Enhance Claude-dispatched OmniRoute workers with native MCP, agents and workflows

.claude/skills/omniroute-runtime-worker/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: omniroute-runtime-worker
+description: Delegate a bounded foundation engineering task from Claude to the native Codex SDK worker through the selected OmniRoute gateway.
+---
+
+Read `examples/omniroute-codex-sdk/README.md` for invocation and lifecycle details.
+Use this project's `examples/omniroute-codex-sdk/worker.py` through Claude's native
+Bash tool. The primary route is `cx/gpt-6.1-sol-max`, with native Max effort.
+The coordinator retains its native Claude account and model route.
+
+Give a writing worker its own worktree, bounded file ownership, an executable
+acceptance condition and the enhanced private Codex home described in
+`examples/omniroute-codex-sdk/enhancements.md`. Use that scoped setup by default;
+preserve an existing home's configuration and adopt only reviewed selected keys.
+Pass native readiness before dispatch, requiring Context Mode and the selected
+skill; require Serena too when the task needs semantic navigation. Tell it other workers
+are present and that it must preserve their edits. Feed the task on stdin:
+
+```sh
+rtk proxy uv run --locked --script examples/omniroute-codex-sdk/worker.py \
+  --workspace "$WORKER_PROJECT" \
+  --codex-home "$PRIVATE_WORKER_HOME" \
+  --preflight --require-mcp context-mode --require-skill using-superpowers \
+  --timeout 60 &&
+rtk proxy uv run --locked --script examples/omniroute-codex-sdk/worker.py \
+  --workspace "$WORKER_PROJECT" \
+  --codex-home "$PRIVATE_WORKER_HOME" \
+  --timeout 600 \
+  --prompt -
+```
+
+Use the selected gateway's native Responses lane at loopback port 20128. Keep
+native caches, tools and project skill discovery intact; load only task-relevant
+skill bodies. Install selected skills through the existing runtime-worker skill
+recipe, rather than importing the entire catalog into the task prompt. Optional
+MCP services use their native configuration and task-specific readiness checks.
+Use the coordinator's selected native workflow roles for research, implementation
+and verification, and the bounded Dagu graph when the task needs automation.
+
+Keep returned thread IDs private and use `--resume` for continuation. The latest
+thread usage snapshot includes previous turns; count it once. A deadline invokes
+native interruption and child cleanup; remote termination and unknown provider
+usage remain unverified. Do not automatically replay a failed writing task.
+
+Use explicit `--model cx/gpt-6-astra-max` for consequential architecture,
+conflicting primary evidence, or a failure unresolved after one bounded Sol
+repair. Record that trigger and the acceptance result. The separate Claude SDK
+bridge remains a trial after its gateway errors; it is not the primary worker.
+
+Sources: [Claude native project skills](https://code.claude.com/docs/en/skills)
+and [official Codex SDK, rust-v0.159.2](https://github.com/openai/codex/tree/ff6aec96948b70d94983af2641a6b67c94faeff5/sdk/python).
+Functional scope and retained failures are recorded in
+`docs/decisions/2026-09-30-omniroute-runtime-workers.md`.

.github/osv-scanner-lockfiles.json

@@ -1,6 +1,18 @@
 {
   "description": "Every tracked dependency lockfile or manifest that security-scan.yml's osv-scanner job scans. A lockfile entry without a parser lets OSV-Scanner infer it from the file name; parser names the OSV-Scanner v2 extractor for names it cannot infer (--lockfile=<parser>:<path>). A covered_by_lockfile entry is a manifest OSV-Scanner v2.6.0 has no source extractor for; its sibling lockfile is scanned instead. An excluded entry is a tracked lockfile deliberately left out of the scan; it needs a reason and an evidence path, and only a deliberately vulnerable test fixture qualifies. tests/test_osv_lockfile_coverage.py fails when a tracked lockfile or manifest is in none of the three lists.",
   "lockfiles": [
+    {
+      "path": "examples/claude-runtime-sdk/worker.py.lock",
+      "parser": "uv.lock"
+    },
+    {
+      "path": "examples/omniroute-codex-sdk/worker.py.lock",
+      "parser": "uv.lock"
+    },
+    {
+      "path": "examples/omniroute-codex-sdk/test_worker.py.lock",
+      "parser": "uv.lock"
+    },
     {
       "path": ".github/requirements-ci.txt",
       "parser": "requirements.txt"