🤖 feat: opt new user-created workspaces in to unrelated messaging by default

[ThomasK33]

Summary

Root workspaces that a user creates (new, scratch, multi-project, fork) are now opted in to unrelated (cross-task-tree) messaging by default, so agents in other task trees can reach them with task_send_message without a manual toggle. Existing workspaces are unchanged, sub-agents stay off, and the per-workspace toggle still turns it off permanently. Delegated task(kind: "workspace") targets follow in #4453.

Background

Cross-tree messaging requires recipient consent (unrelatedWorkspaceConsent). It was off by default, and the refusal is reported as not_found to hide the target's existence, so new workspaces looked missing to other agents.

This PR is delivered progressively. Granting consent to delegated targets at creation opened a new timing window with every fix (see the halt comments below), so that part moved to its own designed follow-up (#4453).

Implementation

• mintUnrelatedWorkspaceConsent() mints the generation and asserts that it passes the fail-closed reader. The existing toggle uses the same helper.
• Consent is granted only once each path's creation setup is complete, because persisted consent is immediately visible to task_list(scope:"instance") and admission:
  • createScratch() / createMultiProject(): no setup steps; written atomically with the entry.
  • create() with an immediate checkout: after registration-time plugin-override sanitization, before announcing.
  • create() with a deferred checkout: after materializeDeferredCheckout has populated and sanitized the checkout, before the init hook. It does not rely on waitForInit, which a second backend sharing the root does not observe. An explicit toggle made between the announcement and the grant cancels it. Removal, a failed checkout or a failed sanitization never grant.
  • fork(): last, after sanitization, goal inheritance and the pending branch-summary marker. It gets its own generation, never the source's.
• Delegated targets: WorkspaceTurnManager passes skipDefaultUnrelatedWorkspaceConsent (🤖 feat: opt delegated task(kind:workspace) targets in to unrelated messaging by default #4453).
• grantCreationUnrelatedWorkspaceConsent re-reads config after its write and reports only the persisted value. Config.saveConfig swallows write failures (🤖 fix: config writes swallow save failures while the in-process snapshot keeps the edit #4444), and editConfig's transform runs on an uncached read, so a re-read does detect them.
• No backfill, no sentinel. An absent value means both "never enabled" and "turned off", and older builds treat any non-empty value as on. The minted value has exactly the shape older builds already accept.
• Copy: consent dialog ("On by default for new chats you create"), task_send_message description and task_id parameter, task_list instance-scope description, schema description. Generated docs are refreshed.

Validation

New and updated tests. Each fails on the previous behavior or under a targeted mutation, and passes now:

• Scratch: distinct generations per workspace, and a later opt-out persists.
• create(): persists a valid generation, with none while registration sanitization runs; with skipDefaultUnrelatedWorkspaceConsent, nothing is persisted, announced or pending.
• Deferred checkout: the real materializeDeferredCheckout has no consent during sanitization, grants before the init hook and publishes; failed sanitization and failed checkout never grant.
• Pending default: an explicit toggle wins; non-pending workspaces are never granted; the mark is one-shot; a failing publication does not throw.
• Swallowed save: the grant reports nothing (fails if the re-read is removed).
• Fork: fresh generation distinct from the source's, absent during sanitization and goal inheritance.
• createWorkspaceTurn creates delegated targets with the skip flag.

Local gates ran with the repo-pinned Bun 1.3.5 (the PATH default here is 1.2.15, which produced unrelated local failures).

Risks

• Product: new user-created workspaces can be discovered and woken by agents in other local task trees, which can spend tokens in the recipient. The untrusted envelope, rate limits, local-runtime restriction and delegated-turn refusal all still apply, and the toggle turns it off.
• Known, tracked:
  • The pending mark for deferred checkouts is process-local, so a toggle handled by another backend sharing the root cannot cancel it (🤖 fix: delegated-turn reservation is process-local, so unrelated admission can race across backend instances #4446).
  • The delegated-turn reservation is process-local (🤖 fix: delegated-turn reservation is process-local, so unrelated admission can race across backend instances #4446, pre-existing).
  • Config writes swallow save failures (🤖 fix: config writes swallow save failures while the in-process snapshot keeps the edit #4444, pre-existing; this PR's grant detects them).

Review history

• Rounds 1–7 on the original, wider scope: a policy objection (owner-intended), then successive timing windows when delegated targets got consent at creation.
• Halted twice. Re-scoped with the owner's approval to user-created workspaces; delegated targets moved to 🤖 feat: opt delegated task(kind:workspace) targets in to unrelated messaging by default #4453.
• A bounded review extension of 2 rounds is declared for the re-scoped diff (see the PR comment).

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $34.04

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 92e8be31c6

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0ae0703f92

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ae0703f92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6a103c800f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6a103c800f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

Pausing this PR for an owner decision. It is not ready, and it will not be merged in its current state.

Why: the review loop is not converging. The review budget is used up (three Codex code+security pairs = six reviews). Each fix to when the default consent becomes visible has opened another window where a freshly created workspace is discoverable before its creator finishes setting it up:

1. Round 2 (fixed in 6a103c8): consent was persisted before registration-time plugin sanitization.
2. Round 3 (open):
   • P1: task(kind:"workspace") targets become discoverable and wakeable before WorkspaceTurnManager registers the delegated-turn handle.
   • P2: a fork grants consent before goal inheritance and the pending branch-summary registration.
   • P2: Config.saveConfig logs and swallows write errors, so the returned generation can differ from what is on disk.

Proposed scope reduction (needs owner acceptance, because it narrows "all new workspaces"):

• Do not grant default consent to workspaces created by WorkspaceTurnManager (task(kind:"workspace")). Their delegator already reaches them through task in existing mode, and they refuse unrelated sends during delegated turns anyway.
• Move the fork grant to after goal inheritance and branch-summary registration.
• Publish consent only from a re-read of the persisted config.

The three round-3 threads stay open until that decision is made.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9836ac075e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Mux	🟢 Ready	View Preview	Sep 24, 2026, 7:16 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df1bf424e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 60a984c0b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b88b06780

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

Halting this PR without merging. The review budget is used up and the review loop is not converging.

State at 7b88b06

• Seven Codex code+security rounds have run; rounds 4–7 were triggered automatically on push. Since round 2, each round has found a new narrow edge in the same area: when default consent becomes visible or final during creation.
• CI on this head was still in progress at halt time (only Codex Comments had failed so far, because of the open threads).
• The independent final review ("ready") covered 9836ac0 and is stale. Later commits added a pending-default marker, cancel-on-toggle behavior and best-effort publication.

Open defects introduced by this PR

1. Round 7: on the pre-reservation exit of createWorkspaceTurn (an invalid explicit AI setting), the new workspace keeps no default consent and its pending marker is never used.
2. Finding C (reopened): my earlier rejection was wrong. editConfig does not keep the edited object in the snapshot, so after a swallowed save failure the UI shows consent on while discovery and admission read off. A post-write re-read would catch it.
3. The pending-default marker added here is process-local. I previously deferred this to 🤖 fix: delegated-turn reservation is process-local, so unrelated admission can race across backend instances #4446, but it is introduced by this PR; a second backend is only the trigger.

Proposed next step
Replace the per-path patches with one bounded creation-finalization design that covers success, failure, cancellation and explicit opt-outs, and keeps the owner's requirement that delegated workspaces are opted in. Then run a fresh independent review of the complete final diff before reconsidering merge.

[ThomasK33]

Correction to the halt record: CI on 7b88b06 has finished. Test / Unit (6/6) failed in one test: "report-decision hold for queued follow-ups (real host) > a workflow-owned leaf that reports while the user's manual message is queued is not auto-deleted". This PR does not touch that area and it looks unrelated, but I have not rerun or investigated it. Codex Comments/Required also fail because of the open threads.

[ThomasK33]

Resuming with a reduced scope, approved by the owner ("take a safer/progressive path").

Scope now: default consent for workspaces a user creates (new, scratch, multi-project, fork). Delegated task(kind:"workspace") targets are excluded here and designed separately in #4453. This removes the mechanism behind the round 4–7 findings: the pending marker for delegated targets, the reservation-time grant, and the early-exit leftovers.

What changed in the design

• A deferred checkout gets consent only after its own sanitization, not at registration. It no longer relies on waitForInit, which another backend does not observe.
• The post-write re-read is restored (my earlier rejection of that finding was wrong), with a test that injects a swallowed save through the real edit path.

Review budget: the original six rounds are used up. I am declaring a bounded extension of 2 rounds for this re-scoped diff: one fix round (blockers only) and one verification round. If the second round finds any new blocker, I stop without merging.

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 0674231f6f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0674231f6f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

Hiding the Codex review summary: Codex approved head 0674231 (👍 after the latest code and security reviews, which raised no findings), and every review thread is resolved. The only line the Codex Comments gate still reads as open is the round-1 advisory "Require consent before granting cross-workspace messaging". That advisory objects to default-on consent itself, which is the owner-approved purpose of this PR (see the thread reply). Its known edge cases are tracked in #4453, #4446 and #4455.