Recover ReviewMonitor stability from the v0.6.2 baseline

[lynnswap]

Context

ReviewMonitor became materially unstable after the unreleased architecture changes that followed v0.6.2.

Confirmed failures on current main (26c8f7b):

• Internal reviewer child JSON can appear as the final user-facing log.
• One logical review can appear as both a product run row and an internal reviewer row.
• Completed rows show age since completion instead of review duration.
• App-server omissions/refresh/runtime transitions can clear review rows and logs.
• Log presentation/viewport behavior is unstable.

The latest published release and selected recovery base is v0.6.2 (82bddbc; annotated tag c8c01d6).

Recovery strategy

Recover from a clean v0.6.2 branch. Keep its product-owned review/store/UI flow, add a ReviewMonitor-owned durable SQLite review/log history, and port only the current app-server/auth/MCP contracts that real consumers need.

Canonical local design branch: codex/v0-6-2-recovery.

Persistence selection: direct GRDB 7.11.1. Actual Swift 6/macOS 26 probes passed for both SQLiteData and GRDB; GRDB provided the required transaction/migration/MainActor observation/error/cancellation/close contracts with a much smaller dependency graph and no wrapper/global-default lifecycle.

The current generic Codex chat/CodexDataKit presentation architecture and unreleased SDK products are not migration requirements.

Tracked work

• Reintroduce API key authentication on the v0.6.2 recovery architecture #97 — API key authentication.
• Restore robust Codex executable discovery on the recovery branch #98 — Codex executable discovery.
• Keep internal reviewer subagent payloads out of user-facing review rows #99 — internal reviewer subagent payload leakage.
• Restore completed review duration semantics in the sidebar #100 — completed review duration and restart/replay semantics.
• Persist ReviewMonitor-owned review history and logs locally #102 — durable local review/log history.
• Stabilize the live log viewport during streaming and window resize #103 — live log viewport stability.
• Port the current Codex review terminal contract to the recovery backend #104 — current review terminal contract.
• Normalize current app-server review notifications in the v0.6.2 log owner #105 — current notification/output normalization.
• Make review cancellation wait for authoritative turn terminal #106 — cancellation terminal barrier.
• Update native ChatGPT authentication for the app-server-owned callback flow #107 — current ChatGPT login lifecycle.
• Protect and migrate existing ReviewMonitor local state during recovery cutover #108 — recoverable local-state cutover.
• Verify and lock the recovery MCP contract against current clients #109 — current-client MCP compatibility proof.
• Port anchor-based sidebar reordering to durable review history #110 — anchor-based durable sidebar reordering.
• Add explicit paging and deletion policy for durable review history #111 — history paging and deletion policy.

Explicitly out of scope:

• Keep sidebar rows unobscured by the bottom status accessory #101 — bottom accessory overlap, closed as not planned at the user's request.

Acceptance criteria

• One logical review has one durable ID, one row, one lifecycle, one terminal kind/cause, one truthful duration, one effective log, and one human-facing final result.
• Sidebar/detail and authorized MCP operations read the same locally committed product history.
• App-server omission, refresh, reconnect, runtime restart, account transition, or sign-out cannot clear committed history.
• Completed duration is exact; orphan recovery shows a frozen lower-bound/unavailable value rather than an advancing fake duration.
• Current Codex terminal, notification, cancellation, login, and executable-discovery behavior is supported without porting the generic-chat architecture.
• Current Codex and Claude Code pass the published session-local five-tool MCP contract.
• Existing current-main local state remains untouched and recoverable through copy/import cutover.
• Loaded history is bounded/paged, terminal deletion is explicit, and manual order is durable/anchor-based.
• The four published v0.6.2 Swift products remain source-compatible under an API digester and separate consumer fixture.
• Package/app/migration/runtime tests and final Codex review pass.

Evidence summary

A live proof run created both a correct product row and a reviewer child row. The source rollout held human output and a 130,903 ms duration; the child rollout held the expected structured JSON. The first thread-list page omitted the live review, and terminal projection triggered repeated list refreshes.

v0.6.2 structurally prevents child JSON leakage and displays fixed duration, but it has no durable cross-launch history.

Both app schemes build/test under Xcode 27. Current package UI tests crash in the API-key prompt lifecycle test; the v0.6.2 package UI suite reproducibly exposes the log tail-pinning failure tracked by #103.

Contract pins: openai/codex@3b45c29062ff0e76e71c91b6753290400e7fa8da, live codex-cli 0.148.0-alpha.15, and GRDB.swift@v7.11.1.