OmniRoute Codex SDK worker harness at Codex 0.160.0 (supersedes #551)

.claude/skills/omniroute-runtime-worker/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: omniroute-runtime-worker
+description: Delegate a bounded foundation engineering task from Claude to the native Codex SDK worker through the selected OmniRoute gateway.
+---
+
+Read `examples/omniroute-codex-sdk/README.md` for invocation and lifecycle details.
+Use this project's `examples/omniroute-codex-sdk/worker.py` through Claude's native
+Bash tool. The primary route is `cx/gpt-6.1-sol-max`, with native Max effort.
+The coordinator retains its native Claude account and model route.
+Two shell startup failures occurred in the builder's nested Codex sandbox;
+the coordinator's separate non-nested read-only shell run succeeded with exit 0
+and output `13`. The builder's task also retained an MCP `Transport closed`
+failure; writing (`workspace-write`) dispatch is not yet qualified at 0.160.0.
+
+Give a writing worker its own worktree, bounded file ownership, an executable
+acceptance condition and the enhanced private Codex home described in
+`examples/omniroute-codex-sdk/enhancements.md`. Use that scoped setup by default;
+preserve an existing home's configuration and adopt only reviewed selected keys.
+Pass native readiness before dispatch, requiring Context Mode. Add
+`--require-skill NAME` only after the documented installer has installed that
+selected skill in the private worker home; a new home with none installed has
+no skill requirement. Require Serena too when the task needs semantic navigation. Tell it other workers
+are present and that it must preserve their edits. Feed the task on stdin:
+
+```sh
+rtk proxy uv run --locked --script examples/omniroute-codex-sdk/worker.py \
+  --workspace "$WORKER_PROJECT" \
+  --codex-home "$PRIVATE_WORKER_HOME" \
+  --preflight --require-mcp context-mode \
+  --timeout 60 &&
+rtk proxy uv run --locked --script examples/omniroute-codex-sdk/worker.py \
+  --workspace "$WORKER_PROJECT" \
+  --codex-home "$PRIVATE_WORKER_HOME" \
+  --timeout 600 \
+  --prompt -
+```
+
+Use the selected gateway's native Responses lane at loopback port 20128. Keep
+the exact model route in the live catalog; the default Sol/max suffix requires
+an OmniRoute build carrying PR #15167. Requested effort does not establish
+gateway-forwarded effort or backend identity. Keep
+native caches, tools and project skill discovery intact; load only task-relevant
+skill bodies. Install selected skills through the existing runtime-worker skill
+recipe, rather than importing the entire catalog into the task prompt. Optional
+MCP services use their native configuration and task-specific readiness checks.
+Use the coordinator's selected native workflow roles for research, implementation
+and verification, and the bounded Dagu graph when the task needs automation.
+
+Keep returned thread IDs private and use `--resume` for continuation. The latest
+thread usage snapshot includes previous turns; count it once. A deadline invokes
+native interruption and child cleanup; remote termination and unknown provider
+usage remain unverified. Do not automatically replay a failed writing task.
+After a `content_filter` stop, preserve native guidance and resume only for an
+explicit permitted alternative or unrelated authorized task.
+
+Use explicit `--model cx/gpt-6-astra-max` for consequential architecture,
+conflicting primary evidence, or a failure unresolved after one bounded Sol
+repair. Record that trigger and the acceptance result. The separate Claude SDK
+bridge remains a trial after its gateway errors; it is not the primary worker.
+
+Sources: [Claude native project skills](https://code.claude.com/docs/en/skills)
+and [official Codex SDK, rust-v0.160.0](https://github.com/openai/codex/tree/a956835d020762cb2b570053af06f643a11c0ecc/sdk/python).
+Functional scope and retained failures are recorded in
+`docs/decisions/2026-09-30-omniroute-runtime-workers.md` and
+`docs/decisions/2026-10-03-omniroute-sdk-worker-0160.md`.

.github/osv-scanner-lockfiles.json

@@ -1,6 +1,18 @@
 {
   "description": "Every tracked dependency lockfile or manifest that security-scan.yml's osv-scanner job scans. A lockfile entry without a parser lets OSV-Scanner infer it from the file name; parser names the OSV-Scanner v2 extractor for names it cannot infer (--lockfile=<parser>:<path>). A covered_by_lockfile entry is a manifest OSV-Scanner v2.6.0 has no source extractor for; its sibling lockfile is scanned instead. An excluded entry is a tracked lockfile deliberately left out of the scan; it needs a reason and an evidence path, and only a deliberately vulnerable test fixture qualifies. A lockfile entry that names a config is scanned in an invocation of its own under that config alone (an explicit --config applies to every input of one invocation), and every other entry together under .github/osv-scanner.toml; the tests bind each such config to its one lock. tests/test_osv_lockfile_coverage.py fails when a tracked lockfile or manifest is in none of the three lists.",
   "lockfiles": [
+    {
+      "path": "examples/claude-runtime-sdk/worker.py.lock",
+      "parser": "uv.lock"
+    },
+    {
+      "path": "examples/omniroute-codex-sdk/worker.py.lock",
+      "parser": "uv.lock"
+    },
+    {
+      "path": "examples/omniroute-codex-sdk/test_worker.py.lock",
+      "parser": "uv.lock"
+    },
     {
       "path": ".github/requirements-ci.txt",
       "parser": "requirements.txt"

adoption/skills/lifecycle.md

@@ -194,6 +194,27 @@ and [Claude structured output](https://code.claude.com/docs/en/headless).
 
 ## Listing budget
 
+### Project-scope exception: 2026-10-03
+
+The repository-owned
+[`omniroute-runtime-worker`](../../.claude/skills/omniroute-runtime-worker/SKILL.md)
+is a Claude Code project skill, auto-listed only in this repository through
+`.claude/skills/omniroute-runtime-worker/SKILL.md`, following
+[Claude's native project-skill scope](https://code.claude.com/docs/en/skills).
+It is maintained with the SDK example rather than installed globally through
+the selected third-party skill manifest. Its description costs 129 characters
+(129 UTF-8 bytes), in addition to the manifest's listing totals; the body loads
+on invocation. Hosts whose `.git/info/exclude` hides `/.claude/` must retain it
+in the real review index with
+`rtk git add -f .claude/skills/omniroute-runtime-worker/SKILL.md`.
+On each SDK or route change, update the skill, example and dated decision
+together, verify the description length and native listing/read observation,
+and run the example's documented checks. The September 30 callsite receipt
+remains the historical listing/read observation; this repair adds no new
+Claude model run. See the
+[October 3 decision](../../docs/decisions/2026-10-03-omniroute-sdk-worker-0160.md)
+for current qualification limits.
+
 - **Claude** fits the listing to `skillListingBudgetFraction` of the model's
   context window (default 0.01, with an 8,000-character fallback) and cuts each
   entry at 1,536 characters. On overflow it drops descriptions, starting with the