feat(messaging): add explicit enrolled Codex SSH peers - #6891

Summary

• Follow the merged local foundation (feat(messaging): add local Codex queued session messaging #6544) with CLI-only Codex-to-Codex messaging across individually enrolled SSH peers. Refs feat(messaging): coordinate Codex and Claude sessions across enrolled hosts #6478; this does not close the broader proposal.
• Add explicit enable, confirmed fingerprint enrollment, safe peer listing/removal/status and foreground ocx message serve. Normal proxy startup and local messaging remain inactive with respect to remote resources.
• Reuse Remote Link's SSH policy, with separately owned forward/return tunnels and expiring return leases. A receiving node can reply without a second SSH login.
• Use protected directional capabilities and mutual proofs on the actual loopback connection before native attachment. Discovery, final loaded-recipient revalidation and experimental thread/queue/add share one connection; unknown outcomes are never replayed.
• Rebuild and validate remote origin headers against the authenticated enrollment. hosts add grants outbound delivery only; correlated one-shot replies use routes opened by this node. Arbitrary inbound delivery requires separate local hosts allow-inbound consent, revocable with hosts deny-inbound.
• Bound resources across all peers and join invocation-owned teardown. Exclude mesh/dashboard/cache controls, isolation, Claude, managed skills, prompt policy, idle watches and native daemon lifecycle changes.

This protected gateway is an OpenCodex wrapper protocol, not a native WebSocket endpoint: raw codex queue --remote does not implement its handshake. Native daemon authentication/configuration is unchanged. Sender session identity remains descriptive; it does not grant user approval or establish same-UID isolation. Foreground ownership and the remote contracts remain proposed maintainer review boundaries.

Verification

Maintainer follow-up — 2026-10-18 (head 5c247f51ad17dcaa1d57b5e3523545953a34f2d2)

Pushed by a maintainer on top of 3aa075d09b (no force-push, contributor commits unchanged): e3ffa13772, f7bb68b03d, and merge commit 5c247f51ad with dev 2a10a2bc45.

• e3ffa13772 — authenticated peer sockets now share twelve connections; four stay reserved for this node's own local control, outgoing probes and lease renewal (REMOTE_LIMITS.ownerReservedConnections, RemoteCapacity.reservePeerConnection). There is deliberately no per-peer share: a three-socket per-peer cap was tried and dropped because three legitimate in-flight sends then refused the same peer's lease exchange. Structure and CLI docs state what remains: one enrolled peer can occupy the peer share, and an initiated peer can end the owner by failing lease renewal (the existing fail-fast owner contract).
• f7bb68b03d — regression tests for the review items: authenticated machine-name/sender variants, two concurrent replies on one route, consent withdrawn during a suspended lookup, repeated RPC ids, a captured authorize proof replayed on a second socket, lost-outcome grant consumption, and messaging SSH consumers going through the shared argv builder. The overlapping-enrollment scratch test now asserts outside the SSH runner, so a shared scratch name fails an assertion rather than surfacing as enrollment_unknown. New files are registered in both layout registries.
• The merged layout registries keep every entry from both parents with unchanged domains (2,327 / 2,458 entries); structure:index and skill:surface regenerate without drift.

Review-item mapping at this head: (1) receiver-bound origin src/messaging/remote-envelope.ts:28-34; (2) outbound-only enrollment src/messaging/remote-enrollment.ts:189-190, correlated replies and live consent src/messaging/remote-replies.ts:71-95, local hosts allow-inbound/deny-inbound documented beside hosts add; (3) pre-auth cap src/messaging/remote-bridge.ts:199-208 plus the owner reserve above; (4) attempt-qualified scratch published under the mutation lock and removed in finally (src/messaging/remote-enrollment.ts:137-147,199-205). Each guard was mutated once in a scratch copy and its named test failed on its behavioral assertion; publication-under-lock itself cannot be interleaved deterministically (no await between the journal check and publication) and is covered by code reading.

Local validation at this head (Bun 1.4.3 via the repository's pinned runner, macOS):

• bun run typecheck, bun run structure:check, bun run skill:surface:check, bun run privacy:scan — exit 0.
• bun scripts/test-with-pinned-bun.ts --isolate tests/codex-integration/messaging-*.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/skill-ocx-generated.test.ts tests/lab/core-lab-boundary.test.ts — 561 pass / 3 skip / 0 fail, 45 files.
• Full suite not run locally: this machine was running eleven concurrent validation lanes, so the AGENTS.md resource exception applies and full coverage is left to hosted CI at this head. Real SSH, native daemon and macOS two-host interoperability were not run at this head.

Security review (credential/gateway boundary): independent reviews of attribution and consent, enrollment/storage/SSH argv, and admission/replay/lifetime found no remaining blocker after the owner-reserve change; the residuals above are documented in structure/remote-messaging.md. This does not replace the outstanding maintainer review, and the readiness checklist below is the author's to re-attest for this head.

Fixture cleanup follow-up — 2026-10-17

Published head: 3aa075d09b097a565acf369da65ec408fc2b8f7b. The only change since 8585d21a12ad1c6e866336417ff646c72c2ea648 is test-helper cleanup: both remote owner starts are inside the cleanup scope, and partial startup/lease failures await all initialized owners before propagating the original error. No runtime or documentation changes.

• Bun 1.4.3: typecheck and whitespace checks passed; existing remote-messaging tests and the file-size guard passed: 138 passed / 2 skipped / 0 failed, 831 assertions across 12 files (52.76 seconds). The skipped cases require opt-in native-daemon and real-SSH qualification.
• Commands: bun run typecheck; bun test tests/codex-integration/messaging-remote-*.test.ts tests/ci-workflows/file-size-ratchet.test.ts; git diff --check.
• No additional fixture-only regression was added. Broader qualification below retains its original head; the full-suite resource exception and interoperability gaps remain unchanged. The CodeRabbit fixture finding is fixed, replied to and resolved. Exact-head hosted CI is pending, not passing evidence.

Prior published-head qualification — 2026-10-17

Published head: 8585d21a12ad1c6e866336417ff646c72c2ea648, rebased onto upstream dev 2a3fd00985c4f825af9ac41547ee7ac42fce4570. Local qualification completed on 2026-10-16; fetched dev was unchanged at the 2026-10-17 publication check. The previous public head was 87 commits behind that tip.

• Includes the admission follow-up to the maintainer's October 15 direction: receiver-validated canonical origin headers bound to authenticated peer identity, outbound-only enrollment, separate explicit inbound consent, and bounded correlated reply routes. Admission and cleanup branches now use explicit, readable control flow. These changes are new relative to the previous public head; they are not described as a rebase-only runtime delta.
• The rebase itself leaves messaging runtime, shared SSH argv, message handlers and messaging regression files byte-identical to the saved local candidate 9401619f7. Conflict resolutions preserve upstream's auto-review documentation alongside the contribution contracts and regenerate authoritative surfaces. Parsed merged layout retains all 2,435 upstream and 2,313 saved-candidate registrations, totaling 2,446 without changing their domains.
• Exact published-head Linux / repository-pinned Bun 1.4.3 focused qualification: 799 passed / 6 skipped / 0 failed, 10,632 assertions across 53 files, 102.84 seconds. Covers messaging admission/replies/lifecycle, shared Remote Link consumers, CLI/management paths and layout/size/structure/surface/runner guards.
• Exact-head typecheck, privacy scan, structure check, generated-surface check and whitespace check passed. Docs built 577 pages and checked 81,444 internal links in 61 seconds. Existing dependencies were reused; no fresh dependency-install qualification is claimed.
• The initial sandboxed attempt was 661 passed / 6 skipped / 138 failed, with socket-listen EPERM and subprocess restrictions. It is retained as nonpassing evidence, not reclassified as a pass. The same bounded focused lane with required disposable local socket access produced the passing receipt above; assertions and timeouts were not weakened.
• Full/changed suites were not rerun: the earlier broad lanes exceeded their recorded resource bounds. Focused/shared-consumer qualification is the documented bounded-resource exception, not a full-suite pass. Final-head native-daemon, real-SSH and macOS qualification remain unrun; earlier receipts and independent reviews retain their original pins. Required exact-head hosted CI, independent credential/gateway-boundary acceptance, sponsorship and maintainer approval remain separate.
• No unresolved inline review threads were present when this description was refreshed. The readiness checklist is reattested for this published head; it does not assert hosted CI success or maintainer acceptance.

Completed commands (Bun 1.4.3 selected through PATH; test wrapper also uses OCX_TEST_RUNNER_BUN):

bun run skill:surface
bun run structure:index
bun run typecheck
bun run structure:check
bun run skill:surface:check
bun run privacy:scan
timeout --signal=TERM --kill-after=15s 240s bun test tests/codex-integration/messaging-*.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/skill-ocx-generated.test.ts tests/ci-workflows/test-runner.test.ts tests/cli/cli-capabilit*.test.ts
(cd docs-site && timeout --signal=TERM --kill-after=15s 180s bun run build)
git diff --check

Prior rebase qualification — 2026-10-13 (previous published head)

Current candidate: 52b137978c5234b1500e9c30779e21e2caa76ac7, rebased onto upstream dev 9b31677c4704215e8f3db1c321a38b36b40062a9 (exact fetched tip at publication preflight). The previous head was 33 commits behind and conflicted.

• Followed the maintainer's generated-surface and roster-preservation directions. Preserved upstream's new advisor declaration and explicit test-layout shard, plus every contribution registration. The combined layout retains all 2,295 dev entries and 2,257 prior-head entries; golden and merged explicit maps agree on 2,303 registrations. Regenerated the operating reference and structure index; capability counts now derive from the combined registry.
• Messaging runtime, shared SSH argv, message command handlers and remote regression fixtures are byte-identical to the previous public head 9a7c2c4d6cdb5360be7456d8ee79e5c29b2d4c17. Rebase resolutions concern shared metadata, generated surfaces and test rosters, not new messaging behavior.
• Exact-head Linux, repository-pinned Bun 1.4.3: 776 passed / 6 skipped / 0 failed, 10,288 assertions across 50 files, 98.76 seconds. Coverage includes messaging, shared Remote Link SSH consumers, CLI/management routes, the expanded capability metadata/help regressions and explicit layout/size/structure/surface/runner guards.
• Exact-head typecheck, structure check, generated-surface check, privacy scan and whitespace check passed. Docs built 577 pages, checking 81,224 internal links, in 44.29 seconds. Existing dependencies were reused; no fresh dependency-install qualification is claimed.
• Broad full/changed lanes were not rerun for this maintenance rebase. Their earlier incomplete/nonpassing receipts and original pins remain below: the changed lane selected over 1,000 files and exceeded its bound, and the full lane reached its 900-second ceiling without a complete receipt. This focused/shared-consumer coverage is the documented bounded-resource exception, not a broad-suite pass.
• Final-head native-daemon, real-SSH and macOS qualification remain unrun. Earlier independent reviews and interoperability receipts retain their original pins; this refresh does not replace independent enrollment/gateway-boundary acceptance, sponsorship or required exact-head hosted CI. No unresolved inline review threads were present at publication preflight. The author has reattested all four readiness boxes for this validated head.

Completed commands (Bun 1.4.3 selected through PATH; test wrapper also uses OCX_TEST_RUNNER_BUN):

bun run skill:surface
bun run structure:index
bun run typecheck
bun run structure:check
bun run skill:surface:check
bun run privacy:scan
timeout --signal=TERM --kill-after=15s 240s bun test tests/codex-integration/messaging-*.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/skill-ocx-generated.test.ts tests/ci-workflows/test-runner.test.ts tests/cli/cli-capabilit*.test.ts
(cd docs-site && timeout --signal=TERM --kill-after=15s 180s bun run build)
git diff --check

Prior rebase qualification — 2026-10-13 (previous refresh)

Current candidate: 9a7c2c4d6cdb5360be7456d8ee79e5c29b2d4c17, rebased onto upstream dev 3eb5a3c0b741d3aa9d689839805a40a81c4f5672. The branch was initially 11 commits behind. At publication preflight, dev had advanced once more to 9c36822dee21ce3d870a5aac065d7e95e545c079, leaving this tested candidate one commit behind, within the readiness gate's ten-commit allowance.

• Resolved the test-layout conflict following the maintainer's directions: retained the new dev registration and the contribution's relocated messaging registrations without duplicating them. Parsed roster comparison retains all 2,249 dev entries and 2,255 prior-head entries; golden and explicit layout agree on 2,257 registrations. The subsequent one-commit rebase replayed all twelve patches unchanged.
• Messaging runtime, shared SSH argv and remote regression fixtures are byte-identical to previous public head 221b5cccc8f0aac76dd55ab7eec1d7a99606f21e. No behavior changes or private integration work are included. Regenerated the operating surface and structure index; neither needed a committed change.
• Exact-head Linux, repository-pinned Bun 1.4.3: 569 passed / 6 skipped / 0 failed, 5,743 assertions across 40 files, 93.67 seconds. The lane covers messaging, shared Remote Link SSH consumers, CLI/management routes, explicit layout/size/structure/surface/runner guards and the newly landed main-account refresh regression.
• Exact-head typecheck, structure check, generated-surface check, privacy scan and whitespace check passed. Existing dependencies were reused; no fresh dependency-install qualification is claimed.
• Docs built 569 pages, checking 79,403 internal links, in 50.77 seconds at intermediate head f052141eb89620f8352e44478312129f4a620fbc; docs and build inputs are byte-identical at the published head. That intermediate focused lane passed 556 / 6 skipped / 0 failed, 5,697 assertions across 39 files. These are intermediate receipts, not mislabeled exact-head reruns.
• Full/changed-suite evidence remains incomplete/nonpassing, with its original pins and limitations retained below. Broad lanes were not rerun for this maintenance rebase: prior changed runs selected over 1,000 files and exceeded their bounds, and the full run reached its 900-second ceiling without a complete receipt. Focused/shared-consumer coverage is the documented bounded-resource exception, not a broad-suite pass.
• Final-head native-daemon, real-SSH and macOS qualification remain unrun. Earlier receipts retain their original pins. Hosted CI and independent credential/gateway-boundary acceptance remain separate. Existing reviewer threads were checked with no unresolved threads; the readiness checklist is retained at the author's direction, not a claim that hosted CI has passed.

Completed commands (Bun 1.4.3 selected through PATH; test wrapper also uses OCX_TEST_RUNNER_BUN):

bun run skill:surface
bun run structure:index
bun run typecheck
bun run structure:check
bun run skill:surface:check
bun run privacy:scan
timeout --signal=TERM --kill-after=15s 240s bun test tests/codex-integration/messaging-*.test.ts tests/codex-integration/codex-main-account-refresh.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/test-runner.test.ts
# Docs build at the intermediate head identified above:
(cd docs-site && bun run build)
git diff --check

Prior rebase qualification — 2026-10-13

Current candidate: 221b5cccc8f0aac76dd55ab7eec1d7a99606f21e, rebased onto upstream dev 6da2774369aa32552e318e333902499683d053bc (exact fetched tip at publication preflight).

• Followed the maintainer's refresh directions. The rebase replayed all twelve contribution commits without conflicts; range-diff marks every patch unchanged. Messaging runtime, remote regression fixtures and shared SSH argv are byte-identical to prior public head 3e5925609e6273380a089aedd4ff9ea49cc4c2f3. No new behavior, deployment or private integration-branch change is included.
• Ran bun run skill:surface and bun run structure:index; both generated outputs already matched their authoritative inputs. Independently compared parsed rosters: all 2,247 current-dev entries and 2,239 prior-head entries are retained; merged golden and explicit layout agree on 2,255 registrations. No newer dev or messaging registration was dropped.
• Exact-head Linux, repository-pinned Bun 1.4.3: 556 passed / 6 skipped / 0 failed, 5,696 assertions across 39 files, 91.89 seconds. This includes messaging, shared Remote Link SSH/prelude consumers, CLI/management routes and explicit layout, size, structure, surface and runner guards. Opt-in native/real-SSH and Windows-specific cases remain skipped; Linux shell-prelude fixtures are not macOS qualification.
• Typecheck, structure check, generated-surface check, privacy scan and diff whitespace check passed. Docs built 569 pages and checked 79,393 internal links, in 42.56 seconds. These non-test checks used the available Bun 1.4.0 and existing dependencies; no fresh root/docs dependency-install qualification is claimed.
• An initial Bun 1.4.0 focused attempt ended 546 passed / 6 skipped / 3 failed, with runner-dependent guards failing because latest dev now pins 1.4.3. Downloaded the official 1.4.3 runner into private tooling, verified its release archive SHA-256, and completed the same focused lane above with the required runner. The first attempt is not passing evidence; no test, timeout or assertion was weakened.
• Full/changed-suite evidence remains incomplete/nonpassing, retained below with original pins. Those broad lanes were not rerun for this unchanged-patch maintenance rebase: the prior changed lane selected over 1,000 files and exceeded its bounded run, while the full lane reached 900 seconds without a complete receipt. Focused/shared-consumer coverage is the documented bounded-scope exception, not a broad-suite pass or a new classification of prior failures.
• No final-head native daemon, real-SSH or macOS qualification was performed. Earlier interoperability and independent review receipts retain their original pins. Exact-head hosted CI, sponsorship, independent credential/gateway-boundary acceptance and maintainer approval remain separate. No review or readiness completion is inferred from the rebase; the new push requires fresh head-bound attestation.

Completed commands:

bun run skill:surface
bun run structure:index
bun run typecheck
bun run structure:check
bun run skill:surface:check
bun run privacy:scan
# PATH and OCX_TEST_RUNNER_BUN select the verified Bun 1.4.3 runner:
timeout --signal=TERM --kill-after=15s 240s bun test tests/codex-integration/messaging-*.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/test-runner.test.ts
(cd docs-site && bun run build)
git diff --check

Prior rebase qualification — roster conflict follow-up

Current candidate: 3e5925609e6273380a089aedd4ff9ea49cc4c2f3, based on latest fetched upstream dev a63267c1349f178b52cf7e5d4d158e8f1e4be075.

• Followed the maintainer's conflict instructions: preserved both the new dev registrations and the messaging roster in tests/fixtures/test-layout-expected.json and scripts/test-layout/layout.json. Independently compared parsed golden mappings with both inputs: all 2,231 dev entries and 2,226 prior-head entries are retained; merged golden and explicit layout agree on 2,239 entries, with no duplicate golden keys.
• Only layout/golden conflict resolutions changed the contribution patches. Messaging/SSH runtime and messaging regression files are byte-identical to the prior public head, confirmed by diff/range-diff; no registration was dropped to make the merge clean.
• Final-head Linux/Bun 1.4.0: 547 passed / 6 skipped / 0 failed, 5,642 assertions across 38 files, 93.99 seconds. Typecheck, structure check, generated-surface check, privacy scan and diff whitespace check passed. Docs built 569 pages, checking 79,386 internal links, in 40.69 seconds. Existing dependencies were reused; no fresh install qualification is claimed.
• Full and changed-suite evidence remains incomplete/nonpassing, as recorded below; those lanes were not rerun in this roster-only correction. The prior 180-second changed-graph run had failures and no complete receipt; no unrelated/environment-only classification is inferred. Focused validation is the bounded resource exception for this conflict-only rebase, not a broad-suite pass.
• Native-daemon, real-SSH and macOS qualification were not rerun on this head. Earlier interoperability receipts retain their original pins below; they are not final-head qualification. Exact-head hosted CI, maintainer sponsorship, credential-boundary signoff and acceptance remain separate. Existing review threads are resolved; this does not grant approval or enable paused CodeRabbit reviews.

Final-head commands (completed successfully):

bun run typecheck
bun run structure:check
bun run skill:surface:check
bun run privacy:scan
bun test tests/codex-integration/messaging-*.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/test-runner.test.ts
(cd docs-site && bun run build)

Earlier rebase qualification — retained with its original pins

Rebase qualification — 2026-10-12

Current candidate: a6206e866302cdafde64b0090c5fdd73283d1743, rebased onto upstream dev 744678faebe3c7fd676beee153c29b929df3b73a. The owner's generated-surface conflict was resolved with bun run skill:surface; range-diff shows no change to messaging runtime or test patches. The later two-commit base advance replayed all twelve contribution commits unchanged. No deployment or local integration branch change is included.

• Final-head Linux/Bun 1.4.0: 277 passed / 3 skipped / 0 failed, 4,305 assertions across 21 files; typecheck, privacy scan, structure check, generated-surface check and docs build passed. Docs built 569 pages and checked 79,377 internal links. Existing dependencies were reused; no fresh dependency-install qualification is claimed.
• Intermediate rebased head 08cbb2147433c1dec7ecbda5a74ae85fcb87dedb on base 8d12a3cb0c9ead696e1179fc9558aa79d894021f: wider messaging/shared-link/CLI/management/guard lane 547 passed / 6 skipped / 0 failed, 5,632 assertions across 38 files. Disposable generated-key real-SSH duplex check: 1 passed / 0 failed, 10 assertions. Messaging and SSH sources are byte-identical at the final head; these remain explicitly intermediate-head receipts, not rerun final-head interoperability evidence.
• On that intermediate head, timeout --signal=TERM --kill-after=15s 180s bun run test:changed selected 1,071/2,245 files and ended incomplete/nonpassing (outer exit 124; wrapper 143). It emitted 18 failure entries involving GUI pairing, Bun PATH provenance, catalog drift healing and catalog picker convergence before termination; there is no final suite-count receipt. No fresh base comparison was performed for these failures, so they are not classified as unrelated/environment-only. This broad lane also is not a final-head pass.
• Full-suite, real native-daemon, macOS, final-head real-SSH and exact-head hosted CI remain unqualified in this rebase round. Focused validation is the bounded scope exception for a rebase whose conflict resolution only changes generated documentation; the broad lane's ceiling/failures remain explicit. Maintainer sponsorship, independent credential-boundary review and acceptance remain separate.

Final-head commands (all completed successfully):

bun run typecheck
bun run privacy:scan
bun run structure:check
bun run skill:surface:check
bun test tests/codex-integration/messaging-*.test.ts tests/clients/link-ssh-argv.test.ts tests/clients/link-ssh-argv-discovery.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts
(cd docs-site && bun run build)

The first scoped regression attempt was blocked by the sandbox's socket-listen restrictions and failed; the same broader lane completed successfully with escalation using disposable fixtures. No live daemon or enrolled production peer was used. CodeRabbit's existing threads are resolved and its last review had no actionable comments, but automatic reviews are paused. Readiness must be freshly assessed against the new head.

Historical qualification (retained with its original pins)

Candidate: 70822541db44df1c49add7600e9953dc4387b975 on feat/codex-remote-contribution, based on upstream dev 9b6f4b2632492b3df637dccc009d6a01ed47c85d (zero commits behind at publication preflight). Fetch/rebase confirmed the branch was already up to date. The latest correction shares strict local-journal interpretation between enrollment retries and recovery: malformed JSON/outer/nested records and invalid values produce invalid_enrollment_journal, preserve original bytes and send no enrollment control request. Safe storage reads and lock failures retain their own classifications. The deployed experiment is unchanged.

• Passed on this candidate: typecheck, privacy scan, structure ownership check, generated operating surface check, and public docs build (569 pages, 79,312 internal links, 1m 0s).
• Current messaging regressions and explicit layout/size/ownership/surface guards: 245 passed, 2 skipped, zero failed; 4,096 assertions across 19 files, 79.17 seconds. Enrollment-only qualification also passed: 43 tests, 277 assertions. The 12 new cases cover malformed journals at enrollment/CLI boundaries plus unsafe-file/busy-lock classification; ten diagnostic cases failed against the preceding implementation and pass after the fix. They check byte preservation, unchanged local/remote state, zero enrollment control exchanges and sanitized output. The preliminary host-key probe may still occur.
• Historical broader consumer qualification at previous head 33df9692d, not rerun wholesale for this journal-only correction: messaging regressions, shared Remote Link SSH consumers, CLI/management routes and explicit source-oracle/layout/size/ownership/surface/runner guards: 486 passed, 6 skipped, zero failed; 5,342 assertions across 36 files, 92.08 seconds. Opt-in SSH/native fixtures run separately; Windows-specific cases remain skipped on Linux.
• In that previous correction, five targeted regression cases failed against the preceding implementation and pass after the correction (39 assertions): probe argument policy, overlapping revocations, failed remote-cleanup scratch disposal, and CLI preparation failure before/after publication. Preparation failures start no SSH helper and still report committed local removal with transaction-qualified remote cleanup guidance.
• Current real loopback SSH enrollment/duplex request-response with HashKnownHosts=yes in the isolated SSH configuration: 1 passed, 10 assertions, 5.98 seconds in a disposable generated-key fixture. Native endpoints are offline Unix fixtures, not live agents or deployed nodes. No user known_hosts file, SSH configuration, credential or service was changed.
• Current changed-graph run incomplete/nonpassing: timeout --signal=TERM --kill-after=15s 180s bun run test:changed selected 1,061 of 2,233 files (53 changed files) and reached the explicit ceiling (outer exit 124; wrapper exit 143), without a final suite-count receipt. It reported two GUI pairing local-intent failures and the Bun PATH-provenance selection failure. These match the three failures previously reproduced on the unmodified base; that historical comparison does not make this incomplete run passing.
• Previous-head changed-graph run incomplete/nonpassing: timeout --signal=TERM --kill-after=15s 180s bun run test:changed selected 1,061 of 2,233 files and reached its explicit ceiling (outer exit 124, wrapper exit 143), with no final suite-count receipt. It reported settings/Anthropic timeouts, cascading spend-ledger owner-home conflicts in bearer-admission cases, two GUI pairing local-intent failures, and Bun PATH-provenance selection failure.
• Historical isolated follow-up of that previous run's five failure-bearing files: 218 passed, 3 failed, 1,383 assertions, 46.65 seconds. Settings, Anthropic and bearer-admission cases pass in this invocation. The same three persistent failures (two GUI pairing cases and Bun PATH provenance) reproduce on an unmodified checkout of the exact upstream base with the same Bun/dependencies: 37 passed, 3 failed, 131 assertions. That comparison does not establish the root cause or turn the broader run into passing evidence. No assertion or product/test timeout was weakened.
• Full-suite validation remains incomplete, not passing. An earlier frozen implementation run reached the existing 900-second parallel-lane limit (exit 124); serial lanes were not reached and no final suite-count receipt exists. That historical run included a contribution layout-size failure subsequently fixed without raising its cap, plus unchanged-path Responses, CodeBuddy, replay, image/audio and runtime-provenance failures/timeouts not proven environment-only. Focused regressions and explicit non-import-graph guards cover this correction; broader exact-head hosted CI remains required.
• Earlier stock codex-cli 0.160.1 protected-gateway qualification accepted a request, completed a synthetic turn and returned a correlated response in a credential-free home: 1 passed, 6 assertions. This is historical evidence, not a native-binary rerun at this head. Executable SHA-256: f34a4d2301892ae96c90097786bfe5dc269f187b6f69faf42a7b357b8c081e35.
• The earlier frozen implementation received a completed security diff scan with no accepted findings and separate architecture/authentication/transport reviews. Later boundary review led to transaction/revocation ordering, freshness, cleanup ownership and helper-budget corrections with focused regressions. The original sealed scan does not cover this head. The maintainer's independent 15-test process-lifecycle receipt at 1154affa5 remains scoped historical evidence, not whole-PR approval, sponsorship or independent credential-boundary sign-off.
• Linux fixture evidence only. macOS interoperability remains unqualified; Windows remote transport is unsupported. No production enrollment, service restart, skill migration or deployment was performed.

Explicit maintainer sponsorship and security review remain requested for enrollment, capabilities and gateway admission. Local validation does not replace that acceptance or required exact-head hosted CI. At that historical checkpoint, the PR remained draft with all four review-readiness boxes unchecked.

Qualification commands (historical receipts explicitly annotated):

# Current candidate 70822541d:
bun run typecheck
bun test tests/codex-integration/messaging-*.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts # 245 pass / 2 skip / 0 fail
bun run privacy:scan
bun run structure:check
bun run skill:surface:check
(cd docs-site && bun install --frozen-lockfile && bun run build)
OCX_MESSAGE_SSH_INTEROP=1 bun test tests/codex-integration/messaging-remote-interop.test.ts
timeout --signal=TERM --kill-after=15s 180s bun run test:changed # incomplete/nonpassing, outer exit 124

# Previous head 33df9692d: wider consumers and failure-isolation receipts:
bun test tests/codex-integration/messaging-*.test.ts tests/clients/link-*.test.ts tests/cli/cli-link.test.ts tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/structure-ssot.test.ts tests/ci-workflows/skill-ocx.test.ts tests/ci-workflows/test-runner.test.ts # 486 pass / 6 skip / 0 fail
bun test tests/codex-integration/bearer-admission-routed-provider.test.ts tests/gui/gui-pair-client.test.ts tests/config/settings-stream-mode.test.ts tests/adapters/anthropic/anthropic-instance-recovery.test.ts tests/ci-workflows/bun-runtime.test.ts # 218 pass / 3 fail
# Unmodified upstream base comparison, same Bun/dependencies:
bun test tests/gui/gui-pair-client.test.ts tests/ci-workflows/bun-runtime.test.ts # 37 pass / same 3 fail

# Earlier historical qualification only; not repeated at the current head:
bun run test # incomplete, 900-second lane ceiling
OCX_MESSAGE_CODEX_BINARY=<explicit-stock-binary> bun test tests/codex-integration/messaging-remote-native.test.ts

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Boxes ticked by the maintainer integration lane on behalf of @phillipod; local validation evidence at e4d0a6d28cf86737eb31915d56958a661b6d8230 (merge of dev d2c71eb66e, Bun 1.4.3 pinned runner): bun run typecheck, bun run structure:check, bun run skill:surface:check, bun run privacy:scan exit 0; bun scripts/test-with-pinned-bun.ts --isolate over the 45 messaging, Remote Link, CLI link, layout, ratchet, structure, skill and core-lab-boundary files listed in the 2026-10-18 follow-up: 561 pass / 3 skip / 0 fail. Full suite left to hosted CI under the AGENTS.md resource exception.

Opened in draft; the author subsequently completed the readiness checklist. Required exact-head hosted CI and maintainer acceptance remain separate.

Summary by CodeRabbit

• New Features
  • Discover loaded Codex sessions and queue messages on explicitly enrolled SSH peers with --host; replies can route to the originating machine.
  • Enable or disable remote messaging, check its status, and probe, enroll, list, remove, or abandon host enrollments.
  • Run a foreground messaging service to establish peer routes and support replies. Send results distinguish queued, unknown, and not-sent outcomes; uncertain sends are not automatically retried.
  • Set inbound access per peer to allow all message types or only correlated replies.
  • Remote connections require confirmed host keys and authenticated, bounded access.
• Documentation
  • Added guidance on enrollment, service operation, resource limits, pending-enrollment recovery, and Windows remote-transport limitations.