Summary

• Mirror Codex app-server native subagent lifecycle events into Task Registry as silent subagent / codex-native tasks.
• Capture both structured thread/started / thread/status/changed events and live collabAgentToolCall state from native spawnAgent / wait items.
• Keep Codex thread identity in runId / sourceId (codex-thread:<threadId>) and deliberately leave childSessionKey unset so OpenClaw task maintenance/cancellation does not treat native Codex threads as OpenClaw-managed child sessions.
• Keep the detached task mutation helpers off the public agent-harness-runtime SDK surface by routing the bundled Codex plugin through a private local-only openclaw/plugin-sdk/codex-native-task-runtime subpath, include that private helper in the build output, and allow that specific non-QA private helper only for bundled Codex alias resolution.

Current-head proof

Current PR head: 75bc96ad74ba6c082e933aae0f372fd1cb76f19c.

• Rebased onto current origin/main at validation time: d0edacad5be774d6f26963148a34a7f05ac71cf8.
• Wrapper prep gates: changelog validation passed; pnpm build passed; pnpm check passed.
• Wrapper broad pnpm test did not pass on local maintainer hardware. The failures were in files outside this PR's diff, including src/agents/*, extensions/telegram/*, extensions/nvidia/*, extensions/openrouter/*, and extensions/mattermost/*. The Codex app-server failures emitted in the broad run passed when rerun directly, so this is being treated as broad-suite/baseline noise rather than a PR blocker.
• Local focused regression tests on current head: pnpm --config.verify-deps-before-run=false test src/plugins/sdk-alias.test.ts src/plugins/contracts/plugin-sdk-root-alias.test.ts extensions/codex/src/app-server/native-subagent-task-mirror.test.ts extensions/codex/src/app-server/event-projector.test.ts extensions/codex/src/app-server/run-attempt.test.ts extensions/codex/src/app-server/run-attempt.context-engine.test.ts extensions/codex/src/app-server/auth-profile-runtime-contract.test.ts src/tasks/detached-task-runtime.test.ts - passed, 232 tests.
• Local formatting and SDK checks on current head: pnpm --config.verify-deps-before-run=false exec oxfmt --check --threads=1 ..., node scripts/check-plugin-sdk-subpath-exports.mjs, node scripts/check-extension-plugin-sdk-boundary.mjs src-outside-plugin-sdk, node scripts/check-extension-plugin-sdk-boundary.mjs plugin-sdk-internal, pnpm --config.verify-deps-before-run=false plugin-sdk:api:check, and git diff --check origin/main...HEAD - passed.
• Scope check on current head: PR diff contains no .github/workflows/*, live Docker harness, Testbox, or validation-tooling changes. Tooling stays private to maintainer validation.

Real behavior proof

• Behavior addressed: Codex app-server native subagents appear in Task Registry as silent subagent / codex-native rows instead of only existing in Codex session/transcript surfaces.
• Real environment tested: real jpclawhq main OpenClaw gateway checkout at /srv/openclaw/main. No Testbox/workflow/tooling changes are part of this PR.
• Exact steps or command run after this patch: deployed this branch's runtime patch to /srv/openclaw/main, ran pnpm build, restarted with sudo systemctl restart openclaw-gateway, checked sudo openclaw-runtime-status, checked /usr/local/bin/openclaw-main nodes status --json, then inspected Task Registry rows for Codex-native subagent records after a live Codex app-server native subagent run. The final current head only narrows the private helper alias to bundled Codex and refreshes generated SDK baseline hash; the Task Registry mirror behavior covered by this gateway proof is unchanged from that live run.
• Evidence after fix: terminal output from the real gateway run plus current-head local focused test output covering the alias-scope tightening.

$ sudo -u openclaw -H bash -c 'cd /srv/openclaw/main && pnpm build'
...
OK: All 4 required plugin-sdk exports verified.

$ sudo systemctl restart openclaw-gateway
$ sudo openclaw-runtime-status
gateway_service=active
gateway_exec={ path=/usr/local/bin/openclaw-main ; argv[]=/usr/local/bin/openclaw-main gateway run --bind loopback --port 18789 --force ; ... ; status=0/0 }
main_version=OpenClaw 2026.5.6 (ea45b72)

$ /usr/local/bin/openclaw-main nodes status --json
{ "ts": "2026-05-08T...", "nodes": [ ... ] }

$ openclaw-main tasks list --runtime subagent --json | jq -c '.tasks[]? | select(.taskKind=="codex-native") | {runtime,taskKind,status,runId,label,terminalSummary,deliveryStatus,notifyPolicy}'
{"runtime":"subagent","taskKind":"codex-native","status":"succeeded","runId":"codex-thread:019e0940-178d-7442-bdee-7081e799996c","label":"Codex subagent","terminalSummary":"Implemented scripts/find-madrid-wine-restaurants.py ... sample output Wine Bar La Fisna scored 85 ...","deliveryStatus":"not_applicable","notifyPolicy":"silent"}

• Observed result after fix: the live gateway stayed active after restart, node status returned JSON from the running main service, and the live Codex app-server run produced silent Task Registry rows with runtime=subagent, taskKind=codex-native, and terminal succeeded status for native subagent spawns.
• What was not tested: local broad pnpm test remains red in unrelated/baseline areas. A fresh final-head Testbox packaging/import proof was queued for about ten minutes and stopped because capacity did not clear; no active Testboxes remain.

Maintainer flow checks

• Latest release branch observed: release/2026.5.10.
• Release relevance: likely release-line relevant if maintainers want native Codex subagent visibility before switching back to releasing from main.
• Review attention: this touches a Plugin SDK-adjacent private local-only route for bundled Codex. The current patch avoids a public SDK export and scopes the private alias to bundled Codex.
• Plugin ecosystem proof: focused SDK subpath/export checks, package contract guardrails, resolver tests, and Codex mirror tests passed; broader plugin-inspector/kitchen-sink/crabbot proof was not run because this is a private local-only bundled-plugin route, not a new public plugin API.