P1: Harden Codex agent harness and governed continuous learning

[jusso-dev]

Goal

Make subscription-backed Codex agents reliable for long-running security work while supporting Hermes-style continuous improvement safely.

Scope

• Durable agent-run records in PostgreSQL instead of gateway memory only.
• Queue-backed invocation, progress events, cancellation, timeout, token/cost ceilings and restart recovery.
• Typed output validation with useful failure diagnostics.
• Trusted policy/human request/untrusted evidence/tool result/approval separation.
• Tool registry with capabilities, schemas, read/write classification and approval policy.
• Post-run self-improvement notes: lesson, failure, preference and procedure hint.
• Versioned skill proposals with evidence references, evaluation suite, diff, human approval, rollback and kill switch.
• No self-authorised permission/tool/policy changes.

Acceptance criteria

• Gateway restart does not lose durable run state or silently duplicate work.
• Every tool call, source, output, token/cost record and cancellation is auditable.
• Prompt injection from telemetry/web/connector output cannot alter trusted policy or tool permissions.
• Agent may propose a note/skill; publication requires evaluation plus human approval.
• Published skill version can be retired/rolled back.
• Subscription credential remains in private Docker volume and never becomes an API key/environment secret.

Verification

• Restart/duplicate/cancel/timeout integration tests.
• Prompt-injection and tool-escalation security tests.
• Structured-output compatibility tests against real Codex.
• Learning proposal/evaluate/approve/rollback E2E.

[jusso-dev]

Implemented on main in 810be14.

Delivered PostgreSQL-authoritative agent runs; idempotent queue dispatch; leases, heartbeat and restart recovery; durable cancellation, timeout, token/cost ceilings and kill-switch cancellation; typed diagnostics; prompt trust separation; governed tool registry; source/output/token/cost audit records; evidence-linked post-run notes; immutable skill proposals with security evaluation, human approval, publication, rollback and retirement; and live learning/task UI.

Verification:

• pnpm run check: pass
• durable runtime integration: 4 passed (restart/duplicate, cancellation, timeout, token and cost ceilings)
• governed learning integration: 16 passed total, including injection/tool escalation rejection, approval, rollback, retirement and kill switch
• Playwright task + learning flow: 8 passed across Chromium, Firefox, WebKit and mobile
• fresh PostgreSQL migration: 27 operational tables verified empty
• authenticated Codex subscription smoke: run 019f9ecc-5fd7-71a3-9e76-2b3802c6be8e completed as ThreatIntelFinding with persisted hash and token usage