Support visible goals for Codex App over SSH

[huangruiteng]

What changed

• Add an explicit codex-app-ssh host type and codex_app_ssh_goal runtime profile.
• Render a bounded visible /goal <task_body> for Codex App over SSH, without heartbeat automation, RRULE cadence, or turn receipts.
• Align the existing codex_cli visible runtime with its typed contract: no heartbeat turn receipt, quota source visible-goal, and no automation-run classification.
• Update onboarding, command catalogs, installer-managed skills, protocol docs, and README guidance.
• Add end-to-end smoke coverage for App SSH and a regression assertion for Codex CLI visible-goal semantics.

Why

Codex App sessions attached to a remote repository over SSH do not expose the host automation surface required by the existing codex-app heartbeat path. They need the same visible-goal ownership model as interactive Codex CLI sessions.

While adding that path, the implementation exposed an older cross-layer inconsistency: CODEX_CLI_VISIBLE was already typed as agent_cli_loop + interactive, and activation already requested /goal, but the shared prompt renderer still unconditionally emitted heartbeat receipts and source=heartbeat. This change makes prompt and quota behavior follow the typed runtime profile.

Impact

• Local Codex App automation remains on heartbeat semantics.
• Codex App over SSH and Codex CLI use visible-goal semantics and are not counted as automation runs.
• Ambiguous codex onboarding remains rejected; callers must choose the exact host.
• Managed LoopX skill files can be refreshed with the new host routing while unmarked user-owned files remain preserved.

Validation

• loopx canary premerge --from-git-diff --git-diff-base origin/main --tier standard
  • 4 direct checks passed
  • 18 selected checks executed and passed
  • 0 failures, 0 warnings, 0 manual holds
  • public/private boundary scan passed
  • merge_gate_passed=true
  • self_merge_allowed=true
• Focused host-loop activation smoke passed, including the explicit Codex CLI visible-goal regression assertions.
• README first-screen wording was previewed and approved before publishing.

[huangruiteng]

LoopX pre-merge evidence

• Changed surfaces: control_plane, canary_runner, docs_project_content, public_boundary, python
• Risk profiles: core-control-plane, canary-runner, docs-project-content-ops
• Direct checks: 4/4 passed (git diff checks plus Python compilation)
• Catalog canaries: 9/9 passed, covering local/package installation, update flow, bounded-context and control-plane risk/maintainability contracts, interface budget, quota resume/state acknowledgement
• Risk-profile smokes: 8/8 passed, covering canary planning/execution/gating/discovery and CLI control-plane modularization
• Public/private boundary: explicit scan of all 24 changed files passed
• Focused behavior coverage: App SSH resolves to agent_cli_loop + interactive, emits a <=4000-character visible goal, omits turn receipts, spends with source=visible-goal, and is not classified as automation; Codex CLI asserts the same visible-goal semantics as a regression contract
• Failures / warnings / skips: 0 / 0 / 0
• Manual holds: none
• Merge decision: merge_gate_passed=true, self_merge_allowed=true

Scope and simplification review

The 24-file count is mostly unavoidable propagation across one public host identity: 13 small runtime/CLI/installer glue files, 9 user/protocol/skill documentation files, and 2 validation files. The implementation keeps one typed runtime profile and one shared visible-goal renderer rather than duplicating an App-SSH-specific prompt path. The existing codex_cli behavior correction is called out explicitly because it fixes the same profile-to-renderer seam exposed by this host addition.

[huangruiteng]

CI follow-up

The first GitHub run exposed seven deterministic contract failures:

• four scheduler decision-table cases because codex_app_ssh was initially treated as a generic CLI surface;
• two public host-list expectations that did not include codex-app-ssh;
• one managed skill text assertion that still matched the old host wording.

Commit 4baf2cbd fixes the production contract rather than only changing snapshots: codex_app_ssh now accepts exactly scheduler_owner=agent_cli_loop plus execution_mode=interactive. The Cartesian decision table rejects every other owner/mode combination. Host-list, first-class profile, and managed-skill expectations now include the new public host.

Validation after the fix:

• focused contract suite: 124 passed;
• Ruff: passed;
• mypy: passed;
• CLI output-budget smoke: passed;
• local full pytest: 1244 passed, 2 skipped, with one environment-only failure because this Debian host lacks python3.11-venv/ensurepip; the failing extension-scaffold test is unrelated to this diff and GitHub's setup-python runner provides ensurepip;
• latest-main merge-tree: no conflict;
• standard pre-merge canary: 4 direct + 18 selected checks passed, 0 failures, 0 warnings, 0 manual holds, self_merge_allowed=true.