[Qubitium]

Summary

Implement an experimental native BGR execution adapter: general Brain/Grunt/Reviewer messaging, isolated reviewer execution over frozen Git snapshots, and trusted cross-process source recording. Omnigent remains the sole scheduler and durable control plane. Companion: ModelCloud/omnigent#98.

• Negotiate bgr/capabilities/read and identity/epoch-fenced bind, send, deliver, inspect, checkpoint and cancel RPCs. Require initialize.capabilities.experimentalApi=true.
• Support task, question, answer, progress, status_query, status_reply, result and cancel through the existing deferred mailbox boundary and bgr_send_message/bgr_reply_message/bgr_report_status. Exact retries deduplicate; changed bodies, stale identities, cancelled assignments and malformed/oversized envelopes fail. Delivery acceptance is not model consumption.
• Add host-only bgr/message/record {threadId,identity,envelope} so the source process records host-authored task metadata before another process returns correlated callbacks. This makes no provider request and adds no second scheduler/mailbox.
• Add atomic bgr/reviewer/start with a fresh isolated thread/home, exact immutable Git base/head, bounded changed-file blobs and diff, one Brain peer, and exactly four tools: status/send/reply/read-review-snapshot. No shell, MCP, ambient instructions, skills, memory, or unsafe settings overrides. Ordinary reviewer bind remains forbidden.
• Support independent reviewer model/provider/reasoning settings; emit complete, no-findings and incomplete results. Review sealing, sibling-result withholding, result normalization, sanitization and PR publication remain Omnigent responsibilities.
• Preserve ordinary unbound thread/tool/interrupt behavior. Cancellation fences queued BGR mail and idle wake reservations. Full serialized-envelope size validation covers UTF-8 boundaries.

Current native capabilities include all three roles, general messaging/callbacks, task dispatch, hostDelivery, hostRecord, reviewerStart, reviewerSandbox and scoped status requests with explicit evidence limits. Native mailboxes/bindings remain process-local: durableMailbox, restartRecovery, consumptionReceipts and crossHostDelivery are false. Checkpoint flush does not constitute durable BGR recovery; cancellation does not attest external-process termination.

See the implemented contract. The unchanged 7b588af32 candidate now passes a real Omnigent browser/native no-findings campaign through publication previews and explicit known-child shutdown. This does not establish consumption receipts, process-loss recovery, autonomous review quality or external publication. Nothing merged or released.

Post-review regressions

• Cancellation was reproduced before production changes: a held worker dynamic tool accepted a BGR query; cancel interrupted the original turn, then the queued query started another completed turn. Three native model requests contained the query [false, true, true]; no BGR reply escaped the canceled runtime. After the fix: one request, query absent, original turn interrupted, no second turn or reply during the bounded observation. Idle cancel is idempotent, rejects new delivery, and makes zero model requests. Queue-level coverage preserves unrelated mail/user input; admission coverage cancels during startup and interrupts reservations both before startup and during lifecycle admission.
• Reply-size overflow was reproduced before the size fix: tool args of 32,473 bytes produced a 32,769-byte envelope. Complete-envelope validation now accepts exactly 32,768 bytes and rejects 32,769 bytes for ASCII and multibyte UTF-8 payloads. Rejection leaves snapshot/query/sequence unchanged and a valid retry succeeds; exact-fit retries remain idempotent.
• Keep design documentation aligned with the current general messaging/reviewer contract and distinguish native process-local evidence from Omnigent durability and end-to-end acceptance.

Test Plan

Integrated Omnigent campaign — unchanged 7b588af32, Omnigent e1fb76c04

Real browser, server, ordinary host, app-server and MultiDex TUI; only provider responses are scripted. One browser-created BGR session delivers its actual initial task exactly once, with no resend/synthetic boot/manual tool injection.

Boundary	Observed result
Native identity and role selection	Brain UUID matches /status, metadata, durable binding and provider cache key. Independent Brain/Grunt/Reviewer models and high/low/medium/high reasoning settings preserved.
Genuine provider dispatch	37 requests across five native threads, zero provider errors; actual nested mcp__omnigent/sys_bgr_control, all native BGR tools, 12 control calls and 45 SSE done items preserve separate namespace/name/string arguments/call IDs.
Execution and independent review	Two Grunts and two isolated Reviewers exchange questions/answers/results; frozen source reads precede sibling sealing, exact-hash Brain acceptance and two sanitized, hash-verified previews.
Explicit worker shutdown	All four known native child processes exit 0; host stop ACK precedes completed outputs. Four durable attempts complete and connections retire. Sealed results/evaluation/previews remain exact; Brain stays attached.
Scope limits	publish:false, no external publication writes. Consumption receipts false, not inferred from replies or stop ACKs. No escaped-descendant/process-loss containment claim. Failed-stop, close/retry and second-round cases remain lower-layer tests, not browser evidence.

The auxiliary continuous SQL sampler failed on byte serialization, and no separate native-close completion timestamp was captured. Stop evidence instead correlates actual retained subprocess return codes at host ACK, process absence, genuine completed outputs and final durable records.

The companion Omnigent PR retains its unresolved database-policy merge gate. This native candidate was not rebuilt or modified for the acceptance run.

Current simulated-provider validation — 066039f948aa9d11a69d1bc2ab7c738d78e466af

Native app-server tests use a local simulated Responses endpoint; the real runtime and tool dispatch execute.

• Two fresh isolated reviewer identities/threads and one Grunt make [5, 5, 4] provider requests. Reviewers inspect the same real immutable Git base/head, read changed-source snapshots, ask Brain clarification questions, receive answers and return results in B/Grunt/A order. No-findings and incomplete result paths are covered.
• Verify exact four-tool reviewer inventories, denied paths, shell/unsafe override rejection, immutable head enforcement and one-Brain peer ACLs.
• A separate two-process source-record regression makes 3 Brain + 4 worker provider requests, with arbitrary native task/question/answer/result IDs, correlated callbacks, idempotent source recording, and rejection of changed content/identity, stale and cancelled sources.
• Final implementation-session checks: native BGR 12 passed; core BGR 16 passed; app-server protocol 324 passed/1 intentional ignore; stable/experimental schema writers and scoped strict app-server test-target Clippy passed. Strict core Clippy retains only the two unchanged failures listed below.
• A stripped debug CLI/app-server/code-mode-host package was built at that exact SHA and replayed against the scripted provider, not installed/released as a production build. Full controller and real same-BGR UI/TUI acceptance are still pending.

From codex-rs, using the documented bounded cached build settings:

cargo test -p codex-app-server --test all bgr
cargo test -p codex-core --lib bgr
cargo test -p codex-app-server-protocol --lib

Earlier status-bridge regression runs (historical, not current capability inventory)

Commands run from codex-rs with the documented bounded cached Rust build settings:

Check	Result
cargo test -p codex-core --lib bgr	10 passed; includes cancellation queue/admission races, exact-fit/overflow UTF-8 reply envelopes, valid retry, anchors and dedup
cargo test -p codex-app-server --test all bgr	8 passed; safe-boundary same-turn status paths, held-tool cancellation/no follow-up turn, idle idempotent cancellation, ordinary-tool regression and experimental gate
RUST_MIN_STACK=8388608 cargo test -p codex-core --lib mailbox	18 passed; ordinary mailbox boundaries plus wait-agent wake behavior
RUST_MIN_STACK=8388608 cargo test -p codex-core --lib interrupt	33 passed; ordinary interrupts retained
cargo test -p codex-core --lib abort_empty_active_turn_preserves_pending_input	1 passed
cargo test -p codex-app-server --test all turn_interrupt	4 passed; running-turn abort, completed-turn rejection, pending approval resolution and websocket drain
cargo test -p codex-protocol --lib bgr::tests	1 passed; reserved host payload field round-trips and rejection of legacy names
cargo test -p codex-app-server-protocol --lib	324 passed, 1 intentionally ignored schema-writer entrypoint; includes host-delivery gating/thread serialization and stable/experimental export consistency
Schema writer, stable and experimental modes	Both passed; regenerated JSON/TS fixtures and embedded exports
cargo check -p codex-app-server -p codex-tui	Passed
cargo clippy -p codex-protocol -p codex-app-server-protocol --lib -- -D warnings	Passed
Strict core/app-server Clippy	Not green: two pre-existing errors in unchanged core/src/compact_remote_v2.rs:531 (expect_used) and core/src/thread_manager.rs:981 (redundant_clone); no new BGR diagnostics
cargo fmt --all --check, targeted Prettier and git diff --check	Passed

Native regressions cover query anchor A versus observed head B, and null query anchor versus observed non-null head, through both same-process and trusted-host delivery. Both new anchor cases failed against the original implementation before the fix. The external-brain runs verify that the sole loaded native thread is the worker, accept/deduplicate while its work tool is held open, reject spoofed sender/team/epoch/role, malformed sender/session, stale target attempt and unsupported scope/kind, then emit a correlated reply and continue the same turn after the safe boundary. All logical IDs use host-like lower32hex values; SHA anchors are 40hex. The disabled-experimental test also rejects host delivery.

Schema regeneration in the initial slice also normalizes existing setAgentSettings/reasoning-default fixture drift without changing those runtime types. Tests extend existing native app-server mock-Responses/dynamic-tool fixtures; no live-provider credentials or UI setup required. A real native wire capture (capability/report-tool schema, host-delivery request/receipt and reply notification) is supplied separately for controller conformance. No merge or release packages.

The wider core mailbox/interrupt groups use an explicit 8 MiB test-thread stack: default-stack runs overflowed in the existing multi_agent_v2_wait_agent_* test functions. These groups pass with RUST_MIN_STACK=8388608. Focused BGR and native app-server tests use the default stack.

Earlier ordinary host UI/TUI regression (not full BGR acceptance)

Post-review validation used Omnigent 9281c1118 and MultiDex 4db4f1608. The candidate package reported codex-cli 0.166.0+4db4f1608; SHA-256 aa9d1a932a68e636f5d429902755d048ead571f4461ed7f5e53067d2336a222e. The server, connected host, transport, bridge and MultiDex TUI were real; only model responses were scripted.

Real interaction	Result
Native browser prompt and actual MultiDex TUI prompt	Passed
Escape interrupts active TUI turn; follow-up succeeds	Passed; no late canceled response or extra turn after the provider's 120-second delay
Chat return and browser reload	Replies persisted once; same native session reattached idle
BGR launch/UI	Unavailable: absent from both menus, including “Other…”

Chromium 148.0.7778.96 with a fresh profile and GPU/WebGL disabled completed the flow. The original Chrome tab crashed with SIGSEGV on Terminal view; cause remains unresolved and is not attributed to this PR. These ordinary native interactions are regression evidence, not BGR typed-mail cancellation, live-provider, cross-provider or full BGR acceptance.

Manual recheck: use the candidate native package with the connected Omnigent host, send a Chat prompt, open Terminal and send a TUI prompt, interrupt an active turn with Escape, send a follow-up, then reload Chat. Verify completed replies appear once and the canceled turn never later produces a response.

Link to Devin session: https://app.devin.ai/sessions/e683ca3709c24c0e817bec37549367cf
Open in Devin Desktop: https://app.devin.ai/desktop/session/e683ca3709c24c0e817bec37549367cf?variant=devin
Requested by: @Qubitium

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring