From c16448dd7f9715bdd7913c760f6e51c832aa6fc7 Mon Sep 17 00:00:00 2001 From: Minglong Pan <56749246+minglong51@users.noreply.github.com> Date: Sun, 20 Sep 2026 20:41:15 -0700 Subject: [PATCH] Pin Codex evidence tooling to verified 0.155.1 Update the exact executable and protocol pins together, retaining unknown capabilities and all existing capture guards. Apply the four approved test literal updates. Triad: SHIP 2026-09-20 --- docs/designs/provider-capabilities.json | 2 +- docs/designs/provider-executables.json | 4 ++-- scripts/provider_capture.py | 4 ++-- scripts/provider_evidence.py | 2 +- scripts/provider_probe.py | 4 ++-- tests/test_provider_evidence.py | 2 +- tests/test_provider_probe.py | 6 +++--- 7 files changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/designs/provider-capabilities.json b/docs/designs/provider-capabilities.json index bf91cd8..0e1ec39 100644 --- a/docs/designs/provider-capabilities.json +++ b/docs/designs/provider-capabilities.json @@ -3,7 +3,7 @@ "evidence_mode": "synthetic", "human_summary": "### Provider capability evidence\n\nEvidence mode: `synthetic`. Required cells: 24/24. v0.6 gate: `experimental_preview`.\n\n| Provider | Version | Source | Support | Freshness | Pass | Fail | Unknown |\n|---|---|---|---|---|---:|---:|---:|\n| claude | synthetic | unknown:none | attach_only_unknown | unknown | 0 | 0 | 8 |\n| codex | synthetic | unknown:none | attach_only_unknown | unknown | 0 | 0 | 8 |\n| kimi | synthetic | unknown:none | attach_only_unknown | unknown | 0 | 0 | 8 |\n\n| Provider | Capability | Status | Binding (task/session/request) | Open/close | Duplicate | Stale session | Reconnect/recovery | Latency ms | Capture | Evidence |\n|---|---|---|---|---|---|---|---|---|---|---|\n| claude | approval_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-claude-approval-request |\n| claude | duplicate | unknown | unknown/unknown/unknown | not_applicable/not_applicable | unknown | not_applicable | not_applicable/not_applicable | | complete | evidence-claude-duplicate |\n| claude | heartbeat | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-claude-heartbeat |\n| claude | input_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-claude-input-request |\n| claude | reconnect | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | unknown/not_applicable | | complete | evidence-claude-reconnect |\n| claude | request_recovery | unknown | unknown/unknown/unknown | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/unknown | | complete | evidence-claude-request-recovery |\n| claude | stale_session | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | unknown | not_applicable/not_applicable | | complete | evidence-claude-stale-session |\n| claude | turn_state | unknown | unknown/unknown/not_applicable | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-claude-turn-state |\n| codex | approval_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-codex-approval-request |\n| codex | duplicate | unknown | unknown/unknown/unknown | not_applicable/not_applicable | unknown | not_applicable | not_applicable/not_applicable | | complete | evidence-codex-duplicate |\n| codex | heartbeat | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-codex-heartbeat |\n| codex | input_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-codex-input-request |\n| codex | reconnect | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | unknown/not_applicable | | complete | evidence-codex-reconnect |\n| codex | request_recovery | unknown | unknown/unknown/unknown | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/unknown | | complete | evidence-codex-request-recovery |\n| codex | stale_session | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | unknown | not_applicable/not_applicable | | complete | evidence-codex-stale-session |\n| codex | turn_state | unknown | unknown/unknown/not_applicable | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-codex-turn-state |\n| kimi | approval_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-kimi-approval-request |\n| kimi | duplicate | unknown | unknown/unknown/unknown | not_applicable/not_applicable | unknown | not_applicable | not_applicable/not_applicable | | complete | evidence-kimi-duplicate |\n| kimi | heartbeat | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-kimi-heartbeat |\n| kimi | input_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-kimi-input-request |\n| kimi | reconnect | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | unknown/not_applicable | | complete | evidence-kimi-reconnect |\n| kimi | request_recovery | unknown | unknown/unknown/unknown | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/unknown | | complete | evidence-kimi-request-recovery |\n| kimi | stale_session | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | unknown | not_applicable/not_applicable | | complete | evidence-kimi-stale-session |\n| kimi | turn_state | unknown | unknown/unknown/not_applicable | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable | | complete | evidence-kimi-turn-state |\n", "present_cells": 24, - "provider_executables_sha256": "eb8c5c5821b078436911c158d969bda926314cd37279daf83bbd80b422a5221b", + "provider_executables_sha256": "7ffcab616d117407e40a53af720cfaa5f289cc1cd9f004295fa8c63a492e5120", "providers": [ { "authoritative": false, diff --git a/docs/designs/provider-executables.json b/docs/designs/provider-executables.json index aab00b6..dc81e43 100644 --- a/docs/designs/provider-executables.json +++ b/docs/designs/provider-executables.json @@ -8,9 +8,9 @@ "source_interface": "claude-native-hook" }, { - "executable_sha256": "f0d8762236594359b60cfbe17f4c7e945a3ce8d1c91e74778838c968d250fb6c", + "executable_sha256": "8eaf1ad12fe6bf89b1710330f58900014322c7c5af677e43be116d8ac5fc0a9e", "provider": "codex", - "provider_version": "0.149.1", + "provider_version": "0.155.1", "source_interface": "codex-app-server" }, { diff --git a/scripts/provider_capture.py b/scripts/provider_capture.py index 451e594..d5523bb 100644 --- a/scripts/provider_capture.py +++ b/scripts/provider_capture.py @@ -166,8 +166,8 @@ class ProviderLifecycle: "codex": ProviderSpec( name="codex", executable="codex", - version="0.149.1", - version_outputs=(b"codex-cli 0.149.1\n", b"codex-cli 0.149.1\r\n"), + version="0.155.1", + version_outputs=(b"codex-cli 0.155.1\n", b"codex-cli 0.155.1\r\n"), source_interface="codex-app-server", mode="command", command=("app-server", "--stdio", "--strict-config"), diff --git a/scripts/provider_evidence.py b/scripts/provider_evidence.py index 14e4a2f..e303724 100644 --- a/scripts/provider_evidence.py +++ b/scripts/provider_evidence.py @@ -652,7 +652,7 @@ def analyze_codex_capture(capture_root: Path, capture_id: str) -> dict[str, Any] repository_root = Path(__file__).resolve(strict=True).parents[1] expected = load_executable_manifest(repository_root / EXECUTABLE_MANIFEST_PATH) codex_analysis = _load_sibling("codex_analysis") - if provider_capture.PROVIDER_SPECS["codex"].version != "0.149.1": + if provider_capture.PROVIDER_SPECS["codex"].version != "0.155.1": raise EvidenceError("codex analysis: unreviewed provider version") try: repository = provider_capture.repository_paths(Path(__file__)) diff --git a/scripts/provider_probe.py b/scripts/provider_probe.py index 1e84528..d9716d5 100644 --- a/scripts/provider_probe.py +++ b/scripts/provider_probe.py @@ -29,7 +29,7 @@ "codex": ROOT / "scripts/collect_codex_evidence.py", "kimi": ROOT / "scripts/collect_kimi_evidence.py", } -PROVIDER_VERSIONS = {"claude": "2.1.245", "codex": "0.149.1", "kimi": "0.38.0"} +PROVIDER_VERSIONS = {"claude": "2.1.245", "codex": "0.155.1", "kimi": "0.38.0"} PROBE_PROMPT = ( "Reply with exactly CLILANE_PROBE_OK and no other text. Do not call tools." ) @@ -75,7 +75,7 @@ SHA256_PATTERN = re.compile(r"[0-9a-f]{64}") SOURCE_INTERFACES = { "claude": ("2.1.245", "claude-native-hook"), - "codex": ("0.149.1", "codex-app-server"), + "codex": ("0.155.1", "codex-app-server"), "kimi": ("0.38.0", "kimi-acp"), } CODEX_TARGETS = { diff --git a/tests/test_provider_evidence.py b/tests/test_provider_evidence.py index 56f65e4..2066004 100644 --- a/tests/test_provider_evidence.py +++ b/tests/test_provider_evidence.py @@ -721,7 +721,7 @@ def test_executable_manifest_pins_exact_provider_binaries(self) -> None: expected, { "claude": "9f7c2260251765a18d0b35198669dacc1912f6e8129a3b01f6b58d93365ff1f1", - "codex": "f0d8762236594359b60cfbe17f4c7e945a3ce8d1c91e74778838c968d250fb6c", + "codex": "8eaf1ad12fe6bf89b1710330f58900014322c7c5af677e43be116d8ac5fc0a9e", "kimi": "92bf3b4b6643e7c4cc12c82e5680cc5b54a5a6768a301de815e5e9a02d2184bb", }, ) diff --git a/tests/test_provider_probe.py b/tests/test_provider_probe.py index 0b89d2d..fcd57cb 100644 --- a/tests/test_provider_probe.py +++ b/tests/test_provider_probe.py @@ -58,7 +58,7 @@ def emit(value): sys.stdout.flush() if sys.argv[1:] == ["--version"]: - sys.stdout.write("codex-cli 0.149.1\\n") + sys.stdout.write("codex-cli 0.155.1\\n") fail(0) if sys.argv[1:] != ["app-server", "--stdio", "--strict-config"]: fail(81) @@ -358,7 +358,7 @@ def fake_oversized_codex(path: Path) -> Path: import sys if sys.argv[1:] == ["--version"]: - sys.stdout.write("codex-cli 0.149.1\\n") + sys.stdout.write("codex-cli 0.155.1\\n") raise SystemExit(0) if sys.argv[1:] != ["app-server", "--stdio", "--strict-config"]: raise SystemExit(81) @@ -488,7 +488,7 @@ def test_codex_uses_dynamic_ids_exactly_once_with_sanitized_environment(self) -> self.config("codex", executable, "capture-codex-success") ) self.assertEqual(result.provider, "codex") - self.assertEqual(result.provider_version, "0.149.1") + self.assertEqual(result.provider_version, "0.155.1") receipt = self.receipt("capture-codex-success") self.assertEqual(receipt["capture_status"], "complete") self.assertEqual(receipt["termination"]["exit_code"], 0)