From c35bb92c2dfd0b5ca5fe0ee9c22a6b14307f08b7 Mon Sep 17 00:00:00 2001
From: Ryan Baum <ryan@ryanbaum.com>
Date: Mon, 29 Jun 2026 18:24:02 -0400
Subject: [PATCH] fix(CrossVendorAudit): raise codex timeout to 600s and pin
 reasoning_effort=medium

The cross-vendor audit (Cato, Rule 2a) silently returns verdict:skipped on
real ISAs: codex exec --model gpt-5.4 is a reasoning model needing ~3min on a
real bundle, but CODEX_TIMEOUT_MS caps at 120s, so SIGTERM fires before a
verdict returns. Also pin model_reasoning_effort=medium so latency is bounded
by an explicit known-good tier rather than an inherited config default
(high/xhigh can exceed even 600s). Narrowly scoped; independent of #1346.
---
 Releases/v5.0.0/.claude/PAI/TOOLS/CrossVendorAudit.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Releases/v5.0.0/.claude/PAI/TOOLS/CrossVendorAudit.ts b/Releases/v5.0.0/.claude/PAI/TOOLS/CrossVendorAudit.ts
index 2d8b087ecc..e06602f417 100644
--- a/Releases/v5.0.0/.claude/PAI/TOOLS/CrossVendorAudit.ts
+++ b/Releases/v5.0.0/.claude/PAI/TOOLS/CrossVendorAudit.ts
@@ -28,7 +28,7 @@ const CODEX_BIN = join(HOME, ".bun", "bin", "codex");
 const BUNDLE_TOKEN_CAP = 80_000;
 const CHARS_PER_TOKEN = 4; // rough estimate for bundle sizing
 const BUNDLE_CHAR_CAP = BUNDLE_TOKEN_CAP * CHARS_PER_TOKEN;
-const CODEX_TIMEOUT_MS = 120_000;
+const CODEX_TIMEOUT_MS = 600_000;
 const TOOL_ACTIVITY_TAIL_LINES = 200;
 const ARTIFACT_PER_FILE_CAP = 30_000 * CHARS_PER_TOKEN;
 
@@ -191,14 +191,14 @@ function invokeCodex(bundle: string): Promise<{ stdout: string; stderr: string;
   return new Promise((resolvePromise) => {
     const proc = spawn(
       CODEX_BIN,
-      ["exec", "--sandbox", "read-only", "--model", "gpt-5.4", "-"],
+      ["exec", "-c", "model_reasoning_effort=medium", "--sandbox", "read-only", "--model", "gpt-5.4", "-"],
       { stdio: ["pipe", "pipe", "pipe"] }
     );
     let stdout = "";
     let stderr = "";
     const timer = setTimeout(() => {
       proc.kill("SIGTERM");
-      resolvePromise({ stdout, stderr: stderr + "\n[TIMEOUT after 120s]", code: 124 });
+      resolvePromise({ stdout, stderr: stderr + "\n[TIMEOUT after 600s]", code: 124 });
     }, CODEX_TIMEOUT_MS);
 
     proc.stdout.on("data", (chunk) => (stdout += chunk.toString()));