Add OpenAI Codex agent backend behind a multi-backend engine seam

[pufit]

What

Runs Nerve sessions on OpenAI Codex (GPT-5.6 family via codex app-server, JSON-RPC 2.0 over stdio) with full parity to the Claude path — interactive web sessions, Telegram, cron, wakeups, forks, resume — behind a clean backend abstraction.

Claude remains the default. The backend is selected by config (agent.backend, agent.cron_backend, per-session backend_override) and is sticky per session: existing sessions and their wakeups stay on their original backend.

Key pieces

• Backend seam (nerve/agent/backends/): AgentEngine decoupled from claude_agent_sdk; runtime-agnostic event stream translated into the existing broadcaster/turn-state machinery.
• Codex backend (backends/codex/): app-server transport (tolerates >64KiB JSONL lines, marks client dead on reader exit), thread/turn lifecycle, exact-point forks, narrow resume-miss recovery, command/file-change approval bridging into the existing interactive-pause UX, structured user-input/plan/output bridges.
• Loopback MCP (nerve/mcp_server/loopback.py): dedicated ASGI serving of Nerve's tools to codex subprocesses with aud-scoped, session-claimed, expiring JWTs (8h session / 2h worker, unique jti).
• Migration v039: legacy backend backfill, native thread/turn mapping, persisted cwd, cost basis.
• Cost & usage: config-driven per-model pricing table; unknown model → cost None; ChatGPT-plan estimates kept separate from billed cost.
• Managed Ultracode layer (pinned) + UI: Claude/Codex selector in the new-chat composer, interactive question card, Ultracode page.
• Schema contract: fixtures pinned against codex-cli 0.144.1 exported schema (scripts/check_codex_schema.py guards drift).

Out of scope (v1)

Langfuse tracing for codex turns, permission-grant approvals (declined safely via JSON-RPC error → codex continues sandboxed), turn/steer, mixed-backend forking (guard refuses), PDF inputs on codex.

Testing

• pytest tests/ — 1533 passed, 2 skipped (new suites: appserver transport, ingester, integrity migration, loopback MCP, ultracode integration, backend selection, MCP session binding)
• npm run build clean; live smoke against codex-cli 0.144.1 (defaults corrected from smoke: gpt-5.6-sol, reverse-diff pre-image snapshots)
• Merging with backend: claude default = zero behavior change.

Generated by Nerve