feat: 使用 Codex 原生能力编排 Luna

README.md

@@ -58,6 +58,8 @@ The native Luna choice is scoped to the requested work. `ds_model_defaults` stor
 
 You can also set one model for a group of delegates in ordinary language: “Use GPT-5.6 Luna for all workers in this task” makes every subsequently created delegate in that task a native Luna subagent; “Use Go GLM 5.3 Flash for all workers in this task” applies that external selection to each new OpenCode worker without changing the machine default. Existing workers keep their original model and must be replaced when the selection changes. “All workers” is task/thread scoped unless you explicitly say “future/global/all new workers”; native Luna still cannot be persisted through `ds_model_defaults`.
 
+Luna does not need OpenCode to support ordinary correction loops or isolated coding. Codex can retain a native subagent within the current task, queue or send follow-ups through the host's native coordination controls, wait or interrupt it, and assign it a host-managed or controller-prepared Git worktree. These are Codex orchestration capabilities, not Luna model features. Cross-task/restart discovery of controller state, OpenCode context forks, external-provider accounting and persisted `task_spec` verification remain reasons to choose the plugin's OpenCode worker.
+
 [OpenAI documents GPT-5.6 Luna](https://developers.openai.com/api/docs/models/gpt-5.6-luna) as a cost-sensitive, high-volume model. Published API prices do not establish how a Codex plan meters native subagent usage, so this project does not claim a fixed Luna saving without a matched Codex measurement.
 
 For the OpenCode worker lane, without saved machine preferences, the built-in default remains `opencode-go/deepseek-v4.1-flash` with `max` reasoning. `ds_check` and `ds_spawn_agent` accept:
@@ -160,7 +162,7 @@ For native Luna, Codex sends a bounded task and the necessary repository context
 
 ### Route by task complexity
 
-Choose the route from reasoning, risk, and exploration/verification burden, not line or file counts. **Small** known edits that take a few minutes stay with Codex. **Medium** mechanical work with clear acceptance criteria prefers delegation: use Codex-native `gpt-5.6-luna` for bounded, low-risk native subtasks when available. Prefer the DeepSeek/GLM OpenCode worker when persistent sessions, isolated worktrees, queued corrections/follow-ups, forks, or persisted verification materially matter, because Luna does not provide that plugin-managed lifecycle. **Large or high-risk** work — state machines, concurrency, permissions, transactions, migrations — may delegate only bounded labor to either lane; Codex must first fix the design, interfaces, invariants, failure semantics and acceptance cases, then review the actual diff and run independent verification. A worker's self-report or passing self-tests are never acceptance. An explicit per-task or fleet-wide model/lane choice overrides these defaults; capability conflicts must be reported, and failures never authorize a silent cross-lane fallback.
+Choose the route from reasoning, risk, and exploration/verification burden, not line or file counts. **Small** known edits that take a few minutes stay with Codex. **Medium** mechanical work with clear acceptance criteria prefers delegation: use Codex-native `gpt-5.6-luna` for bounded, low-risk native subtasks when available, including task-scoped correction loops and isolated worktree execution managed by Codex. Prefer the DeepSeek/GLM OpenCode worker when the user selects it or the task materially needs cross-task/restart discovery, controller-persisted state, OpenCode context forks, external-provider usage accounting, or persisted `task_spec` verification. **Large or high-risk** work — state machines, concurrency, permissions, transactions, migrations — may delegate only bounded labor to either lane; Codex must first fix the design, interfaces, invariants, failure semantics and acceptance cases, then review the actual diff and run independent verification. A worker's self-report or passing self-tests are never acceptance. An explicit per-task or fleet-wide model/lane choice overrides these defaults, and failures never authorize a silent cross-lane fallback.
 
 A 2026-09-15 pilot paired one direct and one delegated DeepSeek execution per size from the same commit: [task routing pilot](./docs/task-routing-pilot-2026-09-15.md). It did not test Luna. It ran one execution per cell in parallel without alternating order, so it is not the repeated benchmark the queen protocol asks for, and its numbers neither generalize nor promise a fixed saving. In that pilot, delegated worker non-cached input plus output was 13.78% below the three direct runs, while the controller's own interval was 55.41% below the direct proxy total; the controller interval also covers managing the direct Codex control arm and reviewing both runs, so it is not a pure delegation bill. Worker totals including cached reads were higher than direct totals, so combined tokens and latency can still increase; medium and large worker usage is marked incomplete.
 

README.zh-CN.md

@@ -58,6 +58,8 @@ Luna 选择只作用于本次要求的工作。`ds_model_defaults` 只保存 Ope
 
 也可以直接给一组工蜂统一指定模型。例如“当前任务所有工蜂都用 5.6 Luna”，表示从这条指令之后，本任务新建的每个工蜂都走 Codex 原生 Luna；“本次全部工蜂使用 Go GLM 5.3 Flash”则让本任务新建的 OpenCode Worker 统一使用该模型，但不改本机默认值。已经创建的工蜂保持原模型，需要换模型时应新建替代工蜂。“所有工蜂”默认只作用于当前任务或当前 Codex 会话；只有明确说“以后 / 全局 / 所有新执行者”才表示持久偏好，而且 Luna 仍不能通过 `ds_model_defaults` 持久化。
 
+普通纠错循环和隔离编码不需要为了 Luna 再经过 OpenCode。Codex 可以在当前任务内保留原生子 Agent，使用宿主原生协调能力排队或发送追加消息、等待或中断，并把 Luna 分配到宿主管理或 Codex 预先创建的 Git worktree。这些属于 Codex 编排能力，不是 Luna 模型能力。只有需要跨任务/重启发现控制器状态、OpenCode 上下文 fork、外部 Provider 用量记录或持久化 `task_spec` 验收时，才应因为生命周期能力优先 OpenCode Worker。
+
 [OpenAI 官方将 GPT-5.6 Luna 定位为面向成本敏感、高吞吐工作负载的模型](https://developers.openai.com/api/docs/models/gpt-5.6-luna)。公开 API 价格不能直接证明 Codex 套餐如何计算原生子 Agent 用量，因此本项目不会在缺少同条件 Codex 实测时承诺固定节省比例。
 
 对于 OpenCode Worker 通道，未保存本机偏好时，内置默认是 `opencode-go/deepseek-v4.1-flash`，推理档位 `max`。`ds_check` 和 `ds_spawn_agent` 可以传入：
@@ -167,7 +169,7 @@ npm --prefix plugins/deepseek-code-agent run test:live
 
 ### 按任务复杂度路由
 
-路由依据判断量、风险以及探索与验证负担，而不是行数或文件数。**小型**已知改动几分钟可完成，由 Codex 直接处理；**中型**机械实现且验收标准清晰时优先委派：范围明确、风险较低的原生子任务可优先使用 `gpt-5.6-luna`。任务确实需要持久会话、独立 worktree、纠错/追加消息队列、fork 或持久化验收时，优先使用 DeepSeek/GLM OpenCode Worker，因为 Luna 不提供这套插件生命周期。**大型或高风险**任务（状态机、并发、权限、事务、迁移等）只能把边界明确的劳动交给任一通道，Codex 必须先确定设计、接口、不变量、失败语义和验收案例，再审查实际 diff 并独立验证。绝不按 Worker 自报或自测通过来接受；用户对本次或全部工蜂的明确模型选择优先于自动路由，能力冲突必须如实说明，任何失败都不能触发静默跨通道降级。
+路由依据判断量、风险以及探索与验证负担，而不是行数或文件数。**小型**已知改动几分钟可完成，由 Codex 直接处理；**中型**机械实现且验收标准清晰时优先委派：范围明确、风险较低的原生子任务优先使用 `gpt-5.6-luna`，当前任务内的连续纠错、消息队列和由 Codex 管理的独立 worktree 也可以继续走 Luna。用户明确选择 DeepSeek/GLM，或任务确实需要跨任务/重启发现、控制器状态落盘、OpenCode 上下文 fork、外部 Provider 用量记录或持久化 `task_spec` 验收时，再优先 OpenCode Worker。**大型或高风险**任务（状态机、并发、权限、事务、迁移等）只能把边界明确的劳动交给任一通道，Codex 必须先确定设计、接口、不变量、失败语义和验收案例，再审查实际 diff 并独立验证。绝不按 Worker 自报或自测通过来接受；用户对本次或全部工蜂的明确模型选择优先于自动路由，任何失败都不能触发静默跨通道降级。
 
 2026-09-15 的 pilot 在同一基线 commit 上为每个规模各做了一次 Codex 直接执行与委派 DeepSeek 执行：[任务分级 pilot](./docs/task-routing-pilot-2026-09-15.md)。它没有测试 Luna。每格仅一次、双臂并行、顺序未交替，因此它不是 queen 协议要求的三次重复正式基准，结果不能推广，也不承诺固定节省。该 pilot 中，worker 非缓存输入加输出合计比三次 direct 低 13.78%，controller 自身区间的 proxy 比 direct proxy 合计低 55.41%；controller 区间也包含管理 Codex 直接执行对照组和审查两组结果，不能当作纯委派账单。计入缓存后 worker total 高于 direct total，总 Token 和耗时仍可能增加；medium 和 large 的 worker 用量标记为不完整。
 

plugins/deepseek-code-agent/.codex-plugin/plugin.json

@@ -33,7 +33,7 @@
     ],
     "defaultPrompt": [
       "Use Codex-native GPT-5.6 Luna with maximum reasoning for this bounded implementation; do not use OpenCode or external credentials.",
-      "Use GPT-5.6 Luna with maximum reasoning for all new workers in this task.",
+      "Use GPT-5.6 Luna with maximum reasoning for all new workers in this task, reusing native follow-ups and isolated worktrees where useful.",
       "Use DeepSeek or GLM to implement this coding goal, then review and verify its patch.",
       "Set OpenCode Go GLM 5.3 Flash with maximum reasoning as my machine default for new coding workers.",
       "Show the current OpenCode worker default and inspect the active coding agent."

plugins/deepseek-code-agent/README.md

@@ -29,6 +29,8 @@ For a bounded, low-risk native task, ask Codex to “use the native GPT-5.6 Luna
 
 A fleet-scoped request can select one model for every new delegate in the current task or Codex thread. For example, “use GPT-5.6 Luna for all workers in this task” routes every subsequently created delegate to native Luna/max, while “use Go GLM 5.3 Flash for all workers in this task” applies that OpenCode selection without changing the machine default. Existing workers retain their original model and must be replaced to change it. “All workers” is not machine-global unless the user explicitly says “future/global/all new workers”; Luna cannot be persisted through `ds_model_defaults`.
 
+Luna does not need OpenCode for an ordinary correction loop or isolated coding. Codex can retain a native subagent for the current task, queue or send follow-ups through native coordination controls, wait or interrupt it, and assign it a host-managed or controller-prepared Git worktree. Those are Codex orchestration capabilities, not Luna model features. Cross-task/restart discovery, persisted controller state, OpenCode context forks, external-provider accounting and persisted `task_spec` verification remain reasons to choose the OpenCode worker.
+
 [OpenAI describes Luna](https://developers.openai.com/api/docs/models/gpt-5.6-luna) as cost-sensitive and high-volume. API list prices are not a promise about native Codex plan metering, and this project has not benchmarked the Luna lane.
 
 For the persistent OpenCode worker lane, the built-in default is `opencode-go/deepseek-v4.1-flash` with variant `max`; a saved machine preference takes precedence. Pass `model="glm-5.3-flash"` for Go GLM, or `provider="deepseek"` for official `deepseek-flash`. `deepseek-v4-pro` and other models in the selected provider's OpenCode catalog are also supported. The saved model pair inherits its saved variant; a different selected provider/model pair defaults to `max` when no variant is supplied; an explicit `variant=null` removes the override for that request.
@@ -52,7 +54,7 @@ The live test makes a small request to the selected model in a temporary Git rep
 
 ## Routing expectation
 
-Route by judgment, risk, and exploration/verification burden, not line counts. Small known edits that take a few minutes stay with Codex. Medium mechanical work with clear acceptance criteria prefers delegation: use native `gpt-5.6-luna` for bounded low-risk subtasks when available. Prefer the DeepSeek/GLM OpenCode lane when persistent sessions, isolated worktrees, queued corrections/follow-ups, forks, or persisted verification materially matter, because native Luna does not provide that plugin-managed lifecycle. Large or high-risk work (state machines, concurrency, permissions, transactions, migrations) may delegate only bounded labor to either lane; Codex first decides the design, interfaces, data flows, invariants, failure semantics and acceptance examples, then reviews the actual diff and runs independent verification. Worker self-reports and passing self-tests are never acceptance. An explicit per-task or fleet-wide model choice overrides these defaults; capability conflicts must be reported, and lane failures never cause silent fallback.
+Route by judgment, risk, and exploration/verification burden, not line counts. Small known edits that take a few minutes stay with Codex. Medium mechanical work with clear acceptance criteria prefers delegation: use native `gpt-5.6-luna` for bounded low-risk subtasks when available, including task-scoped correction loops and isolated worktree execution managed by Codex. Prefer the DeepSeek/GLM OpenCode lane when the user selects it or the task materially needs cross-task/restart discovery, controller-persisted state, OpenCode context forks, external-provider accounting, or persisted `task_spec` verification. Large or high-risk work (state machines, concurrency, permissions, transactions, migrations) may delegate only bounded labor to either lane; Codex first decides the design, interfaces, data flows, invariants, failure semantics and acceptance examples, then reviews the actual diff and runs independent verification. Worker self-reports and passing self-tests are never acceptance. An explicit per-task or fleet-wide model choice overrides these defaults, and lane failures never cause silent fallback.
 
 Codex decides the design, interfaces, invariants and acceptance cases. A native Luna subagent receives one bounded task; a persistent OpenCode worker can additionally use the plugin's worktree, correction and verification lifecycle. Codex reviews the actual patch from either lane. After two unsuccessful OpenCode review correction rounds it may take over, after confirming the worker and verification have stopped.