Deployed a host-side monitor that removes pipeline waiting from Codex agent turns. After a pipeline is dispatched, the agent registers the exact provider run ID, full expected commit ID, thread, deadline, and execution profile. Registration verifies provider access and run identity before it suspends an active Goal.
A persistent systemd timer runs every five minutes. Its Python service queries Gitea Actions or Azure Pipelines without invoking a model. It starts one transient Codex continuation only after the exact run is terminal, the deadline expires, the run disappears for two checks, or the provider fails for three consecutive checks. A Goal changed by a user after registration is held and is not automatically reactivated.
/usr/local/sbin/codex-pipeline-monitor links to the reviewed profile repository source.codex-pipeline-monitor.service performs one bounded reconciliation.codex-pipeline-monitor.timer is enabled with a five minute interval and persistent catch-up./var/lib/codex-pipeline-monitor/watches.sqlite stores the bounded watch registry. It contains run metadata and no provider credentials.ProfileBackups/ax_julian/host/pipeline-monitor/.cadc02d2ff671ecf1e50e4fd7358334422b60ee6.184d06c.Gitea uses the existing repository-local HTTPS credential helper. Azure provider checks run through the Azure DevOps CLI using the PAT stored by az devops login in the ax_julian Azure profile. The monitor service reads that profile as ax_julian; Codex continuation identity remains the user and profile recorded by the registering thread. Provider credentials are fetched at check time and are not copied into the watch database or repository.
The headless host stores the PAT in Azure CLI fallback file storage because no desktop keyring is available. The Azure profile directory is mode 0700 and the PAT file is mode 0600, owned by ax_julian. Azure CLI owns credential removal through az devops logout --organization https://dev.azure.com/SkanAG.
00628e22b9ea1ba4a0edf61d9ff3ae5ffa0c940c aggregated 12 jobs and produced terminal result succeeded.terminal/succeeded and was deleted afterward.42a92ad258412dd8798f5cb3a44a1c5c5b206186 was read successfully through the stored PAT.terminal/succeeded without a Codex continuation.NoNewPrivileges and ProtectSystem restrictions.Disable and stop codex-pipeline-monitor.timer, remove the three installed symlinks under /usr/local/sbin and /etc/systemd/system, and reload systemd. Preserve watches.sqlite until every pending registration has been reconciled or intentionally canceled; deleting it would discard suspended-work ownership and terminal evidence.