B. Codex 0.155 protocol repair + runtime inventory #118

New issue

Closed

opened 2026-09-24 15:23:09 +00:00 by kilo · 1 comment

kilo commented

2026-09-24 15:23:09 +00:00

Member

Child B of #116 (Dynamic Execution Sources program). FIRST implementation child — confirmed protocol drift.

The bug

scarcity_router/worker_codex_adapter.py CodexSession.request (lines ~880-898) omits the params member when the local argument is None. Against codex-cli 0.155.0-alpha.16.3 this makes account/read and the first model/list page fail with JSON-RPC -32600, and is the strongest evidenced explanation for Codex snapshot health = unknown despite a logged-in controlled home.

Live evidence 2026-09-24: with explicit account/read {} the real runtime returned account.type=chatgpt, requiresOpenaiAuth=True; with model/list {} it advertised gpt-6-luna/sol/astra (low…max/ultra), plus gpt-5.5, gpt-5.6-*, gpt-daybreak-blue-latest.

Fix

Method-specific evidenced request shapes — NOT a global {} forced onto every JSON-RPC method:

account/read → params: {}
model/list first page → params: {}
model/list later pages → params: {"cursor": "..."}

Tests

Discriminating coverage that an absent params member for these methods is rejected with -32600 (fixture-shaped, real protocol shapes; the current bug must fail the new tests).

Runtime inventory on the stable surface

Use the official stable App Server surface (initialize, account/read {}, model/list {}) with bounded pagination; do not hard-code currently available reasoning efforts — the runtime is authoritative for availability. Discovery output feeds the ModelInventory contract from child A (slug + supported efforts + source_id + timestamp + provenance + auth state). No sensitive account metadata (email, raw account ids) persisted.

Also reconcile MIN_SUPPORTED_CODEX_VERSION / version gates against 0.155 evidence so health is honestly ok, not unknown, after login.

Child B of #116 (Dynamic Execution Sources program). FIRST implementation child — confirmed protocol drift. ## The bug `scarcity_router/worker_codex_adapter.py` `CodexSession.request` (lines ~880-898) omits the `params` member when the local argument is `None`. Against `codex-cli 0.155.0-alpha.16.3` this makes `account/read` and the first `model/list` page fail with `JSON-RPC -32600`, and is the strongest evidenced explanation for `Codex snapshot health = unknown` despite a logged-in controlled home. Live evidence 2026-09-24: with explicit `account/read {}` the real runtime returned `account.type=chatgpt`, `requiresOpenaiAuth=True`; with `model/list {}` it advertised `gpt-6-luna/sol/astra` (low…max/ultra), plus `gpt-5.5`, `gpt-5.6-*`, `gpt-daybreak-blue-latest`. ## Fix Method-specific evidenced request shapes — NOT a global `{}` forced onto every JSON-RPC method: - `account/read` → `params: {}` - `model/list` first page → `params: {}` - `model/list` later pages → `params: {"cursor": "..."}` ## Tests Discriminating coverage that an absent `params` member for these methods is rejected with `-32600` (fixture-shaped, real protocol shapes; the current bug must fail the new tests). ## Runtime inventory on the stable surface Use the official stable App Server surface (`initialize`, `account/read {}`, `model/list {}`) with bounded pagination; do not hard-code currently available reasoning efforts — the runtime is authoritative for availability. Discovery output feeds the ModelInventory contract from child A (slug + supported efforts + source_id + timestamp + provenance + auth state). No sensitive account metadata (email, raw account ids) persisted. Also reconcile `MIN_SUPPORTED_CODEX_VERSION` / version gates against 0.155 evidence so health is honestly `ok`, not `unknown`, after login.

kilo referenced this issue

2026-09-24 19:14:20 +00:00

Dynamic Execution Sources, Model Discovery, Multi-Account & Security #116

adrian.tkacz referenced this issue from a commit

2026-09-24 19:53:19 +00:00

fix(codex): send explicit params objects on account/read and model/list (issue #118)

kilo referenced this issue

2026-09-24 19:53:46 +00:00

Dynamic Execution Sources, Model Discovery, Multi-Account & Security (D-053, #116) #124

kilo commented

2026-09-26 17:52:57 +00:00

Author

Member

Closeout — implemented in merged PR #124 (merge commit a4370f0 into develop, head 9789c67; program #116 / D-053).

Child B delivered: method-specific evidenced request shapes on the codex App Server surface — account/read carries params {} and the first model/list page carries params {} (later pages {"cursor": …}), fixing the confirmed -32600 drift against codex-cli 0.155.0-alpha.16.3. The fake App Server now mirrors the real 0.155 strictness, so the suite rejects an absent params member with discriminating coverage. Verified live through the product path: the real runtime now answers with an honest auth verdict instead of degrading to unknown. Runtime discovery feeds the ModelInventory contract; no sensitive account metadata is persisted.

**Closeout — implemented in merged PR #124** (merge commit `a4370f0` into `develop`, head `9789c67`; program #116 / D-053). Child B delivered: method-specific evidenced request shapes on the codex App Server surface — `account/read` carries `params {}` and the first `model/list` page carries `params {}` (later pages `{"cursor": …}`), fixing the confirmed `-32600` drift against `codex-cli 0.155.0-alpha.16.3`. The fake App Server now mirrors the real 0.155 strictness, so the suite rejects an absent `params` member with discriminating coverage. Verified live through the product path: the real runtime now answers with an honest auth verdict instead of degrading to unknown. Runtime discovery feeds the ModelInventory contract; no sensitive account metadata is persisted.

kilo closed this issue

2026-09-26 17:53:23 +00:00