Codex, one coding task, sent by a session from its checkout as its own process's user, who holds R (USAGE.md, "Let an agent send runs"); not a session. The session commits and pushes the check-in Codex is to start from, then sends the task: ocx2 create "OBJECTIVE" --pattern URL --login $$clone_user$$ --to POST --of CHECKIN. URL is this file's content-addressed raw URL, https://ollama.openbeagle.org/ollama/raw/SHA3?m=text/plain, SHA3 being fossil sha3sum of this file, published as a tech-note attachment on ollama: a URL named by its content can never serve other text. --login names the clone's user that acts on the session's own run, which the session's pattern fills in as $$clone_user$$; POST is a post in the session's own thread, so the task is a reply there; CHECKIN is the check-in the session pushed, which the files step takes.

Its sandbox is what this pattern asks (HISTORY.md decision 132): its workspace is a directory ending in $$run$$, made of that check-in's files, with no clone and no password, so it signs in as no one; it reads the system's programs and the files that name lookup and TLS read, writes only in its workspace, and binds the home /root/.codex, so Codex runs as the host's Codex login; its sandbox ends with its parent (ends_with_parent), so its wall and a stop end every process of it; and it caps itself at two hours, an hour of CPU for each process, 512 processes, and files of 256M, the patch among them.

A line of sh reads the run's line, takes its objective out with jq, keeps a copy of the files as base, runs codex exec on the objective, niced, then writes diff -ruN base tree to change.patch in the workspace. OCX sends it as the unversioned file codex-$$run$$.patch, a name holding the task's own hash, so it replaces no other file; its reply in the thread names it with its hash, then the task's ended follows, which a session whose process.ends is true is given. The session fetches the patch with ocx2 --json unversioned_get codex-TASK.patch, TASK the task's hash, checks that sha256sum of it gives the hash the reply names, the file's SHA-256 as ended.outputs records it, applies it in its checkout with patch -p1, reviews it, and commits and pushes it, or says in the thread why not. Codex's last message, its standard output, is kept in the reply of kept logs. Every task's process.user is codex-task. A clone runs one run from a user holding R alone at a time, so one such task at a time, and the next waits until it ends.

{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$process_user$$/projects/$$repository_name$$/$$run$$",
      "remove_on": "saved"
    },
    {
      "step": "files",
      "of": "trunk",
      "into": "$$workspace$$/tree"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "linux_capabilities": [],
    "network": true,
    "isolate_terminal": true,
    "ends_with_parent": true,
    "read_only": [
      "/usr",
      "/bin",
      "/sbin",
      "/lib",
      "/lib64",
      "/etc/resolv.conf",
      "/etc/hosts",
      "/etc/nsswitch.conf",
      "/etc/ssl/certs"
    ],
    "read_write": [
      "$$workspace$$"
    ],
    "homes": [
      "/root/.codex"
    ],
    "created_files": [
      {
        "at": "/etc/passwd",
        "text": "$$process_user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "2h",
    "cpu": 3600,
    "processes": 512,
    "file_size": "256M"
  },
  "process": {
    "user": "codex-task",
    "command": [
      "/bin/sh",
      "-c",
      "read -r run || exit 2; objective=$(printf '%s' \"$run\" | jq -r .objective) || exit 2; cp -a $$tree$$ $$workspace$$/base || exit 2; nice -n 10 /usr/bin/codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check \"$1 $objective\" < /dev/null; codex=$?; cd $$workspace$$ || exit 2; diff -ruN base tree > change.patch; [ $? -le 1 ] || exit 2; exit $codex",
      "codex-task",
      "This directory holds the files of a check-in, with no version control: make in its files the change this objective asks, and nothing more; remove any file you made only to build or check it; do not commit. Your last message says what you changed and what you checked. The objective:"
    ],
    "cwd": "$$tree$$",
    "keep": {
      "stderr": "2K",
      "stdout": "4K",
      "stdout_when": "always"
    },
    "unversioned_files": [
      {
        "at": "$$workspace$$/change.patch",
        "as": "codex-$$run$$.patch"
      }
    ],
    "env": {
      "HOME": "$$workspace$$",
      "USER": "$$process_user$$",
      "PATH": "/usr/local/bin:/usr/bin:/bin"
    }
  }
}