[Yuxin-Qiao]

Summary

Partially addresses #6520: canonical ChatGPT-forward Responses egress normalizes an existing safe caller session-id, then thread-id, into upstream session_id. A non-empty canonical session_id wins. Empty session headers are treated as absent, matching the existing auth materializer; a non-empty invalid higher-priority alias suppresses weaker aliases and metadata. With no non-empty alias, the existing Claude metadata identity remains the fallback. Original ingress headers and principal-scoped x-session-id promotion are preserved; keyed/custom destinations and marker-free callers gain no new identity.

Maintainer commits 9e2207411a and dc23a969d1 align affinity expectations, docs, and empty-header behavior. The final test-only commit exercises 401 refresh/replay through the real dispatch path and asserts unchanged conversation identity, caller originator and original headers across both sends. No Codex originator or shared-prefix/cache-cohort identity is fabricated. #6520 stays open: this is header continuity, not measured cache reuse or a fix for identity-free workflows.

Verification

Exact final head: bf059154c8a21bdfc96e62f99256f7ca462837f8; dev base e53c8077e40b6f540bf1e5d5791a55282466bfac.

• bun run test tests/claude-integration/claude-native-affinity.test.ts tests/responses/chat-conversation-affinity.test.ts tests/server/caller-session-identity.test.ts tests/server/caller-session-ingress.test.ts tests/lab/core-lab-boundary.test.ts --parallel=1 --timeout 20000: 69 pass, 0 fail, 555 assertions. Includes canonical alias/metadata routing, keyed/custom fallback, principal separation and original request preservation.
• The added wire-level stored-main 401 refresh/replay cases: 3 pass, 0 fail. Both sends keep the caller session/originator; authorization changes to the refreshed fixture token. A final focused repeat of just those cases passed at the committed file contents. These do not prove live subscription or backend cache behavior, and the prior helper also passed this replay fixture; no red-before claim is made for the replay cases.
• bun run typecheck, bun run privacy:scan, bun run structure:check, bun scripts/file-size-ratchet.ts, git diff --check: passed. Final test-only adjustment was typechecked again.
• cd docs-site && bun run build: 561 pages and 78,082 internal links checked.
• Broad local validation at this final head: OCX_TEST_MAIN_TIMEOUT_MS=900000 bun run test --parallel=2 --timeout 15000 reached the 15-minute cap (exit 124), with 31 observed failures and 890 files unstarted. Continued those files plus 2 interrupted files using bun run test --parallel=4 --timeout 15000 <892 explicit paths>. All files started, but the macOS multi-file process stalled for over ten minutes while importing ocx-launcher-runtime.test.ts; interrupted that run (exit 130), preserving 8 observed failures and the named incomplete file. That file completed in a fresh process: 2 pass, 2 Windows-only skip, 0 fail. All 18 repository serial-lane files completed: 654 pass, 0 fail. The union covers all 2,077 test files across bounded batches; full-suite status remains red, not a clean single-run result.
• Failure attribution on unmodified dev at the same base: Anthropic Fast (7 pass/1 fail; fake-IP DNS triggers the existing destination refusal), provider validation/verbosity (118 pass/20 fail), serving runtimes (34 pass/2 fail), storage-policy race (0 pass/1 fail), retained-root serialization plus plaintext server (42 pass/1 fail/1 error) reproduce the matching 25 failures. No production guard or host network setting was relaxed.
• The remaining 14 observed failures are timing/isolate-sensitive: CLI help/models (43 pass/0 fail) and restart-home (6 pass/0 fail) pass in both current-head and clean-dev fresh-process controls; canonical buffered-turn timing passes in both clean-dev and current-head controls (current head: 41 pass/0 fail). Those successes do not erase the recorded broad failures. Original local logs remain in scratch; Windows-specific execution is left to hosted CI.
• Independent static identity-boundary review is recorded by the maintainer at dc23a969d1 in comment 5986920762. Current source is identical to that reviewed source; final bf059154c8 adds only the replay fixture. This is a scoped review, not an approving GitHub review or test execution by the reviewer.
• The older hosted mirror run at dc23a969d1 cannot certify final-head tests. Required exact-head CI is approval-required. No installed runtime/account setting change or live provider traffic.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (Maintainer-recorded static identity review at dc23a96; final delta is test-only.)

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Readiness boxes ticked by maintainer @lidge-jun during the 2026-10-05 release-readiness train (lane R1). Per owner instruction no tests were run locally; local validation was limited to static checks (typecheck, lint, build, structure, privacy, ratchet) and tests ran in hosted CI at the exact head — that is the documented exception for the first box.

Summary by CodeRabbit

• New Features
  • For supported ChatGPT-backed requests, session-id and thread-id headers can now provide a session identity when session_id is absent. Valid aliases are forwarded with their original header names.
  • Empty headers are treated as absent. An invalid higher-priority identity does not fall back to a weaker alias or metadata-derived identity.
• Documentation
  • Clarified session identity precedence and how it differs from cache-cohort markers. Custom and API-key destinations remain unchanged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: cb1277fe-d20e-4651-b2e2-a7908082b7d6

📥 Commits

Reviewing files that changed from the base of the PR and between e53c807 and bf05915.

📒 Files selected for processing (7)

• docs-site/src/content/docs/reference/proxy-formats.md
• src/server/caller-session-identity.ts
• src/server/responses/core-auth.ts
• structure/data-planes/inbound-compat.md
• tests/claude-integration/claude-native-affinity.test.ts
• tests/responses/chat-conversation-affinity.test.ts
• tests/server/caller-session-identity.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

Canonical ChatGPT-backed Responses egress now resolves session identity from a non-empty session_id, safe caller aliases, or Claude metadata. Tests and documentation cover alias precedence, forwarding, fallback behavior, and auth-refresh replay.

Changes

Canonical Responses session identity

Layer / File(s)	Summary
Resolve native session identity src/server/caller-session-identity.ts, src/server/responses/core-auth.ts, tests/server/caller-session-identity.test.ts	A shared helper trims and validates caller session IDs. Native egress uses safe aliases when no non-empty session_id exists, then uses metadata only when no non-empty alias is present. Tests cover precedence, invalid and empty values, forwarding, and unchanged destinations.
Validate forwarding and document precedence tests/claude-integration/claude-native-affinity.test.ts, tests/responses/chat-conversation-affinity.test.ts, docs-site/src/content/docs/reference/proxy-formats.md, structure/data-planes/inbound-compat.md	Tests cover alias-derived identity during auth-refresh replay and Chat-to-Responses forwarding. Documentation describes identity precedence, unchanged alias header names, destination exclusions, and conversation-marker guidance.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: lidge-jun

Merge Risk: ⚪ Minimal · up to bf059

No merge-blocking code issue was identified. The exact-head CI runs still need approval and completed results before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to bf059

The change is narrowly restricted to canonical ChatGPT forwarding and preserves credential selection, original request headers, and replay identity. No introduced authorization bypass was demonstrated. Upstream interpretation of shared session identifiers remains unverified, so the assessment retains limited uncertainty.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed exposure is caller-selected conversation metadata on canonical ChatGPT requests under the independently selected upstream credential. Requests sharing an upstream account can supply identical explicit identifiers; provider-side collision or ownership effects were not established. Caller-selected session_id and forwarding of both aliases already existed before this PR.

Trust Boundaries and Controls

• observed — Promoted aliases are trimmed and restricted to 1–128 characters using an alphanumeric first character followed by alphanumerics, dot, underscore, colon, or hyphen. Validation controls promotion only: invalid aliases remain in the original headers, and existing non-empty session_id values remain authoritative.
• observed — Session normalization does not select authorization or account credentials. The existing auth materializer overwrites pool credentials with the selected stored account and fails before I/O when required main-credential substitution is unavailable.

Resilience and Maintainability Implications

• observed — The inspected refresh transition retains account context while replacing credential material. Failed refresh aborts before replay, an incompatible refreshed adapter is rejected, and a second 401 cannot initiate another Codex credential replay. Replay transport cleanup releases body observation in a finally block.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: normalizing native upstream session aliases for Responses.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request has been marked Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers notified: @lidge-jun @Ingwannu

[Ingwannu]

Scoped source intake at a9a0ff1, not approval. The five-file diff normalizes an existing safe session-id/thread-id only on canonical ChatGPT egress when session_id is absent; explicit presence (including empty), invalid higher-priority aliases, unchanged ingress headers and noncanonical destinations retain their separate behavior. The tests preserve originator rather than fabricate one. This is header continuity, not measured cache reuse or a fix for identity-free callers; #6520 must remain open for that unresolved scope.

Exact-head Cross-platform CI 37211887030 and React Doctor 37211886966 remain action_required. Draft 0/4 and the unchecked independent identity/auth-boundary review remain holds. The author-reported 48 focused passes and incomplete full suite are not new validation by me. Please complete the required independent review/readiness and executed exact-head CI; no sponsorship or scan waiver is implied.

[lidge-jun]

Maintainer refresh + independent identity-boundary review — head dc23a969d1c3a7c27ce4b4e23cd3c58f54e1d488

Pushed to this branch (no force): a merge of dev e53c807 (no conflicts), plus two commits:

• 9e2207411a updates the wire expectations that the new normalization changes (tests/claude-integration/claude-native-affinity.test.ts for alias cases, and tests/responses/chat-conversation-affinity.test.ts for the hyphen-pair shape). It adds a two-alias precedence case (session-id beats thread-id and metadata) and states the alias precedence exactly in both docs.
• dc23a969d1 makes withClaudeNativeSession treat empty header values as absent, matching materializeCodexUpstreamAuth. Before this, a request with session_id: "" and a valid alias could send the alias on the first attempt but nothing on a retry rebuilt from the raw caller headers. Unit cases and docs were updated to match.

Independent identity-boundary review (sol reviewer, static): VERDICT PASS at dc23a969d1. Earlier rounds at a9a0ff1afc (FAIL: stale affinity assertion P1, docs P2) and 9e2207411a (PASS-WITH-FIXES: empty-header docs P2) are resolved.

• Marker-free callers get no new identity. The only fallback is the existing Claude metadata session, as on dev.
• Aliases are forwarded as validated raw values ([A-Za-z0-9][A-Za-z0-9._:-]{0,127}), exactly like an explicit canonical session_id. No path replaces a principal-scoped value with a raw alias, and promoted x-session-id stays principal-hashed.
• Only canonical ChatGPT forward destinations receive the header. Keyed and custom providers and fallback ingress headers are unchanged.
• Residual: auth replay (passthrough-dispatch.ts refresh path) is covered through the helper contract only, with no wire-level replay case.

Verification: per owner instruction for this release train, no tests were run locally. Static gates at dc23a969d1: bun run typecheck, bun run structure:check, bun scripts/file-size-ratchet.ts, bun run privacy:scan and git diff --check all exit 0. Hosted evidence: PR CI run 37254275278 (approved) and full-matrix workflow_dispatch lane=all on mirror ci-mirror/pr-6588 at the same SHA, 37254293069.

The contributor review-readiness checklist above is left for the coordinator.

[Ingwannu]

Current-head coordination at bf059154c8a21bdfc96e62f99256f7ca462837f8, base dev e53c8077e40b6f540bf1e5d5791a55282466bfac.

Owner comment 5986920762 records the identity-boundary review at preceding dc23a969, including its then-unverified wire-level 401 replay coverage. The subsequent test-only change adds that replay fixture: it asserts two sent identities/originators and the refreshed bearer while preserving the original caller headers. I read the fixture change; it has not been executed by me, and its assertion presence is not a pass.

Please align the PR Summary and Verification with the final implementation/head. The Summary still says an explicit empty session_id wins and empty aliases suppress weaker metadata, while the owner follow-up explicitly says empty values are treated as absent. Record the exact final policy, the review's head/scope and the actual new replay-test result instead of leaving conflicting current descriptions.

Current-head Cross-platform CI 37254847437 and React Doctor 37254847442 are approval-required, not success. The older dc23a969 mirror run cannot certify this added fixture. Keep Draft/readiness conditions and #6520's partial scope; no measured cache-ratio or installed-provider acceptance is established. No new scan, local test, live account/provider call, workflow authorization or approval was performed.

[Yuxin-Qiao]

Final validation follow-up at bf059154c8a21bdfc96e62f99256f7ca462837f8 (dev base e53c8077e4). Summary and Verification now match the maintainer's empty-header policy and state the scope/head of the independent static review. The final test-only delta adds the requested real-dispatch stored-main 401 refresh/replay coverage: all three cases passed; the related five-file set passed 69 tests/555 assertions. Typecheck, privacy, structure, size ratchet and the 561-page docs build passed.

All 2,077 test files were covered across the bounded full attempt, 892-file continuation, isolated launcher completion and all 18 repository serial lanes (654 pass). The full suite remains red: 25 matching failures reproduced on clean dev, and 14 timing/isolate-sensitive failures remain recorded despite passing focused controls. The Verification section gives exact commands, interrupted lanes and remaining Windows coverage. This does not measure backend cache reuse, fix identity-free callers, or satisfy readiness by treating baseline failures as green.

Please authorize/execute required hosted CI at this final SHA and confirm the preceding source-bound identity review remains applicable after the test-only replay delta. The older mirror run at dc23a969d1 cannot certify this head. Draft and #6520 remain open. @coderabbitai review

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
repo="lidge-jun/opencodex"
head="bf059154c8a21bdfc96e62f99256f7ca462837f8"
reviewed="dc23a969d1c3a7c27ce4b4e23cd3c58f54e1d488"
echo "=== Current PR ==="
gh pr view 6588 --repo "$repo" --json headRefOid,isDraft,state,url,statusCheckRollup
echo "=== Delta from reviewed source ==="
gh api "repos/$repo/compare/$reviewed...$head" --jq '{status,ahead_by,behind_by,total_commits,files:[.files[]|{filename,status,additions,deletions,patch}]}'
echo "=== Exact-head workflow runs ==="
gh api --method GET "repos/$repo/actions/runs" -f head_sha="$head" -f per_page=100 --jq '{total_count,workflow_runs:[.workflow_runs[]|{id,name,event,head_sha,status,conclusion,html_url}]}'

Length of output: 9992

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
git rev-parse HEAD
fd --type f '^claude-native-affinity\.test\.ts$'
ast-grep outline tests/claude-integration/claude-native-affinity.test.ts --items all
nl -ba tests/claude-integration/claude-native-affinity.test.ts | sed -n '1,240p'

Length of output: 16188

---

@Yuxin-Qiao, the preceding source-bound identity review remains applicable to the unchanged production source at bf059154c8a21bdfc96e62f99256f7ca462837f8. I verified the commit comparison and read the changed test file. This confirmation does not constitute PR approval or independent test execution.

Verified scope

The delta from dc23a969d1c3a7c27ce4b4e23cd3c58f54e1d488 contains one commit. It adds 53 lines only to tests/claude-integration/claude-native-affinity.test.ts. No production source changed.

The added replay fixture covers:

• Empty canonical session_id, empty session-id, and two-alias precedence at Line 166–Line 169.
• A mocked first-send 401 and subsequent success at Line 183–Line 193.
• Dispatch through handleResponses at Line 202.
• Exactly one refresh and two Responses sends at Line 205–Line 206.
• Stable session_id and caller originator, changed authorization, and unchanged ingress headers at Line 207–Line 210.

These assertions address the previously recorded wire-level replay coverage gap. I did not run the fixture. Your reported passes remain author-provided execution evidence.

Exact-head hosted CI remains blocked

GitHub confirms that both runs target bf059154c8a21bdfc96e62f99256f7ca462837f8:

Workflow	Run	Current conclusion
Cross-platform CI	37254847437	action_required
React Doctor	37254847442	action_required

I have not authorized or executed these runs. This session provides read-only shell access. An authorized maintainer must approve the exact-head runs and obtain completed results. The older mirror run cannot certify this head.

The PR remains draft. The full-suite status remains red as documented. Neither this scoped confirmation nor the replay fixture establishes backend cache reuse or fixes identity-free workflows. #6520 remains outside the completed scope.

I’m triggering the requested CodeRabbit review.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[lidge-jun]

Review rebinding: head bf059154c8a21bdfc96e62f99256f7ca462837f8. An independent sol security re-review found that dc23a969d1..bf059154c8 changes only one test file (+53 lines in tests/claude-integration/claude-native-affinity.test.ts), with no src, dependency, or workflow changes. The new 401 stored-main refresh replay cases are hermetic: they use synthetic JWTs, fully stubbed fetch, and isolated OPENCODEX_HOME/CODEX_HOME with restore in the file hooks. They assert empty-as-absent and stronger-alias precedence on both physical sends, which matches withClaudeNativeSession at dc23a969d1. SECURITY-VERDICT bf05915: PASS, and the earlier identity-boundary PASS carries forward. This closes the replay residual noted in my previous comment. Fork CI runs 37254847437 and 37254847442 at this head are approved, and exact-head PR CI is the merge evidence for this PR.

[lidge-jun]

Maintainer integration (lidge-jun, dev only) — 2026-10-04 landing train, lane R1.

• Head: bf05915
• CI at this head: PR CI 37254847437 (17 passed, 8 path-skipped), enforce-target 37257133708; every executed job passed.
• Review: normalizes caller session-id/thread-id aliases into native upstream session_id ([Bug]: Non-Codex clients on public endpoints get zero prompt-cache reuse on ChatGPT-backed OpenAI models (no synthesized session_id/originator) #6520 follow-up to fix(server): promote scoped caller conversation headers #6554); independent identity-boundary review PASS at this head; readiness ticked by maintainer with hosted-CI-only note.
• Full local suite intentionally not run per maintainer instruction; hosted CI is the evidence.
• scripts/ci/assert-mergeable-review.sh --maintainer-integration: OK.