feat(agents): surface managed Codex agent runs

apps/server/src/auth/RpcAuthorization.ts

@@ -22,6 +22,8 @@ type WsRpcMethod = RpcGroup.Rpcs<typeof WsRpcGroup>["_tag"];
  */
 export const RPC_REQUIRED_SCOPES = {
   [ORCHESTRATION_WS_METHODS.dispatchCommand]: AuthOrchestrationOperateScope,
+  [ORCHESTRATION_WS_METHODS.launchManagedCodexExec]: AuthOrchestrationOperateScope,
+  [ORCHESTRATION_WS_METHODS.cancelManagedAgent]: AuthOrchestrationOperateScope,
   [ORCHESTRATION_WS_METHODS.getWorkflowScript]: AuthOrchestrationReadScope,
   [ORCHESTRATION_WS_METHODS.getTurnDiff]: AuthOrchestrationReadScope,
   [ORCHESTRATION_WS_METHODS.getFullThreadDiff]: AuthOrchestrationReadScope,

apps/server/src/orchestration/Layers/OrchestrationReactor.test.ts

@@ -35,6 +35,7 @@ describe("OrchestrationReactor", () => {
               return Effect.void;
             },
             drain: Effect.void,
+            ingestRuntimeEvent: () => Effect.void,
           }),
         ),
         Layer.provideMerge(

apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.activity.test.ts

@@ -52,6 +52,46 @@ describe("runtimeEventToActivities task progress", () => {
     expect(usagePayload?.usageSnapshot).toBe(true);
   });
 
+  it("upserts late Codex child identity separately from lifecycle state", () => {
+    const event = {
+      ...base,
+      type: "task.updated",
+      eventId: EventId.make("evt-late-metadata"),
+      payload: {
+        taskId: RuntimeTaskId.make("native-child"),
+        parentAgentId: "native-parent",
+        model: "gpt-5.6-luna",
+        effort: "low",
+        timelineBypass: true,
+        agentSource: "provider",
+        cancellationOwner: "provider",
+      },
+      raw: {
+        source: "codex.app-server.notification",
+        method: "collabAgent/metadata",
+        payload: {},
+      },
+    } satisfies ProviderRuntimeEvent;
+
+    const [activity] = runtimeEventToActivities(event);
+    const [duplicateActivity] = runtimeEventToActivities({
+      ...event,
+      eventId: EventId.make("evt-late-metadata-duplicate"),
+      createdAt: "2026-08-06T00:00:01.000Z",
+    });
+
+    expect(activity?.id).toBe("task-identity:thread-1:native-child");
+    expect(duplicateActivity?.id).toBe(activity?.id);
+    expect(activity?.kind).toBe("task.updated");
+    expect(activity?.payload).toMatchObject({
+      taskId: "native-child",
+      parentAgentId: "native-parent",
+      model: "gpt-5.6-luna",
+      effort: "low",
+    });
+    expect(activity?.payload).not.toHaveProperty("status");
+  });
+
   it("splits combined progress and usage into their independent snapshots", () => {
     const event = {
       ...base,

apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts

@@ -346,6 +346,8 @@ function taskLinkageActivityFields(payload: Record<string, unknown>): Record<str
     "outputFile",
     "agentPath",
     "timelineBypass",
+    "agentSource",
+    "cancellationOwner",
     "typedUsage",
     "status",
     "error",
@@ -642,9 +644,16 @@ export function runtimeEventToActivities(
     }
 
     case "task.updated": {
+      const activityId =
+        event.raw?.method === "collabAgent/metadata"
+          ? EventId.make(`task-identity:${event.threadId}:${event.payload.taskId}`)
+          : event.eventId;
       return [
         {
-          id: event.eventId,
+          // Provider spawn metadata may arrive after terminal lifecycle and
+          // may be repeated by item/started + item/completed. Keep one
+          // independently retained identity snapshot per native child.
+          id: activityId,
           createdAt: event.createdAt,
           tone: event.payload.status === "failed" ? "error" : "info",
           kind: "task.updated",
@@ -2062,6 +2071,7 @@ const make = Effect.gen(function* () {
   return {
     start,
     drain: worker.drain,
+    ingestRuntimeEvent: (event) => worker.enqueue({ source: "runtime", event }),
   } satisfies ProviderRuntimeIngestionShape;
 });