refactor: remove legacy Go companion

.github/workflows/ci.yml

@@ -14,51 +14,25 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  static:
-    name: Static, provenance, and package-policy checks
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout product source
-        uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      - name: Validate provenance and source boundaries
-        run: python scripts/verify_provenance.py --root .
-      - name: Validate allow-listed release inputs
-        run: python scripts/verify_package.py --root . --manifest packaging/release-manifest.json
-      - name: Validate cross-language protocol catalogs
-        run: python scripts/verify_protocol.py --root .
-      - name: Compile release scripts
-        run: python -m compileall -q scripts
-      - name: Test companion packaging modes
-        run: python scripts/test_package_release.py
-
-  build-test:
-    name: Go companion and optional bridge tests (${{ matrix.os }})
-    needs: static
+  rust:
+    name: Native Rust CLI checks (${{ matrix.os }})
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - name: Checkout product source
+      - name: Checkout source
         uses: actions/checkout@v4
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.12'
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.22.x'
-          cache: true
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
+          components: rustfmt
       - name: Cache Cargo registry and build
         uses: actions/cache@v4
         with:
@@ -68,43 +42,22 @@ jobs:
             runtime/codex-rs/target
           key: ${{ runner.os }}-cargo-${{ hashFiles('runtime/codex-rs/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
-      - name: Run controller tests
+      - name: Validate provenance
         shell: bash
-        run: cd controller && go test ./...
-      - name: Run integration tests
+        run: python scripts/verify_provenance.py --root .
+      - name: Check formatting
         shell: bash
-        run: cd integration && go test ./...
-      - name: Run adapter tests
+        working-directory: runtime/codex-rs
+        run: cargo fmt --all -- --check
+      - name: Test native Marathon runtime
         shell: bash
-        run: cd runtime/codex-rs && cargo test --locked -p codexmarathon-runtime-adapter
-      - name: Run native bridge tests
+        working-directory: runtime/codex-rs
+        run: cargo test --locked -p codexmarathon-runtime
+      - name: Build native Codex CLI
         shell: bash
-        run: cd runtime/codex-rs && cargo test --locked -p codexmarathon-runtime
-      - name: Build controller and package Linux artifact
+        working-directory: runtime/codex-rs
+        run: cargo build --locked --release -p codex-cli
+      - name: Verify Marathon command surface
         if: matrix.os == 'ubuntu-latest'
         shell: bash
-        run: |
-          mkdir -p dist/build dist/release
-          (cd controller && go build -trimpath -o ../dist/build/codexmarathon ./cmd/codexmarathon)
-          python scripts/package_release.py \
-            --root . --output dist/release \
-            --controller-binary dist/build/codexmarathon \
-            --platform linux-x86_64 --version 0.1.0 --format tar.gz
-          artifact=$(find dist/release -maxdepth 1 -type f -name '*.tar.gz' -print -quit)
-          python scripts/verify_package.py --artifact "$artifact" --manifest packaging/release-manifest.json
-          python scripts/clean_machine_check.py --root . --artifact "$artifact"
-      - name: Build controller and package Windows artifact
-        if: matrix.os == 'windows-latest'
-        shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Force -Path dist/build, dist/release | Out-Null
-          Push-Location controller
-          go build -trimpath -o ../dist/build/codexmarathon.exe ./cmd/codexmarathon
-          Pop-Location
-          python scripts/package_release.py `
-            --root . --output dist/release `
-            --controller-binary dist/build/codexmarathon.exe `
-            --platform windows-x86_64 --version 0.1.0 --format zip --windows-exe
-          $artifact = (Get-ChildItem dist/release -Filter '*.zip' | Select-Object -First 1).FullName
-          python scripts/verify_package.py --artifact $artifact --manifest packaging/release-manifest.json
-          python scripts/clean_machine_check.py --root . --artifact $artifact
+        run: runtime/codex-rs/target/release/codex marathon --help

AGENT_TASKS.md

@@ -1,116 +1,30 @@
-# CodexMarathon companion-agent assignments
+# Native CodexMarathon work areas
 
-These assignments describe the installed-Codex companion product. Agents own
-the implementation, focused tests, documentation, and evidence for their
-area. They must preserve unrelated work and report compiler/live checks as
-passed, blocked, or failed from observed output.
+These work areas describe the Rust integration inside the custom Codex CLI.
+All changes must preserve Codex's native ownership of authentication, active
+turns, transports, conversation state, and recovery.
 
-## Agent 1 — Installed-Codex discovery and command wrapper
+## Runtime domain
 
-Implement executable discovery through an explicit `--codex` path,
-configuration, or `PATH`; version/capability probing; actionable `doctor`
-output; argument forwarding; and launch identity capture. The wrapper must
-never search donor trees or start the optional embedded app-server.
+Implement account metadata, opaque credential snapshots, atomic persistence,
+transition journals, quota policy, and mock-only automatic reset behavior.
 
-Acceptance:
+## App-server service
 
-- A clean machine with `codex` installed is detected without reading secrets.
-- Missing/incompatible Codex versions produce actionable diagnostics.
-- Normal Codex arguments and conversation/thread identity survive wrapper
-  launch.
+Expose typed Marathon status, enabled-state, auto-reset, import, login, and
+switch requests. Verify the source identity and safe-boundary state before
+writing or reloading credentials.
 
-## Agent 2 — Multi-account login and credential lifecycle
+## CLI and TUI
 
-Implement login/add, list/status, activate/use, rename, refresh, and remove
-through the supported installed-Codex interface. Store opaque snapshots in the
-protected vault, preserve refreshed fields, and keep tokens out of metadata,
-logs, journals, diagnostics, and output.
+Expose `codex marathon` and `/marathon` with matching account controls. Login
+must offer a browser-link flow and a device/auth-code flow for headless
+servers. The status line must report Marathon enabled state and managed-account
+count.
 
-Acceptance:
+## Verification
 
-- Two profiles can be created and switched without manual `auth.json` copying.
-- Failed or canceled activation leaves the previous profile intact.
-- Refreshed credentials return to the correct profile.
-
-## Agent 3 — Quota and account policy
-
-Implement active/inactive quota observation, fresh telemetry, threshold and
-`UsageLimitExceeded` decisions, candidate ranking, cooldowns, exhausted-pool
-waiting, reset scheduling, and mandatory post-reset revalidation.
-
-Acceptance:
-
-- Focused tests cover multi-bucket, stale/partial, error, reset, and pool
-  exhaustion cases.
-- No stale or ambiguous observation authorizes an account transition.
-
-## Agent 4 — Preferred live control transition
-
-Integrate the installed Codex supported local control interface. Negotiate
-capabilities, wait for Codex's safe boundary, preserve Account A refreshes,
-atomically deploy Account B, request native reload and transport invalidation,
-and verify account/generation identity before commit.
-
-Acceptance:
-
-- A compatible running Codex process switches without losing its conversation.
-- Active turns prevent credential mutation.
-- Lost acknowledgements and stale generations reconcile by the same transition
-  ID.
-
-## Agent 5 — Controlled restart and resume fallback
-
-Implement the fallback for Codex versions without live control. Ask the same
-Codex process to exit cleanly, confirm exit, deploy credentials atomically,
-relaunch the same executable, resume the same conversation/thread, and verify
-the target identity.
-
-Acceptance:
-
-- Deployment never occurs before process exit.
-- Resume uses an exact thread ID or Codex's `--last` selection and preserves
-  original arguments.
-- Partial restart failures remain durable and reconcilable.
-
-## Agent 6 — Exactly-once recovery and restart durability
-
-Connect policy decisions to Codex's existing parked recovery turn. Keep it
-parked through exhaustion/reset waiting, release it only after a verified live
-reload or controlled resume, and persist transition/recovery intent across
-companion or Codex process restarts.
-
-Acceptance:
-
-- The interrupted task resumes once in the same conversation.
-- Crash, reconnect, duplicate-event, and lost-response cases produce zero
-  duplicate continuations.
-
-## Agent 7 — Companion packaging and release evidence
-
-Build the Go-only default archive and clean-machine checks. Keep the imported
-Rust runtime behind explicit opt-in, validate the archive distribution marker,
-and document installed-Codex acceptance for both live reload and controlled
-restart/resume. Do not replace missing live evidence with embedded-runtime or
-fake-runtime smoke results.
-
-Acceptance:
-
-- Linux companion artifact contains one `codexmarathon` entrypoint and no
-  `codex-app-server`.
-- Optional embedded-runtime artifacts require an explicit flag and are marked
-  separately.
-- Static, focused, integration, optional-runtime, and live installed-Codex
-  evidence are clearly distinguished.
-
-## Dependency order and orchestration
-
-1. Agent 1 establishes installed-Codex discovery and wrapper behavior.
-2. Agents 2 and 3 can proceed in parallel against that boundary.
-3. Agent 4 consumes Agents 1–3 for live reload.
-4. Agent 5 provides the fallback process boundary and resume identity.
-5. Agent 6 connects both transition paths to recovery and restart replay.
-6. Agent 7 packages and validates the resulting companion release.
-
-The orchestrator should assign independent tasks to Luna Max agents where
-slots permit, review shared-worktree diffs after each handoff, and run the
-full companion verification before calling the product complete.
+Run focused Rust tests and compile checks for the runtime, login, app-server,
+TUI, and CLI. Build the release `codex` executable and smoke-test `marathon
+--help` and `marathon status`. Never consume a real provider reset while
+testing automatic reset.