feat: failure attribution, companion preflight, superseded (0.0.50)

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
     "email": "hi@okis.dev"
   },
   "description": "Multi-model orchestration marketplace for Claude Code.",
-  "version": "0.0.49",
+  "version": "0.0.50",
   "plugins": [
     {
       "name": "grok",
       "source": "./plugins/grok",
       "displayName": "Grok Companion",
       "description": "Local Grok CLI delegation: task, review, resumable history, best-of-n tournaments, background jobs, stats, and setup health checks.",
-      "version": "0.0.49",
+      "version": "0.0.50",
       "author": {
         "name": "Harry Yep"
       },
@@ -34,7 +34,7 @@
       "source": "./plugins/codex",
       "displayName": "Codex Companion",
       "description": "First party local Codex CLI delegation for tasks, reviews, resumable threads, and durable background jobs.",
-      "version": "0.0.49",
+      "version": "0.0.50",
       "author": {
         "name": "Harry Yep"
       },
@@ -55,7 +55,7 @@
       "source": "./plugins/fusion",
       "displayName": "Fusion Orchestrator",
       "description": "Multi-model orchestration: tier agents, routing rules, blind panel, ultra fleet, model config, and drift doctor.",
-      "version": "0.0.49",
+      "version": "0.0.50",
       "author": {
         "name": "Harry Yep"
       },

CHANGELOG.md

@@ -1,5 +1,14 @@
 # changelog
 
+## 0.0.50
+
+- codex failure attribution stops collapsing three distinct deaths into one bucket: a seven day read of 175 engine jobs found 34 foreground wall clock kills, 41 percent of every `gpt-5.6-sol` write run against 15 percent for terra and near zero for consult, and their event streams split them into 19 genuine overruns, 12 runs stuck in an `apply_patch verification failed` retry loop and 3 that lost their exec child to `UnknownProcessId`. only the first 19 are a sizing problem, so the standing advice to split the brief was the wrong remedy for 44 percent of the family. neither failing string ever reaches the structured event stream, since events carry only `command_execution` and `file_change` items and a `file_change` is emitted only on success, so detection rides the child stderr that was already streamed live, counted on the arriving chunk with a carried partial line so a pattern split across two reads counts exactly once: `patch_thrash` fires on the third consecutive patch verification failure and a completed `file_change` resets the count, `exec_lost` on the third lost process, both terminate early through the same path a collaboration violation uses, and both join the repeated class in the breaker so one is a retry and two open it. what is saved is the wall clock rather than the label, so a run that genuinely reaches the deadline still reports `timeout`
+- a deliberate kill stops losing its reason on the way to a terminal record: a collaboration policy violation exits through `cleanupRequired`, which leaves the record non terminal at `phase: cleanup-required`, and the reconciliation that finalizes it hardcoded `failureKind: "died"` over whatever was already recorded, so the attribution was destroyed exactly when it mattered and the resumable patch on the terminal path never saw a resumable kind. reconciliation now preserves a failure kind that is in the resumable set and falls back to `died` only when none was recorded, leaving the identity replaced and checkpoint pending paths converging on `died` as before. this is the same defect as the timeout bucket one entry above, a real cause overwritten by a generic one, and it surfaced only because the assertion meant to prove the resume footer could never pass
+- three mechanical companion defects that each cost real work in the same seven days are fixed at their seams: codex refused to start three times in two days because the working directory had no ancestor `.git`, so a read only consult now auto passes `--skip-git-repo-check`, where the check carries no safety meaning, while a write fails fast naming the flag, and the recorded `request` keeps the user's declared intent rather than the inferred value so the inference never propagates down a resumed thread; a single flight bounce destroyed the staged brief twice, because the raw transport was consumed and unlinked at dispatch entry while the already running guard threw later from inside the task path, and the payload now survives until a job record is actually reserved; and the `gpt-5.6-sol` foreground write warning, which rode 58 records of which 34 succeeded, stops being written after `executeRecord` returns and becomes a preflight on the exact risk combination, carrying the measured 41 percent instead of a p90 claim
+- a policy killed run becomes salvageable the way a timed out one is: `timeout`, `policy` and `patch_thrash` with a live thread all receive the resume footer and the wrapper contract's single scripted wind down matches the same set, after two runs lost 413 and 443 seconds of completed work with zero output because resumability was keyed to `timeout` alone. resumability and the breaker stay orthogonal, so `policy` still opens the circuit
+- `/fusion:stats` stops reporting a structurally false unverified rate: every one of the 34 wall clock deaths was salvaged by a wind down resume that settled cleanly, 27 accepted and 6 rejected, but not one of the dead attempts is any worker record's `peerJobId`, since the wrapper binds only to the resume, so they could never receive a verdict by any existing path and sat at `unverified` forever, making one package read as two engine records. a terminal error record carrying a resumable failure kind, a thread id, no recorded verdict and a later same workspace job resuming that thread is now derived as `superseded` and counted in its own bucket; a recorded verdict always wins, and `superseded` is never accepted by `--record` nor written to disk
+- the verification list lesson recurs one layer up, at the brief: a peer package reported `76 pass, 0 fail` while 64 process dependent tests, including every test it had just written, were skipped in its sandbox, because `node --test` exits 0 on a skip and the brief's done criterion accepted the exit code. the package was honest about the skip and two dispatches were still spent before the mandated full environment rerun showed `137 pass, 3 fail`. an implementation brief's acceptance criterion has to read `# fail 0` and `# skipped 0`, or name the titles that must appear passing, so that the work is done and the work is verified cannot both be claimed by one vacuous green
+
 ## 0.0.49
 
 - the judgment posture unverified ceiling is removed entirely, by user directive, after its first week fired almost solely on false positives: the ceiling denied writes in sessions that were verifying constantly, because the 0.0.48 sensor's output evidence regex (`fail 0`) is node:test reporter grammar while the sessions that hit the stop live in vitest repositories (`Tests 1635 passed`), and the exit status channel requires the runner as the final unpiped segment, a shape the standing discipline of piping every run through `tail` or `grep` guarantees never occurs. three days of audit ground truth: 1126 counted writes, 18 verification resets, 25 ceiling denies across six sessions, every denied session demonstrably green on its own suite. the deny branch, `FUSION_INLINE_UNVERIFIED_CEILING`, the approaching ceiling advisory note, the `unverified-ceiling` audit reason and the stats `unverifiedCeilingStops` counter all leave; judgment posture counts and advises and never denies a main loop write, `strict` keeps every floor verbatim, and the two posture independent denials (no-op heartbeat Bash, reaped worker probe) stay. the vitest blind sensor itself is deliberately not repaired here, removal rather than recalibration was the directive, and it remains the open candidate since advisory counts still overstate in vitest repositories

plugins/codex/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "codex",
   "displayName": "Codex Companion",
-  "version": "0.0.49",
+  "version": "0.0.50",
   "description": "First party local Codex CLI delegation for tasks, reviews, resumable threads, and durable background jobs.",
   "author": {
     "name": "Harry Yep"

plugins/codex/agents/codex-rescue.md

@@ -24,7 +24,7 @@ Forwarding rules:
 - If the Read call fails, the file is not empty, or the Write call fails, use a foreground Bash call to run `node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" transport-discard --raw-args-token TOKEN` with the validated token before returning the failure. Do not expose the token or transport file to the user.
 - Do not use Read for any path except the newly allocated empty transport file, and do not read it after writing. Do not search, run Git, execute tests, inspect job state, or perform any check, collection, cancellation, or companion operation beyond the fixed task operation.
 - When an explicit background request returns a receipt, return it unchanged. A direct slash command user inspects progress through status and collects the deliverable through result; when Fusion is installed, its monitor can notify them of completion. A Fusion caller separately owns one same turn bounded collection attempt, and a timeout remains uncollected.
-- When a task operation's companion output ends with `state: error` and `failure: timeout` and its body contains a line beginning `Resume Codex job`, run the command printed on that line exactly once, unchanged except for appending a space, `--`, a space, and this double quoted wind down prompt: "Wind down: do not start new work. Finish the smallest coherent deliverable from the work already completed and report the files changed and the verification output." Run it as one additional foreground Bash call and relay the second companion output verbatim in place of the first. This is the single authorized exception to the one operation rule: exactly one resume per task operation, never chained; any second timeout, any other failure, or any output without that line is relayed as received.
+- When a task operation's companion output ends with `state: error` and a `failure:` value of `timeout`, `policy`, or `patch_thrash` and its body contains a line beginning `Resume Codex job`, run the command printed on that line exactly once, unchanged except for appending a space, `--`, a space, and this double quoted wind down prompt: "Wind down: do not start new work. Finish the smallest coherent deliverable from the work already completed and report the files changed and the verification output." Run it as one additional foreground Bash call and relay the second companion output verbatim in place of the first. This is the single authorized exception to the one operation rule: exactly one resume per task operation, never chained; any second failure, any other failure, or any output without that line is relayed as received.
 - Return the companion stdout exactly as received. Do not summarize, paraphrase, prefix, suffix, or continue the work.
 - Relay the companion's stdout verbatim inside a fenced block. Never retype, summarize, or re-spell any part of it, including footers. Put commentary outside the fence.
 - If the companion invocation fails, return the failure exactly as Bash reports it. Do not generate a substitute answer.