# Context-Budget Delegation (Reader / Writer)

Keep large file bytes out of the working context by delegating reads and
patterned writes to bounded cheap contexts that return line-referenced bullets
or receipts. Spotify published an internal Claude Code setup built this way and
claims roughly a 90% token reduction; that is Spotify's claim about Spotify's
setup, not a measurement made here. The mechanical finding is what matters: the
same read rule placed in CLAUDE.md was advisory and ignored, and every line of
an unbounded read is re-sent on every later turn for the rest of the session.

## Three layers

| Layer | AgentOps surface | Authority |
|---|---|---|
| Advisory | this reference and the `agent-native` Roles note | none; context the agent may ignore |
| Delegation | `bulk-reader` / `code-writer` subagents (`agents/`), `bulk-read` / `code-write` workflows (`workflows/`) | caller-selected per call |
| Enforcement | the opt-in read-budget guard: [READ-BUDGET-GUARD.md](../../cc-hooks/references/READ-BUDGET-GUARD.md) | mechanical once installed; inert by default |

The delegation surfaces live in the AgentOps source checkout: the subagents are
Claude Code plugin agents and the workflows are Claude-only thin conveyors
(`workflows/README.md`). Neither ships with a standalone installed skill.
With the AgentOps plugin loaded, select Agent `subagent_type:
"agentops:bulk-reader"` or `"agentops:code-writer"`, and Workflow `name:
"agentops:bulk-read"` or `"agentops:code-write"`. Use bare names only for
standalone definitions or workflow links when the runtime actually lists those
names. The plugin adds the namespace; source frontmatter and workflow `meta.name`
remain bare.

## Reader and Writer as bounded cheap delegations

- **Reader** (`bulk-reader` subagent, `bulk-read` workflow): the caller passes a
  question and file paths; the reader reads each file completely in slices and
  returns bullets only, each starting with `path:line` or `path:start-end`, at
  most 40 unless the caller sets another cap, plus truthful `lines_covered` and
  `complete`. The caller sees bullets, never bytes, so a follow-up question costs
  one more cheap call and zero main-context lines.
  The slice budget applies to each Read, and the bullet cap applies only to
  the answer: neither caps total coverage. Readers start at offset 1 and
  continue through EOF, retrying truncated output from the first unread line
  with a smaller limit. An early answer may be revised later in the file;
  incomplete coverage cannot establish the final file-wide decision.
  Citations and coverage use actual source line labels, excluding tool wrappers
  and EOF notices. Uncertain counts must remain incomplete, never guessed.
- **Writer** (`code-writer` subagent, `code-write` workflow): the caller passes a
  spec, a REQUIRED reference file and one target path; the writer matches the
  reference's patterns, writes only the target, optionally runs one check, and
  returns a receipt (path, line count, check result, a short summary). The caller
  never reads the result back.
- Both are one-shot delegations: AgentOps adds no queue or persisted delegation
  state. Native runtimes may retain their own transcripts. A dead worker returns
  an explicit error; a missing writer receipt leaves possible writes unknown.

## Guard compatibility

Readers and writers slice: `Read` with `offset` + `limit`, `limit` at most the
budget (350 lines by default, `AOP_READ_BUDGET_LINES` when set). A subagent's
own reads run under the same PreToolUse hook as the caller's, so an unbounded
read inside a delegate is blocked the same way. The guard never fires on a
bounded slice or on a file at or below budget, so a compliant reader is never
blocked and the delegation works whether or not the guard is installed.

## Codex native roles and enforcement

Verified against installed `codex-cli 0.154.0` on 2026-09-12 (the authoring
Desktop session reports 0.153.4). Codex has synchronous `PreToolUse` hooks that
can refuse supported local tool calls with exit 2 and stderr. Shell tools,
including `exec_command`, arrive as `tool_name: "Bash"` and
`tool_input.command`. This replaces the previous unverified assertion that
Codex had no such hook. [Codex hook contract](https://learn.chatgpt.com/docs/hooks).

The Codex guard is an optional installation from the checkout:

```sh
bash scripts/install-codex-context-agents.sh          # personal roles
bash scripts/install-codex-read-budget-guard.sh       # optional shell guard
# Add --project for project scope; see the linked-worktree limit below.
```

Restart Codex to load the roles, and review the exact hook in `/hooks` before
trusting it. Installing files does not activate an untrusted hook. The guard is
inert in the plugin and its default hook manifest remains unchanged. The
0.154 CLI resolves project hooks from the primary checkout even when launched
in a linked worktree. The hook installer rejects `--project` there before
writing anything; install personally or run it in the primary checkout.
Project trust must be saved in Codex config, and does not replace hook trust.
The Codex installer wires only the verified Bash shape. It does not claim coverage
of arbitrary MCP reads, hosted tools, or tool paths that opt out of hooks.
It uses the same policy `core.context:unbounded-read`, budget
`AOP_READ_BUDGET_LINES` (350 by default), waivers and hashed telemetry ledger
as the Claude guard. Pipes, redirects, unresolved shell expressions and other
command words remain outside the predicate. This is a scoped guardrail, not a
complete boundary against all ways to read a file.

The role templates are canonical source files under this skill's `agents/`
directory, mirrored into `skills-codex/agent-native/agents/` by regeneration.
The checkout exposes them at `.codex/agents/` using relative symlinks; the
installer copies the generated templates to the runtime's personal or project
agent directory and registers `agents.<name>.description` and `config_file`
using the installed Codex config editor. The checkout has equivalent explicit
registrations in `.codex/config.toml`; standalone file discovery did not work
in the measured CLI, while registered roles ran successfully. Installation
requires Node and the installed Codex runtime. They do not add skills to the menu.

- `bulk-reader` (`agents/bulk-reader.toml`): one question and one file, slices
  of at most 350 lines (or a smaller configured budget), up to 40 paraphrased
  `path:line` findings with truthful coverage. Default sandbox: read-only.
- `code-writer` (`agents/code-writer.toml`): spec, required reference and one
  target; patterned write and optional check, receipt only. Default sandbox:
  workspace-write. Target-only edits and content-free returns are role
  instructions; they are not a per-file sandbox or output filter. Parent live
  sandbox overrides can also override a role's default sandbox.

Ask Codex: "Use bulk-reader to answer <question> about <path>; return at most
five findings and coverage. Keep the file out of this parent context."
For a write: "Use code-writer with spec <spec>, reference <path>, target
<path>, check <read-only check>; return the receipt only."
The runtime identifies a custom agent by its TOML `name`. When its native
spawn tool exposes `agent_type`, select that name. On a facade that exposes
only a task name, message, model and context inheritance, pass the role's
instructions to a fresh child, explicitly select `gpt-5.6-luna` and the role's
effort, and disable history inheritance (`fork_turns: "none"`). That fallback
is a native delegated prompt; do not claim that the facade loaded a named role
or enforced its sandbox setting. Never replace either route with a subprocess
model invocation. [Codex subagent contract](https://learn.chatgpt.com/docs/agent-configuration/subagents).

The parent checks only coverage, locators and receipt metadata. If evidence is
insufficient, delegate a follow-up or let a fresh validator inspect the result
in its own context. Do not read the whole file back into the parent to verify
that delegation worked. Native output truncation is not proof of complete
coverage; the reader retries smaller slices or returns `complete: false`.

## Model selection

Claude agents and Workflow conveyors default to `haiku`; workflow `model` may
override it. The Codex roles pin `gpt-5.6-luna` (reader low effort, writer medium),
a model available in the measured runtime's catalog and the least expensive
listed model with published comparable credit rates at this cutoff. Spark's
research-preview price is not a comparable published rate. Role model pins and
availability should be rechecked for another account or release; do not silently
substitute a costly model. [Current rate card](https://learn.chatgpt.com/docs/pricing#token-rates).

[model-dispatch](model-dispatch.md) still governs judgment legs; a reader or
writer is an execution role, never a judge. See the checkout design note
`docs/design/codex-context-budget.md` for the installed-runtime evidence,
live proofs and remaining limits.

## Doctrine

- A receipt is a runtime fact, not validation. `written: true`, a line count or
  `check_ok: true` proves that a process ran, nothing about acceptance.
  [Validate](../../validate/SKILL.md) stays fresh and author-distinct over the
  exact written content; the writer's context can never issue that PASS.
- Reader bullets are evidence with a locator, not authority. Have a fresh validator inspect cited
  lines before an acceptance decision that depends on them.
- No new AO command, scheduler or budget account. The guard is a standalone
  opt-in recipe with an installer (ADR-0002: a hook earns its lease on life only
  as an optional runtime adapter); the delegations are caller-selected per call;
  nothing counts tokens on the agent's behalf or renews a spent bound.

# Native judgment receipt references

A consumer can check caller-selected judge profiles with
`ao provenance verify-judgments`. This is a mechanical reader over the existing
`verdict.v2` contract; Validate remains the semantic author. It neither launches
judges nor chooses a strategy, provider, retry, budget or delivery transition.

Before dispatch or source retrieval, the caller resolves task, source owner,
model/provider and destination authorization. Required diversity cannot grant
access to a denied provider. The native runtime must enforce that policy before
transmission; a local verifier cannot retract an unauthorized dispatch. Pass the
independently authorized providers separately from the required profile file.
The generic reader does not resolve configuration; callers supply its inputs.

## Independent inputs

Freeze the expected subject manifest, immutable acceptance file, author context,
required profiles and authorized provider list outside the candidate's control.
Every required leg must concern that exact subject **and** acceptance. Two valid
PASS verdicts over the same bytes for different purposes are not interchangeable.
For example, factual support cannot stand in for permission to disclose a page.

The required profile file is a strict JSON object:

```json
{"profiles":[{"id":"other-family","runtime":"claude","model":"claude-example","family":"anthropic","effort":""}]}
```

Use an exact model ID, not an alias that can silently resolve to another model.
Supported runtime/family pairs are `codex`/`openai` and `claude`/`anthropic`.
Profile IDs must be distinct. An empty effort imposes no actual-effort requirement.
A nonempty effort requires that exact effort in runtime reporting; a requested
option alone does not prove actual effort. Missing native reporting remains an
honest limitation, even when the model and context can be verified.

## Receipt in existing evidence_refs

The caller/runtime records one immutable receipt in protected non-Git evidence
storage. A verdict cites it through an ordinary top-level `evidence_refs` string:

```text
judgment-receipt:/absolute/private/evidence/receipt.json#sha256=<SHA256-of-exact-receipt-bytes>
```

No model, provider, effort or receipt fields are added to `verdict.v2`. Its own
content-addressed artifact remains unchanged, including FAIL, NOT_PROVEN,
findings, omissions and freshness attestation. There is no receipt-to-verdict
backreference or digest cycle: the verdict binds the receipt's bytes.

The receipt's strict version-1 shape is:

```json
{
  "version": "1",
  "requested": {"id":"other-family","runtime":"claude","model":"claude-example","family":"anthropic","effort":""},
  "subject_manifest_digest": "<expected-subject-manifest-digest>",
  "acceptance_digest": "<SHA256-of-exact-expected-acceptance-bytes>",
  "author_context_id": "<observed-author-context>",
  "transcript": {"path":"/absolute/private/evidence/native.jsonl","start":0,"end":1234,"sha256":"<SHA256-of-exact-selected-native-bytes>"},
  "exit_code": 0,
  "timed_out": false,
  "truncated": false,
  "cleanup_verified": true,
  "omissions": []
}
```

Capture the complete invocation span, including native identity and terminal
events. `start` and `end` are zero-based, end-exclusive byte offsets; both must
be native JSONL line boundaries (the file end may lack a trailing newline).
Hash the exact span, preserving CRLF, whitespace and final-newline presence.
Never select only a favorable response from a run that changed model/context or
terminated unsuccessfully. Record withheld/unread required input, incomplete
output and every other omission. Nonempty omissions cannot satisfy the leg.
Raw thinking content is not needed in reports; metadata span references suffice.

The verifier reopens the transcript and parses native envelope fields. It never
trusts a receipt-authored actual-model string, requested profile echo or JSON
inside assistant/tool text. Claude `assistant.message.model` plus native
`session_id`/`sessionId` supplies the reported identity; `system.init.model`
is a requested configuration echo. Codex `session_meta.payload.model`,
`model_provider`, `id` and optional `reasoning_effort` supply metadata when
present. `turn_context` configuration and model self-description do not establish
actual identity. Codex versions without native model reporting remain
`identity_unverified`; do not guess their model from a command or filename.

Successful native termination requires Claude `result` with `subtype: success`
and `is_error: false`, or Codex `event_msg` with `payload.type: task_complete`.
A saved content-only transcript without a terminal event cannot establish
completion. Exit zero alone, a timed-out partial result or a clean process tree
cannot replace the native terminal event. Native fields attest available runtime
reporting; they do not cryptographically prove provider weights, an untampered
recorder, complete source coverage or context isolation. Caller/runtime freshness
attestation remains necessary alongside observed distinct context identities.

## Verify required coverage

```sh
ao provenance verify-judgments \
  --root "$SUBJECT_ROOT" --manifest "$MANIFEST" --intent "$EXPECTED_INTENT" \
  --author-context-id "$AUTHOR_CONTEXT" --evidence-root "$EVIDENCE_ROOT" \
  --required-profiles "$REQUIRED_PROFILES" --allowed-provider anthropic \
  --verdict "$VERDICT"
```

Repeat `--verdict` for supplied legs and `--allowed-provider` for independently
authorized providers. The existing private non-Git evidence root confines
candidate-selected receipt, transcript and verdict reads. Files must be private
regular files; paths cannot escape the root through symlinks. Reads are bounded
to 16 MiB per file. Malformed/duplicate JSON, altered receipt or transcript bytes,
invalid spans and unsupported helper versions fail closed before being relied on.

The result lists each required leg, the unchanged supplied verdict, parsed native
facts and exact source spans, and any mismatches or missing coverage. Unknown
identity, wrong model/family/required effort, stale subject, wrong acceptance,
reused author/peer context, timeout, truncation or unverified cleanup leaves
`satisfied: false` with exit 1. An unavailable required leg remains missing;
never swap it for another family or remove it without caller authority.
Exit 0 and `satisfied: true` establish mechanical matching of the supplied PASS
legs, not a new semantic judgment or a majority vote. Preserve disagreement.

# Model Dispatch (controller-session)

Judgment defaults to a fresh, author-distinct context in the author's model
family: Codex/OpenAI reviews Codex/OpenAI work, and Claude/Anthropic reviews
Claude/Anthropic work. Use that runtime's configured capable model unless the
caller pins one. Other execution roles retain their caller-selected runtime.
Factories are optional adapters; the current session passes requests and
returns runtime facts without adding a mailbox, AO queue or scheduler.

`--cross-model [model]` on Validate or RPI, or an explicit "cross-model review"
request, adds a fresh judge from a different family. The optional model pins
that leg; absent a pin, select an authorized capable other-family model.
Council and other judgment strategies use fresh same-family contexts unless
the caller selects mixed models. These are skill prompt selections, not new
native CLI flags. Selection never grants source-disclosure or provider access.

Risk changes evidence depth; it does not automatically select another family.
An explicitly required unavailable leg remains `diversity_unsatisfied`: a
single-family PASS is `NOT_PROVEN` for the combined request. Optional unavailable
diversity may accompany the same-family result with that disclosure. A delivered
FAIL stands. Neither agreement nor majority vote establishes truth. Authors
cannot issue their own binding PASS.

## Request and independent inputs

One request selects one worker and one result destination. Before dispatch,
resolve role, exact subject/acceptance references, authorized input bytes,
workspace, read/write scope, output/evidence destination, requested model,
requirement for a fresh context distinct from the author and every peer, finite
input/output limits and time bounds from the caller and native runtime. Actual
context identity remains unknown until the native runtime reports it; verify
freshness and distinctness against that observed identity before relying on
judgment. These are invocation facts, not a new AO packet schema,
work store or budget account. Retry remains the caller's decision. Judge legs
receive read-only subject access; only their declared evidence output is writable.

Both the fresh and required cross-family legs receive the same exact subject
and unchanged acceptance with independently supplied initial inputs. Do not
include the author's desired verdict or a peer's conclusion. Seal initial
perspectives before cross-review; preserve findings and dissent afterward.
Each leg must actually load the required skill, subject and authorized evidence;
a skill-name mention or restating the procedure is not activation evidence.

Check task, source owner, model/provider and destination authorization before
reading pages, private citations, session-search hits or tracker comments.
Read permission is not permission to transmit to a reviewer or store in Git.
Native runtime/OS filesystem and egress controls enforce the declared profile;
prompt restrictions, a worktree or a same-user unrestricted process do not.
Unsupported protection prevents restricted-source dispatch. The repository
contract is ADR-0016, State tiers; this installed skill carries the requirements
above without depending on a repository-relative documentation link.

## Association before execution

Before launch, pass source-store/project/work identity and permitted frozen
intent references through the selected runtime input. The caller records the
dispatch association in native work comments/metadata or existing runtime facts
before execution can fail, with worker identity explicitly unknown if not yet
observed. At startup, capture actual runtime/session/context identity and return
it to that caller-owned channel before substantive work; final handoff is only
an additional reference. Do this for a child or resumed execution as well.

Keep requested model/ID, observed model/ID, controller identity, native parent
and resume predecessor distinct. Use the selected runtime's observed resume
identity even if it retains the original session ID; invocation observations
must still remain distinguishable. Never infer parentage from workspace,
filename, title or proximity. An unavailable startup/recording operation stays
a named failure with unknown identity, not a fabricated successful launch.

[Session associations](../../cass/references/SESSION_FORMATS.md#work-to-session-associations)
owns the fact distinctions: provenance, permitted locators, source bounds and
multi-work spans. Record only metadata authorized for the source owner and
recipient/destination; BD/Dolt is versioned, not secret storage. Neither this
reference nor the core phases gain tracker mutation, a new association store,
or runtime lifecycle authority. Required judgment freshness remains unsatisfied
when observed identities or their provenance are missing.

## Selected adapters

Check readiness only for the selected execution shape; never start a factory
merely because it is installed. No substitute can satisfy a required family.

| Selected shape | Readiness and use |
|---|---|
| Native Codex or `codex-exec` | Native fresh context or available `codex exec`; close stdin or supply the finite prompt for non-TTY runs. |
| Bounded Claude print | Available `claude` with the requested model/effort and a host-authorized native control profile; recipe below. |
| Interactive runtime / NTM | Only when the caller selects interactive hosting; verify native readiness, observation and stop support. NTM itself is never required. |
| Test runner | Synthetic conformance only; never evidence of a live model or semantic judgment. |

Prefer the matching native runtime for same-family judgment. A Claude-family
checkpoint may use the bounded adapter below when the actual host permits it;
Codex-family judgment may use a fresh native Codex context or `codex exec`.
A selection is not permission to override a host prohibition, missing controls,
quota ceiling or provider guard in a specialist skill.

## Review duration

Do not impose a fixed ten-minute timeout. Use an explicit caller-selected
review timeout or derive the invocation timeout from the remaining caller/native
deadline; when both exist, the earlier bound wins. A headless call still needs
finite time and input/output bounds under host policy. If neither time bound is
available, report the missing invocation bound before launching; do not invent
a universal review limit. Native cancellation, output caps and cleanup remain.

For the repository's shared adapter, supply `CODEX_EXEC_TIMEOUT` in seconds or
`CODEX_EXEC_DEADLINE_EPOCH` as an absolute timestamp. With no explicit timeout,
the adapter uses the remaining deadline without a ten-minute clamp. Reuse the
same goal deadline across invocations; retries, context resets and renewed
connections do not renew the caller's allowance. Record a timeout as an
incomplete review, preserve its bounded output, and return control to the caller.

## Authorized bounded Claude invocation

For a caller-selected Fable profile, the native command is:

```sh
claude --print --model claude-fable-5-1 --effort xhigh
```

This is one caller-selected profile, not a mandatory model pin. Select another
authorized capable Claude profile when requested. For native model evidence,
request `--output-format stream-json --verbose`; preserve assistant-envelope
model/context fields and the terminal result, not just rendered text. Inspect the
installed CLI contract before choosing flags. An authorized public/toy read can
use native safe-mode/restricted controls with tools, customizations, MCP and
session persistence disabled when the installed runtime supports them. Those
controls and cleared toy bytes do not establish restricted-source isolation.

The command is supplied to a native bounded invocation, not a standalone
unbounded shell recipe. Before starting it, the native runtime must:

1. Freeze exact authorized input and subject/acceptance identities; declare
   finite input and captured-output byte limits, wall-clock timeout and the
   allowed tools, source paths, output paths and egress endpoints. Missing
   limits or unsupported controls make this adapter unavailable.
2. Supply only that input on stdin, close stdin, and start a fresh context with
   the declared profile. Keep transcripts, stderr, diagnostics and review
   output in caller-selected protected non-Git storage; new recorders use
   native umask 077. Do not request permission bypass or broaden the profile.
3. Observe engagement and enforce the timeout and output cap through the native
   process/job control. On abnormal termination, capture available bounded
   state, stop the owned process tree through native controls and verify no
   owned descendants or hook/probe loops remain. Unverified cleanup is a
   disclosed runtime failure, never a successful review or permission to retry.
4. Return actual command/model/context identity, loaded input/skill/subject
   identities, exit or signal, timeout/truncation facts, output references and
   cleanup observations. Distinguish requested model from observed identity;
   missing identity or a wrong family cannot satisfy the required leg.

The selected native runtime retains process, timeout and output control. AO
does not become a scheduler or semantic workflow engine. This non-executable
reference does not change
Door9's policy for tracked executable code or production Go, introduce a
shipped runner, or relax specialist provider-name guards.

## Receipts and judgment

A successful prompt send proves transport, not engagement. Output bytes, exit
zero, a terminated process and clean cleanup prove only those facts. Only fresh
Validate can judge acceptance and persist `verdict.v2` when requested. Keep
model/context identities in [native judgment receipt references](judgment-receipts.md)
and freshness attestation notes. `ao provenance verify-judgments` compares all
caller-required profiles with exact native transcript spans, independently
supplied subject and acceptance, actual termination and omissions. Requested
profile echo or unknown native identity cannot satisfy required diversity.
No verdict schema change is required, and these attestations are not
cryptographic proof of independence.

Both required legs must pass the same exact subject for convergence. A split
never certifies PASS and findings do not disappear because a judge was preferred.
Return both results and unresolved dissent to the caller. Do not convene a
third judge, retry, or resolve truth by a vote on this recipe's initiative.

## Consumers

- Council: per-judge methodology and model/context identity, sealed initial
  perspectives, preserved dissent and no majority-derived PASS.
- Idea Genie duel: optional selected model pins and sealed perspectives within
  its owning challenge contract; specialist provider guards remain intact.
- Validate: fresh same-family and explicitly selected cross-family judgments; this
  reference is the invocation owner and Validate remains the verdict writer.