Codex, one coding task, sent by a session from its clone as its own user, who holds `R` (USAGE.md, "Let an agent send runs"); not a session. The session commits and pushes the check-in Codex is to start from, then sends the task from its checkout: `ocx2 create "OBJECTIVE" --pattern URL --node NODE --to POST --of CHECKIN`. URL is this file's own, `https://ollama.openbeagle.org/ollama/raw/SHA3?m=text/plain`, SHA3 being `fossil sha3sum` of this file, published as a tech-note attachment on ollama: a URL named by its content can never serve other text, where a tree file named at `?ci=BRANCH` could be changed by any run user, each holding `i`. NODE is the session's own node, which a run written from a clone must name and the session's pattern names as `$$node$$`; POST a post in the session's own thread, such as its run or the post that asked for the work, so the task is a reply there; CHECKIN the check-in the session pushed (`fossil info` names it), which the `files` step takes.

The node takes it only within the `r-senders.json` of the release it runs, and it asks no more: its workspace is a directory ending in `$$run$$`, made of that check-in's files, with no clone and no password, so it signs in as no one; it reads the system's programs and the files name lookup and TLS read, as that file lists them, writes only in its workspace, and binds the home `/root/.codex`, so Codex runs as the host's Codex login; its sandbox ends with the node (`ends_with_node` true), so its wall and a stop end every process of it (HISTORY.md decision 107); and its limits stay within the caps that file sets: two hours, an hour of CPU for each process, 512 processes, and files of 256M at most, the patch it shares among them.

A line of sh reads the run's line, takes its objective out with jq, keeps a copy of the files as `base`, runs `codex exec` on the objective, niced, then writes `diff -ruN base tree` to `change.patch` in the workspace. The node shares it as the unversioned file `codex-$$run$$.patch`, a name holding the task's own hash, as the bounds require, so it replaces no other file; the node's reply in the thread names it with its hash, then the task's `ended` follows, which a session whose `process.ends` is true is given. The session fetches the patch with `ocx2 --json unversioned_get codex-TASK.patch`, TASK the task's hash, checks that `fossil sha3sum` of it gives the hash the reply names, applies it in its checkout with `patch -p1`, reviews it, and commits and pushes it, or says in the thread why not. Codex's last message, its standard output, is kept in the node's reply of kept logs. Every task's `process.user` is `codex-task`, which needs no account. The node runs one run from a user holding `R` alone at a time, whatever its `process.user`, so one such task at a time, and the next waits until it ends (protocol v1, section 10; HISTORY.md decision 108).

```json
{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$user$$/projects/$$project$$/$$run$$",
      "remove_on": "saved"
    },
    {
      "step": "files",
      "of": "trunk",
      "into": "$$workspace$$/tree"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "capabilities": [],
    "network": true,
    "own_session": true,
    "ends_with_node": true,
    "read_only": [
      "/usr",
      "/bin",
      "/sbin",
      "/lib",
      "/lib64",
      "/etc/resolv.conf",
      "/etc/hosts",
      "/etc/nsswitch.conf",
      "/etc/ssl/certs"
    ],
    "read_write": [
      "$$workspace$$"
    ],
    "homes": [
      "/root/.codex"
    ],
    "files": [
      {
        "at": "/etc/passwd",
        "text": "$$user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "2h",
    "cpu": 3600,
    "processes": 512,
    "files": "256M"
  },
  "process": {
    "user": "codex-task",
    "command": [
      "/bin/sh",
      "-c",
      "read -r run || exit 2; objective=$(printf '%s' \"$run\" | jq -r .objective) || exit 2; cp -a $$tree$$ $$workspace$$/base || exit 2; nice -n 10 /usr/local/bin/codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check \"$1 $objective\" < /dev/null; codex=$?; cd $$workspace$$ || exit 2; diff -ruN base tree > change.patch; [ $? -le 1 ] || exit 2; exit $codex",
      "codex-task",
      "This directory holds the files of a check-in, with no version control: make in its files the change this objective asks, and nothing more; remove any file you made only to build or check it; do not commit. Your last message says what you changed and what you checked. The objective:"
    ],
    "cwd": "$$tree$$",
    "keep": {
      "stderr": "2K",
      "stdout": "4K",
      "stdout_when": "always"
    },
    "shares": [
      {
        "at": "$$workspace$$/change.patch",
        "as": "codex-$$run$$.patch"
      }
    ],
    "env": {
      "HOME": "$$workspace$$",
      "USER": "$$user$$",
      "PATH": "/usr/local/bin:/usr/bin:/bin"
    }
  }
}
```