[codex] add local failure mining workflow

[divo12]

Stack

Depends on #27, which introduces the immutable FailureDiagnosis contract. Review this PR as the tool, storage, and skill layer only.

Summary

• add a bounded record_failure MCP tool backed by a typed local workspace service
• persist one deterministic diagnosis per file under .workspace/failures while leaving Langfuse as the trace source
• publish artifacts atomically and exclusively through no-follow directory handles
• reject path escapes, directory swaps, oversized artifacts, and conflicting concurrent rewrites
• add the concise failure-miner skill using bounded skim, locate, context, and attribution phases
• route verifier-backed ITSM failures through the skill before harness hypotheses
• bump the plugin to 0.5.0 and pin its portable runtime

Non-goals

• no copied Langfuse traces or local trace database
• no cross-trace clustering, vector index, report generator, or taxonomy registry
• no automatic harness hypothesis, repair, edit, commit, or pull request
• no change to verifier, benchmark, concurrency, retry, model, or trace-query behavior

Local verification

• uv sync --frozen --extra dev --extra plugin
• Ruff: clean; changed files are Ruff-formatted
• strict mypy: clean across 42 source files
• pytest: 172 passed, 2 skipped; 95.42% total coverage
• new failure workspace module: 97% coverage
• production-function maximum cyclomatic complexity: 3
• real concurrent-write, post-validation symlink-swap, and oversized-artifact tests
• trace-query-planner, outcome-recorder, and failure-miner skills validate
• plugin validation passes

Complexity changes

• _prepared_root: 5 to 2
• FileFailureWorkspace.store: 3 to 2
• _workspace_paths: 3 to 1
• _validate_existing: 3 to 2

Live exercise

Plugin 0.5.0 is running in a separate Codex session over a new isolated 50-task Hermes/ITSM batch. Codex confirmed prepare_workspace and record_failure, loaded workspace-init and failure-miner, and is polling the identical re-entrant request with zero harness mutation attempts. A repeatable task-ep-2 Docker image bootstrap error was observed and is external to this change.

All verification above is local evidence, not CI evidence.

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[divo12]

Cyclomatic-complexity follow-up:

Function	Before	After
_prepared_root	5	2
FileFailureWorkspace.store	3	2
_workspace_paths	3	1
_validate_existing	3	2
_is_prepared_root	3	2
concurrent-write regression test	7	3

PR-added production functions now max at CC 3. The unrelated pre-existing trace-tool integration test remains CC 9 and was intentionally left out of this focused PR. Behavior verified with 172 passed, 2 skipped, 95.42% coverage, strict mypy, Ruff, formatting, and plugin validation.

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>