Integration test: managed Codex http_headers reach the OS-managed file - #775
Merged
tt-le merged 1 commit intoSep 21, 2026
Conversation
tt-le
added this pull request to stack #776
September 21, 2026 19:08
Extend the managed-config integration suite: inject an admin http_headers map for Codex via the managed_fixture stub, run the interactive `ug configure codex`, and assert the header lands in /etc/codex/managed_config.toml under [model_providers.Databricks.http_headers]. Mirrors the existing managed MCP file test (interactive ConfigureTerminal + cat of the OS-managed file), extends build_codex_agent_config with an optional http_headers arg, and updates the coverage matrices. Co-authored-by: Isaac <no-reply@databricks.com>
tt-le
force-pushed
the
tien/codex-managed-http-headers-integration
branch
from
September 21, 2026 19:10
e3a2fe0 to
28cc9db
Compare
david-siqi-liu
approved these changes
Sep 21, 2026
andy-xu-db
added a commit
that referenced
this pull request
Sep 21, 2026
## Summary Align discovery integration coverage with the fetched `main` at `6e5b97b` (#775), merged in `043ab5e`. Do not restore the obsolete discovery feature stack or change runtime behavior. - Current main has no `UG_ENABLE_MODEL_DISCOVERY` switch. Remove obsolete unmanaged disable scenarios and duplicate managed variants. Managed discovery and source-override rejection remain covered by repository Cases 1–6. - Current `ug configure` has no `--model-location` option. Cases 7–10 cover configured/fresh default launches: Claude automatically caches `system.ai` models (including recognized Anthropic gateway aliases) and opens its picker; Codex leaves model/reasoning preferences unset and exposes its native catalog without a generated scoped file. - Retain configured/fresh launch-time `--provider` and `--model-location` Cases 11–14 with exact scoped catalog assertions. Codex's parent catalog must exactly match an independent, parent-scoped API response and include the dedicated Codex service; it must not assume the Claude service supports the Codex API. Claude's provider models can appear as exact native Haiku 4.5, Opus 5, or Sonnet 5 picker rows. - Require a real unmanaged workspace for unmanaged tests. A read-only, session-scoped CodingAgentConfig List check reports published admin configuration explicitly; it does not delete, bypass, or inject configuration. - Update both coverage READMEs and the contract checks. No production-code changes, new skips, xfails, retries, or weakened managed-policy enforcement. ## Current coverage | Cases | Supported behavior | Executions | | --- | --- | ---: | | 1–6 | Managed discovery and provider/location override rejection | 12 | | 7–10 | Configured/fresh default launches without discovery flags | 4 | | 11–14 | Configured/fresh provider and parent-schema discovery | 8 | Repository scenario numbers now run consecutively from 01 to 14, with configured/fresh variants sharing a number. Test names, artifact labels, both repository READMEs, and contract checks use the same mapping. The external Google doc and its numbering are untouched. The complete integration suite collects 97 executions: 58 live (25 Claude, 33 Codex), 27 managed-fixture, 4 managed-workspace, 1 workspace-switch, and 7 installation. Discovery checks configure, list metadata, and open/close pickers without inference prompts. Separate existing task/agent tests do perform inference. ## Latest live result and assertion fixes At `7751cf1`, all integration jobs passed in [CI run 35655313004](https://github.com/databricks/unity-gateway/actions/runs/35655313004): - Full Claude: 25 passed; full Codex: 33 passed. - Managed Claude: 18 passed; managed Codex: 14 passed. These nonblocking jobs were checked individually, not inferred from the aggregate gate. - Installation: 7 passed. Both smoke jobs also passed. - All 24 numbered discovery executions passed, including configured/fresh managed discovery, default discovery, provider/parent selection, and managed override rejection. Independent review found and fixed picker and catalog evidence gaps. Claude assertions now match numbered picker rows, not startup banners or footer text, and explicitly recognize native family/version deduplication. Managed caches/catalogs are compared with independent read-only provider-list responses. Codex parent expectations follow the API-compatible scoped response, rejecting missing, extra, duplicate, or out-of-schema app-server models. Claude still accepts only recognized gateway aliases while preserving system.ai membership, raw-ID uniqueness, and discovered-family inclusion. Codex requires absent model/reasoning preferences for unmanaged native defaults. No production code, workspace configuration, or GitHub secrets were changed. The external Google doc remains untouched. ## Verification - Local non-e2e suite: 2,598 passed with `uv run --frozen pytest --ignore-glob='tests/test_e2e*.py'`. Existing live-agent/e2e probes were explicitly excluded locally. - CI unit job: 2,600 passed, 10 skipped; this change adds no skips or xfails. - Discovery evidence, independent catalog, and contract/prerequisite checks are covered by offline regressions. - Ruff lint and formatting, runner `--help`, `git diff --check`, and collection of all 97 integration tests passed. - Saved real CI picker screens validate the row-matching and native-alias logic; banner-only and wrong-version regressions fail as intended. - No live agents or inference probes were run locally for this update; machine-wide agent settings were not bypassed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stacked on #773. Adds an integration test proving the managed
http_headersfeature reaches Codex's OS-managed config end to end through the realugCLI.test_managed_fixture_codex_http_headers_in_managed_file(intest_ug_configure_managed_mcp.py): injects an adminhttp_headersmap via themanaged_fixturestub, runs the interactiveug configure codex(ConfigureTerminal), and asserts/etc/codex/managed_config.tomlcontains[model_providers.Databricks.http_headers]withx-databricks-workspace = "eng-ml-inference".build_codex_agent_configwith an optionalhttp_headersarg.tests/README.mdandtests/integration/README.md.Why interactive
The OS-managed file
/etc/codex/managed_config.tomlis only written whenmanaged_writes_allowed()(i.e.sys.stdin.isatty()) — so this uses the PTYConfigureTerminalflow, mirroring the existingtest_managed_fixture_codex_mcp_written_to_managed_file. (The per-profile~/.codex/ucode.config.tomlis written non-interactively, but the OS-managed file is the high-precedence one worth asserting.)Verification
Structural checks pass locally (
ruff check/format,test_integration_contract.py5 passed,run_integration.py --help). The live run needsUCODE_TEST_WORKSPACE+DATABRICKS_BEARER+ an interactive PTY + Codex ≥ 0.145.0, so it runs in the integration CI job, not locally.This pull request and its description were written by Isaac.