fix(workflows): execute admitted workflow runs

codex-rs/app-server/src/message_processor.rs

@@ -599,6 +599,7 @@ impl MessageProcessor {
             } else {
                 thread_processor.start_background_agent_supervisor();
             }
+            thread_processor.start_workflow_run_supervisor();
         }
         let turn_processor = TurnRequestProcessor::new(
             auth_manager.clone(),

codex-rs/app-server/src/request_processors.rs

@@ -689,6 +689,7 @@ mod thread_schedule_default_prompt;
 mod thread_schedule_processor;
 mod thread_schedule_runtime;
 mod thread_workflow_processor;
+mod thread_workflow_runtime;
 mod token_usage_replay;
 mod turn_processor;
 mod usage_profile_broker;

codex-rs/app-server/src/request_processors/background_agent_live.rs

@@ -3731,7 +3731,11 @@ async fn resolve_background_agent_config(
         .map(serde_json::from_value::<PermissionProfile>)
         .transpose()?;
     let default_permissions = payload
-        .and_then(|payload| payload.get("permissionProfile"))
+        .and_then(|payload| {
+            payload
+                .get("defaultPermissions")
+                .or_else(|| payload.get("permissionProfile"))
+        })
         .and_then(Value::as_str)
         .map(str::to_string);
     let sandbox_mode = if permission_profile.is_none() {

codex-rs/app-server/src/request_processors/thread_workflow_processor.rs

@@ -317,6 +317,27 @@ impl ThreadWorkflowRequestProcessor {
             ))
         })?
         .map(|outcome| api_thread_goal_plan_from_state(outcome.snapshot));
+        let execution = state_db
+            .start_workflow_run_execution(codex_state::WorkflowRunStartExecutionParams {
+                run_id: snapshot.run.run_id.clone(),
+                owner_id: format!("workflow-manager:{thread_id}"),
+                auth_profile_ref: None,
+                config_fingerprint: None,
+                version_fingerprint: Some(
+                    codex_state::BACKGROUND_AGENT_ADMISSION_SCHEMA_VERSION.to_string(),
+                ),
+                parent_agent_run_id: None,
+                max_active_background_agent_runs: None,
+            })
+            .await
+            .map_err(|err| {
+                internal_error(format!(
+                    "failed to admit workflow execution branches: {err}"
+                ))
+            })?;
+        let snapshot = execution
+            .map(|execution| execution.snapshot)
+            .unwrap_or(snapshot);
         Ok(ThreadWorkflowRunStartResponse {
             run: api_thread_workflow_run_snapshot_from_state(snapshot),
             goal_plan,