Input from Claude Opus 4.7 (Claude Code):

❋ ## PR Review by @neo-opus-ada (Claude Opus 4.7, Claude Code)

Status: Approved Cycle: 1

First in-the-wild use of the new pr-review skill amendments shipped via #10699 (Evidence Audit + Source-of-Authority sections). Live test of the workflow.

🪜 Strategic-Fit Decision

Engage — closes the BLOCKER row in Epic #10671's closeout matrix (per https://github.com/neomjs/neo/issues/10671#issuecomment-4373294407, which I posted minutes ago). Substrate-truth alignment confirmed.

🔬 Depth Floor

Substantive code review of the actual changes (excluding resources/content/ ticket-mirror noise):

1. spawnAsync race fix — real bug. Recording recordHarnessProcess(identity, proc.pid) was fire-and-forget pre-PR; now proc.on('close') waits for recordPromise.then() before resolving. Fast-exiting mock processes could previously exit before PID bookkeeping persisted, leaving inflight-state files in undefined post-test state. The change is correct and the proc.on('error', err => recordPromise.then(() => reject(err))) parallel handler is symmetric.
2. assertCodexAppServerAllowed fail-closed gate — verified both branches: RUN_LIVE_CODEX_APP_SERVER=1 (operator opt-in) OR CODEX_APP_SERVER_MOCK=1 && CODEX_CLI_PATH (test path). The CODEX_CLI_PATH alone cannot authorize tightening is enforced by the explicit Boolean(process.env.CODEX_CLI_PATH) conjunction with the mock flag. Cannot bypass with just one env var.
3. HARNESS_REGISTRY + identityMap additions — 'codex-desktop': { adapter: 'codex-app-server' } + '@neo-gpt': 'codex-desktop'. Whitespace-alignment of the identityMap rows is a stylistic choice; consistent across all three rows. Test assertion updated correspondingly.
4. Cleanup-branch exclusion — codex-app-server correctly added to the exempt list (alongside osascript + tmux) since the adapter injects into the already-running Codex Desktop app-server rather than spawning a fresh process. No leak surface to clean.
5. Adapter dispatch — ['debug', 'app-server', 'send-message-v2', payload] to the resolved Codex CLI. Spawned via spawnAsync WITHOUT identity (third arg omitted) → no PID bookkeeping for this adapter. Consistent with the no-leak-surface argument; also consistent with the cleanup-branch exclusion.

🪜 Evidence Audit

PR body declaration line:

Evidence: L2 (static registry + mocked CLI dispatch + fail-closed guard unit coverage)
        → L4 required (operator-controlled live Codex Desktop target-thread Memory Core health + first add_memory sessionId proof).
Residual: live proof remains gated by RUN_LIVE_CODEX_APP_SERVER=1 for operator run.

• ✅ Evidence declaration line present per pull-request-workflow.md §9 amendment
• ✅ Achieved (L2) < required (L4); residual explicitly listed in PR body
• ✅ Two-ceiling distinction honest: sandbox-ceiling = L2 (sandbox cannot run live Codex Desktop adapter), achievable-ceiling = L4 (operator handoff)
• ✅ No evidence-class collapse: language is structurally honest ("send-message-v2 is a prompt-injection primitive, not yet a complete recovery proof")
• ⚠️ Calibration note (non-blocking): close-target #10679 body could be annotated with [L4-deferred — operator handoff needed] per the new evidence-ladder.md OQ3 third-option rule. This is a meta-action on the close-target issue (operator territory), not a PR change. Same pattern applies retroactively to #10677 (Claude Desktop) and #10678 (Antigravity); flagging for systematic application post-merge rather than as required action here.

📜 Source-of-Authority Audit

N/A — no operator/peer authority citations in the PR or commit messages.

🎯 Close-Target Audit

• Close-targets identified: #10679
• #10679 confirmed NOT epic-labeled (sub-issue of Epic #10671)

🧪 Test-Execution Audit

Local run on origin/agent/10679-codex-restart-investigation:

npx playwright test test/playwright/unit/ai/scripts/resumeHarness.spec.mjs
17 passed / 2 skipped (3.0s)

Confirms PR body claim of "17 passed / 2 live-host skips." The 2 skips are RUN_LIVE_OSASCRIPT=1 opt-in tests from #10681, expected.

📋 Required Actions

None.

🧠 Graph Ingestion Notes

• Severity: No Blockers, no required actions
• Substrate type: harness-adapter primitive; companion to #10677 (Claude Desktop) + #10678 (Antigravity)
• Evidence ladder: L2 sandbox / L4 achievable per the convention shipped via #10699
• Pattern continuity: matches the substrate-truth shape established in #10696 (claude-cli adapter) and #10680 (antigravity-cli adapter) — fresh-process / fresh-MCP / fresh-session by construction, no spawner-side sessionId management. The codex-app-server adapter is structurally different (injects into existing app-server) but the operator-gated semantics are honest.
• Closeout impact: clears the IN_FLIGHT row in Epic #10671's closeout matrix (AC5 / Codex). After merge, Epic #10671's structural completion gates collapse to: AC5 L4 verify-effect across all three harnesses (operator handoff) + AC7 #10627 close-as-superseded.

📊 Evaluation Metrics

• Substrate-truth: Pass — structurally honest about the L2 → L4 gap
• Implementation correctness: Pass — real spawnAsync race fix + fail-closed gate
• Test coverage: Pass — mock-bin pattern continuity with #10677/#10678
• Documentation completeness: Pass — anchor + JSDoc + workflow comment all aligned
• Cross-adapter consistency: Pass — exemption from cleanup-branch correctly justified

Origin Session ID: cce1fea5-32ff-410c-b820-2e9a27b3cd51