Sync Codex Lab with current openai/codex substrate

[shiny-code-bot]

Objective

Converge Codex Lab onto a current openai/codex tree while preserving only explicit, contract-backed Every Code product behavior. Upstream snapshots become the integration unit; historical commit ledgers remain provenance evidence rather than a prerequisite to implementation.

Finish Line

Codex Lab main descends from a recorded current upstream checkpoint, passes the Every Code convergence contract matrix, preserves both histories through reviewed merges, and can absorb ongoing upstream changes with a product-main lag target under three days.

Current Status

State: active as of August 23, 2026.

The first post-release exact-ref catch-up candidate remains checkpointed in draft PR #782. Provenance: local baseline 0eed1a86c783c474a009cb8b548ab58e18513614, upstream 343074d4207d572809bd8cea15f4be1d09d98e0b, merge base a7b8c074b577f897111c14de3a5e127b91e2a479, candidate head 15b9c8f373982767f741911e32179c5851d5c171, canonical remote git@github.com:openai/codex.git.

The candidate resolved 90 textual conflicts across 479 upstream-only commits and recorded append-only snapshot upstream/openai-codex/a7b8c074-343074d4. Strict convergence validation passes with seven reproducible snapshots, 493 guarded paths, 25 valid waivers, zero violations, and zero stale waivers. just bazel-lock-check, stable/experimental schema generation, and just test -p codex-app-server-protocol (309 passed, one skipped) were previously green.

Commits de00c66929770358fb0257029ebb68b2893f0711, cb5a4375f22d3177a94bb8f546912f5ed916e668, f6ce09ffce0e65d18e301ab30c4df1864ba2f457, and 15b9c8f373982767f741911e32179c5851d5c171 complete the bounded auth/workload-identity compatibility sequence on code-review evidence: typed fallible initialization, direct and indirect caller propagation, fail-closed app-server launch routing, persisted-login restriction isolation, and login-status/onboarding isolation now align with pinned upstream while preserving Every Code auth-profile and ordinary remote-session behavior.

All five focused package gates still stop before package test execution at the same five known codex-hooks errors. Current CI independently reports only those hooks errors before later crates. just fmt passed. Changed-files IntelliJ inspection found only pre-existing typo noise outside changed hunks.

Automatic Validation selected the correct package-scoped TUI Cargo check but timed out after 30,012 ms; #785 owns provider cache/budget. Background Review produced a P2 remote/WI onboarding finding after handoff. Two independent reviews rejected it as unreachable because workload identity cannot coexist with a remote app-server target in any active launch path; #784 records lifecycle/adjudication. Applicable AGENTS.md context was again truncated from 26,473 to 9,216 bytes; #787 owns that reliability gap.

Next action: repair the bounded codex-hooks API-shape synthesis, then rerun the focused auth/TUI/exec/app-server/CLI gates so the accumulated compatibility sequence finally compiles and its tests execute. Only after hooks is green should the candidate restore displaced downstream-only protocol tests and continue the remaining focused contract gates.

Blocked by: codex-hooks; then displaced downstream-only protocol tests and remaining focused contract gates.

Dogfood follow-ups remain #783 update-channel identity, #784 post-turn completion/review scope, #785 installed Validation provider cache/budget, #786 trace credential redaction, and #787 Background Review instruction context.

Last verified: August 23, 2026, PR #782 head 15b9c8f373982767f741911e32179c5851d5c171.

Scope

• In: upstream-first snapshot integration; explicit Every Code ownership contracts; risk-lane conflict handling; subsystem port/validation trains; history-preserving cutover; continuous mirror/canary operation.
• Out: force-pushing main; replaying every local commit; requiring all historical upstream commits to be individually classified; importing stale worktrees; or preserving undocumented divergence by default.

Acceptance Criteria

• The upstream-first snapshot convergence strategy and owned-contract boundary are explicit.
• Define Every Code-owned convergence contracts #126 defined executable critical contracts and owned exceptions.
• Build upstream snapshot integration and canary branch #428 pinned and built an exact upstream candidate and proved the refresh workflow.
• Sync canonical turn, context, history, and recovery substrate #305-Sync TUI, Guardian, and CI substrate #308 validated the product lanes in dependency order.
• Stop emitting free-form analytics error subreason #429 removed the free-form analytics privacy field before cutover.
• Generated schemas, lockfiles, snapshots, and fixtures were regenerated from the actual candidate and reviewed by source lane.
• Cut over to converged Codex Lab baseline and primary harness #343 proved protected-branch cutover, rollback/re-entry, canary behavior, provenance, and required quality gates.
• Every subsequent maintenance refresh pins an exact upstream SHA, preserves explicit owned contracts, and lands as a bounded independently reviewable change.
• Mirror, integration-canary, and product-main lag stay within the recorded service targets or the current blocker and revised recovery action are recorded here.

Relationships

• Continuous upstream-maintenance lane under Launch Codex Lab and establish post-cutover roadmap #498.
• Historical decomposition parent Upstream sync and Codex Lab feature reclassification #229 is closed not-planned after its scoped issues were created.
• Completed one-time convergence and cutover work: Define Every Code-owned convergence contracts #126, Establish the upstream compatibility envelope #304-Sync TUI, Guardian, and CI substrate #308, Cut over to converged Codex Lab baseline and primary harness #343, Build repeatable read-only upstream audit and checkpoint reporting #384, Verify upstream coverage through checkpoint and classify pending delta #387, Build upstream snapshot integration and canary branch #428, Stop emitting free-form analytics error subreason #429, and Temporarily operate Apple Silicon-only development and release paths #517.
• Related product work that consumes the maintained substrate: Rework durable Background Review around upstream review primitives #231 Background Review, Plugin lifecycle hooks for workspace preparation and quality providers #149 plugin lifecycle, Restore Every Code auto-validation loop #284 Validation, and Make dogfood build provenance visible #311 provenance.
• Rework durable Background Review around upstream review primitives #231 and Share Background Review coordination across linked worktrees #318 are related post-convergence work, not blocked by this lane remaining open for continuous maintenance.

Validation

• Exact ancestry/tree identity for every candidate and cutover.
• Contract matrix from Define Every Code-owned convergence contracts #126 across current main, authoritative Every Code evidence, and Build upstream snapshot integration and canary branch #428.
• Scoped and then full Rust/build/schema/snapshot/integration checks.
• Dogfood for live auth, remote control, release, and other non-hermetic contracts.
• Post-cutover mirror/canary freshness and rollback proof.

Decisions

• Upstream snapshots, not individual commits, are the primary unit of catch-up.
• Historical ledgers are preserved but nonblocking.
• Existing issues are reused where possible: Define Every Code-owned convergence contracts #126 owns contracts and Cut over to converged Codex Lab baseline and primary harness #343 owns cutover.
• Exactly one meaningful Project Now item is Define Every Code-owned convergence contracts #126; blocked descendants remain Waiting.

Open Questions

• Choose the first U0 once Define Every Code-owned convergence contracts #126's initial contract bundle is green.
• Decide after cutover whether continuous-sync operations need a dedicated child issue or remain within Cut over to converged Codex Lab baseline and primary harness #343's completion evidence.

[shiny-code-bot]

Sync recovery checkpoint, 2026-07-04:

The next sync stage is not a direct implementation merge yet. First, produce the #126 drift/ownership ledger against current upstream openai/main@98d28aab54, using 4e259c3bd0 as the last explicit substrate-sync checkpoint.

Reason:

• The fork is now 444 / 730 commits divergent from upstream.
• About 495 upstream commits since the last substrate checkpoint touch the same hot areas as recent dogfood work: app-server, app-server-protocol, core, login, TUI, MCP/protocol/thread-store.
• Recent Refresh loaded threads after API key login #267-Refresh loaded thread auth on logout #270 loaded-thread auth refresh behavior is intentional Every Code dogfood behavior and must be preserved or deliberately redesigned, not accidentally overwritten.

Expected first implementation stage after the ledger:

• A narrow auth/account/thread substrate sync PR.
• Generated schemas or TypeScript should be regenerated only when the specific imported substrate requires it.
• Validation should include the loaded-thread auth regression set covering API-key login, stored-account switch, active removal fallback, ChatGPT token/device login, and logout.

[shiny-code-bot]

Sync-stage decision after #126 drift ledger checkpoint 1:

Do not start with a broad app-server/schema sync. The first code PR should be a small invariant guard that protects local dogfood behavior before importing upstream substrate.

Recommended first code PR:

• Add a focused TUI regression proving account switching uses the loaded app-server session's account/switchActive RPC and does not restart/reload the session the way profile switching does.
• Keep existing loaded-thread app-server auth regressions from Refresh loaded threads after API key login #267-Refresh loaded thread auth on logout #270 as acceptance gates for later auth/account syncs.

Then sync in staged lanes:

1. Auth serialization/storage or thread-store/session substrate.
2. MCP runtime/catalog/OAuth reliability.
3. Agent-control refactor with local third-party prompt/preflight/status guarantees re-homed.
4. Skills/hooks/world-state substrate, preserving local regression guards.
5. App-server protocol/schema sweep after the earlier lanes are settled.

[shiny-code-bot]

First pre-sync guard merged:

PR #271 (84c144b73b24583d54716ec4c332473b5939b28d) landed the TUI stored-account switch flow guard before substrate sync. Stored-account switching now has no Tui restart dependency, preserving the loaded-session account/switchActive path that #267-#270 rely on for loaded-thread auth behavior.

Next implementation slice can now choose between:

• auth serialization/storage substrate, if we want to tackle account-shape drift first; or
• thread-store/session substrate, if we want to unblock MCP/agent sync first.

Either way, keep #271 plus the loaded-thread auth regression set as acceptance gates.