§1 — The read-only tier contradicts the delivery contract
The durable-delivery fence requires every worker to write its manifest to a named file —
the file is the delivery, the message is a convenience. The read-only sandbox
tier, resolved for the investigate and review roles, translates to a codex launch whose
sandbox is process-wide: it rejects writes to the manifest path, the findings file, the UV
cache and /tmp alike. The two contracts compose into a guarantee that every
read-only node fails to deliver.
Measured on 2026-08-16 in the nova project: two investigation nodes completed their
research in full, attempted the single patch containing their deliverables, were rejected
with patch rejected: writing is blocked by read-only sandbox, and died as
NEEDS-HELP with the findings stranded in their final messages. Each cost one resume to
recover, and the rejected patch body is not retained in the stream, so message re-emission
was the only verbatim recovery. This plan is dispatched for immediate execution in the same
session that authored it, not scheduled into a sprint.
§2 — Fix: the delivery directory becomes the writable workspace
For the codex dialect, translate the read-only tier to
--sandbox workspace-write with the process working directory set to the run's
delivery directory — the manifest path's parent — instead of the worktree.
Under workspace-write, the cwd subtree and the system temp directory are writable and
everything else remains readable, so the repository worktree stays effectively read-only
while the manifest, findings files and named logs land normally. The dispatch prompt already
names the assigned worktree as an absolute path, so reading the repository is unaffected;
the composed prompt additionally states plainly that the working directory is the delivery
directory and the repository is read-only.
The launch currently passes the worktree as -C unconditionally
(reckon/_backends.py:268) and maps tiers in _sandbox_flags
(:290-298); the delivery directory must therefore be threaded from the dispatch
record into the argv builder. The run record already carries manifest_path, so
no new state is invented.
§3 — Tests and the process note
Unit tests pin the translation: the read-only tier yields workspace-write with cwd equal
to the manifest directory; the worktree-full and workspace-write tiers are byte-for-byte
unchanged; resume launches inherit the same cwd rule so a resumed read-only worker can still
write its redelivery. The worker-protocol note that currently reads "the reviewed read-only
tier is a per-node runtime choice for work that does not build" gains the delivery guarantee:
read-only never blocks the manifest, and a read-only node that must execute code (builds,
test runs) still belongs in worktree-full because caches outside the delivery directory
remain read-only.
§ Decisions
How does a read-only worker get a writable delivery path?
Owner directive 2026-08-16: investigation sessions must be able to
write their findings. Under workspace-write the cwd subtree is writable, so keeping the
worktree as cwd would make the whole repository checkout writable and surrender the
guarantee the tier exists for; pointing cwd at the delivery directory keeps the
repository read-only in effect while the delivery contract holds. The alternative is
recorded because it is the smaller diff, and rejected because it trades away the
property being protected.
§ Followups
Implement the delivery-cwd translation with pinned launch tests
The one implementation rung: thread the delivery directory
into the codex argv builder, translate the read-only tier per §2, pin the launch and
resume behaviour per §3, and update the worker-protocol note so the process document
matches the mechanism.
/reckon-ship findings-writable-investigations §2
done — no followup. Commit 16100cc (merged): the codex read-only tier launches with -C set to the manifest path's parent, --sandbox workspace-write, and --skip-git-repo-check since the delivery directory is not a repository; the cwd derives from the existing dispatch record so no new state was invented; the composed prompt states the arrangement; fresh and resume launches share the rule so a resumed read-only worker can write its redelivery; worktree-full and workspace-write argv are pinned byte-for-byte unchanged by tests. Focused lane 112 passed / 0 failed; full reckon suite 1,854 passed / 0 failed. The worker-protocol note now documents guaranteed manifest delivery and keeps the caveat that build/test nodes belong in worktree-full because caches outside the delivery directory stay read-only.