Agentic orchestrator for parallel coding agents — plans tasks, spawns agents, and autonomously handles CI fixes, merge conflicts, and code reviews.
Go to file
Ashish Huddar 8d0c53ec1d
fix(codex): reliable activity signals — session-flag hooks, trust bypass, no_signal watchdog (#170)
* fix(codex): deliver activity hooks via -c session flags, trust worktree at launch

Codex (0.136+) never loads hook config from AO's per-session worktrees:
project-local .codex/ layers only load from trusted directories, and for
linked git worktrees codex sources hook declarations from the matching
folder in the root checkout — so the workspace-local .codex/hooks.json AO
wrote was dead config and codex sessions never reported activity.

Deliver the hooks on the launch/resume command instead:
- -c 'hooks.<Event>=[...]' session-flag config for SessionStart,
  UserPromptSubmit, PermissionRequest, and Stop; the session-flags layer
  is not trust-gated and aggregates with the user's own hooks. The
  existing --dangerously-bypass-hook-trust flag lets them run without a
  persisted trust hash.
- -c 'projects={"<worktree>"={trust_level="trusted"}}' (inline-table
  form; the dotted projects."<path>".trust_level key is corrupted by
  codex's naive -c dot-split) so spawns into never-trusted repos don't
  hang invisibly on the interactive directory-trust prompt. Both the
  literal and symlink-resolved worktree paths are trusted.
- -c notice.hide_rate_limit_model_nudge=true so the "switch to a cheaper
  model?" dialog can't hang a headless pane and swallow the spawn prompt.

GetAgentHooks no longer writes workspace files (worktrees stay clean); it
only strips entries older AO versions left in .codex/hooks.json,
preserving user hooks. UninstallHooks/AreHooksInstalled now operate on
those legacy files only.

Verified with a real spawn into a fresh untrusted repo: activity
transitions idle -> active -> idle hands-free, no .codex dir in the
worktree, no hook delivery failures.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(sessions): activity-signal watchdog + hook delivery hardening

A codex upgrade broke activity tracking silently: sessions showed a
confident "idle" forever while the agent worked. This bundle makes hook
delivery verifiable end to end and makes any future breakage loud
instead of invisible.

Watchdog (no_signal status):
- sessions.first_signal_at (migration 0010) records the FIRST hook
  callback per spawn/restore — raw signal receipt, independent of the
  derived activity state. lifecycle.ApplyActivitySignal stamps it (and
  writes through same-state repeats until stamped, e.g. Codex
  SessionStart reporting idle on an idle-seeded row); MarkSpawned clears
  it so every relaunch re-proves its hook pipeline.
- deriveStatus downgrades a live session with no receipt to the new
  no_signal display status after a 90s grace, instead of idle.
  Terminated/PR-derived statuses still win. The sessions CDC update
  trigger now also fires on first-signal receipt so the dashboard
  transition is pushed live.
- frontend maps no_signal -> needs_you (a human should look at the pane).

Hook callback hardening (re-landed from the closed redesign PR #156):
- the session manager pins each spawned session's PATH with the daemon
  executable's directory first, so the bare `ao` in hook commands
  resolves to the daemon that installed them, with a spawn-time warning
  when the pin cannot apply.
- `ao hooks` failures append to $AO_DATA_DIR/hooks.log (size-capped);
  `ao doctor` gains a hooks-log check that warns on failures from the
  last 24h, and an ao-binary identity check.

Codex launch-surface canary:
- `ao doctor` gains codex-launch-flags: it runs probes exported by the
  codex adapter (built from the same flag builders as the real spawn
  argv) against the installed binary, warning when codex rejects the
  hook-trust bypass flag or AO's -c session-flag overrides.
- codex hook callback timeout drops 30s -> 5s so a hung daemon cannot
  stall the agent's turn.

Docs: the agent PRD callback section now describes the implemented flow
(derive state, POST /sessions/{id}/activity, hooks.log) instead of the
unbuilt SQLite/metadata merge, and notes that hook-derived metadata
persistence (codex resume) is still not implemented.

Frontend note: main's renderer test suite has 7 pre-existing failing
files and a vite-config typecheck error unrelated to this change;
workspace.test.ts (the only frontend file touched) passes 26/26.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(store): restore TestSessionWorktreesRoundTrip lost in the re-landing port

The branch ported store_test.go wholesale from the closed redesign
branch, whose copy predates #165 — silently dropping the
session-worktrees round-trip test #165 added. Restore main's file and
re-apply only this branch's addition (TestSessionFirstSignalRoundTrip).
No other ported file lost main-side content (audited per-file against
main; the remaining deletions are this branch's intended refactors).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(status): only derive no_signal for harnesses that have a hook pipeline

Review finding: the no_signal downgrade had no harness-capability gate, but
first_signal_at can only ever be stamped by an `ao hooks` callback. Ten
spawnable harnesses (amp, aider, crush, grok, kimi, devin, auggie, continue,
vibe, pi) install no hooks at all, so every live session of theirs would have
flipped from idle to a permanent no_signal -> needs_you after the 90s grace.

The session service now takes a SignalCapable predicate; daemon wiring injects
activitydispatch.SupportsHarness (the deriver registry is the source of truth
for "this harness can signal"). Left nil, the service never claims no_signal.
A new dispatch test pins that every deriver token is a known harness name.

Also from the same review:
- lifecycle/manager.go and the 0010 migration claimed Codex's SessionStart
  reports idle as the first signal; both codex and claude-code derivers
  deliberately return no signal for session-start, so the comments now cite a
  real case (a lost "active" POST followed by a Stop hook landing idle).
- docs/agent/README.md documents the gate and the restore caveat: a restored
  session the user never prompts has nothing to signal, so it shows no_signal
  after the grace until a receipt-only session-start signal exists.
- 0010 migration uses DROP TRIGGER IF EXISTS per house style.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-06-11 10:36:45 +05:30
.github/workflows feat(frontend): scaffold for frontend with complimentary backend changes (#168) 2026-06-10 11:40:17 +05:30
backend fix(codex): reliable activity signals — session-flag hooks, trust bypass, no_signal watchdog (#170) 2026-06-11 10:36:45 +05:30
docs fix(codex): reliable activity signals — session-flag hooks, trust bypass, no_signal watchdog (#170) 2026-06-11 10:36:45 +05:30
frontend fix(codex): reliable activity signals — session-flag hooks, trust bypass, no_signal watchdog (#170) 2026-06-11 10:36:45 +05:30
test/cli chore: add prettier config and CI auto-formatter (#166) 2026-06-10 09:09:17 +05:30
.envrc Add agent adapters and wire per-session agents into the session manager (#65) 2026-06-02 16:51:32 +05:30
.gitignore feat(frontend): scaffold for frontend with complimentary backend changes (#168) 2026-06-10 11:40:17 +05:30
.prettierignore chore: add prettier config and CI auto-formatter (#166) 2026-06-10 09:09:17 +05:30
.prettierrc chore: add prettier config and CI auto-formatter (#166) 2026-06-10 09:09:17 +05:30
AGENTS.md chore: add prettier config and CI auto-formatter (#166) 2026-06-10 09:09:17 +05:30
CLAUDE.md feat(frontend): scaffold for frontend with complimentary backend changes (#168) 2026-06-10 11:40:17 +05:30
DESIGN.md feat(frontend): scaffold for frontend with complimentary backend changes (#168) 2026-06-10 11:40:17 +05:30
README.md chore: add prettier config and CI auto-formatter (#166) 2026-06-10 09:09:17 +05:30
flake.lock Add agent adapters and wire per-session agents into the session manager (#65) 2026-06-02 16:51:32 +05:30
flake.nix Add agent adapters and wire per-session agents into the session manager (#65) 2026-06-02 16:51:32 +05:30
package-lock.json feat: ao session claim-pr + spawn --claim-pr wiring (#101) 2026-06-06 00:01:03 +05:30
package.json chore: add prettier config and CI auto-formatter (#166) 2026-06-10 09:09:17 +05:30

README.md

ReverbCode

A Go-backed agent orchestration daemon for supervising parallel coding-agent
sessions, with an ao CLI today and an Electron supervisor planned. The Go
module and packages remain agent-orchestrator; "ReverbCode" is the public name.

See docs/architecture.md for the backend mental model
and AGENTS.md for the contributor / worker contract.

What's shipped today

  • Loopback-only HTTP daemon (backend/internal/httpd) controlling projects,
    sessions, orchestrators, and hook callbacks over 127.0.0.1.
  • ao Cobra CLI (backend/cmd/ao) — a thin client over the daemon for daemon
    control, project/session/orchestrator management, and worker spawning.
  • Worker/orchestrator spawn into isolated git worktree workspaces, launched
    inside a zellij runtime adapter.
  • Live per-PR observation via the provider-neutral SCM observer
    (backend/internal/observe/scm/): polling loop, ETag guards, semantic
    diffing, CI/check/review-thread tracking, and lifecycle nudges for CI
    failures, review feedback, and merge conflicts.
  • Agent adapters under backend/internal/adapters/agent/: claude-code,
    codex, opencode, grok, cursor, qwen, copilot, kimi, plus
    shared activity-dispatch / hook utilities.
  • SQLite store (backend/internal/storage/sqlite/) with sqlc-generated
    queries, DB-triggered change-data-capture into change_log, and a CDC
    poller/broadcaster (backend/internal/cdc/) feeding in-process subscribers
    and an SSE replay endpoint.
  • Session lifecycle manager + reaper (backend/internal/lifecycle/,
    backend/internal/observe/reaper/): runtime/activity/PR facts reduced into
    the small durable session state, display status derived at read time.

Quick start

Requirements: Go 1.25+, zellij on PATH for the
runtime adapter, and gh (or GITHUB_TOKEN) if you want the SCM observer to
authenticate against GitHub. The SQLite driver is the pure-Go
modernc.org/sqlite — no system SQLite library is required.

cd backend
go build -o /tmp/ao ./cmd/ao

# Start the daemon and wait for /readyz.
/tmp/ao start

# Register a local git repo as a project. The id defaults to the lowercased
# base of --path; pass --id explicitly when the directory name doesn't match.
/tmp/ao project add --path /path/to/your/repo --id your-repo --name your-repo

# Spawn a worker session running the default agent.
/tmp/ao spawn --project your-repo --prompt "Refactor the auth module"

# Inspect what's running.
/tmp/ao status
/tmp/ao session ls

CLI surface

The CLI is intentionally thin: every product command resolves to a daemon HTTP
route. Run ao <command> --help for the authoritative flag shape; the table
below groups what's on main today.

Lane Command Purpose
Daemon ao start Start the daemon in the background and wait for /readyz.
Daemon ao stop Graceful shutdown via loopback POST /shutdown.
Daemon ao status Report PID/port/health/readiness from running.json.
Daemon ao daemon Hidden internal entrypoint used by ao start.
Project ao project add Register a local git repo as a project.
Project ao project ls List registered projects.
Project ao project get <id> Fetch one project.
Project ao project rm <id> Remove a project.
Session ao spawn Spawn a worker session in a registered project.
Session ao session ls List sessions (filter by project, include terminated).
Session ao session get <id> Fetch one session.
Session ao session kill <id> Terminate a session.
Session ao session rename <id> <name> Rename a session.
Session ao session restore <id> Relaunch a terminated session.
Session ao session cleanup Reclaim eligible workspaces for terminated sessions.
Session ao session claim-pr <session> <pr> Attach an existing PR to a session.
Orchestrator ao orchestrator ls List orchestrator sessions.
Messaging ao send Send a message to a running agent session.
Utility ao doctor Local health checks (config, data dir, DB, git, zellij).
Utility ao completion <shell> Generate bash/zsh/fish/powershell completions.
Utility ao version Print build metadata.
Internal ao hooks <agent> <event> Hidden adapter hook callback.

See docs/cli/ for the daemon-control intent and command shape.

Configuration

All configuration is env-driven; the daemon takes no config file. The bind
host is hard-coded to 127.0.0.1 — the daemon has no auth, CORS, or TLS, and
exposing it beyond loopback would be a security regression.

Var Default Purpose
AO_PORT 3001 Bind port; daemon fails fast if taken.
AO_REQUEST_TIMEOUT 60s Per-request timeout (Go duration).
AO_SHUTDOWN_TIMEOUT 10s Graceful-shutdown hard cap.
AO_RUN_FILE <UserConfigDir>/agent-orchestrator/running.json PID + port handshake path.
AO_DATA_DIR <UserConfigDir>/agent-orchestrator/data SQLite DB, WAL files, managed state.
AO_AGENT claude-code Default agent adapter id used by ao spawn.
AO_SESSION_ID (unset) Set inside spawned sessions; read by ao send and ao hooks.
GITHUB_TOKEN (unset) Used by the GitHub SCM and tracker adapters. Falls back to gh auth token.

Health check:

curl localhost:3001/healthz
curl localhost:3001/readyz

Architecture

The daemon is a long-running supervisor. Adapters observe external facts (PR
state, agent activity, runtime liveness); the lifecycle manager reduces those
into a small set of durable session facts (activity_state, is_terminated,
PR rows). Display status is derived from those facts at read time — it is
never stored. SQLite triggers append every user-visible change to change_log,
and the CDC poller broadcasts those events to in-process subscribers and an
SSE stream.

Full mental model and load-bearing rules: docs/architecture.md.
Package-by-package ownership: docs/backend-code-structure.md.

Testing

The local gate is the backend Go build and race-enabled test suite:

cd backend && go build ./... && go test -race ./...

GitHub Actions is the authoritative pre-merge gate; mirror its commands here
when in doubt. See AGENTS.md for the regen workflow when
touching the daemon API surface (npm run sqlc, npm run api).

Status and roadmap

Current main ships the CLI surface above, the SCM observer end-to-end
(issues #75,
#108,
#109), the agent
adapter platform, and the CDC pipeline with SSE replay. The Tracker observer
(#112) and live
pr_* event consumers (#110)
are in flight. The Electron supervisor under frontend/ is still a placeholder
shell — daemon logic stays in the Go backend.

Tracking milestone:
rewrite on GitHub.

Contributing

Repo layout and the worker contract live in AGENTS.md. Keep
changes surgical, follow the package boundaries documented in
docs/backend-code-structure.md, and prefer
adding daemon HTTP routes over leaking storage / runtime into the CLI.