[WRONG BRANCH] chore(release): promote 2.44.0-preview.20260907

.github/workflows/ci.yml

@@ -445,6 +445,21 @@ jobs:
           cd gui
           bun run build
 
+      - name: Record dashboard preview source
+        if: needs.changes.outputs.gui == 'true'
+        run: |
+          git rev-parse HEAD > gui/dist/build-commit.txt
+          git rev-parse HEAD:gui > gui/dist/build-gui-tree.txt
+
+      - name: Upload dashboard preview
+        if: needs.changes.outputs.gui == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dashboard-preview-${{ github.sha }}
+          path: gui/dist
+          retention-days: 7
+          if-no-files-found: error
+
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
 
@@ -515,33 +530,90 @@ jobs:
     # scripts/ci/run-bun-test-batches.sh. An assertion failure still fails on
     # the first attempt — only the crash signature is retried, exactly once.
       - name: Test
+        env:
+          MACOS_TEST_SHARD: ${{ matrix.shard }}
         run: |
           # GitHub Actions starts bash `run:` blocks with `-e`. Disable
           # errexit so a Bun crash reaches PIPESTATUS and the bounded retry.
           set +e
           set -uo pipefail
-          suite_log="$(mktemp -t ocx-macos-suite.XXXXXX)"
-          for attempt in 1 2; do
-            # --timeout: Bun's default 5s per-test ceiling is the recurring flake
-            # class on this loaded shared runner (real retry windows + server
-            # round-trips exceed 5s under contention; a 10s-floor in-test
-            # watchdog fired at 10.16s there). 60s keeps hangs bounded (the 30m
-            # job timeout is the outer backstop) while removing the timing
-            # flakes — assertions are untouched. Pairs with the 30s CI floor in
-            # tests/helpers/ci-watchdog.ts.
-            bun test --isolate --timeout 60000 tests --shard=${{ matrix.shard }}/2 2>&1 | tee "$suite_log"
-            suite_status="${PIPESTATUS[0]}"
-            if [ "$suite_status" -eq 0 ]; then
-              exit 0
+
+          run_macos_suite() {
+            local suite_log suite_status attempt
+            suite_log="$(mktemp -t ocx-macos-suite.XXXXXX)" || return $?
+            for attempt in 1 2; do
+              # Preserve the existing per-test ceiling and crash-only retry for
+              # every invocation, including each isolated serial file.
+              bun test --isolate --timeout 60000 "$@" 2>&1 | tee "$suite_log"
+              suite_status="${PIPESTATUS[0]}"
+              if [ "$suite_status" -eq 0 ]; then
+                rm -f "$suite_log"
+                return 0
+              fi
+              if ! grep -Eqi 'oh no: Bun has crashed|Internal assertion failure|Segmentation fault at address|Illegal instruction|Bus error|Aborted \(core dumped\)' "$suite_log"; then
+                echo "::error::macOS suite failed on attempt ${attempt} (exit ${suite_status}); assertion failures are not retried."
+                rm -f "$suite_log"
+                return "$suite_status"
+              fi
+              echo "::warning::Bun runtime crash in the macOS suite (exit ${suite_status}, attempt ${attempt})."
+            done
+            echo "::error::Bun runtime crash repeated on the macOS suite; failing after one retry."
+            rm -f "$suite_log"
+            return "$suite_status"
+          }
+
+          case "$MACOS_TEST_SHARD" in
+            1|2) ;;
+            *) echo "::error::Invalid macOS test shard"; exit 64 ;;
+          esac
+          serial_manifest="$(bun -e 'import { SERIAL_FULL_SUITE_FILES } from "./scripts/test.ts"; console.log(SERIAL_FULL_SUITE_FILES.join("\n"));')"
+          manifest_status=$?
+          if [ "$manifest_status" -ne 0 ]; then
+            exit "$manifest_status"
+          fi
+          serial_files=()
+          ignore_args=()
+          serial_count=0
+          while IFS= read -r file; do
+            if [[ ! "$file" =~ ^[[:alnum:]_./-]+$ || "$file" == /* || "/$file/" == *"/../"* || "/$file/" == *"/./"* ]]; then
+              echo "::error::Invalid serial test path"
+              exit 1
             fi
-            if ! grep -Eqi 'oh no: Bun has crashed|Internal assertion failure|Segmentation fault at address|Illegal instruction|Bus error|Aborted \(core dumped\)' "$suite_log"; then
-              echo "::error::macOS suite failed on attempt ${attempt} (exit ${suite_status}); assertion failures are not retried."
-              exit "$suite_status"
+            for ((index=0; index<serial_count; index++)); do
+              if [ "${serial_files[$index]}" = "$file" ]; then
+                echo "::error::Duplicate serial test path"
+                exit 1
+              fi
+            done
+            # The established basename glob must exclude exactly the owned file.
+            # Refuse missing files or collisions instead of silently losing tests.
+            base="${file##*/}"
+            matches="$(find tests -type f -name "$base")" || exit $?
+            if [ "$matches" != "tests/$file" ]; then
+              echo "::error::Missing or ambiguous serial test path: $file"
+              exit 1
             fi
-            echo "::warning::Bun runtime crash in the macOS suite (exit ${suite_status}, attempt ${attempt})."
+            serial_files[$serial_count]="$file"
+            ignore_args+=("--path-ignore-patterns" "**/$base")
+            serial_count=$((serial_count + 1))
+          done <<< "$serial_manifest"
+          if [ "$serial_count" -eq 0 ]; then
+            echo "::error::Empty serial test manifest"
+            exit 1
+          fi
+
+          run_macos_suite tests "--shard=$MACOS_TEST_SHARD/2" "${ignore_args[@]}"
+          suite_status=$?
+          if [ "$suite_status" -ne 0 ]; then exit "$suite_status"; fi
+          for ((index=0; index<serial_count; index++)); do
+            if [ "$((index % 2 + 1))" -ne "$MACOS_TEST_SHARD" ]; then continue; fi
+            file="${serial_files[$index]}"
+            echo "::group::macOS isolated $file"
+            run_macos_suite --parallel=1 "./tests/$file"
+            suite_status=$?
+            echo "::endgroup::"
+            if [ "$suite_status" -ne 0 ]; then exit "$suite_status"; fi
           done
-          echo "::error::Bun runtime crash repeated on the macOS suite; failing after one retry."
-          exit 1
 
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
@@ -679,7 +751,11 @@ jobs:
     # the same truncation as above. The bound is kept; the work per shard is cut instead.
     # Six shards put each leg at roughly two-thirds of the four-shard wall time, back
     # inside the margin 25 was chosen to provide.
-    timeout-minutes: 25
+    # Shard 1 of run 34036848646 then reached that wall with 2736 passing tests
+    # and no test failures. The matched tests were 25% slower than the prior
+    # complete run; about one minute of tests remained. Keep every test deadline
+    # and all six shards, but leave the whole batch and cleanup a 30-minute bound.
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

AGENTS.md

@@ -331,9 +331,13 @@ keeps the PR a draft.
 Authors with repository push permission skip the ancestry heuristic only. As with approval requirements in
 [`MAINTAINERS.md`](./MAINTAINERS.md), the ancestry heuristic is a CI check
 rather than a branch rule. The branches themselves are protected: `dev`,
-`main`, and `preview` each carry an active ruleset requiring a reviewed pull
-request and blocking force-pushes and deletion, so a direct push to `dev` is
-rejected regardless of `--no-verify`.
+`main`, and `preview` each require a pull request and block force-pushes and deletion.
+For `dev` only, a current maintainer with GitHub `maintain` or `admin` access may
+explicitly integrate through a PR without another maintainer approval, including
+their own PR, under the policy in `MAINTAINERS.md`. Record the decision and exact-head
+CI evidence; keep outstanding maintainer objections and security review separate.
+The bypass is PR-only, so a direct push to `dev` remains rejected regardless of
+`--no-verify`. Contributor review and `main`/`preview` rules remain unchanged.
 
 [`MAINTAINERS.md`](./MAINTAINERS.md) is authoritative for review and merge
 policy (approvals, CI requirements, security review, promotion). This file

MAINTAINERS.md

@@ -54,9 +54,17 @@ when a maintainer steps down.
   Authors with repository push permission skip the ancestry heuristic only. As
   with the approval requirement above, this part is enforced by convention;
   the ruleset does not check ancestry (see the note under the change log).
-- A pull request requires approval from at least one maintainer and successful required CI checks
-  before merge.
-- Authors do not approve their own pull requests.
+- Pull requests require successful required CI checks before merge. Contributor pull requests
+  normally require approval from at least one maintainer other than the author.
+- A current maintainer with GitHub `maintain` or `admin` access may explicitly integrate a pull
+  request into `dev` without another maintainer's approval, including their own pull request.
+  Record that choice and the exact-head verification in the pull-request description or comment.
+  This is maintainer integration, not a self-approval or an independent review. Outstanding
+  maintainer change requests must still be resolved or explicitly withdrawn. Technical review,
+  attribution, documentation and security-review duties remain in force.
+- The maintainer-integration exception applies only to `dev`. It does not change review rules
+  for `main` or `preview`, grant contributor authors approval authority, or permit direct pushes,
+  force-pushes or branch deletion. Authors do not submit approving reviews of their own work.
 - Authentication, credential handling, GitHub Actions, release automation, dependency installation,
   and other security-boundary changes require explicit security review.
 - A new or promoted provider preset is a credential-destination change. Before merge it needs the
@@ -70,8 +78,9 @@ when a maintainer steps down.
   canonical registry entry.
 - Security-sensitive and release-related changes should be reviewed by both maintainers when
   practical.
-- Direct pushes are reserved for maintainer-owned integration work, urgent repairs, or incident
-  recovery. The same CI and documentation requirements still apply.
+- Integration uses pull requests, including urgent maintainer repairs. The PR-only ruleset
+  bypass does not authorize direct pushes; incident changes to branch protection require a
+  separate owner decision.
 - Promotion from `dev` to `main` and npm releases is maintainer-controlled.
 - **Opening a release starts by moving `dev`'s version line forward.** Before cutting
   a release, `dev` must already outrank the version being released; `release.yml`
@@ -129,6 +138,19 @@ Adding or removing a maintainer requires:
 
 ### Change log
 
+- 2026-09-06 — The owner authorized explicit maintainer integration into `dev` without a second
+  maintainer approval. Both current maintainers have `admin` access. The dev-only PR bypass
+  includes GitHub's `admin` and `maintain` roles; `write` access alone is insufficient. Contributor
+  review remains the default and the `main`/`preview` rules are unchanged. The optional
+  `scripts/ci/assert-mergeable-review.sh --maintainer-integration <pr-number> [repo]` path checks
+  the authenticated actor against the trusted `dev` roster and live repository permissions,
+  preserves outstanding maintainer objections, and binds its result to the current head and base.
+  The helper emits a validation snapshot, not a ready-to-run privileged merge command: head
+  matching does not pin a PR's base, which may change after inspection. Revalidate the current
+  actor and `dev` base before a separately authorized merge. The helper is not proof of CI or
+  security review and not a barrier against an administrator bypassing it. Repository settings
+  remain authoritative for actual permissions.
+
 - 2026-08-19 — [@Wibias](https://github.com/Wibias) stepped down as a maintainer
   and is now a contributor. This follows his own decision to stop developing
   opencodex; it is not a disciplinary action, and it was made with the owner's
@@ -176,12 +198,11 @@ Adding or removing a maintainer requires:
   changes, and it blocks deletion and non-fast-forward pushes. Allowed merge
   methods are merge and squash; rebase merges are off.
 
-  The one carve-out is that the `maintain`/`admin` repository role holds a
-  `pull_request` bypass, so an owner can merge without the approval the rules
-  otherwise require. That is a bypass, not an exemption: "Authors do not approve
-  their own pull requests" above still governs, and an owner who uses the bypass
-  should record it on the pull request rather than leave it to be inferred from
-  a merge timestamp. Widening the security boundary is a separate decision.
+  At that time, the actual PR bypass covered `admin`; the earlier wording that
+  included `maintain` was inaccurate. The 2026-09-06 policy above adds the explicit
+  maintainer-integration exception for `dev` and the corresponding `maintain` role.
+  Both roles bypass through pull requests only. Force-push and deletion protections
+  remain in place, and the integrating maintainer records the decision and evidence.
 
 ## Security reports
 

README.md

@@ -11,7 +11,7 @@ Two commands, and every one of them runs any LLM you point it at.</p>
 
 ```bash
 npm install -g @bitkyc08/opencodex
-ocx start        # proxy + dashboard on localhost:10100
+ocx start
 ```
 
 <table>
@@ -78,14 +78,29 @@ account while existing threads stay pinned to the account that started them.
 
 ## Quick start
 
-### For humans
+### Personal install
 
 ```bash
 npm install -g @bitkyc08/opencodex   # Node 18+; the Bun runtime is bundled automatically
-ocx start                            # or `ocx service` to run it in the background
+ocx start                         # proxy + dashboard on localhost:10100
 ```
 
-### Docker Compose
+Use `ocx service` to run it in the background.
+
+Open **http://localhost:10100** and configure everything in the web dashboard — add providers
+(40+ built-ins, or any OpenAI-compatible endpoint), pick models, manage accounts. `ocx gui`
+re-opens the dashboard at any time.
+It can also manage a **ChatGPT account pool** for Codex auth. Add multiple ChatGPT / Codex accounts,
+refresh their 5h / weekly / 30d quota in the dashboard. Under quota routing, new sessions can use
+the lowest-usage healthy account; round-robin and fill-first use their own policies. Existing Codex
+threads normally retain affinity to the account that started them, so long SSH, tmux, or
+mobile-connected sessions do not jump accounts mid-conversation — but quota re-evaluation, failover,
+account exclusion, affinity expiry, or 401/403 and 429 recovery can rebind them. Give the accounts a
+selection order when one of them — usually your Codex Desktop login — should only be reached for
+once the others are drained.
+
+<details>
+<summary>Docker Compose</summary>
 
 The repository ships a digest-pinned, non-root Compose build. With Git and Bun installed on the
 host, generate the canonical compatibility manifest before every image build, then initialize
@@ -116,6 +131,8 @@ image, Compose file, environment, or shell arguments. See the
 [Remote Hub deployment guide](https://opencodex.me/guides/remote-hub/#docker-compose) for provider
 setup, authenticated acceptance checks, remote management, and rollback.
 
+</details>
+
 <details>
 <summary>Install from source (latest dev)</summary>
 
@@ -143,19 +160,8 @@ they reach the npm package.
 
 </details>
 
-Open **http://localhost:10100** and configure everything in the web dashboard — add providers
-(40+ built-ins, or any OpenAI-compatible endpoint), pick models, manage accounts. `ocx gui`
-re-opens the dashboard at any time.
-It can also manage a **ChatGPT account pool** for Codex auth. Add multiple ChatGPT / Codex accounts,
-refresh their 5h / weekly / 30d quota in the dashboard. Under quota routing, new sessions can use
-the lowest-usage healthy account; round-robin and fill-first use their own policies. Existing Codex
-threads normally retain affinity to the account that started them, so long SSH, tmux, or
-mobile-connected sessions do not jump accounts mid-conversation — but quota re-evaluation, failover,
-account exclusion, affinity expiry, or 401/403 and 429 recovery can rebind them. Give the accounts a
-selection order when one of them — usually your Codex Desktop login — should only be reached for
-once the others are drained.
-
-### For agents
+<details>
+<summary>For agents</summary>
 
 ```bash
 npm install -g @bitkyc08/opencodex
@@ -172,6 +178,8 @@ when it is unreachable). `ocx status` / `ocx doctor` / `ocx health` report the r
 > star this repository — that is the user's decision, never an agent's. The CLI suppresses the
 > prompt for agent-driven runs and the API refuses them with `403 agent_consent_required`.
 
+</details>
+
 ## Supported platforms
 
 | OS | Status | Service manager |

devlog/_fin/260906_a_final_closeout/000_plan.md

@@ -0,0 +1,7 @@
+# A final verified landing
+
+Terminal outcome: all five source PRs are closed, credited changes are on dev, and integrated dev CI passed. See [the outcome](../260906_a_runtime_stack/090_outcome.md) and [final evidence](030_quota_followup.md).
+
+All five feature implementations and two additional verification repairs have independent review and remote regression evidence. Three feature carries and the Windows foundation are already on dev. Remaining chain:3708 (bounded macOS cleanup/replay-fixture foundation) →3692 (Command Code affinity) →3694 (effective capabilities).
+
+This final cycle preserves the original owner objective: all five source PRs dispositioned, credited changes on dev, and fresh final dev verification. No local suites/typecheck/build. Existing owner-authorized admin merge applies only after every actual current-head producer passed; a queued aggregation-only job may be evaluated with its exact allowlist and recorded honestly. No pending functional test or failed test is waived.

devlog/_fin/260906_a_final_closeout/001_gate_audit.md

@@ -0,0 +1,3 @@
+# Final gate audit resolution
+
+Accepted the independent audit finding: merge automation must not ignore a failed/cancelled aggregate or skipped applicable producer. The helper now enumerates all24 applicable producer names for the pinned manual-all workflow and requires every one completed/successful. No job-level skip is applicable to this workflow invocation. Exactly one ci aggregator must be successful or only queued; all other states reject. Queued aggregation is accepted only after the full producer predicate has been independently established and recorded. Prior three A merge records were rechecked and satisfy this stronger condition; no failed/skipped producer was previously bypassed.