fix: verify Codex resume binding ownership

[austinywang]

Summary

• Verify each Codex checkpoint against the exact durable state_5.sqlite thread and rollout session_meta identity before publishing a surface resume binding.
• Classify TUI, exec/review, subagent, and unknown provenance; prevent ephemeral or nested automation sessions from replacing the last-known-good interactive binding.
• Route SessionStart, prompt-submit, stop, approval-response, and visible-state restoration through the same no-downgrade publication gate.
• Preserve existing bindings when Codex state is temporarily unreadable and emit privacy-safe diagnostics for rejected publishes.
• Keep Hermes behavior unchanged.

Fixes #9629.
Fixes #10047.

Testing

• Focused Codex resume-binding package coverage: 9 tests passed.
• Full CMUXAgentLaunch package suite: 308 tests in 44 suites passed.
• ./scripts/lint-pbxproj-test-wiring.sh passed (688 files checked).
• ./scripts/check-pbxproj.sh passed after normalization.
• Workspace package grouping and Package.resolved policy checks passed.
• Swift parser checks passed for CLI/cmux.swift and the new CLI extension.
• Tagged app build and remote macOS dogfood are pending authorization; this PR is draft until that verification is complete.

Demo Video

• Not applicable: no user-facing UI changed. Tagged behavior dogfood remains pending as noted above.

Review Trigger (Copy/Paste as PR comment)

@codex review
@coderabbitai review
@greptile-apps review
@cubic-dev-ai review

Checklist

• I tested the change locally
• I added or updated tests for behavior changes
• I updated docs/changelog if needed (not needed; no user-facing text or public workflow changed)
• I requested bot reviews after my latest commit (copy/paste block above or equivalent)
• All code review bot comments are resolved
• All human review comments are resolved

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Enforces verified Codex ownership of surface resume bindings and applies a no-downgrade policy. Previously Codex hooks could replace or clear a binding on ad-hoc evidence; now the CLI verifies against state_5.sqlite and rollout files, classifies provenance, and preserves the last-known-good binding when Codex state is unreadable.

• Adds AgentResumeEvidenceProvenance, CodexSessionResumeVerification, and CodexSessionResumeVerifier in CMUXAgentLaunch; verification reads threads in state_5.sqlite, validates rollout JSONL, and classifies TUI, unknown, exec, and subagent provenance.
• Gates all Codex publish paths in CLI/cmux.swift through a canReplace check: queries surface.resume.get, prevents lower-provenance rebinding (exec/subagent never own), and logs privacy-safe rejection breadcrumbs. For Codex, resume-command unavailability no longer clears an existing binding.
• Keeps Hermes behavior unchanged.

Rollout

• If surface.resume.get is unsupported on the app, Codex publishing proceeds with legacy behavior.
• No migration required for users or integrators.

^{Written for commit 4f10c3b. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 86ad5f7f-5d2c-42bb-aa00-fd08ef1a4490

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.