Pin Codex evidence tooling to verified 0.155.1

docs/designs/provider-capabilities.json

@@ -3,7 +3,7 @@
   "evidence_mode": "synthetic",
   "human_summary": "### Provider capability evidence\n\nEvidence mode: `synthetic`. Required cells: 24/24. v0.6 gate: `experimental_preview`.\n\n| Provider | Version | Source | Support | Freshness | Pass | Fail | Unknown |\n|---|---|---|---|---|---:|---:|---:|\n| claude | synthetic | unknown:none | attach_only_unknown | unknown | 0 | 0 | 8 |\n| codex | synthetic | unknown:none | attach_only_unknown | unknown | 0 | 0 | 8 |\n| kimi | synthetic | unknown:none | attach_only_unknown | unknown | 0 | 0 | 8 |\n\n| Provider | Capability | Status | Binding (task/session/request) | Open/close | Duplicate | Stale session | Reconnect/recovery | Latency ms | Capture | Evidence |\n|---|---|---|---|---|---|---|---|---|---|---|\n| claude | approval_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-claude-approval-request |\n| claude | duplicate | unknown | unknown/unknown/unknown | not_applicable/not_applicable | unknown | not_applicable | not_applicable/not_applicable |  | complete | evidence-claude-duplicate |\n| claude | heartbeat | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-claude-heartbeat |\n| claude | input_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-claude-input-request |\n| claude | reconnect | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | unknown/not_applicable |  | complete | evidence-claude-reconnect |\n| claude | request_recovery | unknown | unknown/unknown/unknown | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/unknown |  | complete | evidence-claude-request-recovery |\n| claude | stale_session | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | unknown | not_applicable/not_applicable |  | complete | evidence-claude-stale-session |\n| claude | turn_state | unknown | unknown/unknown/not_applicable | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-claude-turn-state |\n| codex | approval_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-codex-approval-request |\n| codex | duplicate | unknown | unknown/unknown/unknown | not_applicable/not_applicable | unknown | not_applicable | not_applicable/not_applicable |  | complete | evidence-codex-duplicate |\n| codex | heartbeat | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-codex-heartbeat |\n| codex | input_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-codex-input-request |\n| codex | reconnect | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | unknown/not_applicable |  | complete | evidence-codex-reconnect |\n| codex | request_recovery | unknown | unknown/unknown/unknown | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/unknown |  | complete | evidence-codex-request-recovery |\n| codex | stale_session | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | unknown | not_applicable/not_applicable |  | complete | evidence-codex-stale-session |\n| codex | turn_state | unknown | unknown/unknown/not_applicable | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-codex-turn-state |\n| kimi | approval_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-kimi-approval-request |\n| kimi | duplicate | unknown | unknown/unknown/unknown | not_applicable/not_applicable | unknown | not_applicable | not_applicable/not_applicable |  | complete | evidence-kimi-duplicate |\n| kimi | heartbeat | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-kimi-heartbeat |\n| kimi | input_request | unknown | unknown/unknown/unknown | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-kimi-input-request |\n| kimi | reconnect | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | not_applicable | unknown/not_applicable |  | complete | evidence-kimi-reconnect |\n| kimi | request_recovery | unknown | unknown/unknown/unknown | not_applicable/not_applicable | not_applicable | not_applicable | not_applicable/unknown |  | complete | evidence-kimi-request-recovery |\n| kimi | stale_session | unknown | unknown/unknown/not_applicable | not_applicable/not_applicable | not_applicable | unknown | not_applicable/not_applicable |  | complete | evidence-kimi-stale-session |\n| kimi | turn_state | unknown | unknown/unknown/not_applicable | unknown/unknown | not_applicable | not_applicable | not_applicable/not_applicable |  | complete | evidence-kimi-turn-state |\n",
   "present_cells": 24,
-  "provider_executables_sha256": "eb8c5c5821b078436911c158d969bda926314cd37279daf83bbd80b422a5221b",
+  "provider_executables_sha256": "7ffcab616d117407e40a53af720cfaa5f289cc1cd9f004295fa8c63a492e5120",
   "providers": [
     {
       "authoritative": false,

docs/designs/provider-executables.json

@@ -8,9 +8,9 @@
       "source_interface": "claude-native-hook"
     },
     {
-      "executable_sha256": "f0d8762236594359b60cfbe17f4c7e945a3ce8d1c91e74778838c968d250fb6c",
+      "executable_sha256": "8eaf1ad12fe6bf89b1710330f58900014322c7c5af677e43be116d8ac5fc0a9e",
       "provider": "codex",
-      "provider_version": "0.149.1",
+      "provider_version": "0.155.1",
       "source_interface": "codex-app-server"
     },
     {

scripts/provider_capture.py

@@ -166,8 +166,8 @@ class ProviderLifecycle:
     "codex": ProviderSpec(
         name="codex",
         executable="codex",
-        version="0.149.1",
-        version_outputs=(b"codex-cli 0.149.1\n", b"codex-cli 0.149.1\r\n"),
+        version="0.155.1",
+        version_outputs=(b"codex-cli 0.155.1\n", b"codex-cli 0.155.1\r\n"),
         source_interface="codex-app-server",
         mode="command",
         command=("app-server", "--stdio", "--strict-config"),

scripts/provider_evidence.py

@@ -652,7 +652,7 @@ def analyze_codex_capture(capture_root: Path, capture_id: str) -> dict[str, Any]
     repository_root = Path(__file__).resolve(strict=True).parents[1]
     expected = load_executable_manifest(repository_root / EXECUTABLE_MANIFEST_PATH)
     codex_analysis = _load_sibling("codex_analysis")
-    if provider_capture.PROVIDER_SPECS["codex"].version != "0.149.1":
+    if provider_capture.PROVIDER_SPECS["codex"].version != "0.155.1":
         raise EvidenceError("codex analysis: unreviewed provider version")
     try:
         repository = provider_capture.repository_paths(Path(__file__))

scripts/provider_probe.py

@@ -29,7 +29,7 @@
     "codex": ROOT / "scripts/collect_codex_evidence.py",
     "kimi": ROOT / "scripts/collect_kimi_evidence.py",
 }
-PROVIDER_VERSIONS = {"claude": "2.1.245", "codex": "0.149.1", "kimi": "0.38.0"}
+PROVIDER_VERSIONS = {"claude": "2.1.245", "codex": "0.155.1", "kimi": "0.38.0"}
 PROBE_PROMPT = (
     "Reply with exactly CLILANE_PROBE_OK and no other text. Do not call tools."
 )
@@ -75,7 +75,7 @@
 SHA256_PATTERN = re.compile(r"[0-9a-f]{64}")
 SOURCE_INTERFACES = {
     "claude": ("2.1.245", "claude-native-hook"),
-    "codex": ("0.149.1", "codex-app-server"),
+    "codex": ("0.155.1", "codex-app-server"),
     "kimi": ("0.38.0", "kimi-acp"),
 }
 CODEX_TARGETS = {

tests/test_provider_evidence.py

@@ -721,7 +721,7 @@ def test_executable_manifest_pins_exact_provider_binaries(self) -> None:
             expected,
             {
                 "claude": "9f7c2260251765a18d0b35198669dacc1912f6e8129a3b01f6b58d93365ff1f1",
-                "codex": "f0d8762236594359b60cfbe17f4c7e945a3ce8d1c91e74778838c968d250fb6c",
+                "codex": "8eaf1ad12fe6bf89b1710330f58900014322c7c5af677e43be116d8ac5fc0a9e",
                 "kimi": "92bf3b4b6643e7c4cc12c82e5680cc5b54a5a6768a301de815e5e9a02d2184bb",
             },
         )

tests/test_provider_probe.py

@@ -58,7 +58,7 @@ def emit(value):
     sys.stdout.flush()
 
 if sys.argv[1:] == ["--version"]:
-    sys.stdout.write("codex-cli 0.149.1\\n")
+    sys.stdout.write("codex-cli 0.155.1\\n")
     fail(0)
 if sys.argv[1:] != ["app-server", "--stdio", "--strict-config"]:
     fail(81)
@@ -358,7 +358,7 @@ def fake_oversized_codex(path: Path) -> Path:
 import sys
 
 if sys.argv[1:] == ["--version"]:
-    sys.stdout.write("codex-cli 0.149.1\\n")
+    sys.stdout.write("codex-cli 0.155.1\\n")
     raise SystemExit(0)
 if sys.argv[1:] != ["app-server", "--stdio", "--strict-config"]:
     raise SystemExit(81)
@@ -488,7 +488,7 @@ def test_codex_uses_dynamic_ids_exactly_once_with_sanitized_environment(self) ->
                 self.config("codex", executable, "capture-codex-success")
             )
         self.assertEqual(result.provider, "codex")
-        self.assertEqual(result.provider_version, "0.149.1")
+        self.assertEqual(result.provider_version, "0.155.1")
         receipt = self.receipt("capture-codex-success")
         self.assertEqual(receipt["capture_status"], "complete")
         self.assertEqual(receipt["termination"]["exit_code"], 0)