OpenAI status uses a different Codex session than make codex-login

kilo commented

2026-10-04 11:41:01 +00:00

Member

Goal

Make recommendation telemetry use the same configured Codex source that make codex-login authenticates, without recurring manual CODEX_HOME overrides.

Why

Owner-reported and reproduced on Precision on 2026-10-04: scarcity-router status inherits CODEX_HOME pointing at the user's ordinary Codex home and returns openai unknown/telemetry_unknown with no windows. make codex-login authenticates the worker source's isolated home. Running the same installed status command with the worker source home restores healthy OpenAI telemetry. The actual login is successful; session discovery is inconsistent.

Scope

Shared default OpenAI collector selection used by CLI, REST and MCP; per-subprocess Codex home plumbing; reuse of the installed worker-service configuration reader; deterministic regression tests; existing provider/user documentation and explicit decision record for source precedence.

Acceptance Criteria

With exactly one Codex source in the installed worker service, the default collector uses that source's existing controlled home, regardless of ambient CODEX_HOME, without another login or credential copying.
Reuse the same standalone/pinned binary discovery as worker login, with existing SCARCITY_ROUTER_CODEX_BIN override preserved.
No installed service or no configured source preserves ordinary local Codex collection and ambient CODEX_HOME.
Multiple configured sources require an explicit source choice, with an actionable safe error; provide an explicit local-session opt-out for existing workflows. Unknown or malformed source selection must never choose another account silently.
Missing/malformed/unreadable worker configuration and invalid controlled homes fail safely; no credential-home provisioning, credential reads/copying, or global environment mutation occurs during selection.
Existing normalized capacity/eligibility documents and recommendation-only API schemas remain unchanged; no inference occurs.
Deterministic tests cover selection, custom state paths, handwritten/generated units, binary precedence, ambiguity, malformed configuration, local compatibility, child-only environment, and absence of secret/path leakage in normalized output.
Verify the reported working environment without retaining raw provider responses or credentials; run uv sync --only-dev, make check, uv run basedpyright, git diff --check.

Constraints

Preserve per-source isolation, official app-server telemetry, existing D-018 bounded recovery, and proven SSH/headless login behavior. No changes to the execution worker, authentication mechanism/storage, network exposure, catalog, or public serialized contracts. Do not modify shell/global Kilo configuration or reinstall/restart a running worker automatically. Expected complexity: a small source-selection fix in existing modules, not a new configuration framework. Budget: 120 minutes, one independent review, at most one remediation and one narrow recheck; one retry per worker/reviewer. Security-aware review of credential-context selection; no new credential authority/storage/network boundary. UX review required. Human merge gate; no automatic merge.

Links

Owner diagnosis and request in the current local session, 2026-10-04.
D-066 and issue #168 (worker-source discovery for make codex-login).
README.md (Check Capacity; Codex login), docs/providers.md, docs/security.md.

## Goal Make recommendation telemetry use the same configured Codex source that `make codex-login` authenticates, without recurring manual CODEX_HOME overrides. ## Why Owner-reported and reproduced on Precision on 2026-10-04: `scarcity-router status` inherits CODEX_HOME pointing at the user's ordinary Codex home and returns openai unknown/telemetry_unknown with no windows. `make codex-login` authenticates the worker source's isolated home. Running the same installed status command with the worker source home restores healthy OpenAI telemetry. The actual login is successful; session discovery is inconsistent. ## Scope Shared default OpenAI collector selection used by CLI, REST and MCP; per-subprocess Codex home plumbing; reuse of the installed worker-service configuration reader; deterministic regression tests; existing provider/user documentation and explicit decision record for source precedence. ## Acceptance Criteria - With exactly one Codex source in the installed worker service, the default collector uses that source's existing controlled home, regardless of ambient CODEX_HOME, without another login or credential copying. - Reuse the same standalone/pinned binary discovery as worker login, with existing SCARCITY_ROUTER_CODEX_BIN override preserved. - No installed service or no configured source preserves ordinary local Codex collection and ambient CODEX_HOME. - Multiple configured sources require an explicit source choice, with an actionable safe error; provide an explicit local-session opt-out for existing workflows. Unknown or malformed source selection must never choose another account silently. - Missing/malformed/unreadable worker configuration and invalid controlled homes fail safely; no credential-home provisioning, credential reads/copying, or global environment mutation occurs during selection. - Existing normalized capacity/eligibility documents and recommendation-only API schemas remain unchanged; no inference occurs. - Deterministic tests cover selection, custom state paths, handwritten/generated units, binary precedence, ambiguity, malformed configuration, local compatibility, child-only environment, and absence of secret/path leakage in normalized output. - Verify the reported working environment without retaining raw provider responses or credentials; run uv sync --only-dev, make check, uv run basedpyright, git diff --check. ## Constraints Preserve per-source isolation, official app-server telemetry, existing D-018 bounded recovery, and proven SSH/headless login behavior. No changes to the execution worker, authentication mechanism/storage, network exposure, catalog, or public serialized contracts. Do not modify shell/global Kilo configuration or reinstall/restart a running worker automatically. Expected complexity: a small source-selection fix in existing modules, not a new configuration framework. Budget: 120 minutes, one independent review, at most one remediation and one narrow recheck; one retry per worker/reviewer. Security-aware review of credential-context selection; no new credential authority/storage/network boundary. UX review required. Human merge gate; no automatic merge. ## Links - Owner diagnosis and request in the current local session, 2026-10-04. - D-066 and issue #168 (worker-source discovery for make codex-login). - README.md (Check Capacity; Codex login), docs/providers.md, docs/security.md.

kilo commented

2026-10-04 12:01:29 +00:00

Author

Member

Implementation checkpoint on branch fix/171-openai-status-worker-session (uncommitted; no merge/PR/commit performed): shared default collector now follows the installed worker source. SCARCITY_ROUTER_CODEX_SOURCE supports an explicit configured source or @local; configuration mistakes fail with safe actionable messages. Child-only CODEX_HOME preserves the parent environment. Precision checkout status now reports OpenAI ok without a manual home override; no credentials/raw responses retained.

Dependency-only moves were necessary to keep basedpyright import-cycle checks intact: existing controlled-home lifecycle to codex_home.py, existing binary discovery to the acquisition module, and the existing ZCode state-path naming helper to worker_local_store.py. Execution/login semantics are unchanged. No new configuration framework or credential authority/store/network boundary.

Focused regression run: 517 tests passed with umask 0022; final status tests: 26 passed; uv run basedpyright: 0 errors/0 warnings. Original host umask 0002 makes existing worker-service fixtures group-writable and correctly refused by unchanged security checks; validation uses 0022 without relaxing those checks. Full gate pending.

Freeze for one independent correctness/security-aware/UX review: reviewed_head d90f4506f4a5262eaceb842b54d83472993ee890; tracked binary diff SHA-256 ba2d8a790509811e52cd59a54567a6b2fb2927fb8c3318cd56546da7688fc91c; untracked codex_home.py Git object fingerprint 23bc7d2eeede16f41b4d1950fcd78265671f1ff1. No source writes/pushes during review. Budget remains one review, at most one remediation and narrow recheck, 120-minute ceiling; human merge gate.

Implementation checkpoint on branch `fix/171-openai-status-worker-session` (uncommitted; no merge/PR/commit performed): shared default collector now follows the installed worker source. `SCARCITY_ROUTER_CODEX_SOURCE` supports an explicit configured source or `@local`; configuration mistakes fail with safe actionable messages. Child-only CODEX_HOME preserves the parent environment. Precision checkout status now reports OpenAI `ok` without a manual home override; no credentials/raw responses retained. Dependency-only moves were necessary to keep basedpyright import-cycle checks intact: existing controlled-home lifecycle to `codex_home.py`, existing binary discovery to the acquisition module, and the existing ZCode state-path naming helper to `worker_local_store.py`. Execution/login semantics are unchanged. No new configuration framework or credential authority/store/network boundary. Focused regression run: 517 tests passed with `umask 0022`; final status tests: 26 passed; `uv run basedpyright`: 0 errors/0 warnings. Original host `umask 0002` makes existing worker-service fixtures group-writable and correctly refused by unchanged security checks; validation uses 0022 without relaxing those checks. Full gate pending. Freeze for one independent correctness/security-aware/UX review: reviewed_head `d90f4506f4a5262eaceb842b54d83472993ee890`; tracked binary diff SHA-256 `ba2d8a790509811e52cd59a54567a6b2fb2927fb8c3318cd56546da7688fc91c`; untracked `codex_home.py` Git object fingerprint `23bc7d2eeede16f41b4d1950fcd78265671f1ff1`. No source writes/pushes during review. Budget remains one review, at most one remediation and narrow recheck, 120-minute ceiling; human merge gate.

kilo commented

2026-10-04 12:14:50 +00:00

Author

Member

Independent review found two MERGE_BLOCKER cases: handwritten equals-form source flags could be ignored / empty generated sources normalized away, and service-derived binary pins bypassed worker/login non-symlink validation. The one remediation fixes both: exact equals-form source/state/bin parsing plus rejection of empty/abbreviated selection flags; shared validation of service-derived pins while retaining the explicit SCARCITY_ROUTER_CODEX_BIN override semantics. Deterministic reproductions added.

Narrow independent final verification: PASS, both blockers fixed, no material UX regression. Reviewer independently ran 46 targeted tests and reproduced both fixes without credentials/network/inference. Author focused validation: 522 tests pass; basedpyright 0 errors/0 warnings; diff check passes; Precision checkout status remains OpenAI ok with no CODEX_HOME override.

Final reviewed snapshot: same reviewed_head d90f4506f4; tracked diff SHA256 263dbf39aad2a4fd4749881ab5b12748bc00932b3b494740ebf03ce137bc4ef5; new codex_home.py fingerprint unchanged 23bc7d2eee. Full repository gate still running. No commit/push/PR/merge performed; issue stays open until human-reviewed integration into develop.

Independent review found two MERGE_BLOCKER cases: handwritten equals-form source flags could be ignored / empty generated sources normalized away, and service-derived binary pins bypassed worker/login non-symlink validation. The one remediation fixes both: exact equals-form source/state/bin parsing plus rejection of empty/abbreviated selection flags; shared validation of service-derived pins while retaining the explicit SCARCITY_ROUTER_CODEX_BIN override semantics. Deterministic reproductions added. Narrow independent final verification: PASS, both blockers fixed, no material UX regression. Reviewer independently ran 46 targeted tests and reproduced both fixes without credentials/network/inference. Author focused validation: 522 tests pass; basedpyright 0 errors/0 warnings; diff check passes; Precision checkout status remains OpenAI ok with no CODEX_HOME override. Final reviewed snapshot: same reviewed_head d90f4506f4a5262eaceb842b54d83472993ee890; tracked diff SHA256 263dbf39aad2a4fd4749881ab5b12748bc00932b3b494740ebf03ce137bc4ef5; new codex_home.py fingerprint unchanged 23bc7d2eeede16f41b4d1950fcd78265671f1ff1. Full repository gate still running. No commit/push/PR/merge performed; issue stays open until human-reviewed integration into develop.

kilo commented

2026-10-04 12:34:40 +00:00

Author

Member

Final local implementation/installation evidence (2026-10-04):

uv sync --only-dev completed.
Full final umask 0022 && make check: 2674 tests run, OK, 15 skipped; basedpyright 0 errors/0 warnings. A prior full run exposed the old AST provisioning allowlist still naming the pre-move module: corrected by REPLACING worker_codex_adapter.py with codex_home.py, not widening permitted writes. Added an explicit successful-collection assertion that ControlledCodexHome.ensure cannot be called. Reviewed production code did not change after the narrow PASS verification.
Additional final uv run basedpyright and git diff --check pass.
make install succeeded, updating the isolated uv tool package and four console commands from the validated checkout. No worker-service installation/restart, credential copying, or shell/global Kilo configuration changes.
Ran the INSTALLED scarcity-router status from /home/adrian, with no environment override: OpenAI status=ok plan=prolite, validated weekly window; Z.ai remains healthy. This verifies the owner's exact ordinary-shell workflow, not only checkout execution.
Independent review + single remediation + narrow verification finished PASS, including UX.

Final tracked diff SHA256 569f7acd5e3a5c6051ab09b474bf6d5711b37023836fad05da49baf245372823 (post-review delta only guardrail/test metadata); codex_home.py fingerprint unchanged 23bc7d2eeede16f41b4d1950fcd78265671f1ff1. Branch fix/171-openai-status-worker-session; origin/develop..HEAD contains no commits or merges; all uncommitted files are scoped to #171. No commit, push or PR was requested/performed. Issue remains OPEN: verified locally is not integrated into develop; human review/integration remains the merge gate. Existing already-running MCP/REST processes need their normal restart to load the newly installed code; the CLI works immediately.

Final local implementation/installation evidence (2026-10-04): - `uv sync --only-dev` completed. - Full final `umask 0022 && make check`: 2674 tests run, OK, 15 skipped; basedpyright 0 errors/0 warnings. A prior full run exposed the old AST provisioning allowlist still naming the pre-move module: corrected by REPLACING `worker_codex_adapter.py` with `codex_home.py`, not widening permitted writes. Added an explicit successful-collection assertion that `ControlledCodexHome.ensure` cannot be called. Reviewed production code did not change after the narrow PASS verification. - Additional final `uv run basedpyright` and `git diff --check` pass. - `make install` succeeded, updating the isolated uv tool package and four console commands from the validated checkout. No worker-service installation/restart, credential copying, or shell/global Kilo configuration changes. - Ran the INSTALLED `scarcity-router status` from `/home/adrian`, with no environment override: OpenAI `status=ok plan=prolite`, validated weekly window; Z.ai remains healthy. This verifies the owner's exact ordinary-shell workflow, not only checkout execution. - Independent review + single remediation + narrow verification finished PASS, including UX. Final tracked diff SHA256 `569f7acd5e3a5c6051ab09b474bf6d5711b37023836fad05da49baf245372823` (post-review delta only guardrail/test metadata); `codex_home.py` fingerprint unchanged `23bc7d2eeede16f41b4d1950fcd78265671f1ff1`. Branch `fix/171-openai-status-worker-session`; `origin/develop..HEAD` contains no commits or merges; all uncommitted files are scoped to #171. No commit, push or PR was requested/performed. Issue remains OPEN: verified locally is not integrated into develop; human review/integration remains the merge gate. Existing already-running MCP/REST processes need their normal restart to load the newly installed code; the CLI works immediately.

adrian.tkacz referenced this issue from a commit

2026-10-04 17:00:29 +00:00

Align OpenAI telemetry with the configured Codex worker session (#171)

kilo referenced this issue from a pull request that will close it,

2026-10-04 17:01:24 +00:00

Align OpenAI telemetry with the configured Codex worker session (#171) #172

kilo commented

2026-10-04 17:01:47 +00:00

Author

Member

On Adrian's explicit request, committed the unchanged validated fix as df6f758ff4e3b1efaeb49b3b763c74d97de53677, pushed fix/171-openai-status-worker-session to canonical Forgejo, and opened PR #172 targeting develop: BioMedical-IT/scarcity-router#172

Fresh pre-commit gate: uv sync --only-dev; umask 0022 && make check (2674 tests run, OK, 15 skipped); additional uv run basedpyright (0 errors/warnings); git diff --check passed. Single issue-scoped commit, no merge commits, clean local worktree. Previous independent review PASS remains valid: no implementation changes since the validated snapshot. Intermittent nonfatal fixture-thread teardown traceback is disclosed in the PR.

PR is OPEN and unmerged for Adrian's human review/merge. Issue remains open pending integration into develop; no main promotion.

On Adrian's explicit request, committed the unchanged validated fix as `df6f758ff4e3b1efaeb49b3b763c74d97de53677`, pushed `fix/171-openai-status-worker-session` to canonical Forgejo, and opened PR #172 targeting develop: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/pulls/172 Fresh pre-commit gate: uv sync --only-dev; umask 0022 && make check (2674 tests run, OK, 15 skipped); additional uv run basedpyright (0 errors/warnings); git diff --check passed. Single issue-scoped commit, no merge commits, clean local worktree. Previous independent review PASS remains valid: no implementation changes since the validated snapshot. Intermittent nonfatal fixture-thread teardown traceback is disclosed in the PR. PR is OPEN and unmerged for Adrian's human review/merge. Issue remains open pending integration into develop; no main promotion.

adrian.tkacz referenced this issue from a commit

2026-10-04 17:29:33 +00:00

Fix foreign-owner fixture for root CI runners (#171)

kilo commented

2026-10-04 17:30:39 +00:00

Author

Member

CI follow-up pushed to existing PR #172 as 59ec4690e7ecf852ebe1135bfb7c0cc9baaf9463 (only tests/test_worker_local_store.py).

Root cause: test_untrusted_final_directory_below_home_is_refused mocked final owner UID 0 as foreign, but the CI runner itself has effective UID 0, so production correctly accepted the user's own directory. Reproduced the exact original failure in an isolated root Python 3.12 container with read-only code mounts and no network. The fixture now selects UID 1 under root and UID 0 otherwise; it still asserts ownership refusal and no created files. No production changes, skipped-test additions, security-policy changes, or fixture privilege escalations.

Validation: worker-local-store module as real root: 48 tests run, OK (16 existing skips); non-root: 48 tests run, OK (15 existing skips). Reported test executes/passes in both. Full local gate: uv sync --only-dev; umask 0022 && make check (2674 tests run, OK, 15 skipped); extra uv run basedpyright: 0 errors/warnings; git diff --check passes. Reviewed production code remains unchanged; UX impact none. PR body updated with root reproduction and fresh evidence. New remote CI outcome is not yet asserted; PR remains open/unmerged for Adrian.

CI follow-up pushed to existing PR #172 as `59ec4690e7ecf852ebe1135bfb7c0cc9baaf9463` (only tests/test_worker_local_store.py). Root cause: test_untrusted_final_directory_below_home_is_refused mocked final owner UID 0 as foreign, but the CI runner itself has effective UID 0, so production correctly accepted the user's own directory. Reproduced the exact original failure in an isolated root Python 3.12 container with read-only code mounts and no network. The fixture now selects UID 1 under root and UID 0 otherwise; it still asserts ownership refusal and no created files. No production changes, skipped-test additions, security-policy changes, or fixture privilege escalations. Validation: worker-local-store module as real root: 48 tests run, OK (16 existing skips); non-root: 48 tests run, OK (15 existing skips). Reported test executes/passes in both. Full local gate: uv sync --only-dev; umask 0022 && make check (2674 tests run, OK, 15 skipped); extra uv run basedpyright: 0 errors/warnings; git diff --check passes. Reviewed production code remains unchanged; UX impact none. PR body updated with root reproduction and fresh evidence. New remote CI outcome is not yet asserted; PR remains open/unmerged for Adrian.

adrian.tkacz referenced this issue from a commit

2026-10-04 18:51:11 +00:00

Merge pull request 'Align OpenAI telemetry with the configured Codex worker session (#171)' (#172) from fix/171-openai-status-worker-session into develop

adrian.tkacz closed this issue

2026-10-04 18:51:11 +00:00