Design: agents as runs — the codex plugin, communicating workflows, and the missing signal verb

The agentic story, composed from parts that mostly exist — plus the two that don't, named precisely.

The model: an agent is a run

Not a new abstraction. A durable run already is what an agent harness wants: survives crashes mid-thought, observable (flow watch, OTel, heartbeat phases), cancellable with compensation, budgeted, tenant-scoped, replayable for debugging. The design work is the verbs, not the substrate:

The missing verb: run-to-run signals

Today only external callers signal (flow signal, the RPC). A workflow cannot signal another run from a Flowfile — so communicating sequential/parallel agent processes have no mailbox between peers. The fix is a task, not a primitive: flowstate.signal (and plausibly flowstate.run for starting a detached peer, distinct from call:'s parent-child), going through the front door — the same Signal RPC, same tenancy authorization, same validation — exactly the rule trigger plugins follow (#159). Same-tenant only by construction; a run that could signal across tenants would be the decorative boundary again. With it, the CSP-ish shapes compose: pipeline (A signals B), fan-out/fan-in (parallel runs signaling a collector), supervisor (a long-lived run receiving status signals from workers — #105's entity-workflow shape arriving on its own).

The codex plugin

codex.exec: drive an OpenAI Codex session as a step — the demonstration that an agent harness is just a task under governance. Design constraints, all inherited rather than invented:

• Sandboxing is the #156 ladder, chosen per step (isolation:), with Codex's own sandbox options mapped onto it — an agent editing code is exactly the "arbitrary-but-yours" tier, an agent running untrusted suggestions is the hostile tier.
• Patch is the currency (per the #149 write-ops design): the agent's product is a unified diff + structured summary, bounded, reviewable in history — then git.commit_push lands it. The agent never pushes; the workflow does, under its own credentials and policy. Separation of "think" and "act" as steps, which is what makes the whole thing reviewable and gate-able (wait_for_signal: between patch and push = human approval of an agent's change, already expressible).
• Budgets are node budgets: turns/tokens ride repeat_until:'s budget (#157), not plugin-internal counters nobody can see.
• The JSON event stream → heartbeat phases while running (observable progress per #143), bounded structured outputs at the end; full transcripts are #150's offloading territory, not history stuffing.
• Credentials via secret_inputs (#160); protocol details researched against picatz/openai's codex package before building.

The demo that proves it (the house gate)

examples/agent-fix/: a repeat_until: loop — codex.exec proposes a patch, tests run against it, loop ends when green or budget spent — then wait_for_signal: approval, then git.commit_push. One file an author can read that is the agentic pitch: durable, bounded, observable, steerable, gated. Blocked on repeat_until: landing (#157, after call:); the plugin and signal verb are not blocked on anything.

Sequencing: codex plugin + flowstate.signal can start as soon as an agent slot frees; the demo waits for repeat_until:. Related: #145/#149/#150/#151/#153/#155/#156/#157/#159/#160.

Start with the existing Signal RPC and rule-trigger plugin path referenced in #159, then read #157 and #160 alongside the codex.exec and examples/agent-fix/ requirements. Done means defining and implementing same-tenant run-to-run signaling and the Codex step with the stated governance constraints; the full demo remains dependent on repeat_until:.