Skip to content
This repository was archived by the owner on Oct 9, 2026. It is now read-only.
This repository was archived by the owner on Oct 9, 2026. It is now read-only.

Build upstream snapshot integration and canary branch #428

Closed
Closed
Build upstream snapshot integration and canary branch#428
Labels
planDurable planning issueplan:donePlan completed or superseded

Description

@shiny-code-bot
shiny-code-bot
opened on Jul 23, 2026

Objective

Build a continuously refreshable upstream-first integration candidate from an exact openai/codex snapshot, then restore only contract-backed Every Code behavior. This replaces per-commit opt-in adoption with tree-level integration plus explicit product exceptions.

Finish Line

A protected integration branch descends from a recorded upstream SHA, includes the required Every Code product layer, passes the convergence contract matrix, and can absorb a newer upstream snapshot without restarting a historical per-commit audit.

Current Status

State: Complete. PR #497 merged the final proof/waiver/cleanup reconciliation into the protected candidate branch on July 29, 2026. Draft PR #465 remains the sole intentional main cutover vehicle.

Final identities:

  • Current main: 82ffbe8cae7dc68a400ea5d4f29f7bcd42b18c8f (tree 214bc12e7bff546cebc3b9198bf0d9ff2185391f).
  • Pre-anchor local baseline: 8add494682f7c0674672e8dc5b38a4565cd7629b.
  • Initial upstream snapshot U0: 4462b9deef211723b781b426f5e5d36a5777115f from merge base b89ce9a2bcedcfddf3a48f387b7912d602d6d87c.
  • Latest incrementally absorbed upstream snapshot: 61a44880a85d2fd0d8770908dea5733495e571c8.
  • Final candidate: code/upstream-snapshot-428 at merge 86cad522213c21e4d3696064878c4233cb3df724, tree bd3e9f400737f27900615ef3b011d163b0214b55.

Final evidence:

  • Four immutable upstream refresh snapshots reproduce exactly, demonstrating repeated incremental refresh rather than historical replay.
  • Strict convergence passes with 369 guarded paths, zero violations, zero stale waivers, and 40 decided waiver records (25 converged with upstream; 15 adopted upstream deletions).
  • The deterministic exec harness passes 18/18 scenarios and explicitly reports all three opt-in live scenarios instead of silently excluding them.
  • Focused gates pass: 92 harness unit tests, 275 GitHub helper tests, 41 model-manager tests, 46 TUI status tests, format, ShellCheck, and candidate compile checks.
  • PR Finalize upstream convergence proof set #497 blocking CI passed all required jobs in run 30427520665 (7m52s); its V8 build matrix correctly skipped because the change did not touch V8 inputs.
  • Bounded dry-run-first cleanup now identifies rebuildable worktree, harness, and artifact-volume caches while rejecting unbounded explicit paths and traversal/symlink escapes.

#428 no longer blocks the product. Permanent merge of PR #465 into main remains intentionally gated by #343 and the bounded reversible #382 canary; this completion does not override that recorded user decision.

Next action: reconcile #343/#382 against the now-frozen candidate, run only their remaining operational canary/rollback evidence, and merge PR #465 when those separate gates are honestly satisfied.

Last verified: July 29, 2026.

Scope

  • In: exact upstream snapshot pinning; history-preserving integration branch; risk-lane conflict handling; repeatable mirror/canary updates; compile/schema/snapshot/test gates; restoration of contract-backed Every Code product bundles.
  • Out: force-updating main; replaying all local commits; requiring all 1,017 historical commits to be classified; final product cutover; unrelated feature development.

Acceptance Criteria

  • Record current main, merge base, upstream U0, and candidate tree identity.
  • Treat upstream as the default for non-owned surfaces and record every surviving exception.
  • Consume Define Every Code-owned convergence contracts #126's contracts for identity/config, accounts/auth, history, app-server/protocol, agents/tools, TUI, release, and Every Code integrations.
  • Classify conflicts into green bulk-adopt, amber contract-adapt, red manual-review, and intentionally owned lanes.
  • Preserve additive Every Code crates/modules where their upstream API contracts still compile.
  • Validate or explicitly route the six known missing pre-checkpoint behaviors from Reconstruct pre-checkpoint semantic ledger through 1bbdb327 #407, including the OTEL counter→gauge dependency and the P1 analytics privacy finding.
  • Pass focused build, schema, migration, snapshot, integration, and repository checks appropriate to the candidate.
  • Demonstrate incremental refresh from U0 through three newer upstream snapshots without resetting the branch.
  • Leave main and the installed runtime unchanged until Cut over to converged Codex Lab baseline and primary harness #343's cutover gates are satisfied.

Relationships

Validation

Decisions

  • Upstream tree snapshots, not commit-by-commit classification, are the integration unit.
  • Historical ledgers remain provenance evidence but do not block the candidate.
  • A final cutover must preserve both histories through reviewed GitHub PRs; no force rewrite.

Open Questions

Activity

  1. shiny-code-bot
    added
    planDurable planning issue
    plan:blockedPlan blocked by an open native dependency issue
    on Jul 23, 2026
  2. shiny-code-bot
    added a parent issue on Jul 23, 2026
  3. shiny-code-bot
    marked this as blocked on Jul 23, 2026
  4. shiny-code-bot
    marked this as blocking 3 issues on Jul 23, 2026
  5. shiny-code-bot
    unmarked this as blocked on Jul 23, 2026
  6. shiny-code-bot
    added
    plan:activePlan is actionable now
    and removed
    plan:blockedPlan blocked by an open native dependency issue
    on Jul 23, 2026

  7. cbusillo commented on Jul 25, 2026

    @cbusillo
    cbusillo
    on Jul 25, 2026
    Owner

    Candidate refresh update (2026-07-25): PR #465 now points at 0eaff107a5e7 and includes openai/main through 322d5b96cfa5.

    Completed in this refresh:

    • Resolved IDENTITY-1, MODEL-1, and RELEASE-1 and implemented the resulting isolated binary/state, provider-owned catalog/default behavior, and Codex Lab-owned release chain.
    • Preserved execution-account isolation across models, MCP, plugins, skills, hooks, Apps, compact, resume/fork, and auth replacement.
    • Integrated the latest upstream exec-server policy, item timing, bounded Code Mode header, and unified-mention changes.
    • Restored signed app/package/installer/updater/rollback/provenance tooling.

    Final local evidence includes: app-server read/fork 44/44; execution-account 18/18; core-plugins 354/354; upstream timing/policy/history gates 72/72; unified mentions 6/6; package tests 83/83; GitHub helpers 47/47; cache helpers 5/5; scoped Clippy and final formatting passed.

    The repository-wide just test was attempted but the local volume exhausted free space while linking codex-tui after generating 171.4 GiB of artifacts (errno=28), with no test assertion failure. Current-head CI is running and is the complete-suite source of truth.

    No product-policy blocker remains. PR #465 stays draft only for #343 cutover sequencing and its remaining privacy, dogfood, result-quality, persistent-engine, canary, rollback, and protected-branch gates.

  8. cbusillo commented on Jul 25, 2026

    @cbusillo
    cbusillo
    on Jul 25, 2026
    Owner

    Takeover audit update (July 25, 2026): PR #465 is not currently release-ready, and I have paused the push while restoring confirmed contract gaps.

    Current local candidate: 83df7b821c39d4c6795983637cad398300bef0f2, including origin/main through 82ffbe8cae and openai/main through 20dafe201d. Remote PR head remains 8ca503f9579d6a9a512bb8d45dc49e3e6987a8b7.

    Confirmed blockers:

    • State migration compatibility: the shipped ~/.codex-lab/state_5.sqlite ledger has v36 threads session provenance, v37 threads history mode, and v38 threads visible sort indexes. The candidate reuses those versions for different migrations, which would cause SQLx checksum/version mismatch on existing Codex Lab installs.
    • Contract-backed feature wiring: codex-auto-review, codex-browser, and codex-external-agent-sessions exist but have no production dependents. Project validation / ShellCheck providers, Background Auto Review consumers, external-agent runtime routing/preflight, and the model-facing Code Bridge tool were dropped by the upstream-tree anchor and were not restored by later merges.
    • Runtime isolation/reconciliation: the daemon updater lost the child CODEX_HOME mapping to CODEX_LAB_HOME, and API-key login / external-token login / logout lost loaded-thread auth reconciliation.
    • Release hardening: inherited R2 publishing is unsafe in a fork unless guarded; the Codex Lab release path needs symbol archiving/stripping before signing; package-builder tests need blocking CI coverage.

    Validated at the refreshed local head: codex-analytics 90/90, TUI keymap setup 43/43, just fmt, and the exact ci-app codex-lab optimized build all pass. Those checks do not cover the deleted product contracts.

    I am proceeding with a restore-forward pass on this branch (not rebuilding it): migration compatibility first, then runtime/auth isolation, release guards, project-validation/background-review wiring, external integrations, and a convergence CI gate that prevents intentionally-owned/red paths from being silently dropped again. PR #465 remains draft and should not be pushed/undrafted until these fixes are integrated and validated.

  9. cbusillo
    added 3 commits that reference this issue on Jul 26, 2026

    Merge Project Validation restoration for #428

    4fff615

    Merge July 26 upstream refresh for #428

    e39b453

    Forward-port SessionProvenance contract onto upstream snapshot

    25a64a0

  10. 15 remaining items

  11. cbusillo
    added 7 commits that reference this issue on Jul 26, 2026

    Merge external compatibility restorations for #428

    32d1d78

    Merge final proof and guard coverage for #428

    0962349

    Merge final model-context bounds for #428

    f71e701

    Restore remaining external compatibility surfaces

    31b2e76

    Merge remaining compatibility fixes for #428

    ac9c95b

    fix: close the final draft-publication gates for #428

    e48f82b

    Merge final draft-publication gate fixes for #428

    2fd8cf5

  12. cbusillo commented on Jul 26, 2026

    @cbusillo
    cbusillo
    on Jul 26, 2026
    Owner

    Takeover completion update (July 26, 2026): the restored upstream integration candidate is now pushed to PR #465 at 2fd8cf5109eeb2e8c512181c6dbbed51e9363621.

    Candidate identity:

    • Descends from origin/main@82ffbe8cae7dc68a400ea5d4f29f7bcd42b18c8f.
    • Includes openai/main@61a44880a85d2fd0d8770908dea5733495e571c8.
    • Final merge tree is byte-identical to reviewed gate commit e48f82b0a7804ae823a5631dc9791e2589fab5b1.
    • Remote update was a fast-forward; the same SHA is also on code/upstream-snapshot-428-full-ci.

    The restore-forward pass now includes migration compatibility, loaded-thread auth reconciliation, release/publish hardening, Project Validation, Background Review, external-agent/Code Bridge/browser integration, compatibility shims, context bounds, production-path proofs, and a 326-path convergence guard with 61 explicit waivers.

    Final focused evidence includes: Python/workflow helpers 188 green; installer tests 20 green; app-server-protocol 296/296; focused core realtime/external-agent 26/26; MCP lib 15/15; migration repair 2/2; exact ci-app binary build green; scoped Clippy/fix/fmt green; fmt-check, locked metadata, Bazel lock, diff check, and convergence guard green.

    Four independent exact-SHA Opus publication gates found no blocker to updating the draft. They explicitly did not call it merge-ready. Remaining debt includes 56 pending_restore waivers, an independent audit of 55 fork-owned deletions not yet represented in the waiver ledger, unresolved IDENTITY-1/MODEL-1/AGENT-1 surfaces, dispatch-only runtime harness coverage, and live RELEASE-1 smoke/cutover work.

    PR #465 remains draft. The PR body now records the full scale, guard limits, README/identity caveat, unrecorded deletion audit, validation evidence, and current merge-readiness debt. Cutover remains gated by #343.

  13. shiny-code-bot commented on Jul 26, 2026

    @shiny-code-bot
    shiny-code-bot
    on Jul 26, 2026
    CollaboratorAuthor

    Convergence-system closeout update (July 26, 2026):

    Remaining action: the active #465 owner should reconcile/port the convergence-system layer from #476 onto the current candidate, preserving the newer 326-path guard and waiver work, resolve the stack conflict, and rerun the relevant gates. Do not merge #476 blindly or mutate the active owner checkout from another session.

    This session's isolated task branches/worktrees are removed. The unrelated dirty primary checkout and active #465 CI were intentionally left untouched.

  14. cbusillo commented on Jul 27, 2026

    @cbusillo
    cbusillo
    on Jul 27, 2026
    Owner

    PR #465 takeover checkpoint — July 27, 2026

    Candidate branch is clean at a5f9dfacc432612dcc68c14173f5b9615a8b267b; PR #465 remains draft as required.

    Completed:

    Validation blocker is now external cancellation, not code:

    • full CI 30231180075 was cancelled by @cbusillo at 02:34 EDT while compiling
    • retry 30232638609 was again cancelled by @cbusillo at 02:46 EDT
    • Bazel 30231186759 and retry 30232720195 were cancelled at the same times
    • V8 canary 30231128300 was also cancelled

    Do not start another expensive matrix until the competing session/automation cancelling runs is stopped. Once clear, rerun rust-ci-full on code/upstream-snapshot-428-full-ci, dispatch Bazel on code/upstream-snapshot-428, and allow V8 canary to complete. PR #465 should stay draft; no merge/undraft action is authorized.

    Follow-up after validation: design a Windows sandbox containment fix that avoids the PowerShell BCrypt.dll incompatibility instead of reintroducing RestrictedCode inside CI recovery.

  15. shiny-code-bot
    unmarked this as blocking 2 issues on Jul 29, 2026
  16. shiny-code-bot
    closed this as completedon Jul 29, 2026
  17. shiny-code-bot
    added
    plan:donePlan completed or superseded
    and removed
    plan:activePlan is actionable now
    on Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    planDurable planning issueplan:donePlan completed or superseded

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions