fix(codex): require final evidence in oneshot

[BenKalsky]

Summary

• keep Codex commentary/analysis out of durable assistant history and final-response selection
• require turn/completed; text alone no longer converts a timed-out turn into success
• make hermes -z fail closed on failed, partial, or explicitly incomplete runs without emitting partial stdout
• add regressions for the observed commentary → tool → silence/interrupt false-success path

Evidence

• reproduced from two live transcripts: commentary followed by turn_aborted, with no final_answer
• upstream NousResearch/hermes-agent:main still contains the affected contracts as of 2026-07-31
• 205 focused/adjacent tests passed
• Ruff and compileall passed
• git diff --check passed

Runtime

No Hermes service/runtime deployment is included in this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f28d93241

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject non-completed Codex turn statuses

When app-server emits turn/completed with status="interrupted" (or another non-completed status without an error object), run_turn() leaves TurnResult.interrupted false and error unset: it explicitly exempts interrupted, and only records other failures when error is present. Consequently run_codex_app_server_turn() reports completed=True and partial=False, so this new guard does not fire and hermes -z can still emit an earlier partial final_text with exit code 0. Propagate every non-completed terminal status into the result flags before relying on them here.

AGENTS.md reference: AGENTS.md:L54-L57

Useful? React with 👍 / 👎.