scope

In scope

Runtime conformance for start/observe/interrupt/retrieve/reconcile; Codex capability/version negotiation; immutable mapping; requested/resolved/observed identity; domain rejection separation; lost reply, duplicate, restart, cancel, quiet-health, delayed-observation, terminal-replay, invalid-candidate, and unavailable-recovery fixtures.

Out of scope

Codex in core, agent loops/tools, provider routing/model policy, custom protocol, sandbox, M5-B, live credentials in tests, and acceptance decisions.

Acceptance Criteria

Adapter passes the Runtime suite and records requested/resolved/observed identity separately.
Lost replies, duplicate starts, delayed healthy work, terminal replay, missing sessions, and cancel races do not duplicate Attempts.
Unsupported recovery/identity is unknown/unavailable; transport success with domain rejection remains rejection.
Fake runtime proves core works when Codex is unavailable; no core module imports Codex details.
Capability/version mismatch fails closed without weakening the contract.

Constraints

Direct prerequisite: issue #7. Direct dependent: issue #10.
Preserve ADR 0004, docs/architecture/contracts.md, and threat model; use native supported app-server interfaces only.

Links

Parent: issue #3 #3
Direct prerequisite: issue #7 #7
Direct dependent: issue #10 #10
Architecture: docs/architecture/contracts.md, docs/adr/0004-ports-and-resources.md, docs/architecture/threat-model.md

## Goal Implement the Runtime port and Codex app-server reference adapter for immutable Attempt start, observation, interruption, candidate retrieval, identity attestation, and recovery/reconciliation. ## Why Codex is replaceable; one existing harness is needed for the first live slice without making its protocol a core dependency. ## Scope ### In scope Runtime conformance for start/observe/interrupt/retrieve/reconcile; Codex capability/version negotiation; immutable mapping; requested/resolved/observed identity; domain rejection separation; lost reply, duplicate, restart, cancel, quiet-health, delayed-observation, terminal-replay, invalid-candidate, and unavailable-recovery fixtures. ### Out of scope Codex in core, agent loops/tools, provider routing/model policy, custom protocol, sandbox, M5-B, live credentials in tests, and acceptance decisions. ## Acceptance Criteria - [ ] Adapter passes the Runtime suite and records requested/resolved/observed identity separately. - [ ] Lost replies, duplicate starts, delayed healthy work, terminal replay, missing sessions, and cancel races do not duplicate Attempts. - [ ] Unsupported recovery/identity is unknown/unavailable; transport success with domain rejection remains rejection. - [ ] Fake runtime proves core works when Codex is unavailable; no core module imports Codex details. - [ ] Capability/version mismatch fails closed without weakening the contract. ## Constraints - Direct prerequisite: issue #7. Direct dependent: issue #10. - Preserve ADR 0004, `docs/architecture/contracts.md`, and threat model; use native supported app-server interfaces only. ## Links - Parent: issue #3 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/3 - Direct prerequisite: issue #7 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/7 - Direct dependent: issue #10 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/10 - Architecture: `docs/architecture/contracts.md`, `docs/adr/0004-ports-and-resources.md`, `docs/architecture/threat-model.md`

kilo referenced this issue

2026-09-22 16:52:40 +00:00

[Kernel v0] First useful vertical slice #3

kilo referenced this issue

2026-09-22 16:52:41 +00:00

[K4] Evidence-based verification, acceptance, remediation, and outcomes #7

kilo referenced this issue

2026-09-22 16:54:10 +00:00

[K7] CLI reference slice and restart/recovery proof #10

kilo referenced this issue from a pull request that will close it,

2026-09-27 16:02:18 +00:00

[K6] Add bounded Codex app-server Runtime adapter #26

kilo commented

2026-09-27 16:02:47 +00:00

Author

Member

Delivery ledger for #8 (append subsequent review/remediation entries on this issue): PR #26 #26; branch issue-8-runtime-codex -> develop; initial HEAD f80e61c78f1368293acaf38b883ef2d1e91eeb70; max_remediation_cycles = 10; remediation_used = 0. Changed README, Codex Runtime/stdio adapters, and synthetic tests. uv run --locked pytest tests/test_codex_runtime.py tests/test_codex_stdio.py: 19 passed; make check: 509 passed with all gates; make package-check: passed. No dependency/tooling change, so audit not applicable. Acceptance evidence: native start/read/interrupt, identity separation with unavailable generated-turn attestation, unknown recovery and no duplicate uncertain sends, fail-closed version/method checks, Codex-free fake Runtime suite. Risk: schema method inventory must be supplied from pinned installed binary; no live Codex tested. Review pending; issue remains open.

Delivery ledger for #8 (append subsequent review/remediation entries on this issue): PR #26 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/26; branch `issue-8-runtime-codex` -> `develop`; initial HEAD `f80e61c78f1368293acaf38b883ef2d1e91eeb70`; `max_remediation_cycles = 10`; `remediation_used = 0`. Changed README, Codex Runtime/stdio adapters, and synthetic tests. `uv run --locked pytest tests/test_codex_runtime.py tests/test_codex_stdio.py`: 19 passed; `make check`: 509 passed with all gates; `make package-check`: passed. No dependency/tooling change, so audit not applicable. Acceptance evidence: native start/read/interrupt, identity separation with unavailable generated-turn attestation, unknown recovery and no duplicate uncertain sends, fail-closed version/method checks, Codex-free fake Runtime suite. Risk: schema method inventory must be supplied from pinned installed binary; no live Codex tested. Review pending; issue remains open.

kilo commented

2026-09-27 16:12:35 +00:00

Author

Member

Delivery ledger continuation, review cycle 1: reviewed HEAD f80e61c78f1368293acaf38b883ef2d1e91eeb70 -> develop (unchanged). profile=repository_review; monotone floor L4, capability minima reasoning/coding/tool_use 5/5/5, requires_tool_use=true, requires_reasoning_mode=true; known author floor unavailable (not guessed). router_selected=zai/glm-5.3/max; dispatched=zai-coding-plan/GLM-5.3/max (documented provider adapter, no fallback); catalog v4, profile policy v8, degraded=false. Agent Manager request am-1790525077380-494scb, reviewer session ses_f1c6387ccffeQ2tocd2g7FC5It; task-level resolution explicitly GLM-5.3 (zai-coding-plan) · max: DISPATCH_VERIFIED; reviewer completed. Independent review #26 (comment) (Forgejo review id 645): substantive_verdict=APPROVE from ### Overall Recommendation, forgejo_review_state=COMMENT, platform_approval_recorded=false; 0 blocking findings, blocker IDs none, remediation=none; resulting HEAD unchanged; remediation_used=0 / 10. Shared kilo PR-author/reviewer identity is observed; the reviewer deliberately submitted COMMENT, so no platform rejection was observed and no formal-approval-equivalence is claimed. Branch-protection details could not be inspected (MCP denied admin access); no formal approval requirement is assumed. make check 509 passed; make package-check passed; required PR workflow run #2024 succeeded for exact HEAD. Issue open, PR unmerged.

Delivery ledger continuation, review cycle 1: reviewed HEAD `f80e61c78f1368293acaf38b883ef2d1e91eeb70` -> `develop` (unchanged). `profile=repository_review`; monotone floor `L4`, capability minima reasoning/coding/tool_use `5/5/5`, `requires_tool_use=true`, `requires_reasoning_mode=true`; known author floor unavailable (not guessed). `router_selected=zai/glm-5.3/max`; `dispatched=zai-coding-plan/GLM-5.3/max` (documented provider adapter, no fallback); catalog v4, profile policy v8, degraded=false. Agent Manager request `am-1790525077380-494scb`, reviewer session `ses_f1c6387ccffeQ2tocd2g7FC5It`; task-level resolution explicitly `GLM-5.3 (zai-coding-plan) · max`: `DISPATCH_VERIFIED`; reviewer completed. Independent review https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/26#issuecomment-12290 (Forgejo review id 645): `substantive_verdict=APPROVE` from `### Overall Recommendation`, `forgejo_review_state=COMMENT`, `platform_approval_recorded=false`; 0 blocking findings, blocker IDs none, remediation=none; resulting HEAD unchanged; `remediation_used=0 / 10`. Shared `kilo` PR-author/reviewer identity is observed; the reviewer deliberately submitted COMMENT, so no platform rejection was observed and no formal-approval-equivalence is claimed. Branch-protection details could not be inspected (MCP denied admin access); no formal approval requirement is assumed. `make check` 509 passed; `make package-check` passed; required PR workflow run #2024 succeeded for exact HEAD. Issue open, PR unmerged.