Repository navigation
feat(codex): add opt-in delivery observation by client message ID #72
Description
Public scoped 0.4.0 completion — 2026-10-18 KST
The user-approved limited scope is released as v0.4.0, npm latest0.4.0. Exact source dde3923efe116f87f38b1639b29b889d2b832e44, workflow39077096491 attempt1 and the reviewed/Actions/staged/public archive SHA256 84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9 were verified. Exact-main CI/CodeQL, registry signature audit, Sigstore identity/source/subject verification and isolated install/removal passed. Protected environment and final npm approvals were completed by the user.
The four dependent PRs were merged in order and the release preparation #151 is merged. Companion skill candidate #37 in session-peer-skill was prepared and its exact profile/full candidate bytes reviewed; runtime publication does not publish that skill or adopt its pin. The published skill0.2.1 remains unchanged. Postpublication documentation record is PR #152, separately awaiting human merge, without changing the immutable publication source.
This closes the approved scoped development/release work, not every possible platform or automatic receipt route. Exact macOS Codex observation and explicit operator-confirmed receipts remain the included scope. Linux observation #130, Windows observation/private storage #131 and automatic voluntary receipt producer/collector #132 remain open follow-ups. No automatic ACK, receiver deduplication, generic exactly-once or broader native-platform qualification is claimed. Earlier candidate checkpoints below are historical.
Merged implementation checkpoint — 2026-10-18 KST
The user-authorized sequence #106 → #107 → #108 → #109 is merged. Exact final main is be6adb26f844e7158362a8fcd6d379fbe8d46864; CLI/release gate39046557287 and CodeQL39046557167 passed, including Windows Node22/24. Every PR merged by normal exact-head squash after its current-head CI and automatic Code/Security reviews; no admin/protection bypass.
The implementation retains the user-approved limited scope: exact qualified macOS Codex observation and explicit operator-confirmed receipts. Linux/Windows observation and automatic receipt bootstrap remain #130–#132. Publication/skill adoption is not implied by merge. Release preparation is PR #151, tracked in #150; human preparation merge and separate exact-source publication approval remain open. The older candidate/roadmap checkpoints below are historical.
Current roadmap — 2026-10-13 KST
- Target milestone: 0.4.0 — Delivery observation.
- Planning priority: P1 (
priority:P1). - Dependencies/order: Keep all four together; Draft docs(handoff): record the jointly frozen v1 design #106 → feat(handoff): add private correlation ledger and evidence CLI #107 → feat(app-server): add bounded guarded queue-only client #108 → feat(observation): add scoped metadata projection and bounded local waits #109, then current-main integration and companion guidance.
- Remaining scope: Keep approved macOS-qualified observation and explicit operator-confirmed receipts. Platform extensions and authenticated automatic collection remain follow-ups.
This section supersedes older milestone/version/priority statements below. Existing acceptance criteria, evidence limits and historical records remain applicable. Versioned milestones are provisional planning targets, not committed dates or implementation/live-test/merge/release authorization. P1 means a milestone prerequisite/current-release item; P2 a planned extension/research track; P3 later dependent work.
User-approved 0.4.0 scope — 2026-10-11 KST
The user approved finishing all four issues #69/#70/#71/#72 together with narrowly qualified macOS arm64 Codex client-ID observation and explicit operator-confirmed receipts. This changes the planned platform/receipt scope, not the frozen handoff schema or ordinary-mode contract. Candidate implementation and test evidence are in Draft PRs #106 → #107 → #108 → #109; this checklist records reviewed candidate work, not shipped support, merged acceptance or permission to publish.
Linux native observation is tracked in #130, Windows observation/private handoff storage in #131, and a voluntary receipt producer/authenticated collector bootstrap in #132 (Future — Agent integrations). Queue acceptance, turn completion, visible response and queue deletion are never automatic ACK. Native retry remains false. Required unsupported goals refuse before effect; no post-attempt fallback/resubmission. Existing SSH trust, writer and version guards remain.
Candidate acceptance evidence
- Opt-in exact client-ID submission/observation in the original qualified Codex home/thread/generation; ordinary mode is unchanged.
-
deliveredrequires matching native client ID/item; linked turn status is independent from ACK. Warm-store metadata projection returns bounded IDs/status only to JavaScript. SQLite may internally evaluate body-bearing cells: no transcript/history API or raw body/error value is returned, and no broader privacy claim is made. - Required unsupported goals refuse before effect; only documented best-effort mode may use legacy queue before an app-server effect attempt. Once an attempt may have occurred, failure never triggers fallback/resend.
- Preserve known native submission facts through observer, persistence, timeout, SIGINT and SSH failure. Independent waits use original operation IDs/cutoffs; terminal waits are immutable and status/wait never submit.
- Local and destination-owned POSIX SSH preparation/final-send share validated target/home/epoch/generation/goal contracts. Three new qualified-macOS fake-SSH Codex fixtures cover injection, never-injected timeout and queue-response loss: exactly one queue RPC, no legacy fallback, retained binding, status zero additional submissions, duplicate attempt refused. Focused SSH suite 14/14 pass.
- Fixtures include unmatched/deleted queue, linked failed/interrupted turn, schema/storage/owner drift, deadline and cancellation. Full integrated macOS test run: 347 total / 342 pass / zero fail / five Windows-only skips.
- Evidence distinguishes actual local macOS native observation from KR/US ordinary Linux SSH queue/manual confirmation, Windows process-launch/unsupported guards, and fake peers. No Linux/Windows automatic client-ID or authenticated ACK claim.
- Human review, sequential merge, exact-main integration checks and separate exact-source release acceptance completed; public v0.4.0 evidence is recorded above.
#130/#131/#132 are the accepted follow-up scope for platform qualification and automated receipt producer/collector bootstrap. They do not change known effect facts or weaken unsupported/refusal/retry guards. The four 0.4.0 issues stay open until the human review and documentation gates are met.
Original issue plan (historical scope; superseded only by the explicit scoped acceptance above)
Python #181 proposes Codex-first, opt-in delivery observation (study). Each queued submission carries a client message ID that the thread history store records on the injected user item, together with turn status and completion time, so injection and turn completion can be observed by identifier and status alone, without reading message bodies. Deleting a queue row alone cannot distinguish consumption from manual removal, and stale unconsumed rows can persist.
Depends on #69 (contract) and #71 (shared app-server client).
Scope and completion criteria
- Opt-in only: submit through the app-server with a sender-chosen client message ID, then observe read-only in the same Codex home that received the queue.
- Report
deliveredonly when the client message ID is observed on a thread item; report turn status separately; reporttimed_out_unknownat the deadline. Never read or return message text. - When the app-server path or the history schema is unavailable/unsupported, fall back to the current
codex queueand report observation asunsupported. - No automatic resend; observation failure never changes the submission outcome.
- Local and SSH (destination-side) support with the same JSON contract; bounded deadlines and sanitized diagnostics.
- Fixture tests: injected, never injected, manual queue deletion, turn failed, schema drift, deadline expiry.
Activity
abruption commentedon Oct 7, 2026
0.4.0 source work is available as a Draft stack:
All four issues #69/#70/#71/#72 remain in the single 0.4.0 milestone and OPEN. These PRs are partial source implementations, not publication/product acceptance. Automated receipt bootstrap, Windows private storage, original-sender SSH coordination, restart observation, full setup cancellation and real live/platform qualification remain release gates. Native local/SSH retry permission remains false.
Latest local integrated check at ce4741f: build/types; npm test 259 total / 254 pass / 0 fail / 5 Windows-only skips; package smoke/install-uninstall/reproducible pack; repository checker; release pack/artifact; npm audit 0; diff checks pass. Local package SHA-256 a06956e07b7c7723a51fe59160450cbcec5b7819f3afe671d34451596d7a6f10 is validation only, not a published or exact future main artifact. Independent findings on URI routing, generation/storage binding, filesystem bounds and wait concurrency were corrected with regressions.
Review order is #106 -> #107 -> #108 -> #109. Main retarget/rebase and exact-head CodeQL/CI are required before a future merge; stacked PR checks are not CodeQL completion. No merge, npm/stage/tag/fleet/protection changes performed.
abruption commentedon Oct 11, 2026
0.4.0 progress — 2026-10-11 KST
Draft PR #109 updated at
485c6e1bfe41f0c5f5e2e775e6976d295ce69da7, integrating published 0.3.3 main without rewriting the previously reviewed Cloud fixes.Add regressions for positive native acceptance followed by ledger failure: preserve queued/submitted/queueId, reconcile unknown without resubmission, and keep total queue calls at one. Explicitly test synthetic 0.162.1 rejection for required observation (zero queues), versus exactly one legacy queue in best-effort mode before any app-server effect. Includes the revised ledger and app-server guards from the preceding PRs.
Local
npm test: 303/308 passed, 0 failed, 5 Windows-only skipped; build/types, package lifecycle/install/uninstall, repository check, release pack/artifact, audit (0) and diff checks passed. Exact-head CI/CodeQL is now 12/12 SUCCESS, without reruns (CLI, CodeQL); fixtures are not live delivery/ACK or new native/platform qualification.Remaining: Standalone restart-resumed observation, receipt/bootstrap, original-sender SSH ledger coordination, Windows private ACL storage, real live injection/ACK and new native/platform qualification remain open.
All four issues stay in 0.4.0 and remain open. The frozen handoff design controls effect/evidence semantics: required unsupported capability refuses before effect; best-effort legacy fallback is permissible only before any app-server submission may have happened. A bare correlated reply is not authenticated machine ACK. Status/wait/recovery never resubmit. This record does not approve merge/release/publication or silently repin the historical oracle.
abruption commentedon Oct 11, 2026
Physical Windows SSH test — 2026-10-11 KST
Tested the exact unpublished #109 snapshot
485c6e1bfe41f0c5f5e2e775e6976d295ce69da7on a user-authorized Windows 10 Pro x64 host (build 19045), PowerShell 5.1.19041.6456, Node 24.16.0. Existing dedicated-key SSH with BatchMode/StrictHostKeyChecking succeeded; no authentication, host-key, privilege, execution-policy or service changes. Only a new marked temporary test directory was used. Source archive SHA-25628fd777ae561b3619fce7ad170875855728ab13203715973b00faf20dbcb9e27matched after upload.Actual commands/results
npm ci --ignore-scripts --no-audit --no-fund: pass. Empty npm configs/cache and private synthetic HOME/profile/native homes; no global install.npm run test:windows: build and test:types passed; tests 266 total / 155 pass / 2 fail / 109 skip. This real-host run is not all green and was not rerun to replace the failure.Windows SSH executes encoded PowerShell/.cmd with stdin JSON and preserves refused/unknown. Its first result wasssh_preflight_failed / refused / submitted:false, rather than the expected synthetic queued result. A version-only diagnostic reproduced the C# fake-SSH executable failing at.NET Process.StartWithCreateProcesswhen starting its PowerShell child (Win32Exception: access denied). Direct Node version and Node-launched encoded PowerShell/.cmd version probes succeeded. An absolute PowerShell path in the disposable diagnostic also failed. The Windows restriction/root cause is not established; no security-policy workaround or production fix is claimed.handoff_platform_unsupported, and observation/native queue guards reject before mock owner/spawn/effect calls, all counters zero.Scope and remaining work
These are fixture tests on actual Windows, not real Codex/Claude submission, delivery, receipt ACK, or native-platform qualification. The installed Codex was not invoked or version-qualified. POSIX-scoped ledger/owner/observer integration tests remain skipped on Windows; a successful SSH login does not implement Windows ACL/durability/locking or qualify app-server cleanup. Windows handoff/metadata guards remain unsupported, and the native queue allowlist remains narrowly macOS-arm64/Codex 0.160.1. Original-sender SSH handoff/bootstrap also remains unsupported.
Private evidence was downloaded, source hash verified, and the marked remote directory was removed with an independent absence check. Existing user files, native sessions, profiles, keys, SSH settings and global installations were unchanged. No merge/release/publication performed; all four issues remain in 0.4.0.
abruption commentedon Oct 17, 2026
Completed within the user-approved scoped v0.4.0 release. Public source/artifact/signature verification and explicit limits are recorded at the top of this issue. Follow-ups #130–#132 remain open.