Propose guarded daily Codex currency with 0.162.0 canary evidence - #893

Scope

Native Codex update routes activate a release immediately and do not provide a protected two-lane canary gate. This draft proposes a daily Dagu/systemd flow that stages the complete publisher package, requires co-op-owned release review and real queued-task canaries, then selects future launches or retains/restores the prior wrapper on failure. It also records the independently qualified 0.162.0 stage and two current native canaries. No installed launcher, user unit, provider configuration, paper worktree or N2 bundle was changed by currency.

• Base commit: 9f7b38b23d15e47ceb6f68c6651b86088f621797.
• Lane: lane:foundation.
• Owned paths: examples/codex-native/currency/, proposed adoption/templates/systemd/codex-currency.{service,timer}, one new tests/test_codex_currency.py, the dated decision and sanitized receipt, plus nine registered rows in manifests/evidence.json.

SOTA sources

• openai/codex rust-v0.162.0, peeled commit c1382380de69521303b416720a52f42d51af6248; tagged installation README, native package extraction, published SHA256SUMS and official installation documentation. The full installer changes selection; the stage used publisher bytes and its native extraction reference only.
• dagucloud/dagu v2.18.2, graph execution, native schema/validate, timeout and failure/abort handlers; installed native CLI checked the entrypoint format.
• cli/cli v2.102.0, supported gh api, gh release download, required-check queries and gh pr create --draft --body-file.
• aannoo/hcom b2a7c192003e7fd67ed93265289e4ac36276f965, caller-PATH resolver and native absolute tool-path runner. The co-op used per-launch selection, preserving its native hooks and explicit model/effort choices.
• systemd v259 service and timer references: recorded ExecCondition refusal, finite timeouts, daily persistent scheduling and native lock ownership. The existing observability/collector/codex-identity-launcher.sh.example and its documented sed route supply the local selection format; this remains local integration glue.
• Codex tagged managed-worktree specifications and release #50148 match the actual canary namespace's create/status/list tools. The decision proposes co-op-only lifecycle wording; no live brief is edited.
• Alternatives: native codex update activates without this gate; Renovate github-releases and draftPR cover release-pin PR maintenance, not host canary selection. Renovate was neither installed nor measured. No custom model/task runner or vendor fork was introduced.

Evidence-class table

The current canary PASS is scoped to smoke and completed queued tasks. PR887's observed five passing/two failing checks and diverged base are its accurate task result, not PR readiness. Recovered context-mode #852 refusals and a strict checkpoint-field extraction error do not establish a 0.162.0 client regression. Full hidden provider/transport/retry totals remain unknown. Exact local turn/call identifiers stay in private evidence; publication validation caught and removed them from the public receipt.

Local commands run

nice -n 10 ionice -c2 -n7 timeout 600 python3 -m unittest discover -s tests -p test_codex_currency.py
19 tests, OK
bash -n examples/codex-native/currency/currency.sh
exit 0
dagu validate --dagu-home <owned-isolated-validation-state> examples/codex-native/currency/dag.yaml
exit 0; initial root-name refusal retained and corrected
systemd-analyze --user verify <temporary-rendered-proposal-service> <temporary-rendered-proposal-timer>
exit 0; no unit load/enable/start/reload
nice -n 10 ionice -c2 -n7 timeout 600 python3 scripts/validate.py
passed: 70 components, 10909 hashed files, 4 profiles, 239 receipts
git diff --check
exit 0

No existing test expectation changed. No full local suite, provider A/B, upstream Codex test suite or broker execution was run.

Decision record

docs/decisions/2026-10-08-codex-0162-stage-and-currency-proposal.md; the implementation and exact adapter/receipt contract are in examples/codex-native/currency/README.md.

Deployment remains proposed. The co-op callback must be supplied and reviewed through its existing launch/queue ownership, with native two-lane acceptance and exact cleanup on timeout. All cooperating selector writers must use the proposed lock. Review and resolve unit/environment placeholders before any future installation. No standing host timer or default cutover is claimed by this draft.

The proposed promote phase changes which executable the base identity launcher (~/.local/share/codex-ecosystem/bin/codex) runs by replacing its authenticated exec path. It does not modify the CC-owned codex_version map. Under the rollout policy recorded on 2026-10-08, each lane takes hold.<lane> or the mapped default, with 0.161.0 fallback for a missing/invalid map; an explicit per-launch CODEX_VERSION override supports rollback. That selection remains authoritative over the base wrapper. The co-op launcher compares the requested version with the base wrapper's exec line and needs a per-launch wrapper copy for every differing version, including held 0.161.0 and the previous version used for rollback. No mass relaunch or paper-session change is part of this proposal.

Before adopting this standing workflow, co-op-owned selection must integrate the mapped default/holds with this global-wrapper change and retain native rollout evidence. Changing only the base wrapper cannot promote a new release for lanes whose map still selects the prior release. This integration is an explicit deployment gap in the draft; this PR neither edits that private map nor installs any unit. Current CC-approved 0.162.0 mapped rollout is separate from execution of the proposed timer.

Host evidence

No evidence/hosts/ files or platform acceptance status changed. The receipt is a compact, sanitized native-stage/canary record and distinguishes fixture checks from upstream acceptance.

Checklist

• No GitHub Actions workflow was added or changed.
• Every implementation step cites its publisher/native integration reference.
• No credential values, conversations, local session identifiers or personal host paths are published.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned files/worktrees, the anthropic-api-2 builder worktree and paper/N2 paths were preserved.
• Units are proposed only; installation, default rollout and landing remain outside this publication.