ORA-2026-0040: Sub-agents must inherit parent identity

ORA-2026-0040: Sub-agents must inherit parent identity

Rule

Sub-spawned agents (Agent tool, subagents, subprocess wrappers) MUST inherit the spawning parent's fleet identity (PROVIDER-PLATFORM-DEVICE-PROJECT-NN). They MUST NOT run boot-time identity negotiation or self-allocate a new instance number.

Boot-time identity negotiation (scanning fleet-active-queue, probing worktree mtimes, checking artifact signatures) is reserved for top-level sessions only — sessions the operator can see in the platform UI (a Desktop app window, a CLI terminal, a tmux pane).

Identity format for sub-agents

If a sub-agent needs an identity string for feed-writes or commit attribution, it uses the parent's identity with a task suffix:

PARENT-IDENTITY/task-suffix

Examples:

• CODEX-DESKTOP-MacBook-Air-CAMBER-04/cmb-0410-sub
• CLAUDE-CLI-MacBook-Air-ORA-02/audit-agent

The slash delimiter is unambiguous — no top-level identity contains /. The suffix is freeform but should reference the ticket or task name.

What sub-agents MUST NOT do

1. Self-allocate a new NN. Running find ~/gh/-worktrees/-CAMBER-NN-* and picking the next free number creates a phantom identity the operator cannot locate in any UI. 2. Post to FLEET_FEED.md under a self-allocated identity. The shepherd, queue reducer, and operator all assume every feed-post author maps to a locatable session. Phantom authors break this. 3. Create worktrees named with self-allocated identities. Worktree names encode seat identity for telemetry (ORA-2026-0016 Layer 1). A phantom-named worktree pollutes the telemetry surface.

Evidence

Instance 1: CAMBER-20 phantom (2026-04-23)

A sub-agent spawned by CAMBER-04 (shipping CMB-0417) performed boot-time identity negotiation, scanned for free NN slots, and adopted CODEX-DESKTOP-MacBook-Air-CAMBER-20. It wrote commits and worktree files under this identity. Chad's Codex Desktop app roster contained no thread at instance 20 — the identity was unreachable. Wake-work pairing (ORA-2026-0019) was broken because there was nowhere to wake CAMBER-20.

Instance 2: CAMBER-07 single-process split (2026-04-23)

A single Codex process emitted commits under two identities (CAMBER-07 and CAMBER-08). ps aux confirmed one PID. The process internally spawned a sub-agent that ran identity negotiation and adopted a second seat name. Same structural failure — one session, two identities, operator confusion.

Structural cause

Boot-time identity negotiation is designed for the moment a session starts — when an operator opens a new Desktop window or launches claude in a terminal. Sub-agents are not sessions. They share their parent's process, context window, and operator visibility. When a sub-agent runs the same boot-time protocol, it correctly determines a free slot exists, correctly adopts it, and creates an identity that is correct by the protocol's rules but unreachable by the operator. The protocol is not wrong; it is being applied at the wrong scope.

Detection

A phantom identity has all of these properties:

• Worktree writes or feed posts under PROVIDER-PLATFORM-DEVICE-PROJECT-NN
• No matching Desktop thread in operator UI for that NN
• No matching CLI process or tmux session for that NN
• Activity timestamps overlap with a known parent session's activity window

Shepherd automation can lint for this: if a feed-post author has no matching entry in session_list or fleet-active-queue within a 30-minute lookback, flag it as a potential phantom.

Remediation for existing phantoms

1. Rename directive: parent session folds the phantom's work back under its own identity via a feed amendment. 2. Accept-and-retire: if the phantom's work is DONE, post a retirement note acknowledging the phantom and closing the identity. No commit rewriting needed — low harm.

Relationship to prior doctrine

• Amends ORA-2026-0004 / ORA-2026-0032: those entries cover top-level session identity failures (wrong platform, collision between concurrent sessions). This entry covers the sub-agent scope — a different failure mode with the same symptom (phantom/colliding identities).
• Protects ORA-2026-0019 (wake-work pairing): phantom identities break wake-work because there is no session to wake. Inheriting parent identity preserves the pairing.
• Protects ORA-2026-0012 (ticket-reserve collision): phantom seats confound the ticket-allocation register by appearing as real seats that can receive work.