feat(responses): relay native multi-agent function-result injection

[luvs01]

Summary

Follow-up to #4782, which has landed on dev as 519db59b3. This adds actual response.inject transport, not just an unsupported-message error. The maintainer rebased this branch onto dev after the parent landed, so the PR diff is now the injection delta alone.

Full delta versus the rebase base (dev 41f1832f6): luvs01/opencodex@41f1832...92ec363

• Add default-off codexNativeInjection and a separate native injection owner. Forward saved developer-function results on the original selected account and physical WebSocket. Initial multi_agent.enabled: true is required; no capability is inferred from a model name.
• Validate response/lane identity and calls actually advertised by that connection. Accept string-valued function_call_output only. Reserve each call before submission, copy queued inputs, and reject duplicate, foreign, unsupported or mixed steering/injection input explicitly.
• Serialize physical injection frames through a bounded FIFO because the documented success acknowledgement names the response, not a distinct injection ID. Relay the real response.inject.created / response.inject.failed events; validate acknowledgement identity, sequence and failed-input correlation. Do not synthesize acceptance.
• Keep the response owner alive across a terminal event until queued/sent results receive acknowledgements, including when asynchronous results arrive after response completion. A missing acknowledgement, ambiguous send or disconnect never triggers HTTP replay, account failover or a tool rerun.
• Relay response_already_completed with its saved outputs. A caller-sent continuation with the same parent, lane and settings supplies outstanding results once on the same account/socket and rechecks normal pacing/auth guards. The proxy never manufactures a recovery create. Accepted outputs cannot be submitted again.
• Keep accepted result history separate from steering history: insert results after their owning call, exclude rejected input, deduplicate backend echoes, and preserve non-persistable body policy. Exclude inject-control payloads from stream sampling; retain numeric usage accounting.
• Support canonical ChatGPT forward routes experimentally and the explicitly configured public OpenAI Responses API WebSocket route. Add responses_multi_agent=v1 only to the public API connection, preserving configured beta tokens. Do not move subscription traffic to a separately billed API. Translated providers, arbitrary gateways, sidecars, Combo and HTTP fallback do not gain injection support.
• Add 36 injection regressions, helper/test/source-owner registrations, configuration and rollback documentation, and a canonical architecture contract. No dependency changes or validation helper workflows/payloads are included in the feature diff.

Protocol reference: https://developers.openai.com/api/docs/guides/responses-multi-agent (checked 2026-09-17). Public API documentation is not evidence that a particular ChatGPT subscription backend or Codex App/CLI build implements the same execution mode.

Configuration and bounded scope

Merge into the existing OpenCodex configuration and restart before a fresh turn:

{
  "websockets": true,
  "codexNativeInjection": true
}

The initial create must explicitly include "multi_agent": { "enabled": true }. Public API use additionally requires an openai-responses provider at exactly https://api.openai.com/v1, normal API-key authentication and upstreamWebsocket: true; use its configured model prefix. No real API requests are made by this PR or its tests.

This first implementation is for string-valued developer-function results. Rich result arrays, custom/hosted tool results and simultaneous response.steer in an injection-owned turn are explicitly unsupported. The existing steering-only route remains available independently.

Limits: 32 queued/in-flight injection frames, 8 MiB queued payloads, 1,024 advertised calls / 256 KiB call identities, 32 MiB replay history and 128 responses per owned connection. A sent injection has an absolute 90-second acknowledgement deadline that unrelated stream activity cannot extend. Saved-result waits are capped at 30 minutes. Existing wire and stall bounds still apply. Disable codexNativeInjection and restart to roll back without deleting account or conversation files.

Verification

Exact source and publication

• Published head: 92ec3630dc6b1d053010bd79d09ca268791d55d8 — maintainer rebase onto dev 41f1832f6 after feat(responses): preserve native mid-turn steering over WebSocket #4782 landed; the branch commits (attach-conflict fail-fast, nativeControl naming, ws-failure-stage test move) are preserved. Pre-rebase head was 01f813d30 (re-cascaded onto feat(responses): preserve native mid-turn steering over WebSocket #4782 head a3922b9cf, clean merge). Earlier branch commits fix the reviewer-flagged attach seam (a nativeControl.attach ownership failure now fails the turn visibly instead of falling back to HTTP) and move the oversized upstream-handler cases into tests/responses/ws-failure-stage.test.ts to satisfy the file-size ratchet. On the pre-merge head 78e1a8706, bun run typecheck passed, the file-size ratchet passed, ws-failure-stage.test.ts passed 18 tests and ws-upstream.test.ts passed 126 tests locally (Bun 1.4.2); typecheck was not separately re-run on the merge head.
• Tested source tree: 310a428ad9118108a0b8256e339c15ee163dccde (rebased head); earlier hosted verification ran on pre-rebase tree 911d26890441dcb105e7b8391b1b94338474711d.
• Parent feat(responses): preserve native mid-turn steering over WebSocket #4782: landed on dev as 519db59b3 (2026-09-17); the recorded parent head a3922b9cf is superseded.
• Rebase base upstream dev: 41f1832f6a893547f253d728bd93607e1793dd13.
• The branch now sits directly on dev; no parent merge remains.
• Delta versus dev: 40 files, 1,212 insertions, 72 deletions — unchanged by the rebase; the PR diff is now this delta alone.

All verification jobs reconstructed and asserted the exact commit/tree. Their downloaded artifact digests and source identities were checked. A separate publisher, gated on all three operating-system jobs and the documentation build, pushed only the verified new contributor branch without force. It executed no application/dependency code with write credentials. Parent and integration branches were left unchanged.

Completed current-head checks

Run: https://github.com/luvs01/opencodex/actions/runs/35228684916 (in progress on the published head; prior head runs: 35224514834, 35212665696, 35178934345).

• Re-cascade merge 01f813d30 onto parent a3922b9cf (carrying upstream dev eca65bd35): clean merge; typecheck was not separately re-run on the merge head — the pre-merge head 78e1a8706 passed typecheck, the file-size ratchet, ws-failure-stage.test.ts (18 tests) and ws-upstream.test.ts (126 tests) locally.

Check	Result
Injection fixtures	36 passing cases, included in the focused set below
Focused injection/steering/shared-transport/state/ownership set, Linux	459 pass, 1 existing conditional skip, 0 fail
Same focused set, macOS	459 pass, 1 existing conditional skip, 0 fail
Same focused set, Windows	459 pass, 1 existing conditional skip, 0 fail
Runtime	Project-pinned Bun 1.4.0 on all three operating systems
TypeScript check	Passed on all three operating systems
Privacy, architecture, file-size ratchet and whitespace gates	Passed on all three operating systems
Documentation build	449 pages, passed without deployment
Guarded publication	Passed; remote branch read back at the exact tested head

Each focused run covers 12 test files and 3,001 assertions. The conditional skip is the existing older-runtime HTTP fallback case, not an injection case. Tests exercise the actual handler/auth/dispatch/relay with synthetic WebSockets and credentials; public API and ChatGPT credential destinations are asserted, and unexpected HTTP fetches fail the fixture. They do not call a live model.

Coverage includes actual frame delivery, terminal-before-ack, late asynchronous results, same-socket caller continuations, queue order, duplicate calls, mismatched/duplicate acknowledgements, two-connection isolation, warmup/disabled paths, unknown delivery, disconnect cleanup, absolute deadlines, size/count limits, replay ordering/deduplication and log privacy.

Before publication, three focused missing-transport regressions were demonstrated failing with the parent handler restored, then the implementation was restored byte-for-byte. The first broader local run caught missing source-oracle registrations for the new modules; those registrations were fixed before the successful three-platform runs. No assertion or size limit was relaxed.

Reproduction:

bun install --frozen-lockfile
bun run typecheck
bun test --isolate --timeout 60000 \\
  tests/responses/ws-native-injection.test.ts \\
  tests/responses/ws-native-steering.test.ts \\
  tests/responses/ws-upstream.test.ts tests/responses/ws-upstream-reuse.test.ts \\
  tests/responses/ws-endpoint.test.ts tests/responses/ws-failure-stage.test.ts \\
  tests/responses/reserve-dispatch-ws.test.ts tests/responses/responses-state.test.ts \\
  tests/responses/responses-core-modules.test.ts \\
  tests/ci-workflows/file-size-ratchet.test.ts \\
  tests/test-layout.test.ts tests/test-layout-tooling.test.ts
bun run privacy:scan
bun run structure:check
bun scripts/file-size-ratchet.ts
git diff --check 9c411a10480ea04a5d0244024051bae7fa6dbd05 HEAD
(cd docs-site && bun install --frozen-lockfile && bun run build)

Remaining gates / not claimed

• Keep Draft. Parent feat(responses): preserve native mid-turn steering over WebSocket #4782 has landed; full repository/cross-platform CI and independent maintainer/security review remain separate requirements. The green author workflow is a scoped check, not a full release matrix.
• Local import-graph-selected validation stopped during dependency prerequisites because this container could not resolve package-host DNS; selected tests did not execute in that attempt. Local Bun 1.4.2 checks are supplementary. The hosted evidence above uses the project-pinned 1.4.0 and completed the listed scope, not the entire repository suite.
• No live Astra/public API/ChatGPT subscription session, actual App/CLI interface smoke test, real quota change or production rollout was exercised. Successful synthetic transport tests do not certify upstream entitlement or product compatibility.
• No automatic account/API migration, tool execution, broad routing change, unknown-result replay or combined steering/injection semantics is introduced.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

The implementation was checked against existing admission/auth contracts, data-handling constraints and privacy regressions. The unchecked security box reserves independent review of the new long-lived control surface.

Review readiness checklist

• All CI tests are green on my local testing.
• I pushed my PR to the latest dev commit.
• I resolved all correct Codex and CodeRabbit findings.
• My PR is ready for review.

Remaining gates: fork CI on the rebased head 92ec3630d is in progress — https://github.com/luvs01/opencodex/actions/runs/35234973443. Fork workflow_dispatch runs always cancel on the 30-minute macos-control job; the meaningful signal is every other lane green.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

Automatic draft conversion failed. Please convert this pull request to a draft manually until every box above is ticked.

[luvs01]

Publication readback confirmed de600be5f351243492256d8651cd4b2035259d7d, Draft/open and currently mergeable. The original Linux/macOS/Windows/docs artifact ZIP digests all match GitHub's reported SHA-256 values, and each artifact identifies the same tested source tree a8b8bc3421a64aad83c85a0cafad26d0374182f2. The green author run is the scoped 12-file matrix and listed static/documentation checks, not a full repository CI attestation.

New-head upstream checks are action_required, not passing or assertion failures:

• Cross-platform CI: https://github.com/lidge-jun/opencodex/actions/runs/35179242554
• React Doctor: https://github.com/lidge-jun/opencodex/actions/runs/35179242545

Maintainer action is needed for those checks. Parent #4782 has been linked to this follow-up; its code and readiness state were left unchanged. Keep this PR Draft pending the documented parent integration, broader CI, independent review and live compatible-client/backend validation.

[lidge-jun]

리뷰 · 우선순위 56 / 80

이 PR은 Draft이고, 아직 열린 부모 #4782(네이티브 mid-turn steering) 위에 얹은 response.inject 후속입니다. 지금 dev HEAD 19bdcaaf6은 Windows 샤드·행동 오라클·kill/reap 같은 CI/계약 안정화에 가깝고, 이 브랜치가 가져오는 실험적 multi-agent injection은 그 축과 겹치지 않습니다. 본문이 말하듯 against-dev 합산 diff는 부모를 포함한 약 46파일 / +2371이고, injection-only 비교(부모 merge 9c411a10…헤드 de600be5)는 약 +1116입니다. #4782를 먼저 넣고, 이 PR은 injection 델타만 따로 보는 순서가 맞습니다. 부모를 대체하거나 수정하지 않는다고 명시한 점도 유지해야 합니다.

하는 일은 이렇습니다. 기본값 꺼짐 codexNativeInjection과 별도 owner NativeInjectionChannel(src/server/responses/native-injection.ts)을 추가합니다. 초기 create에 multi_agent.enabled: true가 명시되어야 하고, 모델 이름으로 능력을 추론하지 않습니다. 같은 계정·같은 물리 WebSocket으로 저장된 developer-function 결과(function_call_output 문자열만)를 보냅니다. 응답/레인 신원과 그 연결이 광고한 call만 받고, 제출 전 reserve, 큐 입력 복사, 중복·외부·미지원·steer/inject 혼합은 명시 거부합니다. 성공 ack가 injection ID가 아니라 response를 가리키므로 물리 프레임은 유계 FIFO로 직렬화하고, 실제 response.inject.created / failed만 중계합니다(수락을 합성하지 않음). 터미널 이벤트 뒤에도 큐/전송 결과 ack까지 owner를 살리고, 빠진 ack·모호한 send·끊김은 HTTP 재전송·계정 failover·툴 재실행을 절대 하지 않습니다. response_already_completed와 같은 부모/레인/설정 continuation은 같은 소켓에서 미전송 결과를 한 번만 보냅니다. 공개 OpenAI Responses API WS에는 responses_multi_agent=v1 베타만 추가하고, 구독 트래픽을 별도 과금 API로 옮기지 않습니다. 번역 프로바이더·임의 게이트웨이·사이드카·Combo·HTTP 폴백은 injection을 얻지 않습니다.

설정 키는 src/types/config.ts와 src/config/schema/config-schema.ts에 boolean 두 개(codexNativeSteering / codexNativeInjection, 스키마는 optional.catch(false))를 더합니다. types/config 대형 분리 캠페인에 무효화되어 close할 정도는 아닙니다. 다만 분리 PR이 먼저 들어가면 이 키 추가 hunk는 재배치가 필요하고, 지금 dev 우선순위(CI)보다 긴급하지는 않습니다. 문서(docs-site/.../codex-integration.md injection 절), structure 계약, tests/responses/ws-native-injection.test.ts(36 케이스)와 헬퍼 등록까지 한 세트로 맞춰 둔 편입니다. 라이브 Astra/구독/App·CLI 인증은 청구하지 않았고, 작성자 워크플로 초점은 synthetic transport입니다.

라인 src/server/index/websocket-handler.ts - inject/steer/create continuation이 모두 ws.data.nativeSteering 한 필드에 실립니다. kind가 injection이어도 프로퍼티 이름이 steering이라, 읽기와 리뷰에서 혼동하기 쉽습니다. nativeControl 같은 공통 이름이 더 정확합니다.
라인 websocket-handler 생성부 - codexNativeInjection && isInjectionRequest(frame)이면 InjectionChannel, 아니면 steering 플래그로 SteeringChannel입니다. 두 플래그가 동시에 true여도 create 한 턴에 둘 다 owner가 되지는 않습니다. 문서의 “별도 스위치”와 맞는지 한 번 더 확인이 필요합니다.
경로 src/server/responses/ws-upstream.ts - injection은 canonical 또는 공개 API URL에서만 control을 붙이고, 공개 API에만 multi_agent 베타를 붙입니다. 게이트웨이/비정규 baseUrl 거부는 테스트에 있습니다. 구독 경로를 API로 바꾸지 않는다는 주장은 diff와 맞습니다.
경로 native-injection-protocol.ts - 상한(32 frames / 8MiB / 1024 calls / 90s ack / 30m tool wait)과 string-only function results는 1차 계약으로 분명합니다. rich result·커스텀/호스티드 툴·같은 턴 steer+inject 동시는 명시 미지원입니다.
경로 src/types/config.ts · config-schema.ts - 키가 작지만 types/config 분리 열차와 겹칩니다. 분리 전에 넣으면 나중에 재배치, 분리 후에 넣으면 충돌 해결이 필요합니다. close-don't-rebase 대상은 아닙니다.
경로 합산 diff - 부모 #4782 커밋이 그대로 들어 있습니다. 리뷰/CI 신호는 injection-only 비교 URL을 기준으로 보는 편이 맞고, dev에 부모 없이 머지하면 안 됩니다.
경로 보안 체크리스트 - 본문이 security 박스를 비워 두었습니다. 장수명 제어면(결과 주입·continuation·같은 소켓 재전송 금지)은 메인테이너/보안 별도 리뷰가 필요합니다.

메인테이너의 판단이 필요한 지점

• #4782를 먼저 머지한 뒤 이 PR을 rebase/재게시할지(권장), 아니면 스택을 한 번에 볼지
• Draft 유지와 “풀레포 CI + 보안 리뷰 전 Ready 금지”를 계속 강제할지
• ws.data.nativeSteering 네이밍을 공통 control 필드로 바꿀지
• types/config 분리 캠페인과 키 추가 순서를 어떻게 맞출지
• 합성 테스트만으로 experimental 플래그를 dev에 둘지, 라이브 호환 증거가 더 필요한지

너의 추천
injection 델타 자체는 경계·거부·ack 직렬화·재실행 금지가 잘 적혀 있고, 부모 #4782(이전 리뷰 73/80)의 자연스러운 다음 층이다. 다만 지금 dev 팁 우선순위는 CI 안정화이고, 이 PR은 Draft·부모 미머지·합산 diff에 부모 포함·types/config 키 추가가 겹친다. Ready로 올리지 말고, #4782 랜딩 후 injection-only로 다시 맞춘 다음 보안·풀레포 CI를 보고 심사하는 쪽을 추천한다. 지금은 머지하지 않는다.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

리뷰 · 우선순위 70 / 80

이 PR은 Draft입니다. #4782(네이티브 mid-turn steering) 위에 얹는 follow-up으로, 기본값 꺼짐인 codexNativeInjection과 별도 injection owner로 OpenAI multi-agent response.inject를 같은 계정·같은 물리 WebSocket으로 중계합니다. 지금 dev HEAD는 19bdcaaf6(패키지 2.58.0, 팁 #4851 Windows 샤드). 부모 #4782는 아직 열린 상태이고, 이 브랜치는 부모 커밋 + pinned dev 머지를 포함합니다. 합쳐 보면 46파일 / +2371이고, injection-only 비교(부모 머지 이후)는 작성자 기준 36파일 / +1116입니다. 리뷰는 injection 델타를 따로 보고, 랜딩 순서는 #4782 먼저가 맞습니다.

핵심 모듈은 src/server/responses/native-injection.ts의 NativeInjectionChannel입니다. 성공 ack가 injection ID가 아니라 response ID를 가리키므로, 물리 프레임은 유계 FIFO로 직렬화합니다. response.inject.created / response.inject.failed를 합성하지 않고 중계하고, 터미널 이벤트 뒤에도 큐/전송 결과가 ack를 받을 때까지 owner를 살려 둡니다. ack 누락·모호한 send·disconnect는 HTTP 재전송·계정 failover·툴 재실행으로 넘어가지 않습니다. response_already_completed는 저장 출력을 중계하고, 같은 parent/lane/settings의 호출자 continuation 한 번만 같은 소켓으로 outstanding result를 보냅니다. steering 히스토리와 결과 히스토리는 분리되고, inject 제어 페이로드는 스트림 샘플에서 빠집니다.

범위 가드도 분명합니다. 초기 create에 multi_agent.enabled: true가 필요하고 모델 이름으로 capability를 추정하지 않습니다. 공개 OpenAI Responses API WS에는 responses_multi_agent=v1만 얹고, 구독 트래픽을 별도 과금 API로 옮기지 않습니다. 번역 프로바이더·게이트웨이·사이드카·Combo·HTTP 폴백은 injection을 얻지 못하고 명시 에러입니다. 한도는 큐 32프레임 / 8MiB, advertised call 1024 / 256KiB, 리플레이 32MiB, 연결당 128 response, 전송 ack 90초 절대 데드라인, 저장 결과 대기 30분입니다. codexNativeSteering과 동시에 한 turn에서 섞지 못하게 steer()는 mode mismatch로 거절합니다. 설정 키는 src/types/config.ts / config-schema.ts에 optional boolean 추가 수준이라 types/config 대형 분리 때문에 닫을 대상은 아닙니다.

작성자 워크플로(run 35178934345)는 포커스 세트 459 pass × 3 OS, typecheck·privacy·structure·docs build를 주장하지만, 본인이 “Keep Draft / full matrix 아님 / live Astra·App·CLI 미검증”이라고 적었습니다. dev 대비 합친 diff가 부모를 포함해 커서 충돌·리뷰 면적이 큽니다. structure/* 각주 면적도 #4782와 같이 넓습니다.

경로 NativeInjectionChannel - ack가 response 단위라 FIFO 직렬화·in-flight 단일 제출은 프로토콜에 맞다. 연결 로컬 상태(calls/queue/seen) 누수와 90s ack 타이머가 운영에서 실제 상한으로 도는지 Ready 전에 한 번 더 보면 좋다.
경로 codexNativeInjection 기본 off - 실험 스위치를 제품 기본에 안 섞은 점은 #4782와 같은 좋은 패턴이다.
경로 types/config·schema - 키 두 개 추가만이라 분할 캠페인 무관. 다만 websockets: true + 명시 multi_agent + (공개 API면) 정확한 baseUrl/adapter 조건이 문서·가드와 코드에서 한 줄로 같은지 확인이 필요하다.
경로 structure/* + docs - injection/steering 가이드가 길어지고 structure 각주가 반복된다. 동작과 무관한 면적이 리베이스 비용을 올린다.
경로 의존성 - 부모 #4782가 아직 미머지. 이 PR을 단독으로 dev에 넣으면 steering+injection이 한 덩어리로 들어가거나, 부모 없이 rebase 시 깨질 수 있다. 작성자도 #4782 선행을 요청한다.
경로 Draft / CI - 작성자 포커스 그린 ≠ opencodex hosted full matrix. Draft 유지가 맞다. security 체크리스트도 미체크라 독립 보안 리뷰 여지가 있다.
경로 테스트 - tests/responses/ws-native-injection.test.ts + helper fixture 등록은 좋다. live 세션·구독 entitlement는 이 PR이 증명하지 않는다고 본문에 명시되어 있다.

메인테이너의 판단이 필요한 지점

• #4782를 먼저 Ready/랜딩한 뒤 injection만 rebase할지, 스택을 한 번에 볼지
• ChatGPT forward 경로에 injection을 실험적으로 열어 둘지, 공개 API WS만으로 좁힐지
• structure/docs 면적을 핵심 가이드로 줄일지
• Draft → Ready 전 hosted full CI(헤드 SHA) + 보안 리뷰를 필수 게이트로 둘지
• ack 미확인 시 “unknown delivery / 자동 재시도 금지”를 제품 계약으로 고정할지

너의 추천

• KEEP (Draft). feat(responses): preserve native mid-turn steering over WebSocket #4782 랜딩 전에는 머지하지 마세요. injection-only 비교 URL로 리뷰하고, 부모와 겹치는 steering 커밋은 부모 PR에서 다룬 것으로 치세요.
• Ready 전: feat(responses): preserve native mid-turn steering over WebSocket #4782 머지 → rebase → hosted CI 그린 → structure 각주 축소 검토 → 보안 체크리스트 닫기.
• types/config 분할 때문에 닫을 대상 아님. 중복 PR로 보이지도 않음.
• 지금 당장 랜딩하지 말 것.

이 댓글은 grok-bot이 작성했습니다

[luvs01]

Implemented the next supported extension as #4861, Draft, head b00654b368772f08c3bc68ce84b57fafc6305bc8, directly on this PR's unchanged de600be5 head. This parent and #4782 were not modified.

The extension adds rich text/image/file and custom-tool saved-result continuations, explicit MCP approval/refusal continuations, call-type/caller provenance matching, execution-mode owner selection, and preservation of hosted/agent items omitted from sparse terminal output. It also refuses premature same-parent continuation rather than letting it cancel the active owner. response.inject remains the documented narrow string-function path; rich/custom/approval injection and simultaneous steering/injection are not claimed or silently enabled.

Exact-source project Bun 1.4.0 verification passed on Linux/macOS/Windows: 515 pass / 1 existing conditional skip / 0 fail per OS, including 56 added tests; type/privacy/architecture/size checks and the 449-page documentation build passed. Run/artifacts: https://github.com/luvs01/opencodex/actions/runs/35182258776 . Negative controls reproduced the missing behavior before the fix.

The child description links the extension-only 27-file delta. Please integrate the parent chain first. Latest-base reconciliation, full upstream CI, independent review and live compatible-client/backend testing remain separate gates; no paid API use, tool execution or user runtime deployment was performed.

[luvs01]

Author follow-up on the review points, in 7a9a6d2:

• Shared field naming: renamed the connection field and option plumbing from nativeSteering to nativeControl, matching the NativeResponseControl contract it holds. The response-ownership markers moved next to the interface as markNativeControlResponse / isNativeControlResponse. No behavior change; bun run typecheck passes and the two touched suites pass locally (63 tests, 0 failures).
• Both flags on: verified the constructor branch — an injection request under codexNativeInjection gets the injection channel, any other create under codexNativeSteering gets the steering channel, and a single turn never acquires both owners. That matches the "separate, default-off opt-in" wording in structure/transports/streaming-health.md and reference/configuration/server.md; no doc change needed.
• Security checklist: intentionally left unchecked in the body — the new long-lived control surface should get independent review rather than a self-certification.
• Staying Draft until feat(responses): preserve native mid-turn steering over WebSocket #4782 lands, then this PR will be rebased to the injection-only delta for review.

[lidge-jun]

Reviewed as stage 2 of the stack, against the integration contract in #4882 (devlog/_plan/260917_l7_native_control_stack_audit/020_integration_contract.md). The route gating is genuinely tight — four independent checks (nativeResponseControlMode, nativeResponseControlEligible, the inboundTransport/Combo/plaintext-v2 conditions in preparePassthroughExchange, and the re-parse in codexWsUpstreamFetch) all have to agree, and mode is selected from multi_agent.enabled rather than a model name. One correctness seam is worth an explicit branch.

A failed attach() is indistinguishable from a failed send, and falls back to HTTP.

In src/server/responses/codex-ws-exchange.ts, nativeSteering.attach(...) is called inside the same try block as ws.send(frameText). That block's catch assumes the only reachable failure is a send that never left the process, and therefore resolves sseFallback(url, init) to keep the pre-stream HTTP error and failover machinery in charge.

NativeInjectionChannel.attach throws unconditionally once everAttached is set:

if (this.everAttached) throw new Error("Native injection transport is already owned.");

options.nativeSteering is passed to every dispatch site in passthrough-dispatch.ts, including the transient-retry paths, so a second physical WebSocket attempt for the same turn reaches attach a second time. The throw lands in that catch, and the turn silently continues over HTTP as an ordinary single-response turn while ws.data.nativeSteering still holds a channel that can never bind. The client only discovers this when its first response.inject comes back injection_not_supported.

Nothing unsafe happens — no credential moves, no acceptance is invented, and the HTTP turn is a legitimate turn — so this is not a blocker. But the fallback is being taken for a reason the comment above it explicitly does not cover, and a client that asked for a multi-agent injection turn gets a non-injection turn with no signal until it tries to use the feature. Catching the attach failure separately, before the send try, would let the two cases diverge: a genuine send failure keeps the existing fallback, while an ownership failure fails the turn (or refuses the channel) rather than degrading it.

NativeSteeringChannel.attach has the same shape but is reachable only when the channel is currently bound, so steering is unaffected in practice.

Separately, for the record rather than as a change request: the eligibility widening here is the stack's only route expansion, and it is the leg with the strongest documentation behind it. The exactly-pinned https://api.openai.com/v1 + upstreamWebsocket + non-forward-auth condition, combined with adding responses_multi_agent=v1 only when url === OPENAI_API_RESPONSES_URL, does keep subscription traffic off the separately billed API. We read it as correct.

[luvs01]

Fixed in 0daef86bb ("fix(responses): fail the turn on a native-control attach conflict instead of falling back to HTTP").

nativeControl.attach(...) now runs in its own try ahead of the send try. An attach throw — the already-owned case a transient retry can reach — settles via failStream (a visible 502 pre-response failure on the metadata route, or a body failure otherwise) instead of resolving sseFallback. A genuine ws.send failure keeps the existing HTTP fallback. Regression: a native-control attach conflict fails the turn instead of falling back to HTTP in ws-upstream.test.ts asserts zero fallback calls, zero sent frames, a 502 response carrying the ownership message, and a closed, listener-free socket.

Noted on the eligibility widening — the pinned api.openai.com/v1 + upstreamWebsocket + non-forward-auth condition and the responses_multi_agent=v1 scoping are intended exactly as read.

[luvs01]

Re-cascaded onto new parent #4782 head a3922b9cf (which carries upstream dev eca65bd35); the merge was clean and the new head is 01f813d30f2dcb1994dca4c39a7ea22398d7dc49. Local verification on pre-merge head 78e1a8706: typecheck, file-size ratchet, ws-failure-stage.test.ts (18 tests) and ws-upstream.test.ts (126 tests) all pass; typecheck was not separately re-run on the merge head. Fork CI in progress: https://github.com/luvs01/opencodex/actions/runs/35228684916 (fork dispatch runs always cancel on the 30-minute macos-control job; the meaningful signal is every other lane green).