[Bug]: codex_model root default enables Codex on every deployment

[eipasteur]

Description

codex_model is declared in the root module with a non-empty default, so every environment that does not explicitly opt out enables Codex on its next apply. The sibling CLI model variables are opt-in. This appears unintentional.

#350 added to terraform/variables.tf:

variable "codex_model" {
  description = "Default Codex-on-Bedrock model id ... (empty = none)"
  type        = string
  default     = "openai.gpt-5.5"
}

That value is passed into the AgentCore module at terraform/main.tf:353:

codex_model = var.codex_model

The module's own variable defaults to empty and documents empty as meaning none (terraform/modules/compute/agentcore/variables.tf:90), and the module treats empty as not-enabled (terraform/modules/compute/agentcore/main.tf:426):

var.codex_model != "" ? { codex = var.codex_model } : {}

Because the root default is non-empty, the module never receives the empty value its own default and description describe. The cli-models SSM parameter is seeded with a codex entry.

This is inconsistent with the other CLI models. kiro_model defaults to "" in the module (agentcore/variables.tf:84) and is set explicitly at the call site. bedrock_model is set per environment in tfvars. codex_model is the only one that is on unless explicitly disabled.

Expected: enabling a new agent CLI is an explicit, per-environment decision.
Actual: it is inherited from a root default, and nothing in a terraform plan diff reads as "enabling a new agent CLI".

Steps to reproduce

1. git checkout main at b9ab0b6d
2. Use an environment tfvars that does not set codex_model (for example one containing only environment, aws_region, bedrock_model)
3. terraform plan -var-file=terraform/environments/<env>.tfvars
4. Inspect the planned value of the cli-models SSM parameter: it contains a codex entry despite codex_model never being set for that environment

Logs or screenshots

Root default, terraform/variables.tf:

variable "codex_model" {
  default = "openai.gpt-5.5"
}

Module default and gate, terraform/modules/compute/agentcore/:

# variables.tf:84
variable "kiro_model"  { default = "" }
# variables.tf:90
variable "codex_model" { default = "" }   # description says "(empty = none)"

# main.tf:422
var.kiro_model  != "" ? { kiro  = var.kiro_model }  : {},
# main.tf:426
var.codex_model != "" ? { codex = var.codex_model } : {}

Environment

• main at b9ab0b6d (feat(agentcore): add Codex CLI with Bedrock inference #350)
• Terraform >= 1.0 (terraform/main.tf:2); CI pins 1.15.0
• Affects any environment whose tfvars omits codex_model

Question

Is the non-empty root default intended?

If Codex should be opt-in like Kiro, the root default should be "" and environments should opt in through tfvars. If it is intended to be on by default, then the module variable's "" default and its (empty = none) description are misleading and should be updated to match.

Related

#350 also materializes CODEX_HOME under the persistent workspace mount (lambda/agentcore/stage-materializer.js:400; asserted as <ws>/.aidlc/codex-home in lambda/agentcore/test/stage-materializer.test.js:610). Anything on that mount is subject to the AgentCore session-storage idle expiry, documented as 14 days in terraform/modules/compute/agentcore/main.tf:619. That is the mount's expiry rather than a Codex-specific retention policy, but enabling Codex by default widens what lands there, which is a further reason to make the choice explicit.

[JWThewes]

@eipasteur codex_model configures a default model; it does not enable or select the Codex CLI. CLI selection is stored per project and defaults to Kiro. Existing cli-models parameters are also protected by ignore_changes, so they are not modified on the next apply. Setting this default to empty would only remove the explicit model pin; it would not disable Codex. Kiro and OpenCode defaults are seeded similarly.

This does not appear to be a bug as described. Deployment-level CLI allowlisting can be tracked separately as an enhancement.