codex harness: perpetual procevent sources go ownerless across idle turns (no cross-turn continuity)

[tiago-peixoto]

Summary

A Codex-harness primary or secondmate cannot keep a perpetual process-event source alive across idle turns. bin/fm-watch-checkpoint.sh reconciles and restarts sources at each checkpoint, but only while a turn is active; when the last actionable turn ends, nothing owns the source until the next captain-triggered turn. A perpetual source that goes single-shot after each result therefore sits ownerless indefinitely.

Observed behavior, measured

Secondmate on harness=codex, owning a perpetual GitHub PR-monitoring source (bin/fm-procevent.sh, single-shot after each actionable result by design, relying on ordinary watcher reconciliation to re-arm):

• Last successful inventory 2026-08-15T11:51:57Z; it emitted sequence 14, the source exited, the result stayed pending.
• At diagnosis ~40 hours later: bin/fm-procevent.sh list reported OWNER none, PENDING 1; the session-start guard reported the last watcher beat ~144,900 s old.
• Consequence: a captain-authored PR opened during the interval was never inventoried, and a base squash-merge that turned another PR conflict-dirty was never observed. Both had correct predicates; there was simply no observation interval.

Diagnosis and evidence: the secondmate's own report confirmed "Codex checkpoints reconcile and restart sources at each checkpoint, but only while a turn is active, so there is no cross-turn continuity."

Why this is a harness-protocol defect, not a source defect

The procevent contract is explicit: the handler acknowledges the captured result and ordinary reconciliation keeps the perpetual source armed. On Claude the Stop-owned auto-arm (bin/fm-claude-stop-autoarm.sh) supplies that continuity across idle turns with no model tokens. On Pi/opencode the extension model does. Codex's protocol is bounded foreground checkpoints (docs/supervision-protocols/codex.md) precisely because Codex cannot reason while a foreground call runs - which is correct for wakes but leaves no idle-turn owner for source reconciliation. The same-shaped hazard exists for any Codex home relying on procevent.

What we would find useful

• A Codex-side idle-turn continuity mechanism for procevent reconciliation - the smallest shared correction, not a per-source sidecar or scheduler (which the secondmate correctly refused to build).
• Failing that, bin/fm-procevent.sh could surface OWNER none with a stale-age loudly through the session-start digest and the daemon heartbeat scan, so a dead perpetual source becomes a visible alarm rather than a silent absence. The 40-hour gap here was discovered by a captain asking "why wasn't this PR reviewed?", which is the wrong instrument.

Firstmate fork at the current upstream tip; happy to contribute either fix. Related: this is the procevent-side twin of the supervision-starvation class fixed in #2392.

[kunchenguid]

Speaking as Kun's firstmate:

Triage on current main 3f035336f9df (2026-08-21). Full thread read (body, no comments). Author is tiago-peixoto, not kunchenguid/automation.

VISION.md per-rule

• Peace of mind / nothing falling through the cracks: aligns. A 40-hour ownerless gap during which a captain-authored PR was never inventoried is the failure mode the product exists to prevent. Inspected: issue measured evidence (OWNER none, PENDING 1, last inventory 2026-08-15T11:51:57Z).
• One captain, one interface: aligns. A dead perpetual source presenting as silence hides a failure. Inspected: VISION "never hide a failure"; session-start has no OWNER none stale alarm.
• Authority is explicit and never inferred: cannot tell as a consent question; the defect is missing observation, not assumed autonomy. Inspected: no authority-path change requested.
• Scripts own the mechanics / token efficiency: aligns. Idle continuity should be a scripted harness hook with no model tokens, the way Claude's Stop-owned auto-arm already is. Inspected: bin/fm-claude-stop-autoarm.sh vs Codex protocol.
• A restart is a non-event: aligns. A perpetual procevent source must survive the death of a turn. Inspected: bin/fm-procevent.sh reconcile starts ownerless registered sources, but only when something calls it.
• Delegation with a spine: aligns. Supervision is independent validation of the world; no observation interval means no supervision. Inspected: issue (predicates were correct; nothing was looking).
• The fleet outlives any vendor: aligns. Harness adapters must supply the same semantic (cross-turn source liveness) even when the vendor's protocol differs. Inspected: Claude Stop auto-arm, Pi/OpenCode extension continuity, Codex bounded foreground checkpoints only.
• Scope: aligns. This is harness-protocol command-layer work, not workshop validation.

Inspection on current main (claimed paths checked)

Still a real harness-protocol defect. Not fixed.

• docs/supervision-protocols/codex.md on main: Codex owns supervision only as bounded foreground bin/fm-watch-checkpoint.sh cycles during a turn. Quiet checkpoint → drain → next checkpoint. "Codex cannot reason while a foreground tool call is running." There is no idle-turn owner.
• .codex/hooks.json: SessionStart → fm-sessionstart-run.sh; PreToolUse seatbelts; Stop → bin/fm-turnend-guard.sh with timeout 30. No async Stop auto-arm equivalent of Claude's asyncRewake hook.
• bin/fm-watch-checkpoint.sh runs fm-watch.sh in the foreground and exits. When the last actionable turn ends, the checkpoint is gone.
• bin/fm-procevent.sh reconcile will start a runner for a registered source with no live owner — only on an ordinary watcher cycle. Perpetual sources that exit after each result stay ownerless until that cycle runs.
• bin/fm-supervision-instructions.sh Codex repair line is "run another foreground checkpoint" (requires a turn). Claude's line names Stop-owned automatic recovery.
• bin/fm-session-start.sh fleet-state dump does not surface fm-procevent.sh list OWNER none or a stale-age alarm.
• bin/fm-inactive-reconcile.sh is crewmate terminal-outcome scan, not procevent continuity.

Related class: the issue names this as the procevent-side twin of supervision-starvation #2392. Latest main recovery work (#2733, Pi/OpenCode handshake) does not give Codex an idle-turn procevent owner.

Labeling ready-for-pr and leaving open. Prefer a shared Codex idle-turn continuity mechanism for procevent reconciliation over a per-source sidecar. Failing that, OWNER none with stale-age must alarm through session-start and the heartbeat scan rather than sitting silent.