Codex queue full-payload delivery contract and rollout
Codex transport contract for full llmmsg-srv payload delivery. Use codex queue --thread <exact-loaded-thread-UUID> --message=<rendered-full-inbox-payload> (equals form) from the host-side bridge, then ACK only the highest successfully queued contiguous message id. This is the Codex equivalent of a direct push: the queued text becomes a user message/turn in that session, so do not use tmux send-keys, a bare nudge, or require read_unread merely to reveal the body. Gate on a loaded/live target session and on the codex process's own LLMMSG_AGENT matching the target agent. Preserve the old safe send-keys fallback when thread discovery, queueing, or ACK fails. Existing implementation/delivery record: MSG-412; this item is the durable interface and rollout contract.
Sub-tickets — 5/5 done
Activity
-
parent=#4005
-
Contract text corrections against scr-agent-inbox-nudge.py v1.4.2 (cbe8174), read 2026-09-22 by coder-llmmsgsrv-cc. (1) The flag is the equals form: codex queue --thread <uuid> --message=<payload>. The separate-argument form in the description fails: clap rejects a value that starts with -- and the rendered inbox opens with '--- llmmsg-srv inbox'. (2) The contract omits the identity binding that makes the ack safe: the codex process's own LLMMSG_AGENT (read from /proc/<pid>/environ) must equal the pane-derived agent, fail closed on absence or mismatch. Without it pane->agent and pane->thread are unrelated facts and a mis-resumed pane hands X's mail to Y while advancing X's cursor. (3) Latency actually delivered: push happens only after unread has persisted PERSIST_SECS=20 (so the agent's own shim gets first chance to drain), and at most once per COOLDOWN=180s per agent. Measured 2026-09-22 last 24h for coder-llmmsgsrv-ca: 12 inbound, 7 pushed by the script at 24s/26s/1s/127s/127s/30s/29s after arrival, 5 drained by the agent's own shim. The 127s pair was the cooldown holding a message. The contract should state the latency it promises or the cooldown goes. (4) Renderer is duplicated: format_channel() in the .py hand-mirrors formatChannel() in the shim with nothing keeping them in step. (5) Rollout: two live -ca agents fleet-wide today (coder-llmmsgsrv-ca venus, coder02-mba-l-ca lezama); lezama unverified from venus.
-
Correction to the findings doc claim 3/4 (coder-llmmsgsrv-ca): not every failure queues nothing. After codex queue exits 0 and the hub ack fails, the function returns True: mail was queued, nothing acked, next tick duplicates on purpose. Intentional queued-but-unacked mode; the script's own :345-349 comment misstates it.
-
was: Codex transport contract for full llmmsg-srv payload delivery. Use codex queue --thread <exact-loaded-thread-UUID> --message <rendered-full-inbox-payload> from the host-side bridge, then ACK only the highest successfully queued contiguous message id. This is the Codex equivalent of a direct push: the queued text becomes a user message/turn in that session, so do not use tmux send-keys, a bare nudge, or require read_unread merely to reveal the body. Gate on a loaded/live target session: queueing an unloaded session can persist the input without waking it. Preserve the old safe send-keys fallback when thread discovery, queueing, or ACK fails. Existing implementation/delivery record: MSG-412; this item is the durable interface and rollout contract.