# Codex Orchestration Operator Quickstart Dry-Run Receipt V01

Issue: [#382](https://github.com/pinklon/ai-capability-discipline/issues/382)

References:

- [#376 Add Codex lane handoff packet template v01](https://github.com/pinklon/ai-capability-discipline/issues/376)
- [PR #377 Add Codex lane handoff packet template v01](https://github.com/pinklon/ai-capability-discipline/pull/377)
- [#378 Add Codex handoff dry-run receipt v01](https://github.com/pinklon/ai-capability-discipline/issues/378)
- [PR #379 Add Codex handoff dry-run receipt v01](https://github.com/pinklon/ai-capability-discipline/pull/379)
- [#380 Add Codex orchestration operator quickstart v01](https://github.com/pinklon/ai-capability-discipline/issues/380)
- [PR #381 Add Codex orchestration operator quickstart v01](https://github.com/pinklon/ai-capability-discipline/pull/381)

## Purpose And Non-Executable Boundary

This dry-run receipt proves that the Codex orchestration operator quickstart v01 maps common closeout and stop states to the next safe human-mediated action.

It is manual, deterministic, non-executable, and human-mediated.

This receipt is static repo evidence. It is not an autonomous worker, worker loop, polling loop, scheduled executor, webhook-triggered executor, external queue provider, Linear integration, Jira integration, custom database behavior, MCP server, MCP client, live GitHub issue or PR mutator, GitHub issue or PR mutation code, source registry mutator, source-set mutator, Cloudflare controller, provider caller, runtime retriever, browser retriever, package-authority updater, or implementation trigger.

No autonomous execution is implemented.

## Dry-Run Inputs

The dry run uses committed, deterministic inputs only:

- The Codex orchestration operator quickstart v01.
- The Codex lane handoff packet template v01.
- The Codex handoff dry-run receipt v01.
- The human-mediated orchestration lane operating packet v01.
- The human-mediated orchestration dry-run receipt v01.
- Synthetic operator states covering PR closeout, repo sync, issue state, lane state, handoff, and closeout receipt cases.

Validation does not require live GitHub access. The focused validator reads only this document, the committed fixture, committed wiring files, context-pack output, and the validation receipt.

## Dry-Run Outputs

The dry run produces static evidence that the quickstart maps each operator state to one of these safe postures:

- Continue with Codex-owned local sync and repo hygiene when the gate is routine.
- Stop before implementation when sync, worktree, residue, issue state, lane state, or boundary evidence fails.
- Prepare one serial or safe-parallel handoff only when required separation and evidence are present.
- Close out a draft PR with owner review as the next action.
- Close out a merged PR by syncing `main`, validating, cleaning generated residue, and reporting final evidence.

The dry run does not create a branch, create an issue, create a PR, edit an issue, edit a PR, comment on GitHub, mark a PR ready, merge a PR, apply `codex-automerge`, change labels, or trigger implementation.

## Draft PR Closeout Scenario

A valid draft PR closeout reports the issue URL, draft PR URL, branch, commit SHA, validation results, changed files, PR draft state, PR label state, `codex-automerge` state, worktree status, residue scan, and hard-boundary confirmations.

The next action is owner review or an explicit ready-for-review decision.

A draft PR closeout does not authorize ready marking, merge, automerge labeling, follow-up issue creation, or successor implementation.

## Merged PR Closeout Scenario

A valid merged PR closeout requires Codex to sync local `main`, verify the merge commit, verify issue state, run required validation, clean validation-created residue when present, and report final branch, final HEAD, worktree status, residue scan, and validation results.

The next action is either no further work, a new owner-selected ticket, or a bounded successor handoff. A merged PR alone does not authorize successor implementation.

## Stale Local Main Scenario

Stale local `main` is repo hygiene, not an owner decision, unless fast-forward sync fails or the expected baseline cannot be resolved after fetch.

Codex must run fetch and fast-forward sync itself before treating stale local state as a stop condition.

## Failed Fast-Forward Sync Scenario

If `git pull --ff-only origin main` fails, Codex stops before implementation.

The next action is to report the failed sync evidence and wait for an explicit owner decision or refreshed baseline. Codex must not create the work branch, edit files, run implementation validation, or open a PR from a failed-sync state.

## Dirty Worktree Scenario

If `git status --short` is not clean after sync, Codex stops before implementation.

The next action is to report the dirty worktree evidence. Codex must not overwrite, revert, stash, or include unrelated changes without explicit owner instruction.

## Residue Scan Failure Scenario

If the residue scan finds repo-controlled `__pycache__`, `.pyc`, or `.wrangler` entries outside `.git`, `.venv`, and `node_modules`, Codex stops before implementation.

The next action is to report the residue evidence. If the residue is validation-created and clearly unrelated to user work, Codex may remove only that generated residue during closeout and rerun the residue scan.

## Missing, Closed, Superseded, Or Duplicate Issue Scenario

If the work issue is missing, closed, superseded, or duplicate, Codex stops before implementation.

The next action is owner decision evidence. Tony may choose to reopen, supersede, retarget, close, or create a replacement issue, but this receipt and its validator do not mutate issues and do not create issues.

## Owner-Decision Lane Scenario

An owner-decision lane stops until Tony supplies explicit owner decision evidence.

The quickstart must not treat a missing owner decision as permission to implement, branch, open a PR, mutate GitHub, or change any runtime or source surface.

## Blocked Lane Scenario

A blocked lane stops until dependency closure or unblock evidence exists.

The quickstart must not bypass a dependency and must not convert a blocked lane into serial or safe-parallel work by assumption.

## High-Risk Gated Lane Scenario

A high-risk gated lane stops until explicit approval and separate high-risk handling exist.

The quickstart must not treat a high-risk gate as routine implementation or as a draft PR only lane.

## Rejected-Before-Planning Scenario

A rejected-before-planning lane stops until the rejected input is repaired through a separate human-mediated path.

The quickstart must not repair the rejected input by assumption and must not start implementation from rejected planner output.

## Serial Lane Handoff Scenario

For a serial lane, the next action is to use the Codex lane handoff packet template for one workstream only after prerequisite ordering is satisfied.

The handoff must include remote baseline, local repo path, work issue, required branch, required commit message, Codex-owned sync, stop conditions, validation expectations, draft PR only behavior, no-automerge boundary, closeout receipt requirements, and hard boundaries.

Serial work must not be treated as safe-parallel work.

## Safe-Parallel Lane Handoff Scenario

For a safe-parallel lane, the next action is to use the Codex lane handoff packet template only after Tony plus Codex confirm child-ticket separation, branch separation, file separation, claim and lease evidence, no duplicate issue or PR, no branch or file collision, and no stale or conflicting claim.

Each safe-parallel lane gets its own work issue or approved child-ticket prompt, branch, file scope, validation contract, and closeout receipt. Planner output does not launch Codex chats.

## Tony-Does-Not-Run-Local-Commands Proof

Tony does not run local commands.

Codex must not ask Tony to run local Git, GitHub, validation, sync, cleanup, or residue commands when Codex can run them.

Any operator guidance is invalid if it asks Tony to run local commands, asks Tony to sync `main`, asks Tony to clean generated residue, asks Tony to run validation, or treats Tony as the local execution engine.

## Codex-Owned Local Sync Proof

Codex must run local sync and repo hygiene checks itself.

Every valid implementation handoff must include:

```bash
cd <local_repo_path>
git checkout main
git fetch --prune origin
git pull --ff-only origin main
git branch --show-current
git rev-parse HEAD
git status --short
find . \
  -path ./.git -prune -o \
  -path ./.venv -prune -o \
  -path ./node_modules -prune -o \
  \( -type d -name __pycache__ -o -type f -name '*.pyc' -o -type d -name .wrangler \) \
  -print
```

Tony decision evidence is not required merely because local `main` is stale before Codex runs sync.

## Draft PR Only Proof

Each implementation handoff must require a draft PR only unless Tony explicitly changes that boundary.

Codex must not mark the PR ready, must not merge, and must not apply labels that imply automerge.

The PR body must include summary, changed files, validation, limitations, boundaries, and explicit no-autonomy confirmation.

## No-Automerge Proof

`codex-automerge` must not be applied unless Tony explicitly changes that boundary.

The operator guidance is invalid if it permits `codex-automerge`, applies `codex-automerge`, asks Codex to apply it, or omits the no-automerge closeout field.

## Closeout Receipt Completeness Proof

Each closeout must include:

- Issue URL.
- Draft PR URL.
- Branch name.
- Commit SHA.
- Final local branch.
- Final local HEAD.
- Worktree status.
- Residue scan result.
- Changed files.
- Validation commands and results.
- Sandboxed `run_all.py` result.
- Privileged local-server rerun result when required.
- PR draft state.
- PR label state.
- `codex-automerge` state.
- #269 and #271 state or no-reopen confirmation.
- Confirmation that no worker loop, webhook loop, scheduled loop, external queue, GitHub mutation behavior, source mutation, Cloudflare mutation, provider/runtime/browser/package-authority mutation, Linear/Jira/custom DB/MCP behavior, #269/#271 reopen, or `codex-automerge` was introduced.

## Relationship To Codex Orchestration Operator Quickstart V01

The Codex orchestration operator quickstart v01 supplies the operator map for draft PR closeout, merged PR closeout, stale local main, failed sync, dirty worktree, residue, issue-state stops, owner-decision, blocked, high-risk gated, rejected-before-planning, serial handoff, and safe-parallel handoff states.

This receipt proves those quickstart mappings with deterministic examples and rejection cases.

## Relationship To Codex Lane Handoff Packet Template V01

The Codex lane handoff packet template v01 supplies the canonical handoff structure for one Codex lane.

This receipt proves the quickstart routes serial and safe-parallel lanes to that template only when the required evidence and separation fields are present.

## Relationship To Codex Handoff Dry-Run Receipt V01

The Codex handoff dry-run receipt v01 proves that generated handoffs from the template can require Codex-owned sync, reject Tony-running-local-commands prompts, preserve draft PR behavior, prohibit `codex-automerge`, and require complete closeout fields.

This receipt proves the operator quickstart routes to that handoff proof only after the correct state decision.

## What Is Proven

- Common closeout and stop states map to explicit next actions.
- Generated guidance does not ask Tony to run local commands.
- Codex performs local repo mechanics itself.
- Stale local `main` is repo hygiene, not an owner decision, unless sync fails or baseline resolution fails after fetch.
- Draft PR closeout requires owner review or explicit ready decision.
- Merged PR closeout requires sync, validation, residue cleanup when needed, and final evidence.
- Serial and safe-parallel handoffs require complete Codex handoff collateral.
- Closeout receipts require branch, head, worktree, residue, validation, PR draft, label, automerge, #269/#271, and forbidden-scope evidence.

## What Is Not Proven

- Autonomous execution.
- Worker loop behavior.
- Polling behavior.
- Scheduled execution.
- Webhook-triggered execution.
- External queue integration.
- Live GitHub mutation.
- GitHub issue or PR mutation code.
- Source registry or source-set mutation.
- Cloudflare mutation.
- Provider/model/runtime/browser/package-authority mutation.
- Linear/Jira/custom DB/MCP behavior.
- #269 or #271 reopening.
- `codex-automerge`.

## Forbidden Scope

This receipt does not implement or authorize:

- Autonomous worker.
- Worker loop.
- Polling.
- Scheduled execution.
- Webhook-triggered execution.
- External queue provider.
- Linear integration.
- Jira integration.
- Custom database behavior.
- MCP server behavior.
- MCP client behavior.
- Live GitHub issue or PR mutation behavior from receipt or validator logic.
- GitHub issue or PR mutation code in receipt or validator logic.
- Label, milestone, assignee, comment, issue state, PR state, branch state, or merge state mutation from receipt or validator logic.
- Source registry mutation.
- Preview or Production source-set mutation.
- Cloudflare CLI or API use.
- Cloudflare Access or WAF change.
- Provider/model configuration change.
- Runtime retrieval semantics change.
- Browser-side provider calls.
- Browser-side current-source retrieval.
- Package-authority change.
- #269 reopening.
- #271 reopening.
- `codex-automerge`.

## Validation

Validation is deterministic and repo-local:

- `python3 -B validation/scripts/check_codex_orchestration_operator_quickstart_dry_run_receipt.py`
- Related orchestration validators.
- Governance validators.
- `python3 -B validation/scripts/check_context_pack.py`
- `python3 -B validation/scripts/run_all.py`
- `git diff --check`
- Final residue scan for repo-controlled `__pycache__`, `.pyc`, and `.wrangler`, excluding `.git`, `.venv`, and `node_modules`.

If sandboxed `python3 -B validation/scripts/run_all.py` hits the known local static-server bind restriction in `check_published_site_contract.py`, Codex must rerun with the established local-server privilege path and document both results.