canary-native-codex56-fresh — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-908`
Agent identity	`02e879681e52e0a384106169be043416c4d946e850ab26b2269c57681b52a6e7`
Model	`codex:gpt-5.6-sol`
Created	2026-07-26T22:16:35.893964324+00:00
Started	2026-07-27T06:19:44.994918870+00:00
Completed	2026-07-27T06:37:42.754604819+00:00

Description

Objective

Run a real, bounded clean-room canary of WG using the native Codex CLI—not Pi—with codex:gpt-5.6-sol at high reasoning for workers and codex:gpt-5.6-luna at high reasoning for evaluation. This task itself is intentionally pinned to native Codex Sol, so its parent-agent metadata is the first route proof.

Procedure

Confirm codex login status succeeds. Never read, print, copy into artifacts, or expose credential contents.
Create a disposable temporary HOME and fresh git repository. Reuse only Codex authentication by a protected symlink.
Prevent graph contamination: unset inherited WG_DIR and use the absolute installed WG binary plus explicit --dir <temp-repo>/.wg for every nested WG command.
In the fresh HOME, clone the embedded codex starter to a unique codex-56-high profile; set strong=codex:gpt-5.6-sol, weak=codex:gpt-5.6-luna, strong reasoning=high, weak reasoning=high; select it for only the fresh project.
Assert wg config --models resolves task_agent to handler=codex/Sol/high and evaluator to handler=codex/Luna/high, with no pi:openai-codex:* identity.
Start the nested service with one agent. Publish one tiny worker task that creates a deterministic canary file and calls wg_done. Bound all waits.
Assert exactly one nested worker attempt completes and its metadata records executor=codex, model=codex:gpt-5.6-sol, native_model=gpt-5.6-sol, reasoning=high.
Run one manual evaluation of that immutable completed candidate. Assert exactly one evaluator invocation/record uses executor=codex, route=codex:gpt-5.6-luna, reasoning=high and produces a parseable verdict. Keep automatic evaluation, FLIP, and hard gating disabled.
Create an explicit native Codex Sol chat, send an exact-token prompt, verify the reply, restart the nested daemon, send a context-dependent second turn, and prove native session resume rather than a fresh conversation.
Put failing pi and claude sentinels ahead of PATH inside the nested service and assert neither is invoked; native Codex failures must remain native Codex failures. Do not shadow the real codex binary.
Always stop the nested service and delete the disposable HOME/repo. Preserve only redacted command/status/metadata evidence in the parent task log; no secrets or raw auth bytes.
Do not modify the parent project config/profile/service and do not compile the WG repository.

Validation

Parent task agent itself is native Codex Sol/high, not Pi.
Fresh project profile resolves native Sol worker/high and native Luna evaluator/high.
Real Sol worker completes exactly once with exact metadata and deterministic artifact.
Real Luna evaluation completes exactly once with exact route/reasoning and a parseable verdict.
Native Codex chat replies, survives daemon restart, and resumes the same conversation.
Pi/Claude sentinel invocation count is zero; no cross-runtime fallback.
Nested service is stopped and temporary state removed on success or failure.
Redacted results are logged with wg log; then call wg_done on this parent task.

## Objective
Run a real, bounded clean-room canary of WG using the native Codex CLI—not Pi—with `codex:gpt-5.6-sol` at high reasoning for workers and `codex:gpt-5.6-luna` at high reasoning for evaluation. This task itself is intentionally pinned to native Codex Sol, so its parent-agent metadata is the first route proof.

## Procedure
- Confirm `codex login status` succeeds. Never read, print, copy into artifacts, or expose credential contents.
- Create a disposable temporary HOME and fresh git repository. Reuse only Codex authentication by a protected symlink.
- Prevent graph contamination: unset inherited `WG_DIR` and use the absolute installed WG binary plus explicit `--dir <temp-repo>/.wg` for every nested WG command.
- In the fresh HOME, clone the embedded `codex` starter to a unique `codex-56-high` profile; set strong=`codex:gpt-5.6-sol`, weak=`codex:gpt-5.6-luna`, strong reasoning=high, weak reasoning=high; select it for only the fresh project.
- Assert `wg config --models` resolves `task_agent` to handler=codex/Sol/high and `evaluator` to handler=codex/Luna/high, with no `pi:openai-codex:*` identity.
- Start the nested service with one agent. Publish one tiny worker task that creates a deterministic canary file and calls `wg_done`. Bound all waits.
- Assert exactly one nested worker attempt completes and its metadata records executor=codex, model=`codex:gpt-5.6-sol`, native_model=`gpt-5.6-sol`, reasoning=high.
- Run one manual evaluation of that immutable completed candidate. Assert exactly one evaluator invocation/record uses executor=codex, route=`codex:gpt-5.6-luna`, reasoning=high and produces a parseable verdict. Keep automatic evaluation, FLIP, and hard gating disabled.
- Create an explicit native Codex Sol chat, send an exact-token prompt, verify the reply, restart the nested daemon, send a context-dependent second turn, and prove native session resume rather than a fresh conversation.
- Put failing `pi` and `claude` sentinels ahead of PATH inside the nested service and assert neither is invoked; native Codex failures must remain native Codex failures. Do not shadow the real `codex` binary.
- Always stop the nested service and delete the disposable HOME/repo. Preserve only redacted command/status/metadata evidence in the parent task log; no secrets or raw auth bytes.
- Do not modify the parent project config/profile/service and do not compile the WG repository.

## Validation
- [ ] Parent task agent itself is native Codex Sol/high, not Pi.
- [ ] Fresh project profile resolves native Sol worker/high and native Luna evaluator/high.
- [ ] Real Sol worker completes exactly once with exact metadata and deterministic artifact.
- [ ] Real Luna evaluation completes exactly once with exact route/reasoning and a parseable verdict.
- [ ] Native Codex chat replies, survives daemon restart, and resumes the same conversation.
- [ ] Pi/Claude sentinel invocation count is zero; no cross-runtime fallback.
- [ ] Nested service is stopped and temporary state removed on success or failure.
- [ ] Redacted results are logged with `wg log`; then call `wg_done` on this parent task.

Depends on

done fix-native-codex-lightweight-evaluator

Required by

(none)

Log

2026-07-26T22:16:35.873761044+00:00 Task paused
2026-07-26T22:16:36.149789507+00:00 Task published
2026-07-26T22:16:37.904173900+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-905 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer state already exists; use open_at for restart reconciliation
2026-07-26T22:17:24.328187638+00:00 Spawned by coordinator --executor codex --model codex:gpt-5.6-sol --isolation required-worktree
2026-07-26T22:17:59.476049308+00:00 Starting clean-room native Codex 5.6 canary. Parent route proof: executor=codex, model=codex:gpt-5.6-sol, reasoning=high. No parent configuration/service changes; no repository compilation.
2026-07-26T22:27:40.077312862+00:00 Prepared a bounded clean-room harness with protected auth symlink, explicit --dir routing, all inherited WG variables removed, real Codex subprocess monitoring, Pi/Claude sentinels, daemon cleanup trap, and no Codex wrapper.
2026-07-26T22:30:23.970175139+00:00 Canary checkpoint: real Sol worker completed exactly once with native metadata and deterministic artifact. Manual evaluator failed before invoking Codex: error[WG-PI-ROUTE-REQUIRED], role=evaluator, resolved route=codex:gpt-5.6-luna. Pi/Claude sentinels remained zero and cleanup removed the nested service/temp state.
2026-07-26T22:30:40.400812571+00:00 Created and published prerequisite fix-native-codex-lightweight-evaluator for the native Codex one-shot evaluator rejection; canary now explicitly depends on that fix.
2026-07-26T22:30:46.793950724+00:00 Corrected prerequisite edge orientation: canary now waits on fix-native-codex-lightweight-evaluator (no cycle).
2026-07-26T22:31:04.724978961+00:00 Committed reproducible canary harness: 4a327bef. Validation executed: bash syntax/diff checks pass; real clean-room run passed profile + one Sol worker and stopped at the confirmed native evaluator routing defect. Repository compilation intentionally not run per task constraint.
2026-07-26T22:31:45.406538226+00:00 Pushed commit 4a327bef to origin branch wg/agent-905/canary-native-codex56-fresh.
2026-07-26T22:32:04.399919150+00:00 Task marked as incomplete (attempt #1 (2 remaining)): Clean-room canary passed parent/profile/Sol-worker checks but installed WG rejects native Codex evaluator routes with error[WG-PI-ROUTE-REQUIRED] before launching Luna. Re-run after prerequisite fix-native-codex-lightweight-evaluator completes and installs the corrected binary; then validate Luna evaluation and restart-resumed Sol chat.
2026-07-26T22:33:00.909610437+00:00 Reconciliation: task recovered from orphaned state (was InProgress, agent: (none))
2026-07-27T06:19:44.202454793+00:00 Task reset for retry from failed (attempt #3) — reason: Retry preserved clean-room harness after native Codex Luna evaluator fix 6508ea3e was installed from current main
2026-07-27T06:19:45.404383442+00:00 Spawned by coordinator --executor codex --model codex:gpt-5.6-sol --isolation required-worktree
2026-07-27T06:20:11.982572301+00:00 Retrying committed clean-room harness after evaluator fix. Parent route proof: executor=codex, model=codex:gpt-5.6-sol, reasoning=high; will record only redacted evidence and will not compile.
2026-07-27T06:22:19.021966127+00:00 Retry checkpoint: profile and exactly-one Sol worker passed; manual Luna evaluation returned exit 0, but harness direct-child PID sampler observed zero Codex descendants and failed before record validation. Cleanup trap removed nested service/temp state. Updating sampler to traverse the background command's descendant tree; runtime behavior is unchanged.
2026-07-27T06:28:23.023105071+00:00 Retry checkpoint: real Luna evaluation again returned success. Recursive sampling observed a single Codex CLI lineage with three model-bearing processes, so invocation proof is now anchored to the unique installed codex.js entrypoint plus exactly one evaluation record. Added bounded wait for the done worker wrapper PID to exit before teardown to prevent late accounting writes.
2026-07-27T06:33:07.651655840+00:00 Retry checkpoint: evaluator returned success but 20ms polling missed the short-lived JS entrypoint, proving /proc sampling nondeterministic. Replaced it with execve-only tracing that must show exactly one successful launch of the absolute real Codex binary with Luna/high; raw trace stays disposable and unlogged.
2026-07-27T06:36:53.215296887+00:00 PASS redacted canary evidence: parent metadata executor=codex model=codex:gpt-5.6-sol native_model=gpt-5.6-sol reasoning=high; login=status-success; inherited-WG guard=all-unset; fresh task_agent=codex:gpt-5.6-sol/high; evaluator=codex:gpt-5.6-luna/high; worker attempts=1 exact metadata + deterministic artifact; evaluator invocations=1 exact real-Codex exec + one parseable verdict record; chat first reply=exact; restart resume=same session + exact context reply; pi sentinel=0; claude sentinel=0; nested service=stopped; temp state=removed (immediate and delayed checks). No secrets/raw auth/model transcripts preserved.
2026-07-27T06:37:14.944964454+00:00 Committed: c419ca25 — pushed to remote. Validation: bash -n + git diff --check pass; full real clean-room canary PASS; delayed cleanup PASS. Cargo build/test/install intentionally not run because this task forbids compiling the WG repository.
2026-07-27T06:37:42.754605389+00:00 Task marked as done