Clarify Codex compatibility boundary
This commit is contained in:
Meta Vens
parent
cb75c5adce
commit
e44d4f96e6
5 changed files with 91 additions and 58 deletions
|
|
@ -1,7 +1,22 @@
|
|||
# Codex Auth Spine Inventory
|
||||
|
||||
This is the keeper list for the vestigial Codex organ. Anything not justified
|
||||
here is suspect until proven otherwise.
|
||||
here is suspect until proven otherwise. The organ must stay honest: Epiphany is
|
||||
a modified Codex-derived backend with a native CultCache/CultNet body, not a
|
||||
clean-room client pretending to be Codex.
|
||||
|
||||
## Compliance Invariant
|
||||
|
||||
- Keep Codex-compatible auth identity anchored in vendored Codex-derived
|
||||
machinery. Do not fully replace Codex auth with a lookalike native
|
||||
implementation unless OpenAI provides an explicit public path or permission
|
||||
for that use.
|
||||
- It is fine to cut Codex apps, skills, marketplace, plugin UX, broad
|
||||
app-server workflow, and generic JSON control surfaces. Those are product and
|
||||
workflow organs, not subscription-auth legitimacy.
|
||||
- The retained auth/model organ should be brutally thin, but it must be real:
|
||||
load/refresh credentials, preserve required client headers/identity,
|
||||
respect subscription limits, and call the allowed Codex/OpenAI model route.
|
||||
|
||||
## Live Spine
|
||||
|
||||
|
|
@ -18,9 +33,11 @@ here is suspect until proven otherwise.
|
|||
|
||||
### Durable Stores
|
||||
|
||||
- Codex auth storage under the configured Codex home, loaded by
|
||||
`vendor/codex/codex-rs/login/src/auth/manager.rs`.
|
||||
- Auth token state in `CodexAuth` / `ChatgptAuthState`, including refreshable
|
||||
- Codex auth storage under the configured Codex home. The legal/compliance
|
||||
authority should remain vendored Codex-derived auth machinery such as
|
||||
`vendor/codex/codex-rs/login/src/auth/manager.rs`, even when Epiphany wraps
|
||||
it in typed status documents.
|
||||
- Auth token state in Codex-compatible auth records, including refreshable
|
||||
ChatGPT tokens and account metadata.
|
||||
- No durable model/provider state is owned by the current OpenAI spine. The
|
||||
model string is request data; catalog/default selection must become a typed
|
||||
|
|
@ -28,16 +45,21 @@ here is suspect until proven otherwise.
|
|||
|
||||
### Transformations
|
||||
|
||||
- `epiphany-openai-auth-spine` loads env, file, keyring, and auto-fallback
|
||||
Codex auth, refreshes ChatGPT access tokens, preserves account metadata, and
|
||||
exposes the auth subset needed by the Epiphany OpenAI transport.
|
||||
- `epiphany-openai-auth-spine` currently loads env, file, keyring, and
|
||||
auto-fallback Codex auth, refreshes ChatGPT access tokens, preserves account
|
||||
metadata, and exposes the auth subset needed by the Epiphany OpenAI
|
||||
transport. This is now suspect because it has copied too much auth machinery
|
||||
out of vendored Codex; the spine should become a typed wrapper over retained
|
||||
Codex-compatible auth rather than a clean-room replacement.
|
||||
- `epiphany-openai-codex-spine` converts `CodexAuth` directly into
|
||||
authorization/account headers, chooses the ChatGPT Codex backend or OpenAI API
|
||||
base URL from auth mode, builds a local serializable Responses request body,
|
||||
opens an HTTP/SSE stream through `codex-client`, and parses Responses frames
|
||||
into typed Epiphany stream events.
|
||||
- `codex-login` remains in `vendor/codex` as reference/legacy Codex host
|
||||
machinery, but it is no longer in the native Epiphany OpenAI spine graph.
|
||||
- `codex-login` remains in `vendor/codex` and should be treated as keeper
|
||||
auth machinery or the source for a thin vendored auth organ. Removing it from
|
||||
the native request graph may be an overcut if it makes Epiphany look like an
|
||||
impersonating client instead of a modified Codex backend.
|
||||
|
||||
### Outputs
|
||||
|
||||
|
|
@ -50,11 +72,10 @@ here is suspect until proven otherwise.
|
|||
|
||||
## Keep
|
||||
|
||||
- `epiphany-openai-auth-spine`: keep as the native credential compatibility
|
||||
organ. It knows the path Epiphany actually uses now: `CODEX_API_KEY` /
|
||||
`OPENAI_API_KEY`, `$CODEX_HOME/auth.json`, Codex keyring entries, auto
|
||||
keyring/file fallback, ChatGPT token refresh, account id, plan metadata,
|
||||
FedRAMP flag, and the standard HTTP client edge.
|
||||
- `epiphany-openai-auth-spine`: keep only as a typed Epiphany wrapper/status
|
||||
surface around Codex-compatible auth. It should not pretend to be the legal
|
||||
authority for subscription credentials by cloning the auth behavior outside
|
||||
vendored Codex.
|
||||
- `codex-client`: keep only as a plain HTTP/SSE transport helper for now. It
|
||||
does not own Epiphany request shape, model policy, stream semantics, or durable
|
||||
state.
|
||||
|
|
@ -71,10 +92,11 @@ here is suspect until proven otherwise.
|
|||
suspicious unless Epiphany deliberately needs that OpenAI endpoint. Keep them
|
||||
sealed with the transport until the native adapter split can decide.
|
||||
- `codex-api`, `codex-model-provider`, `codex-model-provider-info`,
|
||||
`codex-login`, `codex-core::client`, and `models-manager` are no longer part
|
||||
of the native OpenAI spine graph. If a later model catalog is needed, it
|
||||
should be a typed Epiphany catalog document, not a revival of the old Codex
|
||||
provider stack.
|
||||
`codex-core::client`, and `models-manager` are no longer keeper request-path
|
||||
organs. `codex-login` is different: broad login UX can be cut, but the
|
||||
vendored Codex auth semantics should remain the anchor for subscription use.
|
||||
If a later model catalog is needed, it should be a typed Epiphany catalog
|
||||
document, not a revival of the old Codex provider stack.
|
||||
- Native auth does not yet preserve every Codex auth mode. External bearer
|
||||
command auth and agent identity are legacy/reference gaps unless a concrete
|
||||
user path proves they are needed.
|
||||
|
|
@ -85,7 +107,7 @@ Create an outside-vendor adapter with this shape:
|
|||
|
||||
```text
|
||||
EpiphanyOpenAIAuthAdapter
|
||||
-> load/refresh credentials
|
||||
-> wrap retained Codex-compatible credential loading/refresh
|
||||
-> expose account/auth mode/model availability
|
||||
|
||||
EpiphanyOpenAIModelTransport
|
||||
|
|
@ -94,10 +116,11 @@ EpiphanyOpenAIModelTransport
|
|||
-> emit typed stream events / receipts
|
||||
```
|
||||
|
||||
The adapter may depend on `epiphany-openai-auth-spine` and `codex-client` only
|
||||
while the reliquary survives. It must not depend on
|
||||
`codex-app-server`, `codex_message_processor`, plugin/app/skill/marketplace
|
||||
modules, Codex provider/request construction, or Epiphany state ownership.
|
||||
The adapter may depend on `epiphany-openai-auth-spine`, retained Codex auth
|
||||
machinery, and `codex-client` while the reliquary survives. It must not depend
|
||||
on `codex-app-server`, `codex_message_processor`, plugin/app/skill/marketplace
|
||||
modules, broad Codex provider/request construction, or Epiphany state
|
||||
ownership.
|
||||
|
||||
## Next Cut
|
||||
|
||||
|
|
@ -177,15 +200,12 @@ application. `codex-core` re-exports the contract only as a compatibility
|
|||
alias, and `CodexThread` now calls native state-update functions around its
|
||||
remaining revision check, persistence validation, and rollout/session writeback.
|
||||
|
||||
The credential extraction now covers Codex file/keyring/auto auth plus env API
|
||||
keys, ChatGPT token refresh, account metadata, and header material.
|
||||
`epiphany-openai-codex-spine` uses `AuthCredentialsStoreMode::Auto` by default,
|
||||
so native runtime calls preserve normal Codex keyring storage without importing
|
||||
`codex-login`. `cargo tree` for `epiphany-openai-codex-spine` now finds no
|
||||
`codex-login`, `codex-api`, `codex-protocol`, `codex-app-server-protocol`, or
|
||||
model-provider crates. The remaining question is whether external
|
||||
bearer-command auth or agent identity deserves native implementation or should
|
||||
remain a sealed legacy Codex path.
|
||||
The credential extraction currently covers Codex file/keyring/auto auth plus
|
||||
env API keys, ChatGPT token refresh, account metadata, and header material
|
||||
without importing `codex-login`. That is technically clean but architecturally
|
||||
suspect under the compliance invariant above. The next corrective cut is to
|
||||
re-anchor auth in retained vendored Codex-compatible machinery while keeping
|
||||
Epiphany's typed adapter/status/request surfaces outside the Codex host brain.
|
||||
|
||||
The point is ownership: Epiphany calls a model adapter; it does not live inside
|
||||
the Codex host brain.
|
||||
|
|
|
|||
|
|
@ -5,8 +5,9 @@ This is the new foundation directive.
|
|||
The previous control-plane rebuild made Epiphany cleaner inside Codex. That was
|
||||
useful, but it is no longer the target. The target is not a better parasite
|
||||
inside the Codex organ. The target is Epiphany as its own CultCache/CultNet
|
||||
machine, with Codex reduced to the smallest OpenAI subscription compatibility
|
||||
reliquary that can authenticate and call models.
|
||||
machine, with Codex reduced to the smallest honest OpenAI subscription
|
||||
compatibility reliquary that can authenticate and call models as a modified
|
||||
Codex-derived client.
|
||||
|
||||
No outward product, bridge, Aquarium, Face, dogfood, Unity, Rider, planning, or
|
||||
personality work outranks this liberation pass unless the user explicitly
|
||||
|
|
@ -20,8 +21,8 @@ Free Epiphany from heretek contamination:
|
|||
- subsystem communication is CultNet typed messages and mutation contracts
|
||||
- JSON exists only as schema description, wire compatibility at hostile edges,
|
||||
or explicitly quarantined forensic/import material
|
||||
- vendored Codex stops being a host brain and becomes an OpenAI auth/model-call
|
||||
adapter
|
||||
- vendored Codex stops being a host brain and becomes an honest OpenAI
|
||||
auth/model-call compatibility organ
|
||||
|
||||
## Current Mechanism
|
||||
|
||||
|
|
@ -60,6 +61,11 @@ This is cleaner than the earlier Jenga pile. It is still the wrong organ.
|
|||
- deliberately named quarantine experiments with an expiration path
|
||||
- OpenAI subscription compatibility is the only long-term reason to preserve a
|
||||
Codex-derived organ.
|
||||
- Epiphany must remain Codex-compatible rather than merely Codex-impersonating.
|
||||
Do not replace vendored Codex auth semantics with a lookalike implementation
|
||||
just because it is technically possible; keep enough Codex-derived auth/model
|
||||
machinery that the system is honestly a modified Codex backend, not a fake
|
||||
client tunnel.
|
||||
- Codex apps, skills, marketplace, broad app-server lifecycle, plugin UX, and
|
||||
JSON-RPC surface sprawl are not Epiphany foundations.
|
||||
- MCP support may survive, but as a separate CultNet-speaking adapter, not as a
|
||||
|
|
@ -70,7 +76,9 @@ This is cleaner than the earlier Jenga pile. It is still the wrong organ.
|
|||
Keep or extract:
|
||||
|
||||
- OpenAI authentication/session compatibility needed for the user's Codex
|
||||
subscription
|
||||
subscription; this should remain anchored in Codex-derived auth machinery
|
||||
unless the user obtains explicit permission or a public first-party API path
|
||||
makes that unnecessary
|
||||
- model request/response transport required to use that auth
|
||||
- any model/tool streaming primitives that are truly cheaper to extract than
|
||||
rewrite
|
||||
|
|
@ -113,9 +121,11 @@ OpenAIModelTransport
|
|||
LegacyCodexImportBridge, only if needed
|
||||
```
|
||||
|
||||
The adapter may know how to refresh credentials and submit model calls. It must
|
||||
not own Epiphany state, scheduling, view derivation, worker lifecycle,
|
||||
operator APIs, plugin UX, app discovery, marketplace state, or document truth.
|
||||
The adapter may know how to refresh credentials and submit model calls. It
|
||||
should preserve Codex-compatible identity and auth semantics rather than
|
||||
pretending to be official Codex from a clean-room clone. It must not own
|
||||
Epiphany state, scheduling, view derivation, worker lifecycle, operator APIs,
|
||||
plugin UX, app discovery, marketplace state, or document truth.
|
||||
|
||||
## Ranked Liberation Plan
|
||||
|
||||
|
|
@ -133,7 +143,8 @@ Map the smallest Codex auth/model-call path:
|
|||
Output: `notes/codex-auth-spine-inventory.md` with keep/cut/extract verdicts.
|
||||
|
||||
Success: every retained Codex dependency is justified by OpenAI subscription
|
||||
compatibility or model transport.
|
||||
compatibility, Codex-compatible auth identity, or model transport; every cut is
|
||||
justified as workflow/product bulk rather than auth impersonation.
|
||||
|
||||
### 2. JSON Contamination Ledger
|
||||
|
||||
|
|
|
|||
|
|
@ -33,12 +33,12 @@ remembers doctrine; the branch remembers the blade.
|
|||
## Current Orientation
|
||||
|
||||
- Do not copy exact branch or HEAD from this note. Run `git status --short --branch` and `git log --oneline -5`.
|
||||
- The active foundation directive is now `notes/codex-starvation-and-cultnet-liberation-plan.md`. The previous Codex app-server control-plane rebuild made Epiphany less rotten inside Codex, but that is not the destination. Epiphany must become a native CultCache/CultNet runtime. Codex is a compatibility reliquary for OpenAI subscription auth and model transport, not the host brain.
|
||||
- `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary: `epiphany-openai-auth-spine` is now the native credential organ for env/file/keyring/auto auth, ChatGPT token refresh, account metadata, and header material; `codex-client` remains only as a plain HTTP/SSE helper. `codex-login`, `codex-api`, `codex-model-provider`, `codex-model-provider-info`, `codex-core::client`, and `models-manager` are no longer keeper request-path organs; if model catalog/routing grows back, it should be an Epiphany typed document surface.
|
||||
- The active foundation directive is now `notes/codex-starvation-and-cultnet-liberation-plan.md`. The previous Codex app-server control-plane rebuild made Epiphany less rotten inside Codex, but that is not the destination. Epiphany must become a native CultCache/CultNet runtime while remaining an honest modified Codex-derived backend for subscription auth/model use. Codex is a compatibility reliquary for OpenAI subscription auth and model transport, not the host brain and not a mask for impersonation.
|
||||
- `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary. Corrected compliance invariant: Codex-compatible auth identity should stay anchored in vendored Codex-derived auth machinery. The current `epiphany-openai-auth-spine` native credential implementation is technically clean but now suspect; it should become a typed wrapper over retained Codex auth rather than a clean-room replacement. Codex apps, skills, marketplace, plugin UX, broad app-server workflow, and JSON-RPC sprawl remain cuttable because they are not subscription-auth legitimacy.
|
||||
- Edge JSON is allowed for schema description, hostile ingress before immediate typed parsing, sealed forensic artifacts, or named quarantine experiments. When both subsystems are ours, runtime data must remain typed CultCache documents and move over CultNet typed contracts. Generic `serde_json::Value` in worker launch/result/selfPatch/runtime flow is contamination until classified and replaced.
|
||||
- `epiphany-openai-runtime` worker result ingress now parses assistant output directly into typed role/reorient ingress structs selected from the durable launch document, stores nested `statePatch` and `selfPatch` as typed MessagePack in `EpiphanyRuntimeRoleWorkerResult`, and no longer passes worker result data through generic `serde_json::Value`. JSON survives there only as the OpenAI text-output edge before typed deserialization.
|
||||
- Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. JSON-value selfPatch functions are compatibility wrappers for CLI/artifact ingress; native callers should parse once at the edge and then call `review_agent_self_patch_document` / `apply_agent_self_patch_document`.
|
||||
- `epiphany-openai-codex-spine` no longer uses Codex's Responses client, model-provider layer, `codex-api`, `codex-model-provider`, `codex-model-provider-info`, `codex-protocol`, or `codex-login` for outbound model requests. It uses `epiphany-openai-auth-spine` for env/file/keyring/auto credentials and ChatGPT token refresh, builds a local serializable OpenAI Responses body, opens the HTTP/SSE stream through `codex-client`, and parses Responses SSE frames into typed Epiphany stream events. `cargo tree` for the spine now finds no `codex-login`, `codex-api`, `codex-protocol`, `codex-app-server-protocol`, or model-provider crates. Caveat: external bearer command auth and agent identity are not native yet.
|
||||
- `epiphany-openai-codex-spine` no longer uses Codex's Responses client, model-provider layer, `codex-api`, `codex-model-provider`, `codex-model-provider-info`, `codex-protocol`, or `codex-login` for outbound model requests. That cut may have gone too far on auth. Keep the typed request/status/event surfaces, but re-anchor credential loading/refresh in retained Codex-compatible auth before further transport purges.
|
||||
- Durable Epiphany state types now live in root crate `epiphany-state-model`. `codex-protocol` re-exports them only so old rollout/API callers keep compiling; do not add new durable `Epiphany*` state structs under `vendor/codex`. `epiphany-core` imports the native model directly and no longer depends on `codex-protocol`. Pressure derives from native `EpiphanyTokenUsageSnapshot`; Codex token telemetry is mapped at the bridge. Codex rollout/event reconstruction now lives in `codex-core::epiphany_rollout`, where the Codex `RolloutItem` / `EventMsg` types belong. Exact retrieval path matching is native to `epiphany-core`, so `epiphany-core` has no direct vendored Codex crate dependency.
|
||||
- The May 2026 foundation migration in `notes/epiphany-ideal-architecture-rebuild-plan.md` is complete enough to defend. Read `notes/epiphany-architectural-teardown.md` before touching Epiphany control-plane code, but do not treat it as an open-ended excuse to keep shaving the altar. The rebuild moved scene projection, freshness derivation, pressure policy, targeted context shards, bounded graph traversal, job/progress view derivation, planning view derivation, reorientation resume/regather verdict policy, pure CRRC recommendation policy, fixed-lane coordinator decision policy, role-board projection policy, role/reorient result interpretation, role self-persistence review policy, and role/reorient acceptance bundle policy into `epiphany-core`; typed acceptance receipts replaced summary-string identity for live accept paths, runtime links are dual-written on launch, and result read-back now prefers runtime links.
|
||||
- Read `notes/epiphany-ideal-architecture-rebuild-plan.md` immediately after the teardown. It defines the smallest coherent replacement architecture: durable `EpiphanyState`, runtime-spine-owned `RuntimeState`, separate role memory/heartbeat state, `epiphany-core` as policy owner, app-server as adapter, Aquarium as reflector, typed acceptance receipts, and derived view lenses instead of a protocol verb zoo.
|
||||
|
|
@ -795,12 +795,13 @@ request. `epiphany_automation.rs` still gathers live host facts and executes
|
|||
the host side effects: submit `Op::Compact`, call `epiphany_launch_job`, and
|
||||
emit JSON-RPC state-update notifications.
|
||||
|
||||
The native OpenAI auth spine no longer depends on the vendored
|
||||
`codex-keyring-store` wrapper. It uses the standard `keyring` crate directly
|
||||
The native OpenAI auth spine currently no longer depends on the vendored
|
||||
`codex-keyring-store` wrapper and uses the standard `keyring` crate directly
|
||||
while keeping Codex's `Codex Auth` service name and `cli|{sha256 path prefix}`
|
||||
store key so existing Codex subscription keyring entries remain readable.
|
||||
`codex-client` is now the only vendored crate intentionally kept in the native
|
||||
OpenAI request path.
|
||||
store key. Treat that as an overcleaned technical state, not doctrine. The next
|
||||
auth cut should re-anchor auth in retained vendored Codex-compatible machinery
|
||||
so Epiphany remains a modified Codex backend rather than a clean-room
|
||||
impersonator.
|
||||
|
||||
The MCP config path is now product-quarantined. `Config::to_mcp_config` keeps
|
||||
user-declared MCP servers but no longer accepts a `PluginsManager`, folds
|
||||
|
|
|
|||
Binary file not shown.
File diff suppressed because one or more lines are too long
Reference in a new issue