Flow-Next Files

Teams that route implementation to another model over a CLI bridge get the same thing they already get in host: one owner that holds the whole task and decides its own delegation. Before this release, pinning implementer: to a model reached only by codex exec was silently ignored by the worker, and when a bridge was prompted by hand the child was forbidden from committing and from fanning out, so a long task became a chain of host-inserted returns and re-briefs. Now the worker hands the task to the bridged child, the child checkpoints and parallelizes under the same license the in-host worker holds, and the worker reviews the child's commit range before the normal review and gates.

Changed

• The bridged implementer owns the task, including its own fan-out. When a project's routing block pins the implementer tier to a model the harness reaches only over a CLI bridge, the worker now hands the task to that child instead of implementing on the session model. The worker keeps what needs judgment (the persisted base, the range review against every acceptance criterion, the focused gates, review dispatch, flowctl done) and skips what would only be done twice (its own investigation and any worker-side scouting). The child gets a pointer prompt of identities and rails plus the usage guide's long-task brief, which now bans only a nested bridge and carries the judicious-subagent license, so the child decides its own parallelization exactly as an in-host worker does. The conductor never bridges. worker.md Phase 1b, an optional IMPLEMENTER: <model> at <effort> line in the step 3c dispatch for in-the-moment overrides, and a stage: implement - ran (model: ...; delegated: <n>) line in the done summary so a reviewer sees who implemented and how many subagents the child dispatched. "Never spawn another agent" was a widening that shipped in 5.3.0's follow-up (#436) with no requirement behind it; it is retired, and a bug memory entry records how three checks missed it.
• A bridged implementer may commit checkpoints on its branch. The bridge safety rule used to say the child never commits and the host keeps git, which left a one-task spec on a codex exec bridge with two bad shapes: one multi-hour run ending in a single uncommitted diff, or host-inserted returns with a timebox that taught the implementer to return partial (one task took 19 dispatches). The rule now reads: the child writes code and may commit checkpoints on the branch the host names; it still never pushes, never rebases or rewrites history, never decides scope, never issues a review verdict, and never spawns a nested bridge; the host keeps push, review, flowctl done, task state, and any history rewrite, and reviews the child's commit range from the recorded base on return. The usage guide carries the timebox-free long-task brief and names the sandbox fallback: codex workspace-write keeps .git/ read-only, so a checkpointing child runs danger-full-access inside the asserted repo root, or the host commits between one-run-per-scope-unit dispatches. Thanks to @DanielKillenberger for the report (#431) and for the diagnosis in [#437] that the worker never consulted the implementer tier.
• The July Codex caveats are retired into dated watches. The codex reach page, the platforms note, and the usage guide's self-bridge line no longer say that subagent model steering is unreliable or that a bridged child must stay flat. Steering works on both the role path and the explicit-parameter path since codex-cli 0.146.0 (fn-98, measured from the child rollout), with the precedence rule and the two dispatch gotchas stated where a user sets them. The child fan-out caveat becomes a watch: openai/codex#33267 is still open upstream and reported on codex-cli 0.144 to 0.145 with the gpt-5.6 family; its own minimal repro ran clean three of three on codex-cli 0.153.4 on 2026-09-14, and zero decode errors appeared across the month's seventeen exec-originated spawning runs and twenty-three spawning child threads. No other harness carries a new restriction. Watch spec fn-98 is closed against this release; its read-only-guarantee items stay open work.
• Strategy and standing criteria guard the owner's license. STRATEGY.md gains the design principle "The owner holds the license": whoever implements owns delegation, wrappers and conductors never fan out on the implementer's behalf, and safety rules bound push, history rewrite, scope, verdict, and nested bridges, never the owner's own delegation. .flow/criteria.md gains G3, judged by completion review on every spec: a change to any implementer brief, worker dispatch prose, or subagent license keeps the owner's delegation intact, and a never-list is diffed clause by clause against the spec that asked for it.