Skip to content

Historical inline delivery and parent-only plan

For historical schema-five inline native inspection artifacts and the current parent-only fallback (new native child reviews use schema eight in Prepare and dispatch the complete wave):

Run all selected read-only reviewer passes concurrently: dispatch every independent pass in the frozen wave before waiting for any response. Reviewers may inspect the same files, diff, and evidence; overlapping reads do not require disjoint file ownership or extra approval. Give each reviewer a clear question or axis, and keep the reviewed snapshot stable until all passes join. The parent serializes checkout, source changes, artifact writes, reconciliation, and canonical gates. A single selected pass needs no artificial duplicate. For an assessed review with at least two triggered roles, status=pass requires validated independent specialist coverage except for the complete low-risk parent-only route without required independence described below. Current native paged waves admit naturally fast children through the uninterrupted free-capacity dispatch and complete ordered schedule checks in Prepare and dispatch the complete wave; record independent-spawned when their substantive intervals do not overlap. Historical strict, portable and local reviewer routes retain their overlap gates. Rejected scheduling or missing coverage requires bounded recovery or the disclosed parent fallback, without an internal-consent question; ask only for a concrete missing independent-route decision. Never claim parallelism without observed overlap.

  1. For historical schema-five inline native inspection, prepare non-sensitive contexts before dispatch. Each starts with exact installed role-card bytes, followed by scope inventory, inspection-only instruction, supplied evidence, questions, and the required provenance header format below. Current paged native contexts use the generated audited reads in Prepare and dispatch the complete wave and contain no copied provenance header. Screen for secrets before retaining or sending context; common-secret scanner is detection aid, not guarantee. Keep included/excluded context and coverage gaps explicit. A reviewer may request missing evidence; never turn excerpt-only assessment into unsupported full-source claim.
  2. Freeze inspection-plan.json with exactly consumer_policy={"consumer_id":"code-review","capability":"instruction-bounded-review","promotion_status":"promoted","parent_mutations":"serial","canonical_gates":"serial"}, review_operation="inspection-only", write_policy={"parent_writes":"none","approval_requirement":"not-required"}, source_sensitivity="non-sensitive", review_run_id, parent_thread_id, review_input_sha256, contexts, independent_review_required, and independence_requirement_evidence. contexts contains at most four unique {role_id, context_path, context_sha256} records, with paths relative to and contained by plan directory; use empty list for parent-only review. This historical reader retains its four-context ceiling. An artifact with more required roles remains incomplete: record status=fail and the unmet historical coverage requirement, never a passing parallel result. New reviews retain every role through the schema-eight roster and bounded active pool in Prepare and dispatch the complete wave; do not substitute or drop roles to fit a legacy artifact. Record explicit user requirement as evidence when independent_review_required=true; otherwise use false and null. Mirror these last two fields in review-routing.json. Do not add read_host, review_host, or write approval to this route.
  3. Inspect parallel_execution.py --help and run its preflight --consumer code-review for frozen plan before dispatch. It validates context paths/hashes and scans common secrets before any child receives them. Launch each child with fork_turns="none", complete context as exact message, and hash-bound task name required below. Reviewers return text or probe requests; they do not use any tools. The parent separately assesses authorized safe probes and persists accepted reviewer responses. If returned text exposes sensitive material, stop persistence and use sanitized diagnostics; never publish it as review evidence.
  4. Write specialist-manifest.json with schema version 5, normal run/input/parent identity, optional mirrored sol_selection, and only triggered passes. Bind inspection_execution={"plan_path":"inspection-plan.json","plan_sha256":"<exact digest>"}. Native passes use mode="inspection" and ordinary attempt fields below plus spawn_call_id; retain actual parent/child lineage and received FINAL_ANSWER. Parent-only passes use mode="substituted" without attempts. Do not mix strict runtime_execution, local reviewer wave records, or mode="spawned" into schema 5.
  5. Run normal manifest/result validators after joining wave. Mirror execution_mode, execution_evidence_level="instruction-bounded-review", execution_observed_controls, and write_parallel_eligible=false from inspection summary. Mirror plan's independent_review_required as metadata independence_required and retain independence_requirement_evidence; derive independence_satisfied from actual coverage. Missing or rejected child evidence does not count as independent pass: preserve failed attempt separately, continue parent inspection, and record new parent-only fallback plan with same source and disclosed gap. A fully inspected TRIVIAL or LOCAL schema-five parent-only review may pass when independence was not required and all other gates pass. Other multi-role parent substitutes record a failed or incomplete result.

When strict native launcher cannot establish its mandatory portable reviewer controls, user may explicitly approve separate local reviewer wave. Read that contract before preparing its frozen plan. It is paid, parent-owned local host integration with distinct evidence schema, not native inspection route, fabricated read_host declaration, or automatic permission to retry. Without that approval or passing capability check, preserve process limitation while continuing permitted source inspection.

Rejected events retain only static generated-schema notification names or unrecognized as a diagnostic, never arbitrary method text or payload; the wave still fails closed.

Before every strict portable native spawned route:

  1. Apply shared host compatibility check before preparing specialist context. Role-card defaults, requested profiles, parent controls, or unsupported overrides do not establish compatible child controls. If unavailable, do not dispatch: explicit parallel-read stops with review-host-controls-unavailable-before-dispatch; auto may resolve serial only where independence gate permits it. Never launch work hoping to repair provenance afterward. This check does not apply to instruction-bounded native inspection route in T2 risk-routed specialist fan-out.
  2. For compatible launcher, prepare/hash context, freeze execution plan with read_host={"source":"runtime-tool-contract","sandbox_mode":"read-only","approval_policy":"never"} transcribed from that actual launcher's supported child controls, and run parallel_execution.py preflight --consumer code-review using its documented arguments before dispatch. Historical review_host remains readable.
  3. Missing or incompatible declarations reject explicit parallel-read and make auto resolve serial with compatibility reason. Preflight is compatibility admission, not runtime evidence; authoritative post-run checks stay mandatory. Do not mutate frozen plan after this check.
  4. An explicit serial route with no children may use genuine in-main passes only where independence gates allow them. A serial substitute must be labeled, must not be counted as independent, and must not silently complete user-required independent review.

For every triggered pass:

  • The parent creates <run-directory>/specialists and persists one unchanged markdown response per triggered spawned/substituted pass. Specialists return findings, not file writes. Follow shared read-only work and executable probes boundary for checks requiring scratch writes; retain unresolved specialist conclusions separately from parent-run evidence.
  • Apply ../../../shared/specialist-orchestration.md.
  • For legacy or non-producer routes that require parent-authored contexts, write narrow <run-directory>/specialists/<role>-context.md: objective, axis, relevant evidence, excluded noise, concrete questions, output contract, stop rule. New native runs follow the producer-owned preparation in Prepare and dispatch the complete wave: the parent writes focused briefs referenced by review-briefs.json, while review_prepare.py and review_batches.py create producer-generated contexts.
  • Never give every specialist whole PR/repository.

Parent owns final severity, duplicate merge, conflict resolution, and decision.

For native spawned attempt:

  • Hash completed context before spawn; task name review_<role_with_underscores>_<first_12_context_sha256>_a<attempt>.
  • Record full agent path. This binds runtime child identity to role, context artifact, and attempt even when rollout schema leaves agent_role null.
  • Runtime encrypts actual inter-agent payload: do not claim cryptographic proof plaintext exactly equals saved context; record residual limit in confidence metadata.

Compute SHA-256 for diff.patch and every context pack. Historical schema-five/six native output requires this exact first specialist line (replace placeholders). Current paged prompts request no copied provenance header; dispatch identity, complete audited page reads, terminal output and joins establish provenance. The schema-eight batch-assembly compatibility view in Prepare and dispatch the complete wave is the sole exception; schema-seven and standalone parsers remain strict. Local reviewer wave output uses its separate byte-binding contract without native provenance claims:

<!-- codex-review-provenance role=<role> run=<review_run_id> input=<review_input_sha256> context=<context_sha256> attempt=<n> -->

Routed specialist axes:

  • qa-specialist: tests, edges, regressions, tensor/data boundaries.
  • challenger: adversarial assumptions, high findings, migration/API risks, material no-finding conclusions.
  • Conditional roles: data-steward, cicd-steward, linting-expert, doc-scribe, oss-shepherd, squeezer, scientist, and web-explorer cover named domains. solution-architect and security-auditor remain explicit-selection, read-only advisors and never trigger by matching domain alone; return their evidence to the parent/session for review acceptance.

Use runtime-provided subagents for selected passes, or the parent-only route for TRIVIAL or LOCAL reviews without required independence. Other reviews with two or more triggered roles require validated specialist lineage and coverage before the assessed review can pass. Current native paged waves retain the ordered uninterrupted-dispatch admission in Prepare and dispatch the complete wave; other routes retain their overlap gates. Follow the portable route order in shared orchestration policy for strict routes.

  • A built-in/default child receives exact canonical role card before its context pack. The instruction-bounded native inspection route instead places full role card first, then its scope inventory and relevant evidence inline, and constrains reviewer to text-only inspection; prohibited execution is detected and rejected rather than treated as isolated.
  • It may count as independent only when it has separate child identity/output and artifact records card hash, route, actual model, and observed controls.
  • If the eligible low-risk parent route is selected or no safe subagent route exists, write labeled in-main substitute for each triggered role and set fanout_substituted=true. The first nonblank output line must be role_id: <exact lowercase manifest role ID> (for example, role_id: qa-specialist); a display name alone or an incidental mention is not role binding. Keep the assessment substantive, use one unique output path, and record no spawn attempts. Preserve rejected attempts separately; never relabel them as parent evidence. Two or more triggered roles with a substitute cannot produce a passing assessed result except for the complete low-risk parent-only route without required independence.
  • Substitution lowers confidence and never satisfies independence for critical findings.

The strict portable native specialist-manifest.json uses schema version 3 and contains review_run_id, parent_thread_id=$CODEX_THREAD_ID, review_input_sha256, optional exact mirrored sol_selection, and triggered passes only. New frozen-context native inspection uses schema eight with manifest_kind=native-wave, the actual context_reader_python recipe, complete validated reads, and runtime-bound raw/normalized terminal output. Batched inspection uses the same manifest family with manifest_kind=batched-review and validated constituent native waves. Schema six remains a historical strict reader, including its original header requirement. Historical inline native inspection uses validator-defined schema-five inspection evidence and its inspection_execution binding; keep that route distinct from portable runtime claims. Schema 2 remains readable only for historical artifacts and must not be produced by new review. The explicitly approved local reviewer wave uses schema 4 as described in its linked contract; never mix native spawn attempts into it.

  • Before dispatch, copy the exact installed roles/<role>/ROLE.md bytes for every triggered role to <run-directory>/role-cards/<role>/ROLE.md. Retain these files with the run. Every pass records role_card_sha256 for those bytes. Preflight and candidate validation require each retained file to match both the installed card and manifest digest; promoted-result intake checks the retained file and digest, then uses those bytes for context, model, and route evidence. A later installed-card change does not invalidate a completed run. Each spawn additionally records route, attempted routes, fallback reason, requested and observed controls, parent spawn event ID when available, child thread ID/path, turn ID, actual model/effort, context/output paths/hashes, status, and transient error type when applicable.
  • Schema-five inspection may omit event_id only when actual parent logs contain one spawn_agent call and one matching function_call_output at spawn_call_id, whose JSON output is exactly {"task_name": "<canonical child path>"}. The validator binds the exact context, task name and fork_turns=none, requires a unique child session with matching parent/path metadata, and requires its creation timestamp inside the timezone-aware call/receipt interval. Missing, malformed, ambiguous or stale session evidence fails closed. Retain the original logs; never synthesize an activity event. A supplied but invalid event_id cannot fall back to receipts. Other schemas still require their existing provenance.
  • selected_attempt identifies completed output.
  • Validation binds child name, parent spawn, child lineage, actual model/effort, final output and hashes to Codex rollout logs. New schema-eight native waves derive identity from these records and complete context reads. Only historical routes retain their schema-specific model-written provenance-header checks.

When strict portable pass is spawned, freeze <run-directory>/execution-plan.json before dispatch and write <run-directory>/execution-manifest.json with shared schema version 2 after terminal evidence and joins exist. The plan must bind non-sensitive task classification plus exact consumer_policy for consumer_id=code-review, capability=portable-read-only, promotion_status=promoted, parent_mutations=serial, and canonical_gates=serial; runtime manifest must use portable tier with restricted network, approval policy never, context/output common-secret scans, unverified filesystem isolation, and no write node. Add runtime_execution to specialist-manifest.json with only plan_path, manifest_path, and exact manifest_sha256. The shared runtime manifest contains exactly spawned roles; its selected context/output paths must match their specialist pass records. Run review manifest preflight only after both artifacts are frozen. The instruction-bounded inspection route instead freezes validator-defined schema-five inspection plan and inspection_execution binding, with relative contained contexts and no portable host-control claim. Historical schema-v1 manifests remain structurally readable but are not runtime-promotion evidence.

Use the canonical G0–G8 execution flow for intake, evidence, freeze, approval, dispatch, terminal/join/derivation, integration, verification, and promotion. Code Review may fan out only its validated read-only specialist passes; parent retains all writes, reconciliation, final gates, verdict, and promotion.

Native execution labels are runtime outcomes, not planning claims; local reviewer wave contract defines its distinct conservative projection:

  • Report parallel only when shared validator binds at least two substantive child intervals that overlap on observed host timeline.
  • Report independent-spawned when multiple validated children run without substantive overlap.
  • Report serial for one ordinary child or explicitly serial plan.
  • For strict portable execution, report serial-fallback only when same frozen plan and gates were attempted as fallback and validated child intervals do not overlap. Schema-five parent-only inspection uses serial-fallback for its separately bound parent-review plan; it must retain failed-route evidence rather than rewrite prior frozen plan.
  • Strict portable runtime evidence is limited to exact summary fields evidence_level=portable-read-restricted, network_mode=restricted, approval_policy=never, and filesystem_credential_isolation=unverified; it does not claim global network, command, credential, or filesystem denial or that all command behavior was inspected. Instruction-bounded inspection reports its validator-defined evidence_level=instruction-bounded-review and observed controls without converting instructions into isolation. write_parallel_eligible stays false; code review is read-only inspection workflow. The host-isolated tier remains unavailable until authoritative host evidence exists.

Native attempt policy (local reviewer wave permits no automatic second paid wave):

  • At most two attempts/role.
  • A generic retry needs an authenticated host failure receipt. The current manifest validator cannot authenticate timeout, transport_error, or rate_limited labels, so these generic retries fail validation even in historical manifests. Preserve the original evidence and use a supported recovery or disclosed parent fallback; never relabel completed work. Schema-eight's separately validated internal recoveries remain available under their own conditions.
  • Preserve completed outputs/context.
  • Checkpoint is evidence only, never completed output/provenance replacement.

Independence gate:

  • BROAD/HIGH_RISK prefer real independent QA/challenger outputs. A parent-serial substitute is allowed when launcher is unavailable, but it leaves independence unmet; if independence remains expressly required by the user, withhold completion while reporting source inspection and all available findings. An explicit coverage waiver uses the separate current parent fallback, never an override of the original plan's gate.
  • For schema-eight instruction-bounded native inspection, including validated batches, and historical schema-five/six inspection, set independence_required=true only when user expressly requires independent review and record requirement evidence; otherwise leave it false. Historical strict portable and local reviewer waves retain their existing QA/challenger trigger semantics. Set independence_satisfied=true only when every triggered required role has validator-validated native inspection lineage, strict portable spawned provenance, or validated schema-4 local reviewer wave evidence. Neither declarations nor parent substitutes satisfy this requirement.
  • If either output is unavailable, preserve independence_satisfied=false; record needs-independent-review only when independence is required. Otherwise disclose missing independent coverage and continue source inspection rather than treating process gap as source defect or silently converting substitute into independent evidence.
  • An assessed review with one triggered role may pass with an explicit substitute when its axis is covered and confidence is reduced. A complete TRIVIAL or LOCAL schema-five parent-only review may pass with multiple substitutes when independence was not required; disclose their actual coverage. Other multi-role reviews require all selected specialist passes and validated scheduling evidence.