Codex/OpenCode lead parity, per-role OpenCode sessions, task branches

[abdoharb]

What changed

Brings the Codex lead to near-parity with the Claude lead, adds an OpenCode lead path, and changes the OpenCode session policy. Full detail is in CHANGELOG.md → Unreleased.

Session and branch model ([contract], migration migrations/04-per-role-sessions.md)

• OpenCode sessions are now scoped per role per task. The state file's single OpenCode session id is replaced by builder / reviewer / tester session ids (plus Codex tester thread id).
• Why: on opencode v2 a session pins the tool set of the agent that opened it, so a tester dispatched into the builder's session couldn't write its results. A shared session also gave the reviewer the builder's reasoning, which weakens review independence.
• Every task gets its own branch (T-<id>-<slug>) before an implementer runs.
• init.sh --builder-auto ask|on records a standing decision for the builder's --auto.

Codex lead parity

• scripts/bg-dispatch.sh (start / wait) runs dispatches detached. Codex has no background-watch tool, so without it dispatches die at the lead's exec timeout.
• scripts/claude-review.sh runs a claude/* reviewer headlessly with a read-only tool list, for leads that can't spawn Claude subagents.
• oc.sh --status / --interrupt (v2 endpoints) replace raw opencode api calls in the flow.
• New optional Codex tester role (--tester-model codex/<model> → .codex/agents/tester.toml).
• codex-preflight.sh checks the new wrappers, the Codex tester, and Claude reviewer prerequisites.
• The Codex feature skill gains matching adaptations: no Monitor, no structured question tool, headless Claude review, per-task branches, sandboxed oc.sh.

Canonical flow additions (all three flow copies)

• Where the team stopped status check, the merge record, and the mid-task model/implementer switch procedure.
• Verify a role's "concurrent writer" claim before acting on it.
• The exact ### Pass N verdict heading.
• What to do when the lead can't spawn the configured tester.

OpenCode lead

• leader and planner adapters plus /feature and /toolkit-update commands pointing at the canonical flow.

Fixes

• promote-findings.sh skips a directory tag instead of aborting and dropping later findings.
• Dispatch traces (.pipeline/T-*.{out,err,pid,brief}) are gitignored.
• ShellCheck cleanups.

Verification

Run locally on this branch:

• bash test/smoke.sh: all 38 checks pass
• bash test/invariants.sh: all 135 (rule, file) pairs present
• bash test/codex.sh: all behavioral checks pass (CLI doubles, no model calls)
• python3 test/herdr.py: OK

Not done: no live end-to-end pipeline run against a real OpenCode server or a live Codex lead. docs/CODEX.md → Verification lists the manual scenarios.

Reviewer notes

• Breaking state-file contract change. Downstream projects need migrations/04-per-role-sessions.md.
• Known remaining Codex gaps (follow-up, not in this PR):
  • No Codex-native implementer or read-only reviewer agent.
  • Each sandboxed oc.sh / bg-dispatch.sh call needs runtime approval.
  • No automatic usage-limit retry under Codex.
  • The session hook only pins the id; it doesn't surface active tasks on resume.
  • tester.toml duplicates the tester rules inline and isn't covered by test/invariants.sh.
  • First-run customization skips .codex/agents/.
• Supersedes the closed Codex lead parity #1 (Codex lead parity); its commits are included here.

🤖 Generated with Claude Code