Integrate current upstream Codex snapshot with Every Code contracts

[shiny-code-bot]

Why

Codex Lab needs a refreshable, upstream-first integration candidate without silently discarding contract-backed Every Code behavior. This branch repairs the original upstream-tree anchor loss by restoring product lanes forward, adding executable compatibility proofs, and enforcing an explicit convergence guard and waiver ledger.

This is still a draft integration candidate. It is suitable for CI and review staging, but it is not merge-ready or release-ready. Permanent cutover remains gated by #343.

Candidate Identity

• Candidate head: 5450effdb1d6c51308bf8d0b7cc46f860d1de853.
• Base lineage includes origin/main through 82ffbe8cae7dc68a400ea5d4f29f7bcd42b18c8f.
• Upstream lineage includes openai/main through 61a44880a85d2fd0d8770908dea5733495e571c8.
• The baseline publication-gate merge tree is byte-identical to reviewed gate commit e48f82b0a7804ae823a5631dc9791e2589fab5b1; the current head adds sixteen reviewed CI-remediation commits, which together cover Cargo shear, Bazel compatibility/argument comments, sample config drift, formatting, V8 artifact routing, Windows cfg hygiene, PID liveness, POSIX-only Windows test gating, Linux ARM archive resource control, full-CI timeout budgeting, deterministic cross-platform expectations, Windows path parsing and text normalization, image-codec CI performance, Windows ARM capacity tuning, bounded auto-review persistence, session/auth durability, stale-waiver cleanup, native Windows ARM archive execution, authenticated provider model refresh, MCP/OAuth expectation drift, bounded Windows capture drains, and hosted-runner test isolation.
• Publication updates were fast-forwards; no history rewrite or force push was used.

Scope and Review Shape

Measured at gate commit 2fd8cf5109 (tree-identical to e48f82b0a7), the full diff against origin/main@82ffbe8cae is 3,260 files, +399,677 / -139,409 across 1,507 commits. The sixteen later CI-remediation commits add to those totals and are reviewed separately. Most of that is upstream lineage, so this cannot be reviewed meaningfully as one flat diff. Review should follow the staged restoration merges, the contract matrix in docs/convergence-contracts.md, and the guarded-path/waiver artifacts.

The current convergence artifacts record:

• 326 guarded paths: 301 intentionally_owned, 25 red_manual_review.
• 58 explicit waivers: 53 pending_restore, 4 upstream_deletion_adopted, 1 converged_with_upstream.
• 31 guarded paths absent from the candidate, all matched by waivers.

These numbers are not a claim that all fork behavior survived. Relative to origin/main, this candidate deletes 166 paths: 94 match upstream's own deletions between b89ce9a2 and 4462b9de, and 17 of the remaining 72 carry explicit waiver entries, leaving 55 deletions that are neither upstream-driven nor waiver-documented. None of those 55 fall within the guard's 326 recorded paths, so a green guard attests only to its guarded lanes. Examples include a deleted fork CI lane (.github/workflows/ci.yml, .github/extended-checks.json, and scripts/github/decide_extended_checks.py), the thread-history projection files and 0002_projection_integrity.sql migration, apply_patch_validation, the Odoo #360 proof trio, local/convergence tooling, skill-provenance files, and an older checked-in convergence evidence snapshot. Some appear superseded or intentionally retired, but each still needs an explicit routing decision before undraft.

Additional guard limits to keep visible:

• 217 of 326 rows are presence-only because no upstream blob exists.
• The ownership record is pinned on both ends: reversion comparisons use upstream snapshot 4462b9deef, and ownershipBaseline.current still names d96308e5e9, where only 36 of today's 51 current_tree rows were expanded. The remaining 15 were added at e48f82b0a7 without advancing that pin. The guard was last expanded at e48f82b0a7 (266 to 326); the gate merge and sixteen later CI-remediation commits delete no path and add one non-guarded doctor snapshot, so the guarded path set has not moved. The current head removes the now-stale multi_agents_spec_tests.rs waiver and two stale models-manager waivers, and passes the guard at 326 guarded / 58 waived, but the recorded baselineBlob provenance remains stale and the guard does not prove equivalence against later upstream refreshes.
• Amber-lane work is not comprehensively guarded; several final gate paths, including migration, protocol, MCP, and installer changes, remain protected primarily by focused tests rather than manifest entries.

Restored and Hardened

• Restored Project Validation, ShellCheck/provider integration, Background Review, external-agent routing/preflight, SessionProvenance, Code Bridge/browser integration, and their production-path proofs.
• Preserved account catalogs, account switching, loaded-thread auth reconciliation, execution-account isolation, and preserve-existing-account behavior.
• Restored compatibility for legacy app-server/API shapes, CLI aliases, MCP approval input, hooks, history mode, review decisions, dynamic tool output, and command-output fallbacks.
• Repaired state migration compatibility, including frozen shipped migrations, thread-history generation rollover, and the already-applied legacy version-43 checksum path.
• Added model-context bounds for environment/world-state fragments, external/inter-agent completion payloads, Project Validation, Background Review, Code Bridge, invalid-image recovery, and realtime delegation.
• Added a post-XML-escape realtime delegation hard cap of 5,000 rendered tokens (approximately 20,000 escaped bytes via approx_bytes_for_tokens), enforced on escaped output so the whole item stays below the 10K per-item ceiling, with adversarial metacharacter and multibyte tests.
• Restored Codex Lab release/package/install/update/rollback tooling and added fork-safe release guards, signed-artifact handling, package tests, and CODEX_LAB_HOME consistency on Unix and Windows.
• Expanded the convergence guard from 266 to 326 paths and added presence-only coverage for suite registries that legitimately match upstream bytes.

Validation

Focused validation on the candidate and its reviewed gate trees includes:

• GitHub/Python workflow helpers: 188 tests passed.
• Installer suites: 20 tests passed, including 7 Windows PowerShell home-resolution checks.
• codex-app-server-protocol: 296/296 passed.
• Focused codex-core realtime/external-agent preflight coverage: 26/26 passed.
• codex-mcp-server --lib: 15/15 passed.
• Targeted migration-repair tests: 2/2 passed; the broader state migration suite previously passed 13/13.
• Earlier restoration gates: protocol/hooks/config 936/936; rollout/state/thread-store 435/435; app-server focused 70/70; exec 144/144; TUI focused 15/15; app-server config/dynamic tools 27/27; CLI alias/help 6/6.
• Exact app build passed: cargo build --profile ci-app -p codex-cli --bin codex-lab.
• Current-SHA CI remediation: full cargo shear --deny-warnings is clean; external-agent migration 139/139 (upstream crate content; fork behavior remains waived under AGENT-1), home-dir 4/4, and Code Bridge protocol 17/17 passed; codex-thread-manager-sample checks successfully.
• V8 workflow remediation: 17/17 artifact-download contract tests and 12/12 Bazel checksum-helper tests passed; release/install provenance guards remain green. rust-ci-full explicitly consumes exact-version, checksummed openai/codex artifacts because it publishes nothing, while rust-release.yml keeps the fork-owned fail-closed default.
• Not yet validated: non-Windows full-CI nextest archive jobs were changed to consume the same explicit, checksummed openai/codex V8 inputs as lint/build jobs, and Linux ARM64 archive builds were reduced to two Cargo jobs after three hosted runners shut down at the same final-link phase. Both are remediations whose current-head proof is full-CI run 30213661303, which has not completed.
• The complete Bazel argument-comment analysis found 286 restored call sites; Opus applied exact /*param_name*/ annotations, and two full sweeps reported zero argument-lint diagnostics across the 769 targets that built successfully. Targets that did not build were outside that lint result. The sole remaining sample compile error was fixed through a shared Config default constructor and verified by Cargo check.
• The Windows PID-liveness compile fix passed the native live-process lock test (1/1), scoped Clippy, just fix -p codex-auto-review, and final formatting.
• Latest full-CI remediation passed focused core preflight (1/1), the complete external-command test module (33/33), TUI (2/2), and app-server Project Validation (1/1) tests; the V8 download contract suite remained 17/17; scoped Clippy, just fix, just fmt, workflow syntax validation, and targeted Prettier all passed.
• Final cross-platform corrections passed the Windows command parser regressions (4/4), the headless browser integration test (1/1, with the headed test explicitly ignored), scoped Clippy, just fix, and just fmt; the earlier image utility suite remained 13/13 and its ci-test profile check passed.
• Final non-test gates passed: just fmt-check, targeted workflow Prettier, cargo metadata --locked --no-deps, just bazel-lock-check, whole-repo Bazel query, git diff --check, workflow syntax validation, and the convergence guard (326 guarded / 60 waived). The repo-wide pnpm run format command still flags unchanged codex-rs/browser/src/js/virtual_cursor.js; the same failure reproduces from the prior pushed head 3bfe89b366 and is outside this correction diff.

The combined MCP integration invocation now passes all three affected tests after its expected user agent was aligned with the server's wire-compatible version source. Focused tests also pass for provider-authenticated model discovery, OAuth fallback storage, prompt caching, rollout/reasoning resume, remote-control reconnect, persisted auto-review scope, thread rollback, sandbox summaries, temp-root identity, TUI status/title surfaces, command-popup snapshots, browser proxy discovery, and git-root handling. Scoped Clippy, just fix, just fmt, Cargo metadata, targeted Prettier, workflow syntax validation, git diff --check, and the rusty_v8 Bazel checksum check are green. A local cross-Windows cargo check could not complete on macOS because the host lacks MSVC C headers (assert.h), so hosted Windows CI remains the source of truth for the Windows-only reader and ConPTY changes. The repository-wide local suite was not re-run because the earlier attempt exhausted the local volume while linking after generating 171.4 GiB of artifacts. GitHub full CI has not yet completed successfully on this branch; replacement current-head run 30218796900 is active. No broad-suite result currently backs this candidate.

Final Opus Gate

Independent Opus reviews covered every newly exposed full-CI failure class, including provider auth, MCP versioning, OAuth namespace storage, native Windows ARM archives, browser launch/proxy behavior, ConPTY semantics, Windows sandbox capture, Linux ARM temp-root contamination, and the final combined diff. The final diff review returned SHIP for its second half; the first half found one deterministic import-order blocker, which was fixed before the successful just fmt gate. No review considers this branch merge-ready.

Tracked merge-readiness debt includes:

• 53 pending_restore waivers and the additional unrecorded deletion audit above.
• IDENTITY-1: six paths are waived pending the canonical identity decision — the candidate README is still the upstream OpenAI README, and the TUI status-card surface (card.rs, helpers.rs, rate_limits.rs, its credits-and-limits snapshot, and status/tests.rs) remains reverted to upstream.
• MODEL-1: ten of the eleven guarded codex-rs/models-manager paths, including models.json and default-model logic, are waived and run upstream until the catalog comparison lands; only BUILD.bazel is unwaived. AGENT-1: external-agent config, agent-jobs and multi-agent v2 handlers, restore paths, and external-agent migration remain absent or reverted; auto_review / guardian_review are guarded but not yet accepted evidence.
• The runtime exec harness is dispatch-only, so restored contract scenarios are not all PR-blocking checks.
• Both local-navigation browser integration tests are explicitly ignored because hosted Windows, macOS, and Linux ARM runners did not provide a reliably launchable Chrome/desktop contract; they require an explicit local --ignored run. Browser launch retry classification and proxy-isolation behavior remain covered by ordinary unit tests.
• legacy_tty_job_terminates_and_preserves_descendants is explicitly ignored because nested PowerShell startup under legacy ConPTY is unreliable on hosted Windows; non-TTY capture preservation and ordinary ConPTY I/O remain covered, but this lifecycle case needs a deterministic native helper before it can rejoin blocking CI.
• Live RELEASE-1 release/install smoke remains outstanding; offline tests cannot prove external release authority.
• Inherited rust-v* signing paths remain unrecorded fork-safety debt: Windows Azure Trusted Signing and upstream macOS AKV signing are tag-only and fail closed without fork credentials, but they are outside Cut over to converged Codex Lab baseline and primary harness #343's macOS keychain gate.
• Documented compatibility follow-ups include thread-delete partial-failure/cascade semantics, optional account email, and the semantic remap of legacy on-failure to on-request behavior.
• Context follow-ups include operator-configurable hook/realtime instruction bounds and avoiding duplicate realtime handoff content; no reviewed path currently breaches the draft gate's 10K-token item ceiling.
• Bazel follow-up: upstream Fix Bazel test configuration for platform-specific data openai/codex#35067 added an unsupported Windows-only binary-test attribute; the candidate removes that invalid call site, but the divergence should be recorded or the macro deliberately extended before a future refresh reintroduces it. No in-tree record of this divergence exists today; it lives only in this PR body.

CI Plan

• PR branch: code/upstream-snapshot-428 at 5450effdb1.
• Full-CI escape branch: code/upstream-snapshot-428-full-ci fast-forwarded to the same SHA.
• Current-head runs are active: blocking CI 30219151896, Codex Lab app 30219151796, V8 canary 30219151800, full CI 30219149932, and explicitly dispatched Bazel 30219215416. At the prior head 4ac9473b0d, blocking CI exposed two stale convergence-waiver entries, while the other long-running lanes were superseded by the focused waiver cleanup at this head. At 86a844dacf, blocking CI, the app build, and Bazel succeeded; V8 canary was still in progress when superseded, while full CI exposed the deterministic failures corrected in the following commits. The separate sdk-integration.yml workflow is postmerge/dispatch-only and is not registered on the default branch, so it cannot be dispatched for this draft branch and remains unvalidated here. Bazel is dispatch-only, exercises hosted macOS/Linux plus Windows paths (including a repository-runner release-build lane), and is not part of blocking CI. Current-SHA failures will be diagnosed rather than hidden by stale runs.
• The full-CI V8 override is consumption-only: per-target .sha256 verification is unchanged, and no fork release path opts into cross-repository artifacts.
• The PR stays draft throughout this cycle.

Refs #428
Refs #126
Cutover remains gated by #343.