fix: resolve agent runtime by spawn path

[OliverHennhoefer]

Problem

sol-advisor verifies a spawned agent’s role, model, and effort before accepting its work. The runtime inspector could previously identify a rollout only by UUID, while native spawn_agent returns a task path instead.

In the reproduced case, spawn_agent returned /root/job_read_auth_rereview. The matching rollout recorded sol_advisor_sol_reviewer, gpt-5.6-sol, and high, but its UUID was not available to the caller. The fail-closed workflow therefore could not verify a correctly configured reviewer.

This surfaced during a long-running /goal task because the failed verification interrupted the next review pass, but the identifier mismatch is not specific to /goal.

The workflow stopped with:

Unblock by starting a fresh Codex task where reviewer details expose Sol/high routing and an actual read-only sandbox; update Codex if they remain unavailable. The active release goal remains open.

That response combines two verification gates. This PR fixes the routing-evidence failure caused by the unavailable UUID; sandbox behavior remains unchanged.

Fix

Add path-based lookup:

inspect-agent-runtime.sh --agent-path "$agent_path" --since "$cutoff"

The caller records the cutoff immediately before spawning and then passes the task path returned by spawn_agent.

The inspector matches the exact session_meta.agent_path at or after the cutoff and requires exactly one result. It resolves that rollout’s UUID internally, then reuses the existing filename and runtime validation. The cutoff prevents an older rollout from being selected when a task path is reused.

Missing, ambiguous, malformed, or inconsistent metadata still fails closed. The inspector does not search prompts or select the latest match.

Compatibility

The existing positional UUID interface and its output are unchanged.

This does not change agent roles, model or effort pins, sandbox validation, fallback behavior, retries, or goal lifecycle policy. Short and one-off tasks retain the same implementation and review workflow; only runtime identification changes when local evidence is required.

Verification

Tests cover UUID output compatibility, unique and reused paths, concurrent and ambiguous matches, RFC3339 timestamps and offsets, malformed metadata, safe output, and existing strict routing validation.

Validated with:

sh plugins/sol-advisor/scripts/verify.sh
git diff --check

The orchestration skill and plugin validators also pass.