Stabilize Codex r focus seed cleanup and metadata support

Context

On 2026-05-03, after PR #10665 merged and closed #10664, @tobiu directed the swarm to continue in the same high-proximity session and validate the Codex same-session wake path before heartbeat/fresh-session reactivation.

The controlled Codex bridge test used WAKE_SUB:f9a09dfd-37de-40e5-8857-6cd2c7373232 with:

harnessTarget: bridge-daemon
harnessTargetMetadata.appName: Codex
harnessTargetMetadata.tabShortcut: null
harnessTargetMetadata.focusSeedKey: r

Important operational note: the managed MCP manage_wake_subscription update/list path did not expose focusSeedKey in the returned subscription state, even though the bridge reads it from the subscription graph JSON. For the live test, the runtime subscription metadata had to be verified outside the managed MCP response.

The full 5-row Codex prompt-state matrix was then run with the Codex sidebar collapsed throughout. The matrix was green for same-session bridge wake delivery:

• Row 1 focused-empty: delivery green; residual r stayed in the prompt.
• Row 2 focused-draft: delivery green; r inserted/appended at the cursor; draft preserved.
• Row 3 unfocused-empty: delivery green; prompt gained focus; residual r stayed in the prompt.
• Row 4 unfocused-draft: delivery green; prompt gained focus; r appended to draft text (hello world -> hello worldr); draft preserved.
• Row 5 transcript/history text selected: delivery green; prompt gained focus; r appended to the prompt; transcript selection preserved per @tobiu's "worked fine too" report.

Canonical message anchors from the validation run:

• Row 1: MESSAGE:5f64faf4-c243-42ec-9610-11a10607d48d
• Row 2: MESSAGE:4eed491a-220f-4c9c-8a08-f53ead577cca
• Row 3: MESSAGE:775fc743-08f1-40f9-8c9f-80e22348ae25
• Row 4: MESSAGE:1aa709d7-3470-4644-8b24-cca427973c9d
• Row 5 / summary: MESSAGE:5f8e159f-0dec-4cc5-9f23-8a1ecf27fc0e, MESSAGE:8b303edb-b010-416c-81da-e9dece82204a, MESSAGE:ebec022b-b382-4d5e-883c-29de2421c578

Duplicate Sweep Notes

• Live latest-20 open GitHub issues were read with title, author, and labels. Adjacent open items included #10658, #10651, #10646, #10635, #10633, #10627, #10605, #10604, #10601, #10537, #10517, #10494, #10484, #10476, #10462, #10449, #10442, #10422, #10420, and #10399. None owns this Codex-specific cleanup-plus-metadata productionization.
• ask_knowledge_base(type: 'ticket', query='existing ticket Codex focusSeedKey residual r cleanup wake bridge metadata support') returned no relevant duplicate.
• Local content sweep found important adjacent but non-duplicate items:
  • #10407: closed historical metadata-schema stripping issue; it did not include focusSeedKey in the exposed known-field set.
  • #10442: open broader manage_wake_subscription update merge/overwrite contract concern; related, but not sufficient for Codex focusSeedKey production readiness.
  • #10658 / #10660: Claude prompt-focus and Space seed line; related focus-seed precedent, not Codex cleanup.
  • #10664 / PR #10665: fail-closed Codex safety guard; this ticket is the follow-up now that the r seed passed the collapsed-sidebar same-session matrix.
  • #10517: HarnessPresence/wakePolicy architecture; still relevant to heartbeat/fresh-session routing but not the minimal same-session Codex r seed cleanup.
• Raw Memory Core search for Codex focusSeedKey residual r cleanup managed MCP metadata wake matrix collapsed sidebar surfaced the current-session validation memories, confirming this ticket captures fresh active-session context not yet available through KB sync.

The Problem

The Codex same-session bridge path is now empirically viable, but not production-ready.

There are two coupled blockers:

1. Residual prompt mutation. The r seed reliably breaks through the collapsed-sidebar focus lock and focuses the composer, but it leaves/appends r in the prompt in every tested state. This is non-destructive relative to transcript selection or draft loss, but it is still a visible prompt mutation and must be cleaned up before we call the path stable.
2. Managed metadata gap. The bridge consumes harnessTargetMetadata.focusSeedKey, and the OpenAPI surface contains focusSeedKey, but the currently exposed MCP tool schema/update/list path did not preserve/report the field during live use. A safe operator path must be configurable through manage_wake_subscription, not by direct runtime graph patching.

Without this fix, reactivation work remains brittle: agents can prove the path by hand, but cannot cleanly configure, inspect, or maintain it through the sanctioned MCP interface.

The Architectural Reality

Owning surfaces:

• ai/scripts/bridge-daemon.mjs — reads harnessTargetMetadata.focusSeedKey, emits the pre-clear seed, then performs the focus-dependent Cmd+A / Cmd+X / paste sequence.
• ai/mcp/server/memory-core/openapi.yaml — documents harnessTargetMetadata.focusSeedKey as a known metadata field.
• ai/mcp/server/memory-core/services/WakeSubscriptionService.mjs — owns subscribe/update/list validation and metadata persistence semantics.
• test/playwright/unit/ai/scripts/bridge-daemon.spec.mjs — bridge-daemon osascript generation and Codex fail-closed coverage.
• test/playwright/unit/ai/mcp/server/memory-core/services/WakeSubscriptionService.spec.mjs — managed subscription metadata round-trip coverage.

This is the same-session Shape C bridge-daemon path. It does not prove heartbeat/fresh-session recovery and must not be used to justify WAKE_GATE_OVERRIDE=1 by itself.

The Fix

Implement the Codex r seed as a supported, inspectable same-session wake primitive with cleanup:

1. Add a deterministic cleanup step for Codex when using a mutating focusSeedKey such as r. The likely minimal candidate is a targeted undo/cleanup sequence after the seed has focused the prompt, but before or around the existing clear/paste path. The exact sequence must be proven by tests and, if necessary, a live validation row.
2. Officially support focusSeedKey through the managed MCP metadata path:
   • update schema/tool exposure if the client-visible tool contract omits it;
   • ensure subscribe / update preserve the field;
   • ensure list reports the field so operators can verify state without direct graph inspection.
3. Add coverage that distinguishes single-key focusSeedKey from any future multi-step cleanup or sequence primitive. Do not conflate focusSeedKey: 'r' with a multi-step r -> Cmd+Z strategy unless the implementation explicitly represents that sequence.
4. Keep the #10665 fail-closed guard intact: Codex must still refuse delivery when neither a validated focus seed nor the future app-server path is configured.

Acceptance Criteria

• manage_wake_subscription can set harnessTargetMetadata.focusSeedKey for the Codex subscription through the official MCP path.
• manage_wake_subscription({action: 'list'}) reports harnessTargetMetadata.focusSeedKey so operators can verify the configured seed without direct graph access.
• Existing metadata fields such as appName and tabShortcut are preserved when adding or updating focusSeedKey.
• Bridge-daemon Codex delivery with the validated r seed no longer leaves a residual r in the prompt after the wake payload is delivered.
• Bridge-daemon unit coverage proves the Codex r seed and cleanup sequence ordering relative to activation, pre-clear, paste, and submit.
• WakeSubscriptionService unit coverage proves focusSeedKey round-trips through subscribe/update/list for appName: 'Codex'.
• The #10665 fail-closed behavior remains covered: Codex without a validated focus seed still refuses UI delivery.
• Live post-merge validation repeats at least one collapsed-sidebar Codex wake row and confirms delivery remains green and no residual r remains.
• Heartbeat/fresh-session recovery remains explicitly out of scope until this same-session cleanup/config path is green.

Out of Scope

• Reactivating heartbeat or fresh-session recovery.
• Changing WAKE_GATE_OVERRIDE=1 or lifting the full Wake Safety Gate.
• Implementing the Codex app-server adapter from #10517.
• Reworking the entire manage_wake_subscription update contract from #10442, except where needed to preserve/report focusSeedKey for this Codex path.
• Retesting Claude or Antigravity focus primitives.

Avoided Traps

• Trap: matrix green means full gate lift. Rejected. The matrix proves same-session Codex bridge delivery under collapsed sidebar, not heartbeat/fresh-session recovery.
• Trap: ignore the residual r because it is non-destructive. Rejected. It is safer than transcript selection or draft loss, but still a prompt mutation and should be cleaned up before declaring the path stable.
• Trap: keep direct graph patching as operational procedure. Rejected. The sanctioned managed MCP path must configure and report focusSeedKey.
• Trap: duplicate #10442. Rejected. #10442 is related metadata contract debt; this ticket owns the Codex r wake path productionization and can link/factor out any generic update-contract work if needed.
• Trap: conflate single-key seed with multi-step sequence. Rejected. PR #10665 already drew this boundary. If cleanup requires multiple keystrokes, the implementation must represent that deliberately rather than pretending focusSeedKey alone is the whole primitive.

Related

• #10664 — fail closed for Codex UI wake after Space seed failure.
• PR #10665 — merged guard and documentation for fail-closed Codex behavior.
• #10650 — Wake Substrate Incident Protocol; full gate remains tripped.
• #10517 — Codex app-server / HarnessPresence durable direction.
• #10442 — related managed metadata update/merge semantics.
• #10407 — historical metadata schema stripping issue.
• #10658 / #10660 — Claude focus-seed precedent.

Origin Session ID: d9cd4943-3285-47a6-b629-c05a9a2a38e4

Retrieval Hint: Codex focusSeedKey r residual cleanup collapsed sidebar five row prompt state matrix managed MCP metadata stripped list update bridge daemon #10664 #10665