Prevent the Official context cap from overriding third-party Codex task models #157

Problem

CodexHub correctly publishes the Ollama Cloud GLM-5.2 model with a raw context window of 1,000,000 tokens, but a Codex session that selects that model can still inherit the 272,000-token cap intended only for Direct Official models.

The reporter screenshot shows Ollama GLM-5.2 selected while Codex reports 54k / 258k tokens used. The 258,400 effective window is exactly 95% of the Official 272,000-token cap, not 95% of GLM-5.2's configured 1,000,000-token window.

Confirmed evidence and failure boundary

Observed with Codex CLI 0.144.5 and the current CodexHub-generated catalog:

• gpt-5.6-sol: context_window = 272000, effective_context_window_percent = 95;
• glm-5.2: context_window = 1000000, max_context_window = 1000000, effective_context_window_percent = 95; and
• a CodexHub-managed Codex configuration whose default model is Official contains top-level model_context_window = 272000 and model_auto_compact_token_limit = 244800.

On origin/dev@7ba562b1b2fbaf267403fb9d477ccbf6fac9ed9a:

• catalog_with_openai_context_guard correctly changes only models whose metadata identifies the Direct Official provider;
• config_overlay.apply_overlay reads only the persisted top-level default model;
• when that default is Official, _selected_official_context_budget returns the Official budget and build_overlay writes it as top-level Codex keys; and
• selecting a third-party model for a task/turn does not rewrite the persisted default before Codex computes the task's context budget.

The model-specific catalog is therefore correct. The failure is the scope of the CodexHub-managed top-level override: an Official-only safety cap becomes process/session-global and wins over a later third-party model selection.

Desired outcome

A context/compaction cap derived from Direct Official metadata must constrain only Direct Official model use. Selecting a third-party model must use that model's own catalog/configured limits and must never inherit a CodexHub-managed Official cap.

For the reproduced GLM-5.2 entry, the raw model window remains 1,000,000 and the 95% effective window is 950,000, not 258,400.

Scope

• Correct the ownership and application scope of CodexHub-managed model_context_window and model_auto_compact_token_limit values.
• Cover persisted Official defaults followed by task-, turn-, composer-, and native-thread model overrides to a third-party model.
• Preserve the per-model generated catalog as the source of third-party limits.
• Keep the current authoritative Official 272,000/95%/dynamic-compaction behavior when an Official model is actually selected.
• Preserve CodexHub overlay backup/restore, Stable/Beta ownership, restart, interrupted activation, and sanitized diagnostics.
• Add a deterministic cross-boundary regression that exercises both the persisted default and the effective per-task model selection.

Non-goals

• Removing the Official context guard or choosing a new Official threshold; Remove the OpenAI 272K context guard with an ownership-safe v0.1.4 migration #109 owns that paused product-policy question.
• Changing GLM-5.2's configured 1,000,000-token raw limit or 95% effective percentage.
• Changing Provider routing, request translation, authentication, retry, timeout, SSE, or model identity.
• Reinterpreting a user-authored global context override that is not owned by CodexHub.
• Changing context semantics for OMP, ZCode, Pi, OpenCode, or other managed Gateway clients.

Acceptance criteria

• With an Official persisted default and CodexHub's Official cap active, selecting glm-5.2 for a task/turn yields the model-specific 1,000,000 raw / 950,000 effective budget, not 272,000 / 258,400.
• The same regression passes for a native child/thread created with an explicit GLM-5.2 model override while the persisted default remains Official.
• Switching back to an Official model still yields the authoritative 272,000 raw / 258,400 effective window and an auto-compaction limit no greater than 244,800 for the current 272,000/95% authority.
• A second third-party fixture with a different context window proves the fix is provider/model scoped rather than hard-coded to GLM-5.2.
• CodexHub never removes, lowers, or replaces a user-authored third-party/global override unless existing ownership evidence proves CodexHub wrote it.
• Apply, restart, Stable/Beta takeover, restore, and interrupted-update fixtures do not strand an Official cap on third-party sessions or corrupt unrelated TOML.
• The generated catalog and Gateway status continue to report the exact per-model limits, and missing/contradictory Official authority still fails closed only for Official selection.
• Sanitized diagnostics identify the selected model class and effective limit source without prompts, credentials, local paths, or task identifiers.

Verification and evidence

python -m pytest -q tests/test_config_overlay.py tests/test_routing.py tests/test_catalog_sync.py
python -m pytest -q
git diff --check
python scripts/report_quality_gates.py

The report-quality command is report-only and non-blocking.

Manual evidence: with CodexHub active and the persisted default set to an Official model, start one Codex Desktop task on Ollama Cloud GLM-5.2 and record that the context tooltip reflects the model-specific effective budget (950,000 for the current 1,000,000/95% entry), then switch to an Official model and record the current 258,400 effective budget. Do not record prompt text, credentials, local paths, or task identifiers.

Expected hotset

• src-python/config_overlay.py
• tests/test_config_overlay.py
• src-python/codex_proxy.py, tests/test_routing.py, and tests/test_catalog_sync.py only if the model-selection/catalog boundary needs a narrow correction
• Minimal Tauri activation/status wiring and focused Rust tests only if the effective task-model scope cannot be proven in the Python boundary

Dependencies and relationships

No confirmed hard blocker.

Related, not duplicate:

• Keep Codex auto-compaction within the current Official context budget #124 established the authoritative Official budget and intended third-party non-regression, but its completed evidence covered catalog preservation rather than an Official persisted default plus a third-party task override.
• Remove the OpenAI 272K context guard with an ownership-safe v0.1.4 migration #109 is paused on whether the Official guard should be removed entirely. This Issue preserves that guard and corrects only its cross-model scope, so it does not depend on that policy decision.
• Propagate configured reasoning levels into managed Gateway client catalogs #154 owns reasoning-level export and does not own context-budget scoping.

Execution contract

Execution-Contract: v2
Verification-Class: strict
Verification-Commands: python -m pytest -q tests/test_config_overlay.py tests/test_routing.py tests/test_catalog_sync.py; python -m pytest -q; git diff --check; python scripts/report_quality_gates.py (report-only)
Manual-Evidence: Codex Desktop A/B with an Official persisted default: GLM-5.2 task shows its model-specific 950,000 effective budget, then Official selection shows the current 258,400 effective budget, with sanitized evidence only.
Architecture-Decision: resolved
Review-Owner: orchestrator