[lidge-jun]

Summary

Supersedes #7553. Carries c6862ad, b4f6445, and 436bbbf with their original authorship, then fixes the new regression test's macOS/Windows path comparison.

Sync and restore retain a user-owned root model_context_window. Native subagent defaults record their written model/effort strings in the injection journal; a later string edit is adopted as user-owned even when the old marker survives. Untouched managed defaults still follow OpenCodex settings, and multiline string edits are supported. Native snapshot restore also checks the latest default ownership before trusting an older whole-file hash, preserving edits that recreate earlier injected bytes.

The child-process regression now compares native canonical paths, requires the exact expected config file, and retains separator-bounded containment, isolated home variables and the parent test-home fingerprint. Runtime path canonicalization is unchanged. The test is registered in the existing codex shard and expected oracle, with no net layout.json change. structure/config.md stays at 600 lines.

Refs #7425 (partial scope only; do not close).

Decisions

• Legacy first-sync journal clobbering and combo defaultEffort in the OpenCodex JSON config remain outside this PR. Journals without the new default-value record keep legacy marker-only behavior on their first sync; this PR does not infer ownership without evidence.
• Keep src/codex/paths.ts unchanged. Native realpath resolution intentionally normalizes macOS /var aliases and Windows case/short forms. The assertion must compare canonical paths, not lexical spellings.
• Require both the exact canonical config filename and separator-bounded directory containment. The parent fingerprint measures the runner-isolated HOME; the existing test-home guard separately protects the real user home.
• Keep the existing model/effort pair behavior: either user-owned field prevents a partial managed update. Role files and role selection remain unchanged.
• Shared-registration exception: the carried new test requires scripts/test-layout/layout-codex-collision.json and tests/fixtures/test-layout-expected.json. No layout.json growth.
• Minimal validation-scope exception: four setup lines in tests/claude-integration/claude-desktop-remote-hub.test.ts pin a fixture-owned custom native catalog, keeping exact hub-authority/restart assertions independent of asynchronous host catalog order. The earlier runtime fixture workaround is now superseded by dev test: make codex-runtime, client-connect and loopback-listener tests deterministic #7552: the merged codex-runtime.test.ts is byte-identical to current dev, with all of its stronger isolation/assertions retained. No lane changes to production runtime.ts or test timeouts. Unmodified old dev reproduced both host-dependent failures (59 pass / 2 fail), and their isolation passed 61 / 0; the scratch null-version mutation still triggered the unchanged persisted-byte assertion.
• No authentication, credential, dependency-manifest, workflow or release changes. The new journal field contains only model/effort strings.

Verification

Current head: 9bdf314a6bfcf826fcd2a608170269119117e3f5; includes dev bd5c2ea906741a4201c6f35bb180e7a9a112a4fd. Repository-pinned Bun 1.4.3. Heavy commands are serialized with the host-wide test lock and run outside Git hooks.

Current-head results:

• Focused regression/compatibility/layout/ratchet suites: bun test --isolate <18 focused files>, exit 0; 703 pass / 4 skip / 0 fail.
• bun run test:changed --parallel=2: exit 0; 27,642 pass / 36 skip / 0 fail, all 1,219 selected files / 27,678 tests, 539.9 seconds. Supported concurrency changes only scheduling; no assertions, files or timeouts are removed.
• bun run typecheck, bun run privacy:scan, bun run structure:check: each exit 0 (non-test gates; test counts not applicable).
• bun run --cwd docs-site build: exit 0; 593 pages / 84,861 internal links.
• Fresh independent gpt-6.1-sol/high C4 review: PASS, no remaining source blockers; all 15 changed files reviewed at this exact head. Parent confirmed clean HEAD and git diff --check exit 0. The earlier High native-restore ownership finding is closed; execution/CI evidence is assessed separately.
• bun run test: exit 0, 52,155 pass / 163 skip / 0 fail, all 2,598 files / 22 batches, 541.91 seconds. The generated receipt binds this clean exact head and current check epoch.
• Pending: manual ci.yml run 40067498661, dispatched with lane=all, has matching headSha 9bdf314a6bfcf826fcd2a608170269119117e3f5 and is queued. No platform success is claimed. The PR remains draft.

Regression-first evidence:

• Unfixed dev: 2 pass / 5 fail, exit 1, covering context-window loss, overwritten edits and missing ownership records.
• Original carried test on macOS: 4 pass / 3 fail, exit 1 at lexical containment. Canonical exact-file equality and separator containment now pass.
• Native-restore finding: inject A, sync B, user-edit back to first-injection A, then synchronous/asynchronous restore. Exact unfixed 3f5d6211 sources with current regressions: 9 pass / 4 fail, exit 1. Fixed journal/default suites: 89 pass / 0 fail, exit 0. Positive managed A→B→A controls still require exact snapshot restoration.

Earlier validation failures are retained as history, not current passing evidence. The old-dev full suite failed two ambient-installation fixtures (52,146 pass / 162 skip / 2 fail); an unchanged dev archive reproduced both (59 / 2). Fixture isolation passed 61 / 0, and a scratch null-version mutation still failed the unchanged persisted-byte assertion. Dev #7552 subsequently superseded the lane runtime fixture change. At prior head 7a536aef, full tests passed 52,148 / 162 skip / 0 fail. Its default-concurrency changed cohort hit one unchanged Copilot test's 5,000ms limit; serial execution hit the existing 900-second suite deadline. The supported two-worker run retained the complete cohort and passed 27,695 / 36 skip / 0 fail. No test or timeout was weakened. Obsolete validation was interrupted when the native-restore High was accepted; neither interrupted run nor old-head CI certifies the current fix.

The host-local pre-push hook was bypassed with manager-approved git push --no-verify; it is not repository policy. One hook attempt failed on missing GUI oxlint (exit 127); a later hook suite was stopped when inherited Git variables let fixtures alter the lane HEAD/index and shared core.bare. Neither is passing evidence. All 12,887 tracked files matched the intended commit. After manager approval, only shared core.bare changed from true to false; other keys were unchanged. Intended HEAD and clean status were verified before pushing. Required validation runs outside the hook.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (No auth/credential change; implementation audit PASS.)

Co-authored-by: chlwnsgurg 97290748+chlwnsgurg@users.noreply.github.com

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Integration evidence for exact head 17961b6 (lane L5; supersedes #7553, carrying its three commits with authorship):

• Independent review: fresh gpt-6.1-sol PASS, 0 findings, on the final lane head.
• Lane verification on macOS: the original fix(codex): keep user edits to config.toml across ocx sync #7553 canonical-path failure reproduced first; journal-restore ownership fix red (9 pass / 4 fail) before and green after (89 / 0); focused 522 pass; typecheck, privacy:scan, structure:check exit 0. The full suite showed only failures that reproduce on unmodified dev (installed-Codex detection and native catalog ordering fixtures).
• Not covered here: legacy first-sync journal clobbering and combo defaultEffort from ocx sync overwrites user edits in ~/.codex/config.toml (default subagent, context windows, effort defaults) #7425 (stated in the PR); ocx sync overwrites user edits in ~/.codex/config.toml (default subagent, context windows, effort defaults) #7425 stays open.
• Overlap with dev since its base is limited to test-registration files; merge clean and static checks pass.

Static merge simulation on current dev 71be051 (this Mac): dev=71be051990145357578c61a2f2b258db57654b9f base=47316142fe06171a94de02d63f1727dbed4c0382 pr_files= 15 overlap=[scripts/test-layout/layout-codex-collision.json tests/fixtures/test-layout-expected.json ]; merge clean; install exit=0; gui install exit=0; tsc exit=0; tsc doctor exit=0; structure:check exit=0; privacy:scan exit=0; layout+ratchet guards exit=0 52 pass 0 fail ;

Merged by the triage manager as maintainer integration (MAINTAINERS.md, dev only) under the owner's static-judgment rule while GitHub Actions is degraded; dev push CI will be checked when Actions recovers.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T12:51:19.924601Z	17961b6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.