Codex DM should avoid safety-cancelled setup/social tool calls

[100yenadmin]

Summary

The final-head built-app Codex-DM proof on 500c379 is playable and the campaign-id hint removed broad mid-session shell scans, but the provider trace still shows safety-cancelled tool calls that add latency/noise.

Evidence

• Evidence folder: /Volumes/LEXAR/Codex/worldos-built-app-playtest/codex-app-final-20260601T033714/
• Provider summary: 05-provider-trace-summary.json
• Built app run: codex-app-final-20260601T033714
• Minted run: play-20260531203723
• Built app SHA: 500c379

Remaining Cancelled Calls

• Opening: create_character(Rell Ashwake) before first narration was safety-cancelled because startup should only establish the canon player and stage NPCs in narration.
• First move: social_check(... npc_id="", target_name="the grey-faced Flaming Fist recruit") was safety-cancelled; the model recovered by creating a tracked NPC and continuing.

User Impact

The app remains playable, but fresh-player response latency is inflated by recoverable provider/tool-contract missteps. This should be resolved before trusting full RRI latency/playability evidence.

Acceptance Criteria

• Opening prompt prevents roster mutation beyond the player before first narration unless explicitly configured.
• DM guidance clarifies when to create/find a tracked NPC before social checks instead of calling social_check with ambiguous empty npc_id.
• Repeat built-app proof shows no safety-cancelled tool calls during opening plus first player move.

[100yenadmin]

Implementation PR opened: #487 (stacked on #475). It adds startup roster-mutation and social-check target guardrails plus focused wrapper tests.

[100yenadmin]

Current implementation is consolidated into PR #475 (stacked draft #487 is closed as superseded). The clean-tree built-app proof at app-code SHA 8bd833f used codex-app-headproof-20260601T043909: Codex provider, private art present, Alfira seated, one /move accepted/resolved, /session-surface still actionable, and provider trace summary reported zero errors / zero failed tool calls. Evidence root: /Volumes/LEXAR/Codex/worldos-built-app-playtest/codex-app-headproof-20260601T043909/. Keep this issue open until PR #475 merges.

[100yenadmin]

Post-#475 built-app proof confirmed this issue is still relevant.

Run/evidence:

• Build: 32ca561 on main
• Built-app proof: post475-main-app-proof-20260601T051230
• Minted run: play-20260531221241
• Evidence archive: /Volumes/LEXAR/Codex/worldos-built-app-playtest/post475-main-app-proof-20260601T051230
• Trace summary: ui_playtest_run/native/provider-errors.json

Product behavior was playable: private art present, live campaign attached, Alfira active, /move writable, 5 enabled actions, a real player move accepted, and follow-up DM narration appeared.

Provider trace was not clean:

• 4 mcp_tool_call items ended in failed with safety-cancelled errors.
• One look_around call was user-cancelled.
• Two setup/social log_event calls were safety-cancelled around staged NPC dialogue / startup-contract interpretation.
• One persist_beat call after the real player move was safety-cancelled as if it were still opening-turn persistence.

Interpretation: #475 proves the app wiring can produce gameplay, but it does not close provider-noise/release-trust risk. This should stay open until a later build proves the Codex DM path can produce a trace-clean built-app play session, or the release gate uses a deterministic scripted provider for wiring proof and confines Codex-provider noise to a separate provider-quality lane.