Feature request: global task-authority reservation and fencing across Codex runtimes

Component

Codex App Server and every writer-capable Codex client or runtime, including Desktop, CLI, IDE, SDK, cloud, plugins, and subagents.

This is a cross-runtime control-plane enhancement request. It was prepared from the Codex Desktop task adapter and the documented App Server surface on 2026-09-03. The exact Desktop build is not exposed by the read-only task tool.

Relationship to existing issues

This is an umbrella authority/admission request, not a replacement for these narrower reports:

• #41249 and #39849 cover bounded Desktop task inventory, project filtering, cursor pagination, and completeness.
• #37403 covers one concrete cross-runtime already has an active writer handoff failure.

Those issues establish important symptoms and prerequisites. This request is distinct because pagination alone does not serialize a task created after a snapshot, and a runtime writer-conflict error does not provide a pre-admission reservation shared by every competing create, fork, spawn, turn, and execution path.

The requested outcome is one account/workspace authority contract that makes inventory, reservation, writer activation, and ambiguous-outcome recovery participate in the same ordered protocol.

Related issues:

• https://github.com/openai/codex/issues/41249
• https://github.com/openai/codex/issues/39849
• https://github.com/openai/codex/issues/37403

Protocol reference:

• https://learn.chatgpt.com/docs/app-server

Problem

A correctness-sensitive coordinator may need to enforce one writer task for one canonical project or worktree identity across multiple hosts and runtimes. Separate list and create calls cannot prove that invariant:

1. persisted listings do not by themselves cover loaded, ephemeral, active-turn, or execution-lease state;
2. identity can be presented as a project ID, normalized cwd, or repository/worktree identity;
3. another client can create, fork, spawn, resume, or acquire a writer lease after a snapshot but before local admission;
4. a transport failure can leave the caller unable to distinguish rejection from a committed create.

Failing closed locally avoids an unsafe duplicate but cannot provide a usable global authority boundary.

Requested platform contract

Please provide a versioned account/workspace authority surface with:

• immutable hostRegistry, projectRegistry, sourceRegistry, and runtimeRegistry version/hash roots;
• canonical alias binding across projectId, normalized cwd, and repository/worktree identity;
• enumeration to terminal completion for persisted archived and non-archived tasks across every advertised source;
• per-runtime coverage of loaded and ephemeral thread IDs, active turns, and execution/background leases;
• a stable snapshot receipt binding every registry root, coverage proof, counts, candidate-set hash, collisions, and exact release exceptions;
• a durable global reservation with a monotonically increasing authority epoch/fencing token;
• mandatory participation by create/start, persisted and ephemeral fork, spawn, resume/turn start, message/turn start, shell execution, background/execution lease, handoff/move, archive/unarchive, and future writer-capable paths;
• rejection of raw or nonparticipating App Server paths rather than an unfenced bypass;
• fail-closed behavior for unknown or disconnected runtimes, registry drift, partition, split-brain, lease uncertainty, and coordinator uncertainty;
• a one-use invocation token durably consumed on the first server-accepted invocation before validation or mutation;
• exactly-once recovery where an ambiguous transport outcome permits read-only result lookup but never resubmission;
• an explicit SOLE_WRITER_COLLISION_PRESENT result for every unreleased matching candidate;
• release exceptions bound to exact thread, host, runtime, store, record version, lifecycle role, no-active-lease proof, and immutable release-evidence hash.

Required concurrency and recovery tests

Please cover concurrent callers across clients, runtimes, and hosts; create/fork/spawn/turn/lease races; raw bypass attempts; registry addition, removal, disconnect, and version drift; crash before and after token consumption; coordinator restart; replay; expiry; split-brain; and ambiguous transport recovery.

Non-goals

This request does not ask Codex to inspect private task content, weaken user confirmations, automatically create tasks, or prescribe one storage engine. It asks for protocol semantics that all writer-capable surfaces can enforce consistently.

Start with the documented Codex App Server surface and the related issues #41249, #39849, and #37403 to understand the existing boundaries. Define completion against the requested concurrency and recovery tests, including fencing, bypass rejection, registry drift, crashes, replay, split-brain, and ambiguous transport outcomes.