Run bounded Codex Lab primary daily-driver canary

[shiny-code-bot]

Objective

Make Codex Lab the user's primary coding-agent route for normal daily work as a bounded, reversible canary, while keeping Every Code Lab installed and immediately available only for rollback. Use real work to expose the small product, workflow, and compatibility issues that cannot be found efficiently through synthetic parity planning.

Finish Line

After the GUI/remote entry gate is green, Codex Lab is used as the default for at least three normal workdays and five substantive tasks. The canary includes the official ChatGPT/Codex GUI, native iPhone remote continuation, Automatic Validation, a third-party agent, and Automatic Background Review. Every Code Lab is used only for the planned rollback/re-entry rehearsal or a documented rollback-trigger incident. All observed friction is captured as focused issues, and no unresolved data-loss, wrong-account, wrong-worktree, stale-binary, stranded-turn, or remote-recovery blocker remains.

Current Status

State: Superseded as a pre-merge gate by an explicit user decision on July 29, 2026.

The frozen candidate in PR #465 at 86cad522213c21e4d3696064878c4233cb3df724 is mechanically mergeable with all required CI, the signed macOS app build, and the complete V8 release/ptrcomp matrix green.

Decision: the user selected Merge now and explicitly waived the three-normal-workday/five-substantive-task canary before merging PR #465. The #381 alternate-execution-account proof and exact-candidate rollback/re-entry rehearsal were not completed and must not be represented as passed.

Disposition: close this plan as not planned, preserve #381 and relevant #385 follow-ups as post-cutover dogfood work, and proceed through #343's protected PR merge plus post-merge verification.

Last verified: July 29, 2026.

Scope

• In: clean immutable candidate selection; official GUI launch; native iPhone remote use; stable control auth with pooled execution accounts; real coding tasks; Automatic Validation; third-party agents; Automatic Background Review; provenance capture; rollback/re-entry; focused issue capture.
• Out: permanent deletion or retirement of Every Code Lab; full Sync TUI, Guardian, and CI substrate #308 convergence; complete Audit codex-skills inside Codex Lab dogfood #83 paired-quality graduation; broad parity cleanup; polish that real dogfood has not shown to be blocking.

Acceptance Criteria

Entry Gate

• Prove stable native remote control with separate execution auth #381 is merged with stable control auth, pooled execution auth, per-thread affinity, dynamic rate-limit windows, and hard-reason-only failover.
• A successful native iPhone turn executes through a non-control account without re-pairing; the reset-gated cache experiment is run or the conservative cache-cold assumption remains explicit.
• Validate Codex Lab remote control through ChatGPT GUI #367 completes prompt/turn, approval or structured input, disconnect/reconnect, daemon restart, and revocation validation.
• The candidate is built from clean merged source and records exact commit, binary digest, executable path, profile/channel, GUI version, and account roles.
• One representative task proves fallback to Every Code Lab and re-entry to the pinned Codex Lab candidate without losing the known thread or workspace.

Canary

• Codex Lab is the default route for at least three normal workdays and five substantive tasks.
• At least one task exercises Automatic Validation and its bounded correction behavior.
• At least one task uses a third-party agent with bounded status and terminal cleanup.
• At least one code-changing task produces an Automatic Background Review result or a verified clean result.
• At least one task is continued remotely from iPhone, including an approval or structured user-input exchange and a reconnect.
• Each task records the running candidate provenance, control account, selected execution account, workspace/worktree, and outcome without exposing credentials.
• Every observed friction item is either fixed immediately when small and safe or captured as a focused issue with reproduction evidence and severity.
• Every Code Lab is invoked only for the planned rollback rehearsal or a documented rollback-trigger incident.

Exit Decision

• The canary records one explicit decision: continue Codex Lab as the primary reversible route, roll back to Every Code Lab, or advance to Cut over to converged Codex Lab baseline and primary harness #343 permanent-default graduation.

Rollback Triggers

• Wrong control or execution account, wrong workspace/worktree, or credential exposure.
• Unknown, stale, dirty, or unverifiable executable provenance.
• Session/history loss, unrecoverable resume failure, or stranded agent/turn.
• Native remote approval/input/reconnect becomes unavailable during normal use.
• Hidden or misleading validation/review results that make code quality unsafe.
• Every Code fallback or Codex Lab re-entry cannot complete cleanly.

Relationships

• Post-MVP canary after Codex Lab MVP dogfood plan #28.
• Blocked by Dogfood Codex Lab through ChatGPT GUI remote access #365, whose critical path is Prove stable native remote control with separate execution auth #381 then Validate Codex Lab remote control through ChatGPT GUI #367.
• Bounded prerequisite for Cut over to converged Codex Lab baseline and primary harness #343 permanent default-route graduation.
• Uses the immutable provenance and launcher work from Make dogfood build provenance visible #311 and Update Codex Lab launcher for current ChatGPT.app integration #366.

Decisions

• Do not wait for full Sync TUI, Guardian, and CI substrate #308 convergence or the complete Audit codex-skills inside Codex Lab dogfood #83 paired audit before beginning this reversible canary; those remain permanent-graduation gates unless dogfood exposes a concrete blocker.
• Preserve Every Code Lab unchanged as the immediate rollback path throughout the canary.
• Treat real dogfood findings as evidence-driven scope: small issues should be discovered and fixed from Codex Lab whenever safe, rather than preemptively blocking the canary on broad parity work.