Launch Codex Lab and establish post-cutover roadmap

[shiny-code-bot]

Objective

Own the post-cutover Codex Lab roadmap after the MVP and upstream-first source cutover. Keep launch, reliability, product value, platform bets, and continuous upstream sync separate so only one concrete item is active at a time.

Finish Line

A signed, provenance-verified Codex Lab private release is installed through the supported path and used successfully by a second developer; known limitations are explicit, rollback is proven, and subsequent product work is sequenced from real dogfood evidence.

Current Status

State: historical roadmap container, waiting outside the milestones. The merged DIRECTION.md replaces the old convergence, lab.8 and engine Background Review schedule. The disposition in #964 retired milestones 3/4/5/6/9. On 2026-09-26 the backlog reconciliation closed the retired open children (#490, #540, #549, #598, #602, #603, #642, #319) and parked #383 and #794. #637 (retained CI backlog) and #230 (historical convergence record) stay open as waiting records.
Next action: none from this container. Current work is the "Remote access on the fresh start" milestone (#974, with #979, #976 and #977), then "Other needs on the fresh start" (#993, #994).
Waiting for: nothing. The roadmap and acceptance sections below are historical and do not authorize work.
Last verified: 2026-09-26 backlog reconciliation against the merged DIRECTION.md.

Roadmap

Current finite source work

Milestone 3 retains completed #902 and active #634. #927 fixes inventory and resumable execution; #928 admits and qualifies one fixed range with an honest timing ledger. A recovery-sized range may supply lab.8 but does not satisfy #634's ordinary-refresh proof. Repeatability and remaining lag belong to #230.

lab.8 release and installed acceptance

Milestone 9 contains #929 publication and #843/#844/#849/#904/#906/#783 carried acceptance. #929 waits for #928's qualified landing, not whole #634 closure. Installed evidence follows the published artifact, so publication is never blocked by closing its consumers. The actual installed version at acceptance start determines rollback.

Milestone 7's lab.6/lab.7 tracking is superseded with historical results preserved; moving unfinished work does not mark it complete. #850 is assigned to milestone 5 under #795 as a separate unresolved cutover gate. No code-route activation is part of lab.8 publication or installation.

Next product and later work

#787 is the next product slice after one qualified convergence, or when the checkpoint rule parks it. Its remaining instruction-delivery guarantees are not waived by the release. Milestone 4's broader completion work and milestone 6's performance targets stay independent and do not all become lab.8 blockers.

#778/#231/#149 retain research from #926. No auth proxy, MCP agent migration, review-hook replacement, T3 dependency, or infrastructure retirement is selected. Existing cache/storage/owner-control goals remain parked unless an actual current blocker justifies a narrow promotion.

Acceptance Criteria

• A signed private prerelease is published from an exact merged main commit and installed through the supported path by a second developer.
• The installed runtime reports exact release/source provenance and does not rebuild from source during normal launch.
• One bounded second-user smoke proves install, launch, a real code-changing turn, one external-agent operation, one Automatic Validation result, one visible Background Review outcome, restart/resume, and rollback.
• Authentication, permissions, model/provider selection, core status surfaces, known limitations, failure reporting, and rollback are documented in a short recipient guide.
• Scope enters the private-dogfood milestone only when the second-user canary cannot complete install, launch, the core harness smoke, or rollback without it.
• Post-release priorities are selected from observed dogfood evidence rather than open-issue count or architectural adjacency.

Relationships

• Codex Lab MVP dogfood plan #28 and Codex fork overlay capability map #1/Provider-agnostic worker decision spike #2 preserve the original product/overlay intent.
• Sync Codex Lab with current openai/codex substrate #230 owns continuous maintenance, with Automate low-token recurring upstream convergence #634 finite proof and its Prepare complete inventory and resumable convergence execution #927/Complete one timed pinned convergence after lab.7 #928 children.
• Prepare and publish exact-provenance Codex Lab lab.8 #929 owns lab.8 publication; Prove installed Codex Lab release acceptance through lab.8 #843 owns installed release acceptance with Prove installed lab.8 upgrade, rollback, and agent reachability #844/Prove installed Astra compatibility on lab.8 #849/Restore provider CLI discovery in the installed Lab supervisor #904/Restore native external-agent routing with default roles and V2 plaintext tasks #906. Route Codex Lab update checks through the Codex Lab release channel #783 consumes installed updater evidence.
• Cut the code command over to a provenance-verified Codex Lab release #795 requires Prove installed Codex Lab release acceptance through lab.8 #843 plus Qualify model cache and wire compatibility before runtime cutover #850 and separate activation authority. Qualify model cache and wire compatibility before runtime cutover #850 moves to cutover ownership rather than remaining a release-child closure trap.
• Preserve applicable AGENTS instructions in Background Review context #787 is next product priority. Extract Codex Lab runtime behind extension and native agent-provider boundaries #778/Rework durable Background Review around upstream review primitives #231/Plugin lifecycle hooks for workspace preparation and quality providers #149 carry scoped research from superseded Explore a thin-fork path: stock Codex engine with Lab features moved to plugin, MCP bridge, and a minimal patch series #926.
• Keep build storage bounded and release/convergence builds fast #549/Reduce blocking CI latency without weakening PR isolation #637/Correct SDK cache invalidation and runner cleanup; qualify Rust CI cache #891 and their performance/storage children remain existing later owners. Exclude repository-root Cargo build outputs #908 belongs in Prepare complete inventory and resumable convergence execution #927 preparation; Bound background-review fingerprinting of untracked files #895 remains separate fingerprint hardening.

Decisions

• Continue the existing upstream-first, thin/hybrid direction. Explore a thin-fork path: stock Codex engine with Lab features moved to plugin, MCP bridge, and a minimal patch series #926 adds research options and evidence, not a new engine migration decision.
• Immediate source sequence: Prepare complete inventory and resumable convergence execution #927 -> Complete one timed pinned convergence after lab.7 #928. One qualified cycle returns product priority to Preserve applicable AGENTS instructions in Background Review context #787; broad convergence/tooling/performance work cannot silently consume that slot.
• Admit a coherent representative checkpoint using contract changes, distance, artifacts and compatibility needs. Freeze exact inputs; changing a pin creates a new recorded attempt.
• Prepare and publish exact-provenance Codex Lab lab.8 #929 can publish a fully qualified recovery or ordinary landing. Only an ordinary result with all Automate low-token recurring upstream convergence #634 criteria can close that proof.
• End-to-end timing never pauses or excludes failures. Preparation investment and in-run tooling debt are separately tagged, not hidden.
• Reuse installed-acceptance owners and preserve lab.6/lab.7 history. Lab.8 must prove its own actual upgrade/rollback/restoration boundary.
• Publication, installed acceptance, GUI coordination, Qualify model cache and wire compatibility before runtime cutover #850 wire evidence and Cut the code command over to a provenance-verified Codex Lab release #795 activation remain distinct. No graph edge grants runtime authority.
• Keep GitHub as the planning source. No new architecture umbrella, efficiency platform, automatic coordinator, or automatic paid-credit/fast-mode change.
• Preserve poisoned-account isolation Expired pooled accounts poison a healthy active Codex Lab login #519, terminal-auth fallback Switch execution accounts only after terminal authentication failure #599 and quota-window priming Add explicit opt-in quota-window priming for enrolled accounts #600 as separate behaviors. Research proxy alternatives in Extract Codex Lab runtime behind extension and native agent-provider boundaries #778 cannot waive them.

Open Questions

• Automate low-token recurring upstream convergence #634 must assess and admit the next ordinary guarded refresh after the current release/product slot; completed Complete one timed pinned convergence after lab.7 #928 is the recorded recovery baseline.
• Prepare and publish exact-provenance Codex Lab lab.8 #929 must qualify the repaired exact source/artifacts and obtain applicable operation approvals.
• Stock-plus-extensions versus retained native patches remains a later evidence-based choice in Extract Codex Lab runtime behind extension and native agent-provider boundaries #778; the proposed Explore a thin-fork path: stock Codex engine with Lab features moved to plugin, MCP bridge, and a minimal patch series #926 spikes remain unexecuted.

Next Action

Historical. See Current Status: current work is #974, then #993 and #994.