§1 — Outcome

Codex CLI and Claude Code can propose, start, execute, resume and close dependency-ordered work from the same plan and sprint state. Execution records the exact instruction context, checkout, model/agent surface, commands, commits, tests, artifacts and evidence documents. Failures are durable events, not lost chat context.

§2 — MCP and sprint improvements

§3 — reckon-ship redesign

The current skill is strong on full-plan intent, prerequisite checks, exclusive scopes, continuous state writeback, archive records and worker verification. It is too absolute in treating a parallel fleet as mandatory, assumes agent APIs that are not universal, mixes execution policy with git recipes, and treats an approved plan as blanket authorization for destructive actions. Refactor it around a capability preflight, dependency DAG, resumable execution ledger, evidence gates and portable worker adapters. Parallelism becomes recommended when safe and available, with a defined single-agent Codex fallback.

Sprint plans and evidence form a DAG whose ready nodes run in isolated worktrees before orchestrator integration and cleanup. Plan, sprint, and repository allocation state enter the roadmap analyzer, which returns ready work, blockers, critical paths, completion, and wiring repairs.

§4 — Acceptance and observability

Tests cover interrupted/resumed execution, version conflicts, worker failure, partial landings, checkout mismatch, absent subagent support, evidence gate failure and archive migration. A structured error log records tool, operation, request projection, response size, error class, retry and resolution. The input research is Reckon Plan Management Audit.

§ Followups

Build the portable execution ledger and bounded sprint surface

Begin after the context manifest and provenance types land, then refactor the skill and MCP around capability-aware, evidence-gated execution.

Project: reckon
Plan:    execution-orchestration-hardening (http://localhost:8765/reckon/execution-orchestration-hardening.html)
Section: full plan
Tier:    opus

Context
  The current sprint surface is usable but indirect; reckon-ship is rigorous but
  tied to one agent/fleet model and lacks a resumable evidence ledger.

State to read
  reckon-plan-management-audit.html, skills/reckon-sprint/, skills/reckon-ship/
  MCP read/edit/audit implementations and tests

Scope locks / constraints
  Preserve optimistic concurrency and HTML-first state.
  Never weaken global safety approval boundaries.

Done-when
  1. Bounded sprint operations and portable resumable execution land with failure tests
  2. tests still green
  3. followup written + this followup marked resolved

Deliver the sprint orchestration skill slice

Implement sprint target resolution, evidence-aware dependency waves, provider-neutral capability routing, worktree isolation, orchestrator integration and cleanup guards.

Project: reckon
Plan: execution-orchestration-hardening
Section: sprint delivery orchestration slice
Capability: one-below default with orchestrator-level retention for high-risk work

Context
  Deliver the user-authorised independent skill slice while leaving prerequisite-bound ledger and MCP work open.

Done-when
  1. Sprint handles, DAG orchestration, capability routing and worktree lifecycle are documented and tested
  2. Full Reckon test suite remains green
  3. Evidence links the implementation commit, validation, errors and remaining work

Landed in commit 36d5bdd; both skill validators passed, 6 focused tests passed, and the full 1,181-test suite passed. Evidence: archive/execution-orchestration-hardening-sprint-delivery-landed.html

A node cannot be dispatched into a repository other than the one holding its plan

reckon crew dispatch --repo <other> resolves the node's plan inside the dispatched repository and refuses with plan-unavailable when it is not there. That makes every cross-repository node undispatchable, even though the semantics are already coherent everywhere else: the plan is the semantic authority, and read_plan/edit_plan already accept checkout_path to separate the plan's checkout from the working one.

Measured while sweeping twelve mounted projects for a reckon-owned plan: four repositories hold work that plan authorises and none of it could be delegated, because the plan lives in reckon while the edits land in imas-efit, imas-ambix, nova and hanney. The obvious workaround is worse than the gap: pointing write paths at another checkout puts a worker outside the worktree that bounds its blast radius.

The repair is to let the plan resolve through its registered mount while the worktree still comes from --repo, so a cross-repository node keeps both its semantic authority and its isolation.

/reckon-ship execution-orchestration-hardening

§ Research

Reckon Plan Management Audit
audit-doc initially failed: uv cache at ~/.cache/uv was read-only in the Codex sandbox; retry with UV_CACHE_DIR=/tmp/reckon-uv-cache passed
Sprint delivery orchestration landed: target resolution, one-below routing, worktree isolation and conservative cleanup
Skill validator initially failed because PyYAML was absent; uv run --with pyyaml made the dependency explicit
Skill validation rejected angle brackets in frontmatter; syntax examples were retained in the body and frontmatter rephrased
Audit classified reckon-type evidence in discovery but rejected it against the current plan/research schema; the record uses a research compatibility envelope with artifact-kind evidence until typed provenance lands
Roadmap and wiring analysis landed: project allocation, critical paths, guarded prose edits, and coordinated skill repairs
Unified plan editing landed: one mode-discriminated MCP write surface with guarded state and prose paths
MEASURED GAP filed from a live nova incident (run r-20260822T151117616586, 2026-08-22): a codex worker whose usage limit exhausted MID-TURN died with phase failed, no manifest, and a stream tail of turn.started, error, turn.failed - and that death NEVER FED THE BUDGET TRACKER. crew preflight read headroom unknown and held nothing during an actual exhaustion, so a fresh dispatch could have run straight into the same wall before the reset; the budget contract says holds happen only where exhaustion was actually reported, and this exhaustion was observable in the stream but unclassified. Proposed tool work, two halves: (1) the failure classifier inspects the terminal error event of a failed run and, on the backend quota signature, records an exhaustion into the budget state with its reset time so preflight holds until then; (2) the live/recover classification labels such runs quota-exhausted-resumable rather than bare failed, since the proven recovery is one crew resume into the same session after reset - the member context survives and only uncommitted in-flight edits are lost. The orchestrator-facing half of this incident (the watcher signature and the manual treat-as-held rule) is already documented in reckon-ship SKILL.md at bc9f6b5; this comment files the product half with the plan that owns bounded, resumable execution.