commit - 493b141a2c7e4f667fa2ffaf1ea8635278fe6a90
commit + 2bc69aedf0c572e1dd76c84c1a3e686d34b33ec9
blob - cfa8ed3941286d1fca9816ccf861d10200d89280
blob + dabe96d94618c20e13513fdd049b9ff53c41e48f
--- .scratch/codex-subscription-adapter/issues/01-implement-pure-c-codex-subscription-adapter.md
+++ .scratch/codex-subscription-adapter/issues/01-implement-pure-c-codex-subscription-adapter.md
# Implement the pure-C Codex subscription Adapter
-Status: ready-for-agent
+Status: needs-info
Type: task
## What to build
## Acceptance criteria
-- [ ] A new accepted ADR authorizes the experimental fixed OpenAI subscription
+- [x] A new accepted ADR authorizes the experimental fixed OpenAI subscription
endpoint, direct configured access token, manual expiry behavior, honest
client identity, and no metered fallback.
-- [ ] `provider "codex"` and named `type "codex"` routes parse, print with
+- [x] `provider "codex"` and named `type "codex"` routes parse, print with
secrets redacted, wipe secrets, reject API-key/endpoint override forms, and
accept only the profile's exact `gpt-5.5` model.
-- [ ] The first profile compiles a 272,000-token window for `gpt-5.5`, while an
+- [x] The first profile compiles a 272,000-token window for `gpt-5.5`, while an
explicit `context_limit` retains normal first priority; there is no model
discovery and every other Codex model fails before network use. Fugu uses
the raw catalog window plus its own Compaction reserve and does not import
the upstream Codex client's 95% headroom calculation.
-- [ ] Exact request fixtures pin `stream=true`, `store=false`,
+- [x] Exact request fixtures pin `stream=true`, `store=false`,
`tool_choice=auto`, `parallel_tool_calls=true`, encrypted-reasoning include,
`reasoning.effort=medium`, `text.verbosity=low`, and
`prompt_cache_key="fugu:<session-id>"`; they pin omission of
`service_tier`, and `client_metadata`. If the separate Effort directive is
explicit, `codex` v1 rejects the route before network use instead of silently
omitting Owner policy.
-- [ ] A synthetic access JWT yields exactly one bounded account header;
+- [x] A synthetic access JWT yields exactly one bounded account header;
malformed, expired, ambiguous, oversized, residency-routed, NUL, and CR/LF
cases fail before network use.
-- [ ] The Coordinator and Subagent request fixtures pin exact Responses JSON
+- [x] The Coordinator and Subagent request fixtures pin exact Responses JSON
for text, mixed Tool history, Tool errors, suffixes, compaction history,
continuity metadata, and mismatch omission.
-- [ ] The SSE decoder passes adversarial split, ordering, duplicate, conflict,
+- [x] The SSE decoder passes adversarial split, ordering, duplicate, conflict,
malformed JSON/UTF-8, usage, terminal, and every cap test.
-- [ ] Canonical Tool ids remain Responses `call_id`; provider item ids survive
+- [x] Canonical Tool ids remain Responses `call_id`; provider item ids survive
only in validated provider state and replay with their paired reasoning.
-- [ ] Continuity state is capped at 2 MiB, reflection-filtered, invisible to the
+- [x] Continuity state is capped at 2 MiB, reflection-filtered, invisible to the
UI, transactionally journaled, resumable, and removed by abandonment,
`/clear`, and `/compact`.
-- [ ] A fresh-process local TLS fixture completes
+- [x] A fresh-process local TLS fixture completes
`user -> function call -> function result -> final assistant text` using the
journaled continuity state and no `previous_response_id`.
-- [ ] Only `fugu-api` adds the exact bearer/account/user-agent/Accept/content
+- [x] Only `fugu-api` adds the exact bearer/account/user-agent/Accept/content
headers; header and local-TLS fixtures prove the forbidden cookie,
originator, beta, Responses-Lite, and optional session/request-id headers are
absent. Captured Coordinator request bodies and every imsg other than startup
secret custody remain credential free.
-- [ ] 401/403 fail once with a bounded replacement hint; 429/5xx use existing
+- [x] 401/403 fail once with a bounded replacement hint; 429/5xx use existing
pre-output retry policy; no condition triggers a metered request or account
rotation.
-- [ ] Input/cache usage does not double-count cached tokens, and Subagent usage
+- [x] Input/cache usage does not double-count cached tokens, and Subagent usage
remains excluded from the Lead Context display.
-- [ ] Existing ktrace and hardened checks prove that `fugu-api` still cannot
+- [x] Existing ktrace and hardened checks prove that `fugu-api` still cannot
open, write, or execute and that no new Role gains authority.
- [ ] An opt-in, non-root live check proves HTTP SSE, honest Fugu identity, one
- text response, one harmless `read` Tool round, and continuity capture without
- exposing token, account id, prompt, or raw response in terminal output,
- Journal, syslog, or diagnostics.
-- [ ] README/manual/config examples explain the experimental unsupported
+ text response, one harmless `read` Tool round, and continuity capture. The
+ token and account id remain absent from terminal output, Journal, syslog, and
+ diagnostics; prompt and response bytes appear only through Fugu's specified
+ canonical Owner transcript and transactional Journal records, never as raw
+ Provider transport or diagnostics.
+- [x] README/manual/config examples explain the experimental unsupported
contract, direct token placement, expiry replacement, no exact
`max_tokens` enforcement, fixed endpoint, and lack of API fallback.
- [ ] Normal, hardened, package/linkage, and release live gates pass without
Responses Lite profiles. Static research and design are sufficient for an AFK
agent to implement every hermetic slice; only final credentialed acceptance is
Owner-assisted under the explicit stop/go rules above.
+
+2026-07-17 implementation checkpoint: commits `754bf13` through `ad10e01`
+accept the fixed compatibility profile, add transactional bounded Provider
+state, implement exact Responses requests and fail-closed SSE decoding, enforce
+JWT/account/header custody, route Lead and Subagent Generations, prove fresh
+resume and Tool continuation over local TLS, and document the unsupported
+Owner-only setup and opt-in live audit. The slices were developed test-first;
+the request, stream, continuity, authentication, configuration, routing, and
+whole-Role regressions recorded failing witnesses before production changes.
+
+Follow-up proof commits `366e631`, `ec0adfb`, `b53282d`, `02ccefe`, `1e3e26b`,
+and `2c7c92c` pin exact Compaction history requests, explicit malformed JSON
+and UTF-8 rejection, delegated usage exclusion from the Lead Context display,
+the raw Codex window plus Fugu reserve/Owner-override policy, and the
+credential custody split across request-imsg, TLS-header, and Role-linkage
+seams.
+
+Native checkpoints built and linked all production Roles and reached 2428/0 in
+the focused Codex suite before the final proof-only fixtures. Those fixtures
+raise the portable focused suite to 2442/0. The final native audit rebuild links
+all production Roles; the installed-style print/local-TLS mesh reaches 143/143,
+and the deployment/package/linkage suite reaches 17/17. The latter pins the
+credentialed Codex codec and hostile decoder to `fugu-api`, with the
+credential-free request translator linked into only the Coordinator and
+Subagent request-building Roles. Existing hardened sandbox/ktrace checks remain
+the authority proof for the unchanged Role topology.
+
+Integration with configurable Effort rejects an explicit Codex Lead setting at
+configuration or Generation admission and an explicit child setting at
+Subagent startup before network use; combined native configuration, agent boot,
+and routing suites reached 292/0, 24/0, and 62/0 respectively.
+
+Criteria 1-14 and 16 are complete. The hermetic portions of criterion 17 are
+green, but criteria 15 and 17 remain unchecked until the Owner explicitly runs
+the non-root credentialed live gate. No real token was requested or used, so
+the ticket is `needs-info` and intentionally has no Resolution.
