hierarchical-codex
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CODEX_MISSION_LEDGER_DB | No | Path to the SQLite database file used by the control plane. | |
| CODEX_MISSION_LEDGER_HOME | No | Base directory for mission ledger state. Defaults to a project-local or user-global data directory. | |
| CODEX_MISSION_LEDGER_ARTIFACTS | No | Directory for content-addressed artifact storage. | |
| CODEX_MISSION_LEDGER_EVENT_PAGE_SIZE | No | Page size for audit event listing. | |
| CODEX_MISSION_LEDGER_MAX_LEASE_SECONDS | No | Maximum allowed lease duration in seconds. | |
| CODEX_MISSION_LEDGER_MAX_ARTIFACT_BYTES | No | Maximum size in bytes for artifact storage and reads. | |
| CODEX_MISSION_LEDGER_DEFAULT_LEASE_SECONDS | No | Default lease duration in seconds for worker leases. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| mission_createA | Create the durable mission record before spawning agents. strategy is locked at create (default fanout). directorPlan is required only for director_plan: a workspace-relative .md path to the plan file Sol wrote in the project folder. Forbidden otherwise. |
| mission_getA | Read a mission and optionally its task, artifact, claim, and review state. Treat this result as authoritative over chat summaries. The mission row includes strategy, portrait, and directorPlan (workspace-relative plan file path) even when includeDetails is false. |
| mission_closeA | Complete a mission only after every task is terminal. Failed tasks require an explicit acceptance decision. |
| task_allocateB | Allocate a policy-checked work package before native spawn_agent. Put the returned task_id into the child's prompt. Root role depends on mission.strategy: fanout/director_plan/pipeline require Terra; direct allows one root Luna. fanout Terra objective max 2000 characters. |
| task_getC | Read the authoritative task version, lease, assignment, inputs, budget, and status before mutating it. |
| children_statusA | Read direct children of a coordinator task as compact status rows (ids, status, version, summary, leaseExpired). Call once after wait_agent. Do not poll with task_get. If leaseExpired, cancel instead of waiting again. |
| task_claimB | Atomically claim a ready task using optimistic versioning. The returned lease token is required for worker mutations. |
| task_startC | Move a leased task to running and establish its result producer. |
| task_heartbeatA | Renew an active lease. Use this during long tool calls; an expired lease may be reclaimed by another worker. |
| task_releaseA | Return a leased/running/blocked task to ready when the current worker cannot continue. Include a concrete reason. |
| task_blockC | Record a blocking dependency while retaining the lease. Continue heartbeats or release the task. |
| task_failA | Record a definitive worker failure, clear its lease, and charge final usage. Future sibling allocation counts actual failed usage instead of the full reservation. |
| task_cancelA | Cancel a non-terminal task after its direct children are terminal. Child cancellation requires the running direct parent's version and lease token. |
| task_supersedeB | Link a failed task to a viable sibling replacement for audit and closure. Child supersession requires direct-parent authority. |
| task_set_effortA | Change model reasoning effort while a task is ready and unleased, within its recorded maximum. Child changes require direct-parent authority. |
| artifact_putA | Store bounded content in the content-addressed artifact store. Required fields are taskId, actorId, kind, mimeType, content, encoding, and idempotencyKey. Do not send missionId. Return artifact references instead of copying large content into agent messages. |
| artifact_getA | Read a bounded prefix of an artifact by ID. Prefer targeted retrieval over loading full artifacts. |
| result_submit_candidateA | Submit a worker result as candidate only. This closes the producer lease; a different reviewer must check it. artifactRefs must belong to this taskId — call artifact_put on the same task first, and do not attach child-task artifacts. Include actual usage when known. summary max 500 characters. |
| result_checkA | Independently check a candidate. The reviewer cannot be the producer. Luna verifiers call this on review_target_task_id without claiming. Rejection returns the task to ready. |
| result_verifyC | Apply the second evidence gate to a checked result. Approval produces verified, not committed. |
| task_commitB | Commit a verified task after every direct child is terminal. This may unlock dependent tasks. |
| results_gate_and_commitA | For low or medium risk only, record check and verify reviews then commit in one call. Does not skip gates. High or critical work must use luna-verifier plus result_check, result_verify, and task_commit. Children must already be candidate. On a direct mission, Sol (not the Luna producer) may be the reviewer without parentTaskId. |
| budget_reportA | Atomically add token, cost, wall-time, and tool-call usage to a mission and optionally a task. Hard limits are enforced. |
| recovery_snapshotA | Read durable mission state and a bounded audit-event page after interruption, compaction, or client restart. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 24 tools
The tools are grouped by resource (mission/task/artifact/result) and most have clear roles, but several lifecycle transitions overlap: task_release, task_fail, task_cancel, and task_supersede all end or abandon work in subtly different ways, and result_check, result_verify, and results_gate_and_commit represent closely related review stages. Descriptions help, but an agent could still misselect the wrong transition for a given task state.
The dominant verb_noun pattern (task_claim, task_start, mission_create, artifact_put) is consistent and predictable across the set. Minor exceptions like recovery_snapshot, children_status, and results_gate_and_commit break the pattern slightly but remain readable and understandable.
24 tools is at the high end and feels heavy, even for a hierarchical orchestration server. The count is justified by the broad lifecycle, but several review/commit and task-failure tools could plausibly be consolidated to reduce selection overhead.
The tool set covers the full mission/task lifecycle, artifact storage, result verification gates, budget accounting, cancellation, failure handling, supersession, and recovery. Minor gaps remain, such as no general mission/task listing or dedicated result retrieval endpoint, but the core workflow has no obvious dead ends.