[Subscription Providers 2/7] Current Code Mode and task-preserving Collaboration V2

[NOirBRight]

Part of #603.

Acceptance

Extend the existing request-scoped tool compatibility and directed-message modules for current caller declarations, flat custom exec and child subsets. Expose only actually declared handlers; preserve exact custom input, typed Item identity, Call identity, stream order, tool results and same-child followup. Prevent opaque assignments in both official/subscription directions. Recover only an authoritative exact assignment with matching author/recipient/call provenance; never execute JavaScript in Gateway, infer plaintext from ciphertext or substitute a placeholder. Opaque-only tasks require caller-owned restatement/reissue using original requirements and child state/results without replaying effects. Reuse current codecs. Deterministic adversarial lifecycle/history tests and bounded current-Codex Code Mode/V2 evidence; retained malformed envelopes and zero-width exact-output failures remain failures.

Dependencies

None.

Verification

Risk class: strict. Follow docs/agents/verification-policy.md and docs/specs/cli-subscription-providers.md. Historical feasibility does not qualify the production candidate.

[NOirBRight]

Draft integration PR: #614. Current production source is reviewed through e9449930; the later commits add tests/evidence only.

The missing source-prevention branch for actual codex_exec/0.159.3 is fixed in the existing Official compatibility request/SSE path. Public pipeline tests prove scoped declared handlers and separate Call/Item identity. Empty-account actual CLI → real Gateway → fake Official proves ALIAS → native encrypted_function_args:[] → original child input_text, with zero vendor calls.

One bounded real Official-parent → Cursor-child V2 run on exact e9449930 passed: one child, two actual Code Mode fixture reads, same-child followup/wait, exact output, actual Gateway restart and fresh caller/completed history. All 15 Responses requests were HTTP200; all 26 agent-message part sequences were plaintext. Private account trees/snapshot were removed. Evidence: docs/evidence/subscription-official-cursor-e9449930-2026-10-01/.

The earlier Cursor-parent → Official-child/Code Mode/restart passes remain tied to their own e13e2fd0 snapshot; historical reverse-V2 failure remains unchanged. No same-SHA four-case qualification is invented.

This issue remains open: authoritative observed-assignment recovery has no production observer/trusted author and source-Call association, and unrelated old opaque-history handling remains partial. The test-only recovery helper is not claimed as implemented production recovery. Incomplete followups such as “Continue” do not justify dropping ciphertext or replaying completed effects.

[NOirBRight]

Orchestrator decision — source association investigation, 2026-10-05

The first Codex / GPT-6.1 Sol High design round is complete, without production changes or tests. I independently checked the immutable d5e5a85 helper, Gateway rejection path, V1 signed fields and ADR-0018. #605 is not accepted or closed.

Confirmed gap: current child agent_message input lacks the parent's executed source-Call/delivery association. Native declarations establish handler shapes, V1 signatures establish model/effort/Call binding, and address/text matching does not establish the message's execution source. ObservedAssignment has no production consumer and does not itself verify such association. The sanitized reviewed frames show child requests arriving without the parent's spawn source pair; historical observations retain their original candidate/runtime identity.

Accepted direction for the next investigation: find a caller-runtime-owned execution/delivery receipt attached to the receiving request/history, scoped to actual actor/root/thread instances and exact source/target Item identity. The local trust boundary must be derived from real caller implementation; a trusted local adapter may suffice, and remote signing infrastructure is not presumed necessary. Receipt schema, authentication transport and persistent journal are not implementation-approved until a supported caller hook and fixture are established.

Required behavior remains unchanged: recover only exact observed mislabelled plaintext with explicitly matching provenance; never reconstruct ciphertext, infer authority from model text/shared bearer headers/Continue, omit essential old history, normalize output or replay effects. Until the caller supplies the missing association, retain visible bounded rejection before upstream work and caller-owned restatement/reissue.

New prerequisite #635 investigates actual installed Codex/T3 execution-event and durable-history interfaces, including nested custom-exec collaboration, actor lineage, successful enqueue/delivery, target message/part and supersession. It is registered as a native blocker of #605. A second read-only Codex / GPT-6.1 Sol High Agent is running. It must return an actual supported integration fixture or a precise externally owned capability/change proposal; similarly named SDK APIs and speculative Gateway journals do not satisfy it.

Full round-one report is retained by this orchestrator at /var/tmp/codexhub-campaign-20261005.23SPun/provenance-r1.md. The next Agent received the original brief, full prior findings, parent's response and unresolved objections. #632 remains the sole code writer; #633 waits for reviewed integration.

[NOirBRight]

Orchestrator acceptance — #635 investigation, 2026-10-05

Accepted as a completed research/dependency report. It does not implement production recovery or close #605. I read the report/fixtures, checked native message dispatch and actual MCP metadata insertion in version-matched source, verified all listed source/artifact SHA-256 identities, and retrieved current official App Server documentation.

Verified conclusions:

• Active installed T3 runtime uses Codex 0.160.0; PATH and historical qualification used 0.159.3. T3 package is 0.0.46-nightly.20261004.2644. These observations do not relabel old runtime evidence.
• Actual MCP requests can carry runtime Call/thread/session and conditional origin Item/window IDs. Their scope is MCP execution. A host nested Call is distinct from the outer custom Item; absent origin stays absent.
• Native collaboration send/spawn has useful execution/enqueue/history seams, but the inspected path does not persist source execution through accepted delivery to exact target agent_message Item/part and the current outgoing request/history. Neither generic command hooks nor UI/raw observation alone supplies the missing causal association.
• T3-owned delegate_task creates an app-owned user_message. Improving its MCP metadata retention would be useful independently, but cannot satisfy native collaboration acceptance by substitution.

Evidence classes remain explicit: observed-t3-child-history.json is a real sanitized current-child T3 history projection; caller-mcp-request-example.json is source-derived/fictitious, not a captured receipt. No complete native receipt fixture was fabricated. Investigation performed no inference, suites, source/account/config changes or upstream publication. The version-matched public Codex tag is not a reproducible-build claim for installed binary bytes.

External prerequisite #638 now records native execution/delivery provenance plus frozen pre-inference current-history binding, its exact owning seams and acceptance fixtures. It is registered as a native blocker/sub-issue of #605 BEFORE this research ticket closes. Gateway integration and all historical recovery acceptance stay open. No installed caller patch, unrelated T3 feature, external repository change, remote-signing system or speculative Gateway journal is approved.

Report and sanitized fixtures retained at /var/tmp/codexhub-campaign-20261005.23SPun/caller-hook-evidence/. Public source identity: Codex rust-v0.160.0 -> a956835d020762cb2b570053af06f643a11c0ecc; T3 package commit 737993303d36. Repository baseline d5e5a85/tree 718acdabe7016eb31c325242333693ec47a087e1.

Official documentation consulted: https://learn.chatgpt.com/docs/app-server ; https://learn.chatgpt.com/docs/hooks . The complete causal-receipt absence is a bounded source/interface finding, not a universal claim that a future hook cannot exist.