feat(harness): Initial Codex Support

.github/workflows/ci.yaml

@@ -128,7 +128,7 @@ jobs:
             --set-string substrateWorkerPool.workerImage=ghcr.io/kagent-dev/substrate/ateom-gvisor:v${{ env.SUBSTRATE_VERSION }}
         run: |
           echo "Cache key: ${{ needs.setup.outputs.cache-key }}"
-          printf '%s\n' controller golang-adk claude-harness byo-a2a | xargs -P4 -n1 bash -c '
+          printf '%s\n' controller golang-adk claude-harness codex-harness byo-a2a | xargs -P4 -n1 bash -c '
             image="$1"
             DOCKER_BUILD_ARGS="--cache-from=type=gha,scope=${{ needs.setup.outputs.cache-key }}-e2e-${image} --cache-from=type=gha,scope=${{ env.CACHE_KEY_PREFIX }}-main-e2e-${image} --cache-to=type=gha,scope=${{ needs.setup.outputs.cache-key }}-e2e-${image},mode=max --platform=linux/amd64 --push" \
               make GIT_COMMIT=e2e BUILD_DATE=1970-01-01 "build-${image}"
@@ -150,6 +150,9 @@ jobs:
           CLAUDE_DIGEST=$(docker buildx imagetools inspect "localhost:5001/kagent-dev/kagent/claude-harness:${VERSION}" | awk '$1 == "Digest:" { print $2; exit }')
           test -n "$CLAUDE_DIGEST"
           export KAGENT_E2E_CLAUDE_IMAGE="localhost:5001/kagent-dev/kagent/claude-harness@${CLAUDE_DIGEST}"
+          CODEX_DIGEST=$(docker buildx imagetools inspect "localhost:5001/kagent-dev/kagent/codex-harness:${VERSION}" | awk '$1 == "Digest:" { print $2; exit }')
+          test -n "$CODEX_DIGEST"
+          export KAGENT_E2E_CODEX_IMAGE="localhost:5001/kagent-dev/kagent/codex-harness@${CODEX_DIGEST}"
           envsubst < core/test/e2e/manifests/lifecycle.yaml.tmpl | kubectl apply -f -
           for _ in $(seq 1 60); do
             READY=$(kubectl get agenttemplate smoke -n kagent -o jsonpath='{.status.harnesses[?(@.harness=="kagent")].conditions[?(@.type=="Ready")].status}')
@@ -411,6 +414,7 @@ jobs:
           - cli
           - golang-adk
           - claude-harness
+          - codex-harness
     runs-on: ubuntu-latest
     services:
       registry:

.github/workflows/image-scan.yaml

@@ -45,6 +45,9 @@ jobs:
           - build_target: claude-harness
             image_name: claude-harness
             tag_suffix: ""
+          - build_target: codex-harness
+            image_name: codex-harness
+            tag_suffix: ""
     runs-on: ubuntu-latest
     services:
       registry:

.github/workflows/tag.yaml

@@ -22,6 +22,7 @@ jobs:
           - kagent-adk
           - golang-adk
           - claude-harness
+          - codex-harness
     runs-on: ubuntu-latest
     permissions:
       contents: read

Makefile

@@ -56,16 +56,19 @@ KAGENT_ADK_IMAGE_NAME ?= kagent-adk
 GOLANG_ADK_IMAGE_NAME ?= golang-adk
 
 CLAUDE_HARNESS_IMAGE_NAME ?= claude-harness
+CODEX_HARNESS_IMAGE_NAME ?= codex-harness
 CONTROLLER_IMAGE_TAG ?= $(VERSION)
 UI_IMAGE_TAG ?= $(VERSION)
 KAGENT_ADK_IMAGE_TAG ?= $(VERSION)
 GOLANG_ADK_IMAGE_TAG ?= $(VERSION)
 CLAUDE_HARNESS_IMAGE_TAG ?= $(VERSION)
+CODEX_HARNESS_IMAGE_TAG ?= $(VERSION)
 CONTROLLER_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/$(CONTROLLER_IMAGE_NAME):$(CONTROLLER_IMAGE_TAG)
 UI_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/$(UI_IMAGE_NAME):$(UI_IMAGE_TAG)
 KAGENT_ADK_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/$(KAGENT_ADK_IMAGE_NAME):$(KAGENT_ADK_IMAGE_TAG)
 GOLANG_ADK_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/$(GOLANG_ADK_IMAGE_NAME):$(GOLANG_ADK_IMAGE_TAG)
 CLAUDE_HARNESS_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/$(CLAUDE_HARNESS_IMAGE_NAME):$(CLAUDE_HARNESS_IMAGE_TAG)
+CODEX_HARNESS_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/$(CODEX_HARNESS_IMAGE_NAME):$(CODEX_HARNESS_IMAGE_TAG)
 
 #take from go/go.mod
 AWK ?= $(shell command -v gawk || command -v awk)
@@ -223,18 +226,20 @@ build-all: BUILD_ARGS ?= --progress=plain --builder $(BUILDX_BUILDER_NAME) --pla
 build-all: proto-generate buildx-create
 	$(DOCKER_BUILDER) $(BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -f go/Dockerfile     ./go
 	$(DOCKER_BUILDER) $(BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -f go/harness/claude/Dockerfile ./go
+	$(DOCKER_BUILDER) $(BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -f go/harness/codex/Dockerfile ./go
 	$(DOCKER_BUILDER) $(BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -f ui/Dockerfile     ./ui
 	$(DOCKER_BUILDER) $(BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -f python/Dockerfile ./python
 
 .PHONY: build
 build: ## Build and push all component images
-build: buildx-create build-ui build-kagent-adk build-golang-adk build-claude-harness build-controller
+build: buildx-create build-ui build-kagent-adk build-golang-adk build-claude-harness build-codex-harness build-controller
 	@echo "Build completed successfully."
 	@echo "Controller Image: $(CONTROLLER_IMG)"
 	@echo "UI Image: $(UI_IMG)"
 	@echo "Kagent ADK Image: $(KAGENT_ADK_IMG)"
 	@echo "Golang ADK Image: $(GOLANG_ADK_IMG)"
 	@echo "Claude Harness Image: $(CLAUDE_HARNESS_IMG)"
+	@echo "Codex Harness Image: $(CODEX_HARNESS_IMG)"
 
 .PHONY: build-monitor
 build-monitor: ## Watch BuildKit process list inside the buildx container
@@ -263,6 +268,7 @@ build-img-versions: ## Print the fully-qualified image tags for all components
 	@echo kagent-adk=$(KAGENT_ADK_IMG)
 	@echo golang-adk=$(GOLANG_ADK_IMG)
 	@echo claude-harness=$(CLAUDE_HARNESS_IMG)
+	@echo codex-harness=$(CODEX_HARNESS_IMG)
 
 .PHONY: controller-manifests
 controller-manifests: ## Regenerate CRD manifests and copy them into the Helm chart
@@ -307,6 +313,12 @@ build-claude-harness: buildx-create
 	$(DOCKER_BUILDER) $(DOCKER_BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -t $(CLAUDE_HARNESS_IMG) -f go/harness/claude/Dockerfile ./go
 	$(DOCKER_PUSH) $(CLAUDE_HARNESS_IMG)
 
+.PHONY: build-codex-harness
+build-codex-harness: ## Build and push the native Codex Harness image
+build-codex-harness: buildx-create
+	$(DOCKER_BUILDER) $(DOCKER_BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) -t $(CODEX_HARNESS_IMG) -f go/harness/codex/Dockerfile ./go
+	$(DOCKER_PUSH) $(CODEX_HARNESS_IMG)
+
 .PHONY: push
 push: ## Push all component images (controller, ui, ADKs)
 push: push-controller push-ui push-kagent-adk push-golang-adk

go/.gitignore

@@ -24,3 +24,6 @@ Dockerfile.cross
 *.swp
 *.swo
 *~
+
+# Schema bundle generated by Codex CLI
+harness/codex/protocol/

go/README.md

@@ -1,6 +1,6 @@
 # Kagent Go
 
-This directory is a single Go module (`github.com/kagent-dev/kagent/go`) containing three top-level package trees that make up the Go components of Kagent.
+This directory is a single Go module (`github.com/kagent-dev/kagent/go`) containing four top-level package trees that make up the Go components of Kagent.
 
 ## Packages
 
@@ -9,6 +9,7 @@ This directory is a single Go module (`github.com/kagent-dev/kagent/go`) contain
 | **api** | `go/api/` | Shared types: CRD definitions, ADK model types, database models, HTTP client SDK |
 | **core** | `go/core/` | Infrastructure: Kubernetes controllers, HTTP server, CLI, database implementation |
 | **adk** | `go/adk/` | Go Agent Development Kit for building and running agents |
+| **harness** | `go/harness/` | Native Claude and Codex Actor runtimes plus their shared A2A execution support |
 
 ### Dependency graph
 
@@ -46,10 +47,15 @@ go/
 │   ├── hack/             # Development utilities (mock LLM, config gen)
 │   └── test/e2e/         # End-to-end tests
 │
-└── adk/                  # Go Agent Development Kit module
-    ├── cmd/              # ADK server entry point
-    ├── pkg/              # Agent runtime, models, MCP, sessions, skills
-    └── examples/         # Example tools (oneshot runner, BYO agent)
+├── adk/                  # Go Agent Development Kit
+│   ├── cmd/              # ADK server entry point
+│   ├── pkg/              # Agent runtime, models, MCP, sessions, skills
+│   └── examples/         # Example tools (oneshot runner, BYO agent)
+│
+└── harness/              # Native Harness Actor runtimes
+    ├── claude/           # Claude Code adapter and image
+    ├── codex/            # Codex App Server adapter and image
+    └── runtime/          # Shared A2A, continuation, and OS utilities
 ```
 
 ## Building
@@ -119,9 +125,13 @@ The controller embeds OCI manifest digests for agent workload images at **link t
 |---|---|---|
 | `golang-adk` | `build-golang-adk` | `AgentImageDigest` |
 
-
 `kagent-adk` remains available as a base for Python BYO images, but is not a declarative runtime.
 
+The native images use the root `build-claude-harness` and
+`build-codex-harness` targets. Their digest-pinned references are supplied
+explicitly through `Harness.spec.workload.image`; they are not controller
+linker values.
+
 ## Quick Testing with Oneshot
 
 The `adk/examples/oneshot` tool lets you test agent configs locally:

go/api/config/crd/bases/kagent.dev_agenttemplates.yaml

@@ -471,6 +471,15 @@ spec:
                     latestSuccessfulRevision:
                       minLength: 1
                       type: string
+                    warnings:
+                      description: |-
+                        Warnings reports non-blocking compatibility decisions made while compiling
+                        this AgentTemplate for the Harness.
+                      items:
+                        type: string
+                      maxItems: 100
+                      type: array
+                      x-kubernetes-list-type: set
                   required:
                   - desiredRevision
                   - harness

go/api/v1alpha3/agenttemplate_types.go

@@ -229,6 +229,12 @@ type AgentTemplateHarnessStatus struct {
 	// +kubebuilder:validation:MinLength=1
 	// +optional
 	LatestSuccessfulRevision string `json:"latestSuccessfulRevision,omitempty"`
+	// Warnings reports non-blocking compatibility decisions made while compiling
+	// this AgentTemplate for the Harness.
+	// +kubebuilder:validation:MaxItems=100
+	// +listType=set
+	// +optional
+	Warnings []string `json:"warnings,omitempty"`
 	// +kubebuilder:validation:MaxItems=4
 	// +listType=map
 	// +listMapKey=type