Add a shared Python supervisory-control example

[bigboateng]

Change contract

When: A developer wants Codex to delegate to Qwen or DeepSeek while a shared application controls which delivery actions are admissible.
Before: The examples show individual approval decisions, without a stateful delivery supervisor or worker recovery from a denied action.
After: examples/supervisory-control runs real agent CLIs through one Pitot Controller and a shared Python supervisor. A local model replay drives both worker variants through early release denial, completed build, external test invalidation, recovery and verified release. The README explains the control concepts, practical use cases, program-first supervision, replacement policy boundaries and a sourced MCAS engineering lesson; technical comments describe the code flow.

Boundaries preserved

• The application owns supervisory state, completed operations and external test events. Pitot carries native actions and enforces the correlated response.
• Permission does not advance delivery state. Release consumes a current reservation and rechecks the tested revision and artifact.
• The demo uses temporary profiles, fake credentials and local model endpoints. Existing runtime behavior and other agent integrations are unchanged.

Evidence

Scenario or check	Expected result	Observed result
Real Codex → Qwen	Native release denial, recovery and completed verified release	Passed
Real Codex → DeepSeek Harness	Same shared policy and native feedback loop	Passed
Application boundary tests	Stale grants, changed artifacts, failed operations, invalid native data and hook transport failures block release	8 passed
Repository maintenance	Existing checks and example test registration pass	200 tests passed; one existing skip
Go module, static checks, formatting	Pass	Passed
Exact-head GitHub CI	Pass before merge	49 checks passed at ea9773e4a9f4

Failure and recovery

Unknown commands and wrong roles are denied. An invalidated or changed artifact must be rebuilt and tested before release. The example cleans up owned processes and temporary files; optional logs preserve native feedback for diagnosis. This is an additive example and can be reverted without changing the library API.

Remaining limits

The runnable native demo targets macOS and Linux and runs one delivery session with one worker at a time. It demonstrates control boundaries using deterministic local model replay; it does not measure model quality, provide a hostile-process sandbox, or implement post-release revocation. The README lists tested CLI versions and reproducible commands.

[github-actions]

Pitot coding-agent E2E

Intelligence Flow is the verification source; Pitot's public README carries the latest main status.

Agent	Ubuntu	macOS	Windows	Result	Evidence
Claude	✅ Pass · real CLI 2.1.296 · native · binary-observed anthropic messages	✅ Pass · real CLI 2.1.296 · native · binary-observed anthropic messages	✅ Pass · real CLI 2.1.296 · native · binary-observed anthropic messages	✅ Passing	All platforms are required
Cursor	✅ Pass · real CLI 2026.10.01-e373342 · native · binary-observed cursor connect proto	✅ Pass · real CLI 2026.10.01-e373342 · native · binary-observed cursor connect proto	✅ Pass · real CLI 2026.10.01-e373342 · native · binary-observed cursor connect proto	✅ Passing	All platforms are required
Codex	✅ Pass · real CLI 0.162.1 · native · binary-observed openai responses	✅ Pass · real CLI 0.162.1 · native · binary-observed openai responses	✅ Pass · real CLI 0.162.1 · native · binary-observed openai responses	✅ Passing	All platforms are required
Devin	✅ Pass · real CLI 3000.11.3 · native · binary-observed devin connect proto	✅ Pass · real CLI 3000.11.3 · native · binary-observed devin connect proto	✅ Pass · real CLI 3000.11.3 · native · binary-observed devin connect proto	✅ Passing	All platforms are required
DeepSeek Harness	✅ Pass · real CLI 0.2.0-rc.2 · native · binary-observed openai chat	✅ Pass · real CLI 0.2.0-rc.2 · native · binary-observed openai chat	✅ Pass · real CLI 0.2.0-rc.2 · native · binary-observed openai chat	✅ Passing	All platforms are required
GitHub Copilot CLI	✅ Pass · real CLI 1.0.95 · native · binary-observed openai chat	✅ Pass · real CLI 1.0.95 · native · binary-observed openai chat	✅ Pass · real CLI 1.0.95 · native · binary-observed openai chat	✅ Passing	All platforms are required
Gemini	✅ Pass · real CLI 0.63.0 · native · binary-observed gemini generate content	✅ Pass · real CLI 0.63.0 · native · binary-observed gemini generate content	✅ Pass · real CLI 0.63.0 · native · binary-observed gemini generate content	✅ Passing	All platforms are required
Kimi Code	✅ Pass · real CLI 2.1.1 · native · binary-observed openai chat	✅ Pass · real CLI 2.1.1 · native · binary-observed openai chat	✅ Pass · real CLI 2.1.1 · native · binary-observed openai chat	✅ Passing	All platforms are required
OpenCode	✅ Pass · real CLI 2.0.27 · native · binary-observed openai responses	✅ Pass · real CLI 2.0.27 · native · binary-observed openai responses	✅ Pass · real CLI 2.0.27 · native · binary-observed openai responses	✅ Passing	All platforms are required
Pi	✅ Pass · real CLI 1.1.0 · native · binary-observed openai chat	✅ Pass · real CLI 1.1.0 · native · binary-observed openai chat	✅ Pass · real CLI 1.1.0 · native · binary-observed openai chat	✅ Passing	All platforms are required
Qwen Code	✅ Pass · real CLI 0.25.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.25.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.25.1 · native · binary-observed openai chat	✅ Passing	All platforms are required

Runtime capabilities

Capability	Ubuntu	macOS	Windows	Result
pitot request	✅ Pass · real runtime allow/deny	✅ Pass · real runtime allow/deny	✅ Pass · real runtime allow/deny	✅ Passing

Source commit: ea9773e4a9f4