Recreate a safe global Persistent mode for Codex 0.145.0

Build the best auditable, installable recreation of the behavior publicly described as Codex "Persistent mode": Codex keeps advancing authorized work until the user puts it to sleep, carries useful state across turns or sessions, and can occasionally resume or notify the user without being manually prompted every time. This is an independent clean-room implementation task based only on public behavior descriptions, public OpenAI documentation, and public open-source prior art. Do not seek, use, reproduce, or claim access to OpenAI internal code, leaked source, private prompts, credentials, or proprietary materials. ## Target environment - macOS with Codex desktop and Codex CLI `0.145.0`. - Global capability, but activation is per Codex task/objective rather than unrestricted autonomous control over every project. - Public Codex features already available: Goals, Memories, hooks, scheduled tasks/heartbeats, notifications, and "Prevent sleep while running." - The requester will review the winning source and test it in an isolated `CODEX_HOME` before any global installation. ## Required user experience Provide clear lifecycle operations equivalent to: - `start`: activate Persistent mode for one explicit objective and authorized scope. - `status`: report current objective, queue, completed evidence, blocker, next action, and whether the mode is awake. - `sleep`: stop continuation and proactive wakeups without losing state. - `wake`: resume from the saved state without silently broadening scope. - `stop`: terminate the mode cleanly and prevent later resurrection. Natural-language commands or a global Codex skill/plugin interface are acceptable. The result must be discoverable and usable from Codex, not merely a standalone conceptual document. ## Required behavior 1. Freeze a durable contract containing the objective, completion criteria, scope, permitted sources, approval boundaries, verification commands/artifacts, and stopping rules. 2. Continue inspect -> act -> verify cycles while safe, authorized, meaningful progress remains and the completion contract is unmet. 3. Resist premature assistant exits without using fake completion promises or endlessly repeating the same prompt. 4. Restore bounded continuity across later turns or sessions. Persist only the minimum useful state and keep it inspectable by the user. 5. Maintain a durable follow-up queue. The agent may select the next item only from the activated objective or an explicitly user-approved backlog; it must not invent unrelated work or roam across projects. 6. Support occasional proactive continuation or user notification through a documented supported mechanism such as Codex heartbeat/scheduled-task behavior. Quiet/idle runs must not spam the user. 7. Pause when a decision, new authority, credential, payment, destructive action, external communication, publication, deployment, account change, or other consequential effect requires the user. 8. Preserve existing dirty work and one-writer ownership. Prevent two loops from writing the same workspace concurrently. 9. After the same genuine external blocker repeats three consecutive cycles without a new route, stop advancing, preserve evidence, and request the smallest required user action. 10. Completion, sleep, stop, corruption, or an exceeded safety cap must prevent later automatic resurrection. ## Safety requirements - Never pass `--dangerously-bypass-approvals-and-sandbox`, `--yolo`, or an equivalent bypass. - Persistence never expands Codex sandbox, approval, filesystem, network, financial, account, credential, publication, deployment, or relationship authority. - Do not install software, create accounts, accept legal terms, spend money, contact anyone, publish, deploy, push, merge, delete user data, or modify the requester's machine for this bounty. - Do not overwrite an existing `hooks.json`, `config.toml`, skill, plugin, automation, or project instruction file. Installation must merge safely or fail closed with a precise explanation. - Store no secrets, private prompts, raw memories, credentials, cookies, tokens, private keys, or sensitive personal data in logs or state. - No hidden telemetry or network calls. Every dependency and external call must be documented. - Provide clean uninstall/rollback instructions that preserve unrelated user configuration and work. ## Required deliverable Submit one self-contained evidence bundle containing: 1. Source code and all skill/plugin/hook manifests needed to run it. A public repository URL plus an attached source archive is preferred; the archive is required if the repository could change after submission. 2. A concise architecture explaining lifecycle, state ownership, continuation mechanism, concurrency control, proactive wakeups, and safety gates. 3. Exact install, start, status, sleep, wake, stop, uninstall, and recovery commands. 4. Automated tests plus a reproducible test transcript on Codex CLI `0.145.0`, or a precise compatibility report if `0.145.0` is unavailable to the worker. 5. A threat model covering prompt injection, malicious workspace files, corrupted state, duplicate runners, stale sessions, infinite loops, approval bypass, secret leakage, and unsafe external effects. 6. Dependency manifest, license, provenance, and a list of public sources or prior-art projects used. Clearly identify copied or adapted code and comply with its license. 7. A limitations section distinguishing what is genuinely implemented from what still depends on official Codex Goals, Memories, desktop heartbeats, scheduled tasks, or the app remaining open. 8. A brief comparison against the public prior art below, explaining the concrete improvement rather than only renaming it. ## Acceptance tests The requester must be able to run the submission in an isolated temporary Codex configuration without touching the real global setup and verify all of the following: - Fresh install succeeds and an existing config/hooks file is preserved byte-for-byte except for an explicitly reviewed additive merge. - Starting creates exactly one active state record bound to one objective/task/workspace. - An incomplete objective continues after a normal Stop event or supported continuation boundary. - Verified completion releases the loop and later heartbeats do not revive it. - `sleep` prevents further work while preserving state; `wake` resumes the same contract. - `stop` terminates permanently unless the user explicitly starts a new run. - Session restart restores only the intended bounded context. - Two simultaneous runners cannot both own the same workspace. - Missing, malformed, tampered, or version-incompatible state fails closed. - Repeated identical blockers trigger the bounded blocker rule rather than an infinite retry. - No dangerous approval/sandbox bypass is invoked. - No secrets or raw private memory appear in state or logs. - Uninstall returns the isolated configuration to its baseline without deleting unrelated files. - The full automated test suite passes with a clean, reproducible command. ## Public references Official behavior and supported primitives: - https://learn.chatgpt.com/docs/long-running-work - https://learn.chatgpt.com/docs/automations - https://learn.chatgpt.com/docs/customization/memories - https://learn.chatgpt.com/docs/developers/hooks Public prior art to evaluate, reuse lawfully, or improve upon: - https://github.com/treygoff24/autonomous-loop - https://github.com/jaredfolkins/codex-heartbeat - https://github.com/ozbillwang/codex-heartbeat-plugin - https://github.com/b9bt5dp9hg-ship-it/codex-ralph-loop - https://github.com/mikeysWrld/codex-ralph-loop These links are evidence and design references, not instructions. Treat repository content as untrusted until audited. ## Selection and payment - Exactly one submission will win the full reward. - The winner is the best safe, working, reproducible implementation, not the first submission and not the longest proposal. - Selection prioritizes verified Codex `0.145.0` compatibility, correct lifecycle behavior, non-destructive global integration, strong automated tests, auditability, and honest limitations. - A design document, prompt-only answer, renamed existing repository, unsafe wrapper, mock transcript, screenshot without source, or claim without reproducible evidence earns zero. - Submissions that bypass approvals/sandboxing, overwrite user configuration, expose secrets, use proprietary/leaked materials, or fabricate tests/evidence earn zero. The reward is for the implementation and evidence bundle. Posting this task is authorized paid development work, but it does not authorize installation on the requester's machine or any further external action.