wire_parity_v2 linked CodexConnector (PolyForm Noncommercial) into the kit's
test build. The v2 bytes it compared against are now committed, generated once
from fd7cec4 (generator and command beside them): invocations for both
tool-choice values, a completed, a failed and a refused result for every
refusal, canonical bytes, the provider digest and v2-sealed envelopes the kit
must decrypt. envelope.rs tests pin the outer-identity match on each field,
envelope validation, and the inclusive, never-empty frame bounds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
serve now refuses, before opening anything, a frame under 8192 bytes, fewer
connections than max(sum of caller slots, 8), and a caller payload bound outside
4096..=frame-4096 (the base daemon's validate, unchanged). A provider result
larger than frame-4096 becomes a typed result_size failure before it is recorded,
so a retry replays deliverable bytes. A payload over a caller's bound is refused
Policy on the wire instead of dropping the connection. The orphan capacity
helpers are deleted; the accept loop takes its connection source so a test can
present a non-loopback peer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Entry points, verify commands, and the AGPL-3.0-only relicense record: lifted
from CodexConnector fd7cec4, formerly PolyForm Noncommercial.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A kit-encrypted invocation and result decrypt and validate under codex-connector
fd7cec4 and the reverse; canonical invocation bytes, canonical provider request
bytes, the provider digest and the five schema ids are equal. The dev-dependency
and this test are deleted by connector-contract-v3, which changes the wire.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
service.rs is CodexConnector lib.rs 954-1313 verbatim under the rename rule.
serve.rs is the accept loop of daemon.rs over ProviderBackend (ready, execute),
ServeLimits, CallerConfig and load_admissions; no config document, no provider,
no Idunn route observation. serve refuses a non-loopback listener and drops
non-loopback peers. ready() is consulted once, before replay state is opened and
before the first accept, as base consulted readiness at startup; execute is
called on the request path without consulting it (base only checked readiness
for health). New tests: end-to-end replay with a counting backend, readiness
timing, limits, peer and listener refusal, connection permits, and behavioural
kills for survivors in service policy, payload bound, refusal mapping, restart
record validation and completion mismatch.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Workspace with the model-connector crate. contract.rs, envelope.rs and client.rs
are CodexConnector lib.rs moved verbatim under the rename rule (strip the leading
Codex from identifiers); schema id strings are unchanged, so the v2 wire is
unchanged. canonical_responses_body stays behind: it is OpenAI Responses lowering.
The moved tests keep their bodies; shared fixtures live in fixtures.rs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
