Require explicit providers in Codex execution tools - #887

Scope

Six repository caller categories now require an explicit provider before constructing codex exec: native proof, blind convergence, adjudication, landscape sweep, token judging and the capability gate's SDK launcher. Missing choices refuse before setup; native and keyless loopback OmniRoute preserve the existing isolation, model/effort and stdin contracts. Constructors retain the existing fast service tier.

This revision also repairs the hosted failures found on the initial draft: a verified source digest triggered generic-api-key, older fixtures omitted the required provider or fast-tier argument, and the current lane source provenance was absent from its append-only registry.

• Base: 9f7b38b23d15e47ceb6f68c6651b86088f621797, reached by one rebase after fetching the corrected current-main target.
• Lane: lane:foundation; PR remains a draft for both co-op reads.
• Owned paths: the six executor categories and capability wrapper, their README files and tests, the dated decision and two artifact receipts; remediation adds a narrow .gitleaks.toml entry, explicit fixture updates and append-only lane provenance.
• manifests/evidence.json was recovered and refreshed using the existing freshness_propose.register_receipt, host_receipts.register_file and evidence_manifest helpers. Its registration is committed last.

SOTA sources

• openai/codex rust-v0.161.0, commit 979011409de0a60b52f179721948e65531d26144: codex-rs/model-provider-info/src/lib.rs, codex-rs/config/src/loader/mod.rs and codex-rs/core/config.schema.json. This is the retained implementation reference for supported provider overrides, profiles and configuration isolation.
• Official advanced configuration and configuration reference.
• Existing inline-provider reference: codex_job.py at be7273a4, its transport-only provider-table construction.
• promptfoo 0.123.1 Codex SDK provider: the supported SDK launcher and stdin integration documented in tools/capability-gate/README.md.
• gitleaks/gitleaks v8.30.1 README and generic credential rule: native rule-scoped condition = "AND", exact path and whole-line matching. The binary archive was verified against the workflow's pin at the rebase base.
• Native evidence writer and append-only lane provenance contract. Existing native provenance producers supplied the new registry entries; merged entries remain unchanged.

Changed test expectations

The following six older test expectations changed to match the explicit-provider contract. Runtime routing was not weakened.

• RunnerTests.test_codex_command_line_stdin_and_directory: strict argv includes the existing -c service_tier="fast" pair.
• RunnerTests.test_ultra_defaults_and_idle_refusal_precede_state_changes and RecoveryRunnerTests.test_default_budgets_clear_observed_healthy_silence_and_research_duration: direct staged fixtures declare provider: native.
• ShellTests.test_staged_copy_needs_no_work_dir_argument: preserve generated codex metadata while overriding polling intervals.
• Both SkillLaunchTests live/missing-skill fixtures pass --provider native, a temporary Codex home and a mocked worker environment. The live fixture's strict expected argv includes the provider argument and checks the environment.

Existing timeout, refusal, directory isolation, prompt, observed-route and six-versus-five run assertions remain. The two lane-vendoring expectations are unchanged; actual native source provenance was appended instead. New gitleaks tests cover the allowed source digest, rejection on other fields/paths/shared lines and equality with the named source digest.

Evidence-class table

Local commands run

Every test command used nice -n 10 ionice -c2 -n7 timeout 600 and one named module:

nice -n 10 ionice -c2 -n7 timeout 600 python3 scripts/validate.py passed after registration. Root-relative native gitleaks dir . --config .gitleaks.toml --max-target-megabytes 2 --redact --no-banner passed with no findings. Final committed-history scan is recorded in the publication receipt.

Failure conditions remain recorded: the four assertions/four errors reproduced from the initial modules, the red allowlist regression, the initial new-receipt metadata/schema error and the absolute-subtree scan whose path format does not match the deliberately repo-relative allowance. Intermediate repeated runs are not summed.

These checks are offline integration, synthetic fixtures and source review. They do not establish a fresh live model/provider run, actual service-tier delivery or current hosted CI success. The historical receipt's tests/test_codex_worker_lane.py digest remains dated; the merged current module was tested separately. A transient subprocess warning was observed and the referenced child was independently confirmed exited.

Decision record

docs/decisions/2026-10-08-codex-exec-explicit-provider.md; original and remediation receipts are under evidence/artifacts/codex-exec-explicit-provider-20261008/.

Host evidence

No host receipt, account, service or active client configuration was changed.

Checklist

• Nonempty SOTA sources and exactly one lane label.
• Secret diagnosis preceded mutation; only rule/file/line metadata reported.
• One rebase; evidence registration uses native helpers.
• Module-scoped tests, original failure conditions and changed expectations recorded.
• Historical evidence preserved; independent source/test critics completed.
• Both co-op reads and exact-head hosted acceptance.
• CC cue and 5f landing.