Cut over to converged Codex Lab baseline and primary harness

[shiny-code-bot]

Objective

Cut over Codex Lab source and the primary coding-agent route only after the upstream-first candidate preserves Every Code contracts, passes product/quality gates, and proves rollback. This issue owns the protected transition from the current fork baseline to the converged baseline; it does not own candidate construction.

Finish Line

Codex Lab main and the default coding-agent route use a provenance-verified candidate that descends from the recorded upstream snapshot, preserves Every Code contracts, passes deterministic and paired real-task gates, supports rollback/re-entry, and completes a bounded soak without data loss, wrong-account use, stale binaries, stranded agents, or unbounded output.

Current Status

State: Complete. The converged Codex Lab baseline is merged to protected main.

Cutover identities:

• Previous main: 82ffbe8cae7dc68a400ea5d4f29f7bcd42b18c8f.
• Reviewed candidate: 86cad522213c21e4d3696064878c4233cb3df724.
• Protected merge commit: 6f94416cf5f7ccd5a8ed4d0b8ae5ca4c080e6df5.
• Final main tree: bd3e9f400737f27900615ef3b011d163b0214b55, exactly matching the reviewed candidate tree.

Validation:

• PR Integrate current upstream Codex snapshot with Every Code contracts #465 merged on July 29, 2026 after all required CI, the signed macOS ARM64 app build, and the complete V8 release/ptrcomp target matrix passed.
• Post-merge main blocking-CI run 30461082474 passed all 13 jobs in 8m11s.
• Strict convergence had already passed with 369 guarded paths, zero violations, zero stale waivers, and four reproducible incremental-refresh snapshots.
• The deterministic exec harness passed 18/18 scenarios, with three opt-in live scenarios explicitly reported.
• There are now zero open pull requests.

Explicit gate decision: after the candidate was fully green and mergeable, the user selected Merge now on July 29, 2026. This waived #382's three-workday/five-task canary, #381's native alternate-account proof, and exact-candidate rollback/re-entry as pre-merge requirements. #382 is closed as not planned, not complete; #381/#385 remain post-cutover dogfood follow-ups.

Ongoing upstream lag and refresh operations remain tracked by #229/#230 and do not keep this one-time cutover plan open.

Next action: continue normal Codex Lab work from merged main; address #381/#385 only as post-launch dogfood work or when real use exposes a blocker.

Blocked by: none.

Last verified: July 29, 2026.

Scope

• In: protected source cutover, immutable candidate selection, provenance, rollback/re-entry, paired quality, primary-route canary/soak, release-readiness evidence, and steady-state sync readiness.
• Out: building the upstream candidate, defining product contracts, implementing subsystem ports, or bypassing required blockers.

Acceptance Criteria

• The selected candidate records previous main, exact upstream ancestry, merge/candidate tree, build provenance, and validation evidence.
• Define Every Code-owned convergence contracts #126 contracts pass and every intentional divergence is explicit.
• Build upstream snapshot integration and canary branch #428 proves repeated incremental refresh from the initial upstream snapshot through three newer snapshots.
• Stop emitting free-form analytics error subreason #429 and all critical privacy/security/auth/sandbox/protocol findings are resolved or explicitly rejected with evidence.
• Sync TUI, Guardian, and CI substrate #308's final TUI/Guardian/CI gate and Audit codex-skills inside Codex Lab dogfood #83's paired skills/result-quality gate are complete.
• Run bounded Codex Lab primary daily-driver canary #382 was explicitly waived by the user as a pre-merge gate and closed not planned; no canary completion is claimed.
• Exact-candidate rollback/re-entry was explicitly waived as a pre-merge gate; Prove stable native remote control with separate execution auth #381/Prove persistent Codex Lab engine behind official Mac and iOS clients #385 retain the remaining post-cutover dogfood evidence.
• The cutover merged PR Integrate current upstream Codex snapshot with Every Code contracts #465 through protected main, preserving previous-main and upstream histories with no force rewrite.
• Mirror/convergence automation is present and repeatedly proven; ongoing upstream-lag operations continue under Upstream sync and Codex Lab feature reclassification #229/Sync Codex Lab with current openai/codex substrate #230.

Relationships

• Graduation gate for Upstream sync and Codex Lab feature reclassification #229/Sync Codex Lab with current openai/codex substrate #230 convergence.
• Blocked by: Audit codex-skills inside Codex Lab dogfood #83, Sync TUI, Guardian, and CI substrate #308, Build upstream snapshot integration and canary branch #428, and Stop emitting free-form analytics error subreason #429.
• Active canary child: Run bounded Codex Lab primary daily-driver canary #382.
• Related provenance: Make dogfood build provenance visible #311.
• Related GUI/remote-control graph: Dogfood Codex Lab through ChatGPT GUI remote access #365, Validate Codex Lab remote control through ChatGPT GUI #367, Prove stable native remote control with separate execution auth #381, and Prove persistent Codex Lab engine behind official Mac and iOS clients #385.
• Completed foundation: Codex Lab MVP dogfood plan #28, Prove current-binary third-party-agent dogfood #312, and closed children Prevent detached Background Review from stranding parent turns #368-Promote bounded cargo-check validation for Codex Lab dogfood #372.

Validation

• Full required CI from the exact candidate and cutover heads.
• Immutable build provenance and exact binary digest.
• Contract matrix, schema/snapshot comparisons, paired task quality, live dogfood, rollback/re-entry, and bounded soak.
• Post-merge main health and one successful upstream canary refresh.

Decisions

• Reuse this issue as the source-and-harness cutover gate rather than create a duplicate convergence-cutover issue.
• Candidate construction remained in Build upstream snapshot integration and canary branch #428; this issue owned only protected cutover and post-merge verification.
• July 28, 2026: keep PR Integrate current upstream Codex snapshot with Every Code contracts #465 draft despite green merge-critical CI while Audit codex-skills inside Codex Lab dogfood #83/Sync TUI, Guardian, and CI substrate #308/Build upstream snapshot integration and canary branch #428/Run bounded Codex Lab primary daily-driver canary #382 remained recorded gates.
• July 29, 2026: after Audit codex-skills inside Codex Lab dogfood #83/Define Every Code-owned convergence contracts #126/Sync TUI, Guardian, and CI substrate #308/Build upstream snapshot integration and canary branch #428/Stop emitting free-form analytics error subreason #429 closed and the exact candidate passed required CI, signed macOS app, and full V8 verification, the user explicitly selected Merge now.
• The July 29 decision waived Run bounded Codex Lab primary daily-driver canary #382's three-day/five-task canary, Prove stable native remote control with separate execution auth #381's native alternate-account proof, and exact-candidate rollback/re-entry as pre-merge gates. Those checks are not represented as completed; Run bounded Codex Lab primary daily-driver canary #382 closed not planned, and Prove stable native remote control with separate execution auth #381/Prove persistent Codex Lab engine behind official Mac and iOS clients #385 remain post-cutover follow-ups.
• PR Integrate current upstream Codex snapshot with Every Code contracts #465 merged through protected main with a merge commit; no branch rewrite or force push was used.

Open Questions

• Decide after cutover whether ongoing sync operations need a dedicated child or can close with proven automation and SLO ownership here.