v0.5.14

codex-peer v0.5.14

This release makes an interactive Codex session wake for a peer message after a turn that ended in an error, and replaces the first paragraph of the Sessionbus skill. It requires Sessionbus v0.5.9 or newer (daemon and hub) and still pins the Sessionbus Go SDK v0.5.9. Native Codex is installed separately and is not pinned.

scripts/install-codex.sh installs the latest stable release by default, so it now installs v0.5.14. Upgrading from v0.5.13 needs no daemon, hub or lane-row change.

Visible to users: an interactive session whose last turn ended in an error no longer stays silent for its peers. The next peer message starts a turn in it.

Changes since v0.5.13

• A message starts a turn after an error-ended turn. Native Codex reports a thread whose last turn ended in an error with the status systemError until the next turn starts. The broker knew only active, idle and notLoaded; for any other status it kept the message and started nothing. On v0.5.13 the sender was answered written and the session did not wake. The broker now handles systemError like idle: the message starts a turn. Any other status it does not know is still kept.
• The skill's first paragraph says that one list call covers all hosts. It now reads: "list with no arguments returns, in one call, every peer you can see on all connected hosts. It also returns self_info, your own identity: compare self_info.session_id with row IDs to recognise yourself." With the previous paragraph a session asked every host separately. Nothing else in the skill changed.
• Versions:
  • RELEASE_VERSION is 0.5.14;
  • the Codex plugin source version (codex/marketplace/codex/.codex-plugin/plugin.json) is 0.5.14-codex.0;
  • packaged archives carry 0.5.14-codex.g<revision>, as before.
• No installer code, dependency, protocol or workflow change.

Evidence

Observed once each on one Linux host with native Codex 0.162.1, run by an operator who did not write the change and read independently by a reviewer:

• Before, on v0.5.13: a session's turn ended in an error, because the provider refused the selected model. One peer message was then answered written. No turn started and no reply came in the 329 seconds until the last read. An ordinary idle session on the same build woke and replied.
• Wake after an error-ended turn: the same steps on this code. The message was answered written; a turn started in the same session about 20 ms after the message was sent, without typed input, and the session replied; the turn ended cleanly about ten seconds after the message.
• Idle session: the message was answered written; the session woke without typed input and replied.
• Busy session: a message sent while a 120-second foreground command was still running was answered written; the reply came inside the same task, before it ended.

For the error-ended case the session was started with a model name the provider refuses. After the failed turn the model was changed for that session only, which starts no turn and wrote nothing to the configuration, and then the one message was sent.

That run used a build of commit ef9d2a3. This release differs from that commit only in RELEASE_VERSION, the plugin source version, the two tests that expect them, and this file.

Codex lanes were not rerun on this build.

Not captured: the status value itself. That native reports systemError in this state, clears it only when a turn starts, and does not consult that status when a turn start is requested, was read in the native Codex source at 0.162.1. No returned status was recorded.

Limits

• If the cause of the error persists, the started turn fails again. One turn is attempted per message; nothing is repeated.
• A turn start that native refuses in this state is dropped and counted, as for an idle thread. v0.5.13 kept such a message instead. The native Codex source at 0.162.1 does not refuse a turn start because of that status; it can decline one for other reasons, as for an idle thread.
• Any other status the broker does not know still keeps the message silently, as described for a kept message in the v0.5.13 notes.
• Native is not pinned. The thread status values this release relies on were read in the native Codex source at 0.162.1. A later native version can change them.
• Linux only. Nothing in this release was exercised live on macOS.
• The limits of v0.5.13 stand.

v0.5.13

codex-peer v0.5.13

This release changes how a message to an interactive Codex session is acknowledged and handed to native Codex. It requires Sessionbus v0.5.9 or newer (daemon and hub) and still pins the Sessionbus Go SDK v0.5.9. Native Codex is installed separately and is not pinned.

scripts/install-codex.sh installs the latest stable release by default, so it now installs v0.5.13. Upgrading from v0.5.12 needs no daemon, hub or lane-row change.

Visible to senders: a message to an interactive Codex session is now answered with written. It used to be answered with injected. written means the peer holds the message; it is not proof that native Codex has taken it.

Changes since v0.5.12

• The receipt is sent on arrival. The peer's broker acknowledges a message with written as soon as it holds it. Before, it answered only after native Codex had acknowledged the message, and every native failure reached the sender as rejected with no receipt.
• Messages are handed over in arrival order. The broker steers the turn in progress, or starts a turn when the thread is idle.
• A refused steer is kept. When native refuses a steer as an invalid request (the turn had just ended, a compaction or review was running, or a human interrupt ended the turn), the message stays queued and is handed over again on the next message or change of the thread's turn state. Before, it was lost.
• An uncertain hand-off is dropped and counted, never repeated. A steer or turn start that was sent to native and failed in any other way, or whose outcome is unknown, is removed. When the broker shuts down it writes one line per kind to its standard error: the native method, the outcome class and a count. The lines carry no message content and no native error text.
• Bounds. The queue is in memory only: 64 messages or 1 MiB per thread and 16 MiB per broker. Beyond that a message is answered rejected with reason Sessionbus unsent input limit reached. The queue ends with the thread's bus presence.
• Versions:
  • RELEASE_VERSION is 0.5.13;
  • the Codex plugin source version (codex/marketplace/codex/.codex-plugin/plugin.json) is 0.5.13-codex.0;
  • packaged archives carry 0.5.13-codex.g<revision>, as before.
• Lanes are unchanged. No installer, dependency, protocol or workflow change.

Evidence

Observed once each, by a reviewer who did not write the change, on one Linux host with native Codex 0.162.1:

• Idle session: the message was answered written; the session woke without typed input and replied.
• Busy session: a message sent while a foreground sleep 120 was still running was answered written; the reply came in the same turn, before the command ended.
• Turn boundary: a message sent while /compact was running was answered written; after the compaction ended, a new turn started with that message and replied. Nothing was typed or resent.
• Regression: one lane run was collected, acknowledged and closed, and the native quit ended the session.

That run used a build of commit 2c47b61. This release differs from that commit only in RELEASE_VERSION, the plugin source version, the two tests that expect them, and this file.

Not captured: the wire answer with which native refused the steer during the compaction. That such a refusal is a non-acceptance was read in the native Codex source at 0.159.3 and 0.162.1; it was not observed on the wire.

Limits

• A turn start that native did not submit is still dropped. Native reports that case with the same error as an internal failure, so it is treated as an unknown outcome and counted, not kept.
• A kept message is silent. Its sender has written and sees nothing more until the message is handed over. Messages still queued when the thread's bus presence ends are discarded without a line.
• A message that native has already accepted is native's. What native does with an accepted steer when the user then interrupts the turn is unchanged and was not tested.
• Native is not pinned. The refusal code, thread status values and turn notifications this release relies on were read in the native Codex source at 0.159.3 and 0.162.1. A later native version can change them. written does not guarantee that native takes the message or that the model reacts to it.
• Linux only. Nothing in this release was exercised live on macOS.
• One earlier event stays unexplained. On v0.5.12 one busy-session message was answered rejected with no receipt. Its cause and what became of it were not traced, and this release does not explain it.

v0.5.12

codex-peer v0.5.12

A version-alignment release. Its runtime is unchanged from v0.5.9, and its version now matches core v0.5.12. It requires Sessionbus v0.5.9 or newer (daemon and hub) and still pins the Sessionbus Go SDK v0.5.9; it does not include Go SDK v0.5.12. Native Codex is installed separately and is not pinned.

scripts/install-codex.sh installs the latest stable release by default, so it now installs v0.5.12. Upgrading from v0.5.9 changes no behaviour and needs no daemon, hub or lane-row change.

Changes since v0.5.9

• Versions:
  • RELEASE_VERSION is 0.5.12;
  • the Codex plugin source version (codex/marketplace/codex/.codex-plugin/plugin.json) is 0.5.12-codex.0;
  • packaged archives carry 0.5.12-codex.g<revision>, as before.
• Third-party notices: the packaged THIRD-PARTY-NOTICES.txt now matches the dependencies actually built in: Sessionbus Go SDK v0.5.9, peer-common and BurntSushi/toml v1.6.0. In v0.5.9 it named an older SDK revision and omitted the other two.
• Contributor rules: the repository now has contributor rules (AGENTS.md).
• No runtime, installer, dependency or workflow change.

Evidence

No new live/native acceptance was run for this release; its runtime is v0.5.9's.

v0.5.9

codex-peer v0.5.9

This release requires Sessionbus v0.5.9 (daemon and hub) and pins the Sessionbus Go SDK v0.5.9. The version matches core v0.5.9.

Breaking, a flag day. The unreleased lane policy field idle_message is removed from the protocol and the SDK; message wake is mandatory. This peer requires a v0.5.9 daemon. Peers built with SDK v0.5.7 or earlier are incompatible with it. Upgrade the hub, the host daemons and the product integrations together. Follow the upgrade steps, including the offline lane-row edit, in the core v0.5.8 release notes. v0.5.9 has the same runtime as v0.5.8.

Fixes:

• Typed argument conflicts are rejected before launch. A typed lane model or reasoning_effort combined with a raw native argument that selects the same setting (for example model plus --model) now fails spawn with argument conflicts with typed field <name>. Before this, it reached codex app-server and failed late. Untyped native arguments are unchanged, and parsing stops at --.
• codex-peer --native-version runs native Codex directly. It no longer starts a broker or App Server, and creates no launch directory. The exec strips all SESSIONBUS_* variables.

scripts/install-codex.sh installs the latest release by default, so it now installs v0.5.9. Pin SESSIONBUS_VERSION on hosts that are not yet in their upgrade window. The legacy per-product installers inherited from the combined repository (scripts/install-{claude,grok,qwen,opencode,kilo,pi,omp}.sh) are removed. They installed the combined v0.5.3 peers, which are incompatible with Sessionbus v0.5.8 and later. Use each product repository's installer. The historical combined releases and assets remain available.

---

What's Changed

• Extract Codex peer with preserved runtime and functionality checklist by @antst in #61
• Record completed Codex installed acceptance in migration docs by @antst in #62
• Update Codex plugin repository metadata by @antst in #63
• Follow the removal of the unreleased idle_message policy field by @antst in #64
• Reject conflicting typed Codex arguments by @antst in #65
• Fix Codex native version dispatch by @antst in #66
• release: v0.5.9 by @antst in #67

Full Changelog: v0.5.3...v0.5.9

v0.5.3

Sessionbus peers v0.5.3

Requires Sessionbus daemon and kit v0.5.7.

Messages wake idle lanes automatically. Active Codex and Grok lanes retain acknowledged native injection. Other lane adapters submit nothing natively when safe active admission cannot be established; the daemon retains the message in bounded memory and automatically starts the next managed run without blocking the sender on the current turn.

Interactive Pi and OMP now initiate native work for idle deliveries. Pi handles tree and compaction transitions. OMP submits independently tracked batches through native steer/triggerTurn and verifies their message/context identities. Existing interactive carriers for the other products remain intact.

Delivery receipts describe acceptance, not completed model work. A queued lane message belongs to the daemon; a queued peer message belongs to its product owner. Neither is durable or safe to resend. Capacity exhaustion fails explicitly, uncertain writes are never replayed, and native denial, cancellation, shutdown or context reset can prevent completion.

Upgrade federation hubs and daemons together for completion-pointer forwarding; incompatible links return ForwardLost. Restart installed product/MCP processes after updating to load the current SDK. An old SDK can reject current spawn responses containing policy.trace and disconnect even after the child opened.

Claude lanes use automatic next-run scheduling. Historical same-turn injection worked, but its acknowledgment independence from a blocked tool and its terminal-boundary safety remain unproven. This release does not claim a fix for the native Qwen OOM issue.

Validation: Linux/macOS CI, Go race tests and vet, native extension/plugin suites, independent source review, actual CodeRabbit review findings resolved, and reproducible candidate artifacts. Corrected Codex candidate passed all four permanent-install cells: idle and active delivery in both lane and interactive modes. Pi lane-idle and the corrected Grok lane-idle candidate also passed permanent-install tests, including the original trailing-newline Grok regression. The remaining installed product cells are still in progress. Qwen setup is blocked by HTTP403 on its sole advertised model; no wake delivery was attempted in that cell; these results are candidate evidence, not completed acceptance of every final release binary.

Signed release tag v0.5.3 binds source 710e5d3. Published asset verification is recorded separately from candidate and installed-test evidence.

Sessionbus peers v0.5.2

Sessionbus peers v0.5.2

Managed peer and lane launches keep the Sessionbus communication tool available under ordinary native policy, while preserving caller-selected permissions for other tools.

Changes

• Add exact Sessionbus tool grants for Codex and Qwen; protect managed communication from conflicting launch arguments in Claude and Pi. OMP exposes the tool through its native approval and essential-tool mechanisms.
• Grok ensures the exact MCPTool(sessionbus__sessionbus) allow rule in its global user config before managed startup. Existing compact or structured permission rules and unrelated settings are preserved; subsequent launches do not rewrite an already-present rule. This persistent config rule works around native leader-mode CLI rules being ignored. The wrapper verifies rule presence, while native policy remains authoritative: existing deny and ask rules are preserved, and effective permission still depends on native policy and caller-selected mode.
• Restore explicit Kilo lane bypassPermissions through native session policy, leaving ordinary launches on inherited policy.
• Update the public Sessionbus Go SDK and JavaScript kit to 0.5.5, including compatibility with effective trace-policy responses.
• Report peer release/build identity from --version; use --native-version for the underlying product version outside lane mode.
• Fix Codex local-plugin catalog discovery and improve installation documentation.

Qwen limitation

This release ships the Qwen wrapper permission fix, not a native memory fix. One official Qwen 0.24.1 run delivered its Sessionbus message and then failed with a V8 heap OOM; its cause remains unresolved. Subsequent instrumented rebuilds did not reproduce it, including one ten-minute session with ten turns and twenty confirmed message deliveries. Used heap returned from a 615.7 MB peak to 141.3 MB and RSS from 756.1 MB to 250.8 MB. Those rebuilt binaries are not byte-identical controls for the original official artifact.

No diagnostic counters, SDK instrumentation, PTY test drivers or heap-limit workaround are included in the wrapper release. The original failure and bounded diagnostic results remain documented in PR50.

Scope and compatibility

Pi and OMP remain preview integrations. Explicit bypass remains a separate caller choice; the managed Sessionbus grant does not enable global bypass. Use matching current peers/helpers and Sessionbus 0.5.5 for the current tracing response contract, and restart managed sessions after updating their helpers.

v0.5.1

Sessionbus peers v0.5.1

This release adds parent-tracing tool controls, fixes Codex result collection,
and corrects OMP startup and shutdown ordering. Pi and OMP remain preview
integrations.

Included source changes

• Codex now collects every final_answer item from the exact persisted native
  turn in native item order. It joins multiple items with one blank line while
  preserving the bytes inside each item. Commentary, tool messages, and other
  turns remain excluded. This fixes the confirmed multi-item collection loss in
  #66; it does not rewrite text
  generated by Codex itself.
• OMP normal shutdown drains the owned native RPC stream and report work before
  completing owner cleanup. Startup bridge requests now wait until the registry
  owns the bridge, so an immediate native owner.ready cannot race its
  assignment. The wait remains cancellable and shutdown joins it.
• Every peer tool declaration exposes trace with mode off, events, or
  content, and spawn accepts the same initial trace setting. The default is
  off. A trace-aware daemon sends at most one ordinary message copy to the
  eligible direct parent for a settled Sessionbus send. content includes the
  body; events carries message and delivery metadata.

Trace compatibility and limits

Parent tracing requires the corresponding Sessionbus daemon and all involved
hubs, available in Sessionbus v0.5.4. Updating peers alone does not enable it.
The initial scope excludes Run/lane lifecycle events and native prompt or result
content.

Older daemons reject trace as an unknown method and reject an explicit spawn
trace field under their closed schema. Updated daemons report
unsupported_trace for tracing controls across unsupported federation links.
The live tracing relationship ends when the parent ends, including for
persistent children; a same-ID reconnect does not recover it.

Tracing creates no durable policy, trace history, journal, replay, catch-up, or
separate event transport. Copies use ordinary Sessionbus message delivery and
remain live, bounded, and best-effort. An upgrade error must not be interpreted
as tracing being enabled.

Preview scope

Pi and OMP remain preview integrations under the existing
acceptance record. This
release does not promote them or replace their remaining installed acceptance
work.

v0.5.0

Sessionbus peers v0.5.0

This is the first stable binary release of the standalone peers repository.
Claude, Codex, Grok, Qwen, OpenCode and Kilo are the established integrations.
Pi and OMP are included as preview integrations; the stable release label
does not remove that qualification.

Requires Sessionbus v0.5.3 or later and an installed, authenticated native
product. Sessionbus daemon and peers release numbers are independent. DSH has
its own package and release lifecycle and is not one of these eight archives.

Included changes

• Managed interactive launches and daemon-owned lanes use the public Sessionbus
  API for discovery, delivery, Run, collection, acknowledgment and cleanup.
• Claude, Codex, Grok, Qwen, Pi and OMP interactive presence reconnects after daemon
  loss while preserving the native session. Old actions and deliveries are never
  replayed. Supersession and native exit remain terminal; Worker lanes retain a
  single launch-connection lifetime.
• Tool declarations expose the protocol's closed argument fields. send uses
  message and target, targets or group; it has no summary field.
• Claude interactive delivery restores the structured envelope for its compact
  sender display. Claude's own model-input guidance remains native.
• Shipped skills explain uncertain no_receipt outcomes, lane-only running
  state, and which product's options govern cross-product delegation.

Install and update

Use the README installer commands.
They install the latest stable release and verify the CI-generated archive
checksum. The same commands update an existing installation; they need no
version edits. SESSIONBUS_VERSION=development selects the rolling prerelease,
and explicit release tags and mirrors remain supported.

Archives are available for Linux and macOS on amd64 and arm64. Native products,
credentials, permissions and configuration remain native. The peer installers
do not install the daemon or the vendor products. Relaunch/resume managed
sessions after updating so their helpers load the new build.

Known limits and preview scope

Daemon connection loss ends a Worker and its retained results for every product;
it is not an instruction to replay an interrupted action.

Pi and OMP's acceptance record distinguishes
installed observations from deterministic fixtures and lists the work before
removing preview status. Pi admitted interrupt/recovery and OMP staged delivery,
Forget and interactive context acceptance remain in that work. OMP dialog
cancellation and Task child behavior retain their fixture-only qualification.
No extra model call is required just to turn an already-assessed fixture failure
into a successful fixture exit.

Ambient extensions remain enabled. An OMP extension writing unrelated text to
RPC stdout can invalidate the managed connection. Native startup can migrate
legacy settings or keybindings and update bookkeeping. Neither a successful
launch nor an empty editor promises byte-identical native configuration.

Linux installed observations do not establish native macOS behavior. macOS
builds and CI fixtures are validated separately; native macOS acceptance remains
qualified by each product's recorded evidence.

Development build

Built from tested develop. Pin a versioned release for stable installations.