[0design]

Workflow generation and human review need distinct execution paths. This unreleased candidate adds an explicit independent-operator Codex route for YAML model steps while keeping current-agent caller jobs unchanged. The workflow records its exact credential-free provider identity, reserves unknown subscription cost before executable probes, requires a null USD budget, zero retries and a bounded deadline, and rejects agent-origin execution or model tool activity. An interrupted attempt is held for reconciliation.

Remote human review binds the enrolled reviewer/provider, complete prepared subject, signed decision, shared workflow lease and exact continuation checkpoint. A model result cannot decide that gate. Bounded typed inputs are tied to their source event; reusing an event with changed input refuses. A person can STOP an interrupted native run using a fresh exact snapshot and a verified dead lease. Gate/receipt/checkpoint and uncertain external effect information remain durable; publication is never blindly retried. Incomplete starts and legacy recovery claims remain held.

Validation: source-pinned CI passes 1732/1732 tests and the exact downloadable Registry export/install checks on b15dd1d. The CI Core53 archive matches the local candidate byte-for-byte. Independent bounded review initially found an optional/non-fsynced reservation and a persisted-provider override. Both are fixed and independently closed: a concrete RunStore flushes the exact reservation and directory entries before probes, and a different configured identity is refused. Missing store, four injected file/directory flush failures, provider changes and a positive durable binding are covered by focused disposable fixtures.

The initial local full-suite run preserved inherited agent-session guards, so its positive authority fixtures could not decide gates; those controls were not weakened or cleared. Raw historical failures remain separate from the final CI result.

All model/authority/effect checks use new disposable fixture roots, identities, executable stubs, keys and simulated transports/terminals. Real model use, operator enrollment, downstream Telegram/platform integration and product acceptance are not claimed. Installed runtimes and public Registry release pointers remain unchanged. The native Codex capability is distinct from accepted llm-call-cli; this PR does not create Registry component acceptance or activate a scheduler.