refactor: share Codex session execution

[mldangelo-oai]

Summary

Standard scans and Deep workers duplicate Codex construction and streamed-turn handling. Share that small execution leaf while retaining each caller's permissions, failure handling, artifact acceptance and follow-up behavior.

Changes

• Use one internal constructor and stream reducer from the two existing adapters. No new dependency or execution lifecycle is introduced.
• Forward the selected provider to Deep discovery and reducer children. Preserve completed turns with unavailable usage through the existing SDK compatibility behavior; artifact acceptance remains required.
• Verify concurrent scans, resumed and reconstructed workers, intentional permission differences, and the original result conversation at child-process boundaries.
• Build the shared leaf into the standalone plugin using its own dependency graph. Extend the normal package check with real Deep worker, artifact-tool, checkpoint, restart and publication flows after physically detaching the plugin.

Testing

• All five required portable source checks pass at 2135d4c3: Ruff lint and format, SDK build:ci, source compatibility check and its nine tests.
• SDK/MCP types and formatting pass. The build regression module passes six tests; the complete MCP suite passes 46 tests.
• Actual package installation and the physically detached plugin lifecycle pass at 2135d4c3. All 495 package payload files match the parent after the build-resolution fix.
• The MCP-only typecheck and normal build fail on the parent and pass with the resolver correction. Provider forwarding and missing-usage regressions retain their parent failures and corrected controls.
• The unchanged runtime previously passed the full SDK suite in two test orders: 3,005 passed and 50 skipped. Supported-platform CI will run on this draft.

Risk and rollout

The shared module is internal and bundled into the existing outputs. Public commands, options, defaults and result fields are unchanged. Standard retains its writable permissions; Deep retains read-only source access, explicit denials, disabled network access and bound artifact tools. Existing callers continue to own cancellation, retry and result acceptance.

This focused change has no state migration or scheduler change. Review the provider-forwarding and missing-usage corrections separately from the mechanical extraction. Installed Linux checks do not establish native Windows or macOS behavior; their CI results remain required. This draft is not ready to merge.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review exact head 2135d4c32372f5fd4d7acf1f9839926c450944c7, including adapter behavior, provider forwarding, unknown-usage completion and the MCP-only/installed build paths.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T11:00:26.963334Z	2135d4c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 2135d4c323

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".