Codex review: needs maintainer review before merge.

Summary
The PR routes Codex app-server compaction through native Codex thread compaction, adds doctor migration/warnings for stale Codex/Lossless compaction config, exports a context-engine owner helper, and updates Codex docs/changelog.

Reproducibility: yes. Current main has a high-confidence source-level reproduction path: an owning context engine can compact before native Codex compaction, and the linked issue plus PR proof show the OAuth api.responses.write failure mode.

Real behavior proof
Sufficient (logs): The PR body includes structured before/after Testbox runs and the discussion includes redacted live beta-run logs showing the original public Responses/OAuth scope failure no longer appears after the patch.

Next step before merge
Protected maintainer label plus live lifecycle/accounting observations require maintainer merge/release judgment; I found no narrow automated repair finding to queue.

Security
Cleared: The diff changes Codex routing, doctor repair logic, docs, changelog, SDK export surface, and tests without adding dependencies, workflows, install scripts, secret access, or downloaded code execution paths.

I tested 2026.5.14-beta.1 with this PR merged locally. The original 401 failure appears fixed: I no longer see compaction routed through public openai-responses with the Codex OAuth profile, and there are no api.responses.write scope errors.

I did find a few follow-on lifecycle/accounting issues around the different compaction paths.

WebChat /compact

Running /compact did reach the new Codex app-server wrapper path:

2026-05-15T17:44:18.197+10:00 [agent/embedded] started codex app-server compaction
2026-05-15T17:45:08.396+10:00 [agent/embedded] completed codex app-server compaction
2026-05-15T17:45:08.402+10:00 [ws] ⇄ res ✓ sessions.compact 53111ms

After that, frontend refresh RPCs returned successfully (commands.list, models.list, sessions.list, chat.history), but the active session then appeared stuck as processing / activeWorkKind=embedded_run. Diagnostics repeated:

classification=stalled_agent_run
reason=active_work_without_progress
activeWorkKind=embedded_run
lastProgress=codex_app_server:notification:turn/completed

So the manual /compact path can complete native Codex compaction, but leave the OpenClaw embedded-run lifecycle wedged.

The context meter also did not visibly drop after this manual /compact; it stayed around 45%, though Compactions eventually showed 1.

Organic / threshold compaction

I then forced organic compaction by intentionally pushing the session context up with large read-only tool output.

This behaved differently:

• The UI visibly showed context dropping mid-turn.
• Internal status dropped from about 180k/272k (66%) to 34k/272k (12%).
• The session did not wedge in the same way.
• But Compactions stayed at 1; it did not increment for the organic compaction.
• I did not see the same gateway log lines as the manual /compact wrapper path.

So organic compaction appears functionally successful, but it is not reflected in compactionCount, and the logging/accounting path seems different from manual /compact.

/codex compact

I also tried /codex compact. That appears to be a separate direct Codex control path: it starts Codex compaction, but does not seem to use the PR wrapper path, wait for completion, or update OpenClaw accounting in the same way as WebChat /compact.

Current read

This PR looks correct for the original bug: Codex-backed sessions no longer fall back into OpenClaw/public Responses summarization and hit the api.responses.write 401.

The remaining issues seem to be observability/lifecycle/accounting:

1. Manual WebChat /compact can complete Codex native compaction but leave the active embedded run stuck.
2. Organic threshold compaction reduces effective context cleanly, but does not increment compactionCount.
3. UI context/status can be stale or inconsistent across these paths.
4. /compact, /codex compact, and organic threshold compaction appear to exercise three different bookkeeping/logging paths.

Landing proof for rebase merge (not squash):

Behavior addressed: Codex app-server compaction now stays on native Codex thread compaction; OpenClaw context-engine compaction is not used as fallback/primary summarizer for Codex-runtime sessions. Lossless remains supported through the context-engine slot and legacy config is migrated by doctor when safe.

Real environment tested:

• Baseline reproduction on origin/main: tbx_01krn641yf4ppdtbb0kappkjbx, Actions https://github.com/openclaw/openclaw/actions/runs/25904490545 (failed as expected: contextEngine.compact called for Codex compaction and warning absent).
• PR Testbox: tbx_01krnafa4hbkrdpz35b8f5sx6w, Actions https://github.com/openclaw/openclaw/actions/runs/25907207989 (passed).
• Edge-case Testbox: tbx_01krnf6zh784p07gzpejccwwn2, Actions https://github.com/openclaw/openclaw/actions/runs/25910432813 (passed).
• Security fix Testbox: tbx_01krng2knqeyv0nb9g0x5e01tr, Actions https://github.com/openclaw/openclaw/actions/runs/25911067410 (passed).
• Sibling Codex checkout: ../codex on main at 6a225e4005; targeted app-server compaction contract test passed.

Exact steps or command run after this patch:

• git diff --check origin/main...HEAD
• pnpm plugin-sdk:api:check
• OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test src/commands/doctor/shared/codex-route-warnings.test.ts extensions/codex/src/app-server/compact.test.ts extensions/codex/src/app-server/run-attempt.context-engine.test.ts -- --reporter=dot
• (cd ../codex/codex-rs && cargo test -p codex-app-server thread_compact_start_triggers_compaction_and_returns_empty_response)

Evidence after fix:

• Rebased stack preserved as three commits; merge method requested: rebase, not squash.
• Local focused tests passed after latest rebase: 59 doctor tests + 22 Codex extension tests.
• Plugin SDK API baseline check passed after latest rebase.
• Codex app-server source/test confirms thread/compact/start submits Op::Compact, returns {}, and emits contextCompaction item started/completed notifications.
• Codex review final run before rebase reported no accepted/actionable findings; rebased diff only resolved changelog movement.

Observed result after fix:

• Codex app-server compaction starts native thread compaction and never invokes contextEngine.compact() as fallback/primary summarizer.
• Stale OpenClaw compaction summarizer overrides warn at runtime and are removed by doctor when safe.
• Lossless legacy compaction config migrates to plugins.slots.contextEngine = "lossless-claw" with bounded summaryModel policy; unsafe mixed/conflicting configs stay intact with manual warnings.

What was not tested:

• No live installed Lossless package against a real user install in this final landing pass; covered by contract/unit tests, local fixtures, Testbox lanes, and sibling Codex app-server contract verification.