Problem
A controlled Codex start refuses a live app-server socket without enough process evidence for safe recovery.
The wrapper currently names the socket path. It does not name the owner PID, parent PID, session ID, or relationship to the registered PTY runtime.
The supervisor journal reports repeated restarts only. An operator must inspect the socket and process tree separately.
Field evidence
The fleet saw this failure three times on Linux and macOS.
On Hetz, a stopped evals PTY left an app-server tree inside an old transient scope. Linux reparented that tree to the user systemd subreaper.
The socket owner remained outside the replacement PTY ancestry. The supervisor retried every 30 seconds and recovered after an authorized TERM to the exact socket owner.
A fixed parent-PID rule is not portable. macOS can reparent to PID 1, while Linux can reparent to a user-systemd subreaper.
Required behavior
The refusal must name the socket path, owner PID, parent PID, session ID, and ancestry result.
The diagnostic must classify a holder as detached from, or managed by, the registered PTY runtime.
A detached-holder message must require authorization, TERM on the exact owner, a wait and re-check, and same-PID escalation only. It must forbid process-group signals.
A managed-holder message must forbid a signal. It must tell the operator to walk and report the live ancestry.
The driver must not clean up automatically. The supervisor retry policy must not change.
Acceptance
- Linux uses Unix peer credentials to identify the socket owner.
- macOS uses the Unix peer PID socket option.
- Process facts include the parent PID and session ID.
- Classification compares owner ancestry with the registered PTY runtime.
- Missing or incomplete evidence fails safe as managed-holder.
- Tests cover owner facts, both classifications, and the two recovery messages.
- No code sends a cleanup signal.
Related
Issue #260 covers the separate Codex driver cleanup defect. This issue covers the diagnostic when a live holder already exists.
Problem
A controlled Codex start refuses a live app-server socket without enough process evidence for safe recovery.
The wrapper currently names the socket path. It does not name the owner PID, parent PID, session ID, or relationship to the registered PTY runtime.
The supervisor journal reports repeated restarts only. An operator must inspect the socket and process tree separately.
Field evidence
The fleet saw this failure three times on Linux and macOS.
On Hetz, a stopped evals PTY left an app-server tree inside an old transient scope. Linux reparented that tree to the user systemd subreaper.
The socket owner remained outside the replacement PTY ancestry. The supervisor retried every 30 seconds and recovered after an authorized TERM to the exact socket owner.
A fixed parent-PID rule is not portable. macOS can reparent to PID 1, while Linux can reparent to a user-systemd subreaper.
Required behavior
The refusal must name the socket path, owner PID, parent PID, session ID, and ancestry result.
The diagnostic must classify a holder as detached from, or managed by, the registered PTY runtime.
A detached-holder message must require authorization, TERM on the exact owner, a wait and re-check, and same-PID escalation only. It must forbid process-group signals.
A managed-holder message must forbid a signal. It must tell the operator to walk and report the live ancestry.
The driver must not clean up automatically. The supervisor retry policy must not change.
Acceptance
Related
Issue #260 covers the separate Codex driver cleanup defect. This issue covers the diagnostic when a live holder already exists.