Bug type

Regression (worked before, now fails)

Beta release blocker

Yes. The installed Codex plugin passed its preflight and all three live turns; this is a trusted-main release-harness assertion defect.

Summary

The live-codex-npm-plugin release assertion still reads the retired <sessionFile>.codex-app-server.json sidecar after #101210 moved Codex app-server bindings into SQLite plugin state.

Steps to reproduce

1. Run the live-codex-npm-plugin release-path lane for candidate 811ddd96180583bae00001f71971419182ae0520 with the trusted harness from main.
2. Observe the Codex CLI preflight and all three OpenClaw agent turns succeed.
3. Observe scripts/e2e/lib/codex-npm-plugin-live/assertions.mjs fail while opening the retired sidecar.

Expected behavior

The trusted-main assertion should resolve the session's stable binding key and validate the active Codex binding in state/openclaw.sqlite under plugin_state_entries.

Actual behavior

The product path passes 3/3 live turns, then the assertion exits with ENOENT for codex-npm-plugin-live.jsonl.codex-app-server.json.

OpenClaw version

2026.7.1-beta.3 candidate 811ddd96180583bae00001f71971419182ae0520; trusted harness SHA 0e4c7cd15542da327dcde5edc937f1fcb275b45a.

Operating system

Ubuntu GitHub Actions runner, Docker E2E, Node.js 24.16.0.

Install method

Packaged OpenClaw artifact plus npm-packed @openclaw/codex inside the release Docker lane.

Model

codex/gpt-5.4

Provider / routing chain

OpenClaw agent command -> npm-installed @openclaw/codex -> Codex app-server.

Additional provider/model setup details

The live provider interaction succeeded. The failure occurs only in the post-turn trusted-main assertion.

Logs

turn1_agent_status: 0
turn2_agent_status: 0
turn3_agent_status: 0
Error: ENOENT: no such file or directory, open '.../codex-npm-plugin-live.jsonl.codex-app-server.json'
    at assertAgentTurn (.../scripts/e2e/lib/codex-npm-plugin-live/assertions.mjs:423:19)

Screenshots, recordings, and evidence

• Failing job: https://github.com/openclaw/openclaw/actions/runs/29071385155/job/86296271087
• SQLite migration: refactor(codex): store app-server thread bindings in SQLite plugin state #101210

Impact and severity

• Affected system: beta release validation using the trusted-main Codex npm plugin harness.
• Severity: blocks the release gate while product behavior is healthy.
• Frequency: deterministic on the migrated storage shape.
• Consequence: false-negative release validation after paid live provider turns complete successfully.

Additional information

The old sidecar assertion predates #101210. Runtime code correctly writes the binding to SQLite; only the release assertion was left behind.

Post-merge rerun https://github.com/openclaw/openclaw/actions/runs/29074133207 proved the trusted-harness routing also defaulted to the candidate checkout because scripts/lib/docker-e2e-scenarios.mjs overescaped the .release-harness path regex. The product again passed preflight and all three live turns before executing the candidate's stale assertion.