[GraciousGazelles]

Summary

Agents need durable work and reply tracking without returning to the provider for every quiet update. Add the default-off agent_mailbox surface for same-tree Multi Agent V2. One core-independent library owns a separately versioned mailbox_1.sqlite; native agent membership, execution, approvals, budgets, cancellation, and scheduling remain authoritative.

The built-in send/wait facades expose quiet notes and progress, explicit request/reply obligations, immutable accepted native work references, and any/all joins. Native acceptance captures work before tool publication; canonical append and successful flush precede per-item observation. Provider response creation establishes input admission, so failed setup, compaction, restart, continuation handback, and uncertain dispatch retain honest custody rather than inventing completion or resending input. Live and replayed collaboration reports share the same bounded completed/pending and wake-cause data.

New tracked operations reject incompatible resolved roles/recipients before native acceptance. Accepted retries preserve their original work and child, including when a role becomes unavailable. Atomic mailbox write transactions reserve SQLite's writer before reading custody state, avoiding deferred read-to-write upgrade failures during concurrent delivery and child settlement. Genuine storage failures still retain the original accepted message and report an unknown activation disposition. V1 and mailbox-disabled native operation remain unchanged. Recipient idle activation is a separate, default-off permission.

The accompanying CI changes add the new crate to existing focused and CodeQL coverage, keep this fork's scoped Bazel/SDK/post-main execution on standard GitHub-hosted runners without forwarding the optional remote-execution credential, and correct preview versions to one SemVer build-metadata separator. The fork-only Windows hosted-local fallback selects the native GNU host for tests, Clippy, release verification, and the existing post-main health workflow. Cold hosted-local compilation has a fork-specific 360-minute job ceiling for Bazel tests, Clippy, release verification, and SDK builds; other repositories retain their respective 120/30/60/30-minute defaults. The existing protected-main merge-queue response window is aligned to 360 minutes, with all other queue settings unchanged. Cache publication remains restricted to the existing trusted post-merge pushes. The keyless hosted fallback retains shared CI settings for lean Rust artifacts and no duplicate on-runner disk CAS, instead of unintentionally selecting development artifact/cache settings. Disposable fork-hosted Linux runners reclaim only the unused preinstalled Android SDK, and the Bazel test job uses the existing native Linux user-namespace prerequisites so sandbox assertions can execute. The existing Bazel-only WebRTC patch keeps native build caches in each action's output without relaxing the Darwin build sandbox. Existing target sets, production deadlines, required checks, and zero required approvals are unchanged. The positive Windows stdio fixture uses the normal bounded 10-second initialization cap rather than a one-second cold-start assumption; only pre-foreground PowerShell startup readiness gets a separate 120-second allowance, leaving subsequent input, Ctrl-C, resumed-shell, and exit assertions unchanged. The Wine support target's outer harness gets the normal moderate allowance to finish reporting its unchanged internal checks, and interrupted core shards retain their written attempt-log diagnostics.

Validation

• Focused native run 40107505223, exact runtime source 1203008b816f46ff2fcd66639d18c60e118b3d69: mailbox library 23/23, rollout 1/1, core mailbox 53/53, strict schema 2/2, and the original five native adapter cases in five consecutive serial, fail-first groups all passed (25 adapter invocations). Baseline core-library 16/16 and integration 4/4, execution backfill 1/1, protocol compatibility 1/1, and a further core-integration selection 5/5 also passed. The proof binds host, target, and harness to that full SHA, base 7d0a6477497c2224c6f3fb2e42d2b53c6600c556, fingerprint 7ca464d61369705c, and complete selected-job reconciliation. The only subsequent source change is test formatting. Focused proof is not current-head aggregate, protected landing, or live acceptance.

• The transaction correction has an actual red/green discriminator: unchanged-runtime run 40107444994, exact source 32fb3c35ab61b8dcf0308a3a08d2709b9d370e07, executed 21 passing library tests and two failing contention regressions. Both activation claim and receipt persistence returned SQLite code 5 (database is locked) while another writer was held. Both now pass in the focused successor above. Earlier adapter runs exposed an unknown activation receipt and intermittent join/deadline failures; those contrary results are retained, not replaced by an absolute no-flakes claim.

• Validation-lab 39996919215, exact source 7dd06d6c6a9ec1da2cffb31eaffd90d8e1a9ee92: the full public protocol library passed 302/302 and schema fixtures 2/2. The separate mailbox UI/protocol lane passed protocol 2/2, app-server protocol 2/2, TUI 3/3, and notification parser 4/4. The aggregate run's earlier core failure was repaired before the native run above.

• Generated-source run 39996863028, exact source 7dd06d6c6a9ec1da2cffb31eaffd90d8e1a9ee92: existing schema, status snapshot, and lock-generation machinery succeeded with an empty generated patch.

• CI-control run 40098230703, exact source 3992c1d5b49b6954fc85d0d8b8deaadf2bf8e888: the existing workflow lane passed its five suites (319, 5, 10, 22, and 89 tests), workflow policy, and YAML parsing of 58 workflows. Real fake-command fixtures exercise the Bash entry point's hosted-only lean-config restoration for both test and info, unchanged target/payload handling and remote exclusion, plus the interrupted-shard diagnostic regression. The proof binds host, target, and harness to the full SHA, base 7d0a6477497c2224c6f3fb2e42d2b53c6600c556, fingerprint cb30258b3bcfcd9a, and complete one-lane job reconciliation. Native/Rust/artifact lanes were intentionally skipped; this does not prove native disk recovery or Intel throughput.

• At exact a5d7070c36cff09803f24926e03cf8c8ea69927e, CodeQL run 40086579598 passed. Protected run 40086579691 was terminal failure: Windows release/Clippy and three test shards, GNU release, SDKs, and Rust CI passed, but Windows shard 4 still failed its resumed-shell PTY check. The successor waits for a fresh unique PowerShell prompt before the unchanged version check, within the same total ten-second contract; native Windows proof remains pending. Linux/Darwin jobs exhausted disk, and Intel tests hit the provider-confirmed physical six-hour limit with 118/316 test targets reached (not 118 confirmed passes). Musl recovered two strict-schema fixture failures, now corrected and passing in the focused run; GNU interrupted core attempts still lack a complete cause. The successor fixes the Bash entry path that omitted shared lean CI settings; native capacity recovery remains unproven.

• The required dependency check in that protected run reports RUSTSEC-2026-0387 for inherited crypto-bigint 0.5.5 through AWS credentials-login. Main has the same affected dependency chain. A separate bounded dependency assessment found no compatible upstream-backed repair preserving supported login. No advisory waiver, login feature removal, or auth dependency mutation is included; the required security check remains enforced and independently blocks landing.

• Repaired Linux previews at exact source 1203008b816f46ff2fcd66639d18c60e118b3d69 passed the existing hosted package checks. These include the transaction correction; the older previews below do not.

  • x86-64 build 40112853679, artifact 12570485137: version 0.146.0-alpha.8-sedna.10+upstream.8593.ci.925.g1203008b, artifact SHA-256 aa0346c134de440d60537297af7753637e72d450979dafabca6b3004c712b9f9, expires 2026-10-27 17:45:09 UTC.
  • AArch64 build 40112855390, artifact 12570365729: version 0.146.0-alpha.8-sedna.10+upstream.8593.ci.926.g1203008b, artifact SHA-256 eaa22b6862280ad681bf050ebc6948e3efc76ddc48d4a79fbef058bb10d17f91, expires 2026-10-27 17:40:01 UTC.

• Coherent Linux previews at exact ca9a4735805606277e95393aed34494356df19ab succeeded through the existing package machinery:

  • x86-64 build 40005208473, artifact 12526444477: 0.146.0-alpha.8-sedna.10+upstream.8593.ci.921.gca9a4735, expires 2026-10-26 19:44:01 UTC.
  • AArch64 build 40005207965, artifact 12527601363: 0.146.0-alpha.8-sedna.10+upstream.8593.ci.920.gca9a4735, expires 2026-10-26 19:41:43 UTC.

  Both metadata jobs checked out the full source SHA, and both build jobs executed version, ELF, archive/manifest/checksum, and launcher-package checks before successful upload. This is workflow-executed qualification, not independent inspection of downloaded archives or operator installation. Packages remain bound to their actual source; later lint/test/CI-only commits are not relabelled into their manifests.

No local builds or tests were used. These are progressive source-bound artifacts, not qualified replacement or upgrade packages for a different source lineage. Preview installation, session restart, authentication changes, and live adoption are not part of this change. The mailbox feature is off by default; explicitly enable both multi_agent_v2 and agent_mailbox to select it. agent_mailbox_idle_activation remains an independent recipient choice.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-23T17:19:06.217901Z	08988d6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.