Add isolated opt-in OmniRoute transport to the Codex lane - #963

Scope

Add an explicit codex_lane.py --provider omniroute insurance transport while keeping native as the default/preferred provider, every isolation flag, fresh private homes and the blind child environment boundary. The CC's 2026-10-10T07:51Z ruling authorizes proceeding under explicit disclosure: every OmniRoute packet and attempt records provider=omniroute and pass_through=not_attested (deployed settings unreadable by policy; OmniRoute@c1e30b76 chatCore.ts:3156, systemPrompt.ts:210-217/278-283, strategySelector.ts:234-249). The sealer requires this exact runner-owned disclosure; the gateway is not claimed to be attested.

• Base commit: 86bb669ad6c81b9adafdb222d545a1bf2aa95218 (one landing rebase from published head 4646b9da6c9c7fb85f335ce7ce336e2e3d380435).
• Lane: lane:foundation.
• Owned paths: tools/sota-convergence/codex_lane.py, its README/schema/code registry/evidence receipt, scripts/landscape.py's shared sealer validation, tests/test_codex_lane.py, the dated decision and manifests/evidence.json.

The opt-in uses keyless inline provider overrides, not a profile or native auth. It defaults to http://127.0.0.1:21128/v1; CLI endpoint overrides take precedence over the sole added environment key, OMNIROUTE_BASE_URL. Non-loopback URLs, userinfo, queries/fragments, invalid ports and malformed types are refused before a child starts. Endpoints and cx/ model spelling are canonicalized before receipts/resume checks. Only OmniRoute packets and attempts add provider, endpoint and pass-through fields. Implicit and explicit native selection preserve the original receipt and usage fields, following the CC's 09:38Z ruling. Provider/endpoint changes rerun rather than reuse a native or differently routed result. Legacy native receipts and all required code digests remain valid.

SOTA sources

• Existing native receipt contract, pinned to landing base 86bb669ad6c81b9adafdb222d545a1bf2aa95218: restore the original exact assertion, keep transport metadata exclusive to OmniRoute, and verify implicit/explicit native receipts and every attempt retain their existing fields, as ruled by the CC at 09:38Z.
• native-agent-stack landscape-sweep README, automatic native-to-OmniRoute failover and codex_job.py:695-703, pinned to 4d345267866403d75edece400fde6cd35ec4d05c: adopt the supported transport-only inline provider while retaining the blind lane's stricter isolation and omitting the sweep's key/profile/search setup.
• Official OpenAI Codex configuration reference: custom-provider base_url, Responses wire format, static HTTP headers and default-false requires_openai_auth. Installed codex-cli 0.162.1 accepts the overrides, measured by the local HTTP canary; its exec --help confirms --ignore-user-config.
• OmniRoute Codex registry, pin 0585aba5589d5a1f49243a13a8db249558e7c9e3, lines 9-17 and 71-74: the cx Codex Responses executor and Sol/effort aliases. Composition record records base c1e30b7676975feb298b49eff6ff58923c04b89e, PR15167, affinity045aa81f3/build5f4b3d577; actual post-October-9 deployment/configuration remains unverified.
• OmniRoute passthroughHelpers.ts:47-89 at c1e30b7676975feb298b49eff6ff58923c04b89e supplies format passthrough, not a mutation bypass. Global system prompt helper:275-283, invoked at chatCore.ts3156, can wrap nonblank instructions. Plugins, middleware and payload rules also remain configuration-dependent.
• OmniRoute compression strategySelector.ts:232-249 and adaptive resolveAdaptivePlan.ts:48-68: the off request header can be overridden by adaptive planning. The supported no-memory header disables its memory/skills branch; it does not establish a route-wide no-rewrite guarantee.
• Exact disclosure required by the CC: not_attested (deployed settings unreadable by policy; OmniRoute@c1e30b76 chatCore.ts:3156, systemPrompt.ts:210-217/278-283, strategySelector.ts:234-249). At c1e30b7676975feb298b49eff6ff58923c04b89e, systemPrompt.ts:210-217 gates injection and 278-283 wraps instructions; strategySelector.ts:234-249 distinguishes the master kill from adaptive planning. Owner dashboard attestation remains the CC's item. If later attestation shows global prompt/compression/adaptive/plugin/payload settings apply, OmniRoute-provider verdicts are re-run. If native sign-in recovers before lane launch, use native and retain this transport as fallback only.

Evidence-class table

The client HTTP capture observed instructions absent/blank, so the pinned executor's blank-instructions fallback is a material boundary. It did not establish a successful gateway/provider turn or max-quality parity. No forbidden gateway route, live verdict wave or gateway inference call was made.

Local commands run

python3 -m unittest tests.test_codex_lane tests.test_verdict_lane_vendoring -v
rc 0; all 112 tests pass, 6.235s, including the restored exact native assertion, native receipt/usage omission, ISOLATION_ARGS, README block guards and exact disclosure/sealer checks.

python3 scripts/evidence_manifest.py --check
rc 0; 11,381 registered files. Changed evidence files refreshed through scripts.host_receipts.register_file; code registrations remain append-only.

python3 scripts/validate.py
rc 0; 70 components, 11,381 hashed files, 4 profiles, 239 receipts.

gitleaks git . --log-opts=86bb669ad6c81b9adafdb222d545a1bf2aa95218..HEAD --redact --no-banner
rc 0; the PR commit range scanned, no leaks found, installed Gitleaks8.30.1.

python3 scripts/codex_quota.py --json --timeout 15
rc 0; ordinaryUsageAllowed=false, primary reset2026-10-14T03:28Z (only filtered availability/reset metadata retained).

Synthetic tier-1 packet dry-run: test_omniroute_dry_run_on_a_synthetic_tier1_packet_writes_nothing, rc0, no model/output/home. Final tier-1 STAGED is not published yet; preliminary exports do not satisfy that gate.

Decision record

docs/decisions/2026-10-10-codex-lane-omniroute.md and tools/sota-convergence/evidence/codex-lane-omniroute-20261010.json record the implementation, primary sources, canaries, native-window measurements and unattested gateway preservation boundary.

The CC's ruling permits operation under the recorded not-attested disclosure and re-run rule; it does not turn format passthrough or client capture into an attestation. Native stays preferred/default, and dashboard/owner attestation belongs to the CC. No gateway settings/deployment change is included.

Host evidence

Not applicable: the added receipt records local client/gate integration, synthetic fixture and source-review boundaries.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment.
• New/changed workflows declare top-level permissions: {} and only required job permissions.
• No secrets are printed, logged or committed; no new required secret is added.
• No new paid hosting, subscription or billing surface is introduced.
• Peer-owned files/worktrees preserved; fix(openhands): protect native shard discovery before macOS CI retirement #959 remains separate.