Route Codex bridge launches through Limen

[Yehonal]

Summary

• Route unqualified Codex bridge launches through the authored Limen developer profile and remove the static gpt-5.6-terra/high pin.
• Preserve fail-open startup when Limen is unavailable or fails, with explicit unavailable-route provenance and no invented fallback model.
• Append versioned bridge launch events, resolve a new Codex thread ID after the first confirmed send, and write that runtime UUID into the session graph.
• Register known runtime UUIDs immediately when resuming an existing Codex thread.

Default profile

developer is the default because a generic Codex bridge session is implementation-oriented. Callers can still select another authored role profile explicitly. Model and effort are accepted only from Limen routing or explicit caller inputs; the bridge does not synthesize a substitute when routing is unavailable.

Launch record

Events use append-only JSONL with schema agent-mesh.bridge-launch-event.v1. A launch.started event records bridge origin, launch ID, agent, tmux target, role profile, routed model and effort, cwd, launch time, caller, route status, and a known thread ID when resuming. A later launch.thread_resolved event adds the Codex thread ID after an exact read-only state-store match. Ambiguous matches are recorded rather than guessed.

Graph diagnosis

A read-only check found that the graph had received new nodes again on September 15. The reproducible gap was that those nodes still had a null runtime UUID, and resume did not register the known UUID. This change addresses that provenance gap without claiming an unverified event-writer outage.

Verification

• npm run verify
• tmux bridge capacity and routing suite: 23/23
• launch-record Python suite: 3/3
• strict-ready suite: 4/4
• graph bridge integration: 1/1
• shell syntax and ShellCheck: clean

No runtime rollout, live-session change, install, or merge was performed.