Document Codex auth spine inventory
This commit is contained in:
Meta Vens
parent
bd3e3cbb70
commit
76f284f88e
4 changed files with 127 additions and 76 deletions
|
|
@ -1,72 +1,117 @@
|
|||
# Codex Auth Spine Inventory
|
||||
|
||||
Objective: keep only the Codex organ that proves OpenAI entitlement and moves typed model-call requests to the OpenAI edge. Everything else is suspect until it earns a live invariant.
|
||||
This is the keeper list for the vestigial Codex organ. Anything not justified
|
||||
here is suspect until proven otherwise.
|
||||
|
||||
## Live Spine
|
||||
|
||||
Plain path:
|
||||
### Inputs
|
||||
|
||||
1. Epiphany prepares a typed turn/request document.
|
||||
2. A small auth spine resolves OpenAI credentials.
|
||||
3. A small model transport spine serializes the typed request at the OpenAI wire edge.
|
||||
4. The OpenAI stream is decoded into typed Epiphany runtime events/results.
|
||||
5. Epiphany stores durable state as CultCache documents and exposes CultNet schemas at network edges.
|
||||
- User authentication material from Codex auth storage or an external auth
|
||||
provider.
|
||||
- Model/provider configuration from Codex config and model provider metadata.
|
||||
- Per-turn model request data: prompt instructions, formatted input, tools,
|
||||
output schema, reasoning controls, service tier, and model metadata.
|
||||
- Session identity: conversation/thread id, installation id, window id,
|
||||
session source, optional turn metadata, and optional parent/subagent headers.
|
||||
|
||||
Current Codex mechanism:
|
||||
### Durable Stores
|
||||
|
||||
- `vendor/codex/codex-rs/login/src/auth/manager.rs`
|
||||
- Owns `CodexAuth`, `AuthManager`, token refresh, API-key auth, ChatGPT subscription auth, agent identity auth, and unauthorized recovery.
|
||||
- Real need: OpenAI subscription/API entitlement and refresh behavior.
|
||||
- Smell: imports app-server protocol auth modes and wider Codex protocol types. The auth organ is not cleanly independent.
|
||||
- `vendor/codex/codex-rs/codex-api/src/auth.rs`
|
||||
- Owns `AuthProvider` and `SharedAuthProvider`.
|
||||
- Real need: small async boundary that applies auth headers to transport requests.
|
||||
- Keep candidate. This is close to the shape Epiphany wants.
|
||||
- `vendor/codex/codex-rs/codex-api/src/provider.rs`
|
||||
- Owns endpoint base URL, headers, retry policy, idle timeout, and request construction.
|
||||
- Real need: OpenAI/Azure endpoint configuration.
|
||||
- Keep candidate, but only as model transport configuration.
|
||||
- `vendor/codex/codex-rs/codex-api/src/endpoint/session.rs`
|
||||
- Owns request construction, auth application, retry telemetry, and HTTP/SSE execution.
|
||||
- Real need: authenticated OpenAI HTTP/SSE execution.
|
||||
- Keep candidate if carved away from telemetry and generic endpoint spread.
|
||||
- `vendor/codex/codex-rs/codex-api/src/endpoint/responses.rs`
|
||||
- Owns Responses API request serialization and SSE request launch.
|
||||
- Real need: OpenAI wire adapter.
|
||||
- Allowed JSON: `serde_json::to_value` at this exact external wire edge.
|
||||
- `vendor/codex/codex-rs/codex-client/src/default_client.rs`
|
||||
- Owns reqwest client setup and trace header injection.
|
||||
- Real need: HTTP transport.
|
||||
- Keep candidate, but it should become a small transport dependency, not a Codex identity.
|
||||
- `vendor/codex/codex-rs/core/src/client.rs`
|
||||
- Owns the current live request path from prompt/model info through `ApiResponsesClient`.
|
||||
- Real need: some of this is model-call orchestration.
|
||||
- Smell: currently embedded in a broad Codex session core with tools, session telemetry, prompt assembly, realtime/websocket alternatives, and unauthorized retry loops.
|
||||
- Codex auth storage under the configured Codex home, loaded by
|
||||
`vendor/codex/codex-rs/login/src/auth/manager.rs`.
|
||||
- Auth token state in `CodexAuth` / `ChatgptAuthState`, including refreshable
|
||||
ChatGPT tokens and account metadata.
|
||||
- Model cache managed by
|
||||
`vendor/codex/codex-rs/models-manager/src/manager.rs`.
|
||||
- Session-scoped model transport state inside
|
||||
`vendor/codex/codex-rs/core/src/client.rs`: provider, auth environment
|
||||
telemetry, conversation id, websocket fallback state, and cached websocket
|
||||
session.
|
||||
|
||||
## Not The Spine
|
||||
### Transformations
|
||||
|
||||
These may remain in the vendored tree during quarantine, but they are not Epiphany organs:
|
||||
- `codex-login` loads auth, refreshes ChatGPT access tokens, preserves account
|
||||
metadata, and exposes `CodexAuth`.
|
||||
- `codex-model-provider` converts `CodexAuth` plus provider config into a
|
||||
bearer auth provider and API provider.
|
||||
- `models-manager` uses provider auth to fetch `/models`, cache the catalog,
|
||||
and choose default/model metadata.
|
||||
- `codex-core::client` builds Responses API requests from typed prompt/model
|
||||
structures, adds Codex/OpenAI identity headers, chooses HTTP or websocket
|
||||
transport, streams response events, and handles auth/error/rate-limit
|
||||
telemetry.
|
||||
|
||||
- Apps, skills, plugins, marketplace, startup sync, connector inventory.
|
||||
- TUI/CLI/chat UI/session lifecycle except a temporary login UX if needed.
|
||||
- Multi-agent tool plumbing from Codex. Epiphany owns swarm physiology through CultNet/CultCache.
|
||||
- App-server protocol surfaces that exist to mirror Codex product features.
|
||||
- JSON-RPC shapes that expose internal accidents instead of CultNet contracts.
|
||||
- Realtime/websocket, review, guardian, cloud task, backend task, and account UI surfaces unless a specific auth entitlement dependency proves otherwise.
|
||||
### Outputs
|
||||
|
||||
## Invariants
|
||||
- Bearer-authenticated OpenAI/ChatGPT-compatible model calls.
|
||||
- Streaming model response events.
|
||||
- Compaction/memory/realtime model helper calls that use the same provider
|
||||
setup.
|
||||
- Model catalog and model metadata.
|
||||
- Auth and transport telemetry/errors needed to recover or report failure.
|
||||
|
||||
- OpenAI auth is a sealed reliquary: it may authenticate and refresh, not own Epiphany runtime shape.
|
||||
- The OpenAI API wire adapter may serialize JSON because OpenAI speaks JSON. That permission does not leak inward.
|
||||
- CultNet schemas describe network edges. CultCache documents carry live state.
|
||||
- A Codex type survives only if it protects one of these invariants: credential validity, authenticated request construction, streaming decode, or model capability/provider metadata.
|
||||
- `codex_message_processor.rs` is not allowed to be the owner of Epiphany runtime truth.
|
||||
## Keep
|
||||
|
||||
## Suspicious Load-Bearing Questions
|
||||
- `login/src/auth/manager.rs`: keep as the initial credential compatibility
|
||||
organ. It knows ChatGPT/API-key/agent/external auth modes, refresh semantics,
|
||||
token storage, and account metadata. Long term, wrap it behind an Epiphany
|
||||
`OpenAIAuthAdapter` instead of letting the rest of Epiphany import it.
|
||||
- `model-provider/src/auth.rs` and `model-provider/src/provider.rs`: keep as
|
||||
the provider auth resolver. This is the narrow bridge from Codex auth state to
|
||||
API bearer auth.
|
||||
- `core/src/client.rs`: keep only the model transport subset: provider setup,
|
||||
Responses request construction, HTTP/websocket streaming, identity headers,
|
||||
and auth recovery telemetry. It is too entangled to delete before a native
|
||||
Epiphany model adapter exists.
|
||||
- `models-manager/src/manager.rs`: keep narrowly for model catalog refresh,
|
||||
default model selection, and auth-mode filtering until Epiphany has its own
|
||||
typed model catalog document.
|
||||
|
||||
- Can `AuthManager` be extracted without `codex_app_server_protocol`, `codex_protocol::auth`, and app-server-specific auth modes?
|
||||
- Does Epiphany need Codex websocket/realtime paths, or only Responses SSE?
|
||||
- Which model-provider metadata is genuinely required to keep subscription compatibility?
|
||||
- Can unauthorized recovery live entirely in the auth spine instead of the session/chat processor layer?
|
||||
- Can model-call input/output become one typed Epiphany document pair before the OpenAI edge serialization?
|
||||
## Cut Or Seal
|
||||
|
||||
- Codex app-server routing is not part of auth/model transport. It can host
|
||||
compatibility wrappers while Aquarium/CLI still speak JSON-RPC, but it must
|
||||
not be the native Epiphany operator surface.
|
||||
- Codex apps, skills, marketplace, plugin UX, and MCP OAuth handlers are not
|
||||
required for OpenAI subscription compatibility. MCP may survive as a separate
|
||||
CultNet adapter, not as a reason to keep the Codex app-server brain.
|
||||
- `codex-core::client` helper calls for memories/realtime/compaction are
|
||||
suspicious unless Epiphany deliberately needs that OpenAI endpoint. Keep them
|
||||
sealed with the transport until the native adapter split can decide.
|
||||
- `models-manager` collaboration mode surfaces are not part of the auth spine.
|
||||
Model catalog yes; collaboration-mode presets no.
|
||||
|
||||
## Extract Target
|
||||
|
||||
Create an outside-vendor adapter with this shape:
|
||||
|
||||
```text
|
||||
EpiphanyOpenAIAuthAdapter
|
||||
-> load/refresh credentials
|
||||
-> expose account/auth mode/model availability
|
||||
|
||||
EpiphanyOpenAIModelTransport
|
||||
-> accept typed Epiphany model-turn request
|
||||
-> call OpenAI Responses API through Codex-compatible auth
|
||||
-> emit typed stream events / receipts
|
||||
```
|
||||
|
||||
The adapter may depend on `codex-login`, `codex-model-provider`,
|
||||
`codex-model-provider-info`, `codex-api`, and the narrow model-transport pieces
|
||||
of `codex-core`. It must not depend on `codex-app-server`,
|
||||
`codex_message_processor`, plugin/app/skill/marketplace modules, or Epiphany
|
||||
state ownership.
|
||||
|
||||
## Next Cut
|
||||
|
||||
Define the first `epiphany-openai-adapter` crate boundary as a wrapper, not a
|
||||
rewrite:
|
||||
|
||||
- input: typed model-turn request plus adapter config
|
||||
- output: typed stream events and terminal usage/error receipt
|
||||
- internal dependency: Codex auth/model transport only
|
||||
- forbidden dependency: Codex app-server or Epiphany JSON-RPC routes
|
||||
|
||||
The first implementation can be a thin wrapper around existing Codex transport.
|
||||
The point is ownership: Epiphany calls a model adapter; it does not live inside
|
||||
the Codex host brain.
|
||||
|
|
|
|||
|
|
@ -34,6 +34,7 @@ remembers doctrine; the branch remembers the blade.
|
|||
|
||||
- Do not copy exact branch or HEAD from this note. Run `git status --short --branch` and `git log --oneline -5`.
|
||||
- The active foundation directive is now `notes/codex-starvation-and-cultnet-liberation-plan.md`. The previous Codex app-server control-plane rebuild made Epiphany less rotten inside Codex, but that is not the destination. Epiphany must become a native CultCache/CultNet runtime. Codex is a compatibility reliquary for OpenAI subscription auth and model transport, not the host brain.
|
||||
- `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary: retain `codex-login` credential storage/refresh, `codex-model-provider` auth resolution, the model-transport subset of `codex-core::client`, and the narrow model-catalog subset of `models-manager`; do not treat Codex app-server, apps, skills, marketplace, plugin UX, MCP OAuth handlers, or collaboration-mode surfaces as auth-spine machinery.
|
||||
- Edge JSON is allowed for schema description, hostile ingress before immediate typed parsing, sealed forensic artifacts, or named quarantine experiments. When both subsystems are ours, runtime data must remain typed CultCache documents and move over CultNet typed contracts. Generic `serde_json::Value` in worker launch/result/selfPatch/runtime flow is contamination until classified and replaced.
|
||||
- The May 2026 foundation migration in `notes/epiphany-ideal-architecture-rebuild-plan.md` is complete enough to defend. Read `notes/epiphany-architectural-teardown.md` before touching Epiphany control-plane code, but do not treat it as an open-ended excuse to keep shaving the altar. The rebuild moved scene projection, freshness derivation, pressure policy, targeted context shards, bounded graph traversal, job/progress view derivation, planning view derivation, reorientation resume/regather verdict policy, pure CRRC recommendation policy, fixed-lane coordinator decision policy, role-board projection policy, role/reorient result interpretation, role self-persistence review policy, and role/reorient acceptance bundle policy into `epiphany-core`; typed acceptance receipts replaced summary-string identity for live accept paths, runtime links are dual-written on launch, and result read-back now prefers runtime links.
|
||||
- Read `notes/epiphany-ideal-architecture-rebuild-plan.md` immediately after the teardown. It defines the smallest coherent replacement architecture: durable `EpiphanyState`, runtime-spine-owned `RuntimeState`, separate role memory/heartbeat state, `epiphany-core` as policy owner, app-server as adapter, Aquarium as reflector, typed acceptance receipts, and derived view lenses instead of a protocol verb zoo.
|
||||
|
|
@ -539,19 +540,23 @@ The twenty-ninth cut moved repeated Epiphany state-updated notification shaping
|
|||
into `epiphany-codex-bridge/src/mutation.rs`. This did not materially shrink
|
||||
the route file, but it removed another duplicated protocol-shape authority from
|
||||
the mutation handlers. `epiphany_mutation_routes.rs` is about 1,071 lines.
|
||||
The auth-spine inventory now exists at
|
||||
`notes/codex-auth-spine-inventory.md`. It maps the keeper Codex organ and sets
|
||||
the next real extraction target: create an outside-vendor
|
||||
`epiphany-openai-adapter` wrapper around auth/model transport with no
|
||||
dependency on Codex app-server or Epiphany JSON-RPC routes.
|
||||
|
||||
Also: MCP itself is allowed to be JSON. The target is not "replace MCP JSON";
|
||||
the target is an Epiphany-owned boundary that speaks typed Epiphany
|
||||
intent/result/receipt documents internally and normal MCP JSON-RPC externally.
|
||||
|
||||
Continue with the actual whale-carcass cut: carve remaining route-level mutation
|
||||
orchestration into explicit typed bridge/service calls, starting with launch
|
||||
response shaping and then reassessing whether the next clean cut is worth
|
||||
making or whether the remaining code is honest Codex edge glue. Success is a
|
||||
visibly smaller processor and less mutation authority in Codex, not merely
|
||||
nicer payload names or another adapter reliquary. Do not resume Rider, Unity,
|
||||
Aquarium, Face, dogfood, planning, app, skill, marketplace, or bridge expansion
|
||||
until this organ is being cut cleanly.
|
||||
Continue with the actual whale-carcass cut: create the first
|
||||
`epiphany-openai-adapter` boundary outside `vendor/codex`, wrapping only the
|
||||
keeper auth/model transport spine identified in
|
||||
`notes/codex-auth-spine-inventory.md`. Success is Epiphany calling a model
|
||||
adapter rather than living inside the Codex host brain. Do not resume Rider,
|
||||
Unity, Aquarium, Face, dogfood, planning, app, skill, marketplace, or bridge
|
||||
expansion until this organ is being cut cleanly.
|
||||
|
||||
The Phase 6 freshness slice is landed. It exposes read-only
|
||||
`thread/epiphany/freshness` from live retrieval summaries plus graph
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -70,7 +70,7 @@ data_flow:
|
|||
- move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose
|
||||
|
||||
active_subgoals:
|
||||
- The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive: inventory the minimal Codex auth/model-call spine, classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, replace worker launch/result/selfPatch cargo with typed documents, evacuate operator surfaces from Codex JSON-RPC, split MCP into a CultNet adapter, and keep cutting until Epiphany can run without `codex_message_processor.rs` except for legacy compatibility.
|
||||
- The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the vestigial OpenAI subscription auth/model transport organ. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, replace worker launch/result/selfPatch cargo with typed documents, evacuate operator surfaces from Codex JSON-RPC, split MCP into a CultNet adapter, and keep cutting until Epiphany can run without `codex_message_processor.rs` except for legacy compatibility.
|
||||
- The May 2026 teardown/rebuild migration in `notes/epiphany-ideal-architecture-rebuild-plan.md` is closed unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne.
|
||||
- Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears.
|
||||
- Preserve read-only boundaries for retrieve, distill, propose, freshness, context, graphQuery, roleResult, reorientResult, and the canonical view lenses for scene, jobs, roles, planning, pressure, reorient, crrc, and coordinator.
|
||||
|
|
@ -94,6 +94,7 @@ active_subgoals:
|
|||
|
||||
accepted_design:
|
||||
- `notes/codex-starvation-and-cultnet-liberation-plan.md` is the active foundation directive. It supersedes outward product/bridge/dogfood work and supersedes the weaker goal of merely making Codex app-server a cleaner adapter. Epiphany must become a native CultCache/CultNet runtime; Codex remains only as an OpenAI subscription auth/model-transport reliquary until that too can be replaced or minimized.
|
||||
- `notes/codex-auth-spine-inventory.md` is the current source-grounded inventory of the Codex organ that may survive: `codex-login` credential storage/refresh, `codex-model-provider` auth resolution, the model-transport subset of `codex-core::client`, and the narrow model-catalog subset of `models-manager`. Codex app-server, apps, skills, marketplace, plugin UX, MCP OAuth handlers, and collaboration-mode surfaces are not part of the keeper spine.
|
||||
- `notes/epiphany-architectural-teardown.md` is the current foundation-cleanup directive. Its suspicion pass supersedes outward Phase 6 expansion as the active priority until the control-plane ownership problems are resolved.
|
||||
- `notes/epiphany-ideal-architecture-rebuild-plan.md` is the replacement blueprint: the smallest coherent architecture is durable `EpiphanyState`, runtime-spine-owned `RuntimeState`, separate role memory/heartbeat state, `epiphany-core` as policy owner, app-server as adapter, Aquarium as reflector, typed result acceptance receipts, and derived view lenses instead of a protocol verb zoo.
|
||||
- Epiphany is a fork-level modeling architecture, not merely a Codex collaboration mode.
|
||||
|
|
@ -279,4 +280,4 @@ rejected_paths:
|
|||
|
||||
current_status:
|
||||
summary: The Codex starvation pass has five typing receipts, seventeen processor cuts, and now a real physical extraction: `epiphany-codex-bridge` lives outside `vendor/codex` and owns the Codex-facing Epiphany adapters for scene, jobs, context/planning/graph query, retrieval, result projection, runtime-spine result adaptation, launch/prompt doctrine, mutation document mechanics, live-state projection, pressure/pre-compaction rendering, freshness/reorientation projection, CRRC/coordinator/role-board projection, and acceptance/evidence signal helpers. Vendored app-server now retains only `epiphany_invalidation.rs` as a root Epiphany module because watcher lifecycle is still app-server machinery; `codex_message_processor.rs` still contains route dispatch and mutation orchestration. The processor is about 10,339 lines, `epiphany_mutation_routes.rs` is about 1,071 lines, and `epiphany_state_helpers.rs` is down to a 19-line rollout-state loader after moving typed mutation helpers, reviewability checks, completed runtime-result acceptance loading, live-state projection, launched/interrupted job fallback projection, role/reorient acceptance update bundle construction including its core state update, protocol patch-to-core state-update projection, and state-updated notification shaping out to the bridge. This is progress, not absolution: the bridge is still Codex-facing compatibility, not the final CultNet runtime, and route-level launch/update/promote/interrupt orchestration still lives inside the Codex processor. MCP itself is correctly JSON at its protocol edge; the target is typed Epiphany intent/result/receipt wrappers around MCP, not replacing MCP JSON.
|
||||
next_action: Continue Codex starvation by carving remaining route-level mutation orchestration into explicit outside-vendor service calls, starting with launch response shaping and then reassessing whether the next clean cut is worth making or whether the remaining code is honest Codex edge glue. Do not resume app/skill/marketplace expansion.
|
||||
next_action: Continue Codex starvation by creating the first outside-vendor `epiphany-openai-adapter` boundary as a wrapper around the keeper auth/model transport spine, with no dependency on Codex app-server or Epiphany JSON-RPC routes. Do not resume app/skill/marketplace expansion.
|
||||
|
|
|
|||
Reference in a new issue