Bind Codex app-server threads at controlled launch

[myobie]

Five-PR review order

Please read the native-delivery set in this order:

1. Specify declared native DING delivery #229 — shared native-delivery VRS: selector, durability, retry, and legacy-transport boundaries. Start here.
2. Add declared native delivery selector #230 — selector and Doctor implementation: parses deliver "mcp" / deliver "app-server" and preserves legacy ding.
3. docs(vrs): specify Claude native DING delivery #232 — Claude-specific MCP channel contract and live provider evidence. This path is parked pending provider organization policy.
4. docs(vrs): specify Codex native DING delivery #233 — Codex-specific app-server contract: thread ownership, delivery state machine, and typed receipt.
5. Bind Codex app-server threads at controlled launch #234 — this PR: the first Codex implementation slice, limited to controlled launch and durable thread binding.

These are two related dependency branches, not one linear Git stack: #232 and #233 are based on #229; #234 is based on #230. All five remain draft, unmerged, and held for Nathan's exact-head review.

Summary

• lower deliver "app-server" canonical Codex tasks through a hidden controlled-launch wrapper
• start a dedicated Codex 0.145.0 app server on a private host-local Unix socket and initialize an observer before the TUI starts
• persist an agent/runtime/incarnation-bound thread identity for both new threads and successful resumes
• auto-resume the prior thread without treating its old incarnation as current ownership
• refuse concurrent owners with a non-blocking process lock and fail closed on protocol, argv, binding, or control ambiguity

This is the topology and thread-binding slice only. It does not watch inboxes or send messages; those remain later adapter work. It is stacked on the delivery selector draft (#230) and implements the controlled-launch boundary specified by #233.

Contract details

• The provider protocol is pinned to codex-cli 0.145.0.
• Unix app-server transport uses the required WebSocket handshake before JSON-RPC initialization.
• A new thread binds from the first typed thread/started event.
• A prior thread becomes current only after the fresh dedicated daemon reports that exact thread as idle or active; the binding is then atomically rewritten with the new runtime incarnation.
• Review/fork thread events cannot silently replace the first binding.
• A rejected second owner cannot publish a new incarnation or invalidate the live owner.
• The wrapper terminates the TUI if control closes and tears down its exact child daemon on exit.

Verification

Green on exact head fd5ba46:

• cargo check --locked
• cargo test --locked --lib — 262 st2, 7 agent-spec, and 5 wire tests
• cargo test --locked --test codex_app_server — 3/3
• cargo test --locked --test reconcile — 37/37
• cargo test --locked --test run — 45/45
• cargo test --locked eval_run:: — 29/29
• cargo clippy --all-targets --locked — no new warnings; only existing repository warnings
• rustfmt --check --edition 2024 src/codex_app_server.rs tests/codex_app_server.rs

Live Codex 0.145.0 evidence used one dedicated daemon/control/TUI topology. A fresh launch bound thread 019fec97-c2ed-74b3-a693-71f2ba62577c. A later controlled launch resumed that exact conversation, returned FINAL_BIND, rotated the runtime incarnation, and rewrote the binding so it matched the new incarnation while retaining the same thread ID. Normal TUI exit left no Unix socket or disposable PTY residue.

The repository-wide test command still encounters the pre-existing catalog_diff::classification_only_and_nested_agent_filename_changes_are_exact failure, reproduced on the base branch. The existing eval_up host-qualified runtime-ID expectation mismatch is likewise present on the base. Neither path is changed here. Hosted Nix remains the PR gate.

[myobie]

Folded into the reviewable implementation replacement #241 at exact head d8269638bc6a82e4b2f9ce29b2e8509be5bd2337. The replacement preserves this draft’s relevant history and has exact-head hosted Nix green. Closing this superseded draft; its branch is intentionally retained.