[HTExplicit]

Problem

The fork carried its own Codex "ticket" subsystem: a background module that sent probe requests through a separate harvest proxy to obtain short-lived (120 s) per-account, per-model route qualifications. It also ran a fail-closed scheduler gate and a per-request gate that blocked OAuth accounts without a live qualification for gpt-6-astra / gpt-6-sol / gpt-6-luna / gpt-5.6-sol. Our own quality data shows answer quality follows the account, not how the request is routed. The owner decided to remove the subsystem completely. Upstream has no equivalent.

Change

Removed:

• the ticket module (codexruntime/tickets) and its routing host: probes, cookie handling, connection leases, proxy trust, demand tracking and the renew loop;
• the scheduler and request gates, the qualified transport, and the forced HTTP bridge for gated models on WS. WS ingress uses the upstream v0.2.11 condition again;
• admin endpoints for manual and batch harvest/stop, harvest-proxy parse/test, route validation and the legacy ticket settings;
• the job executors for codex_ticket_harvest, codex_ticket_stop and extension_operation;
• codex_turn_tickets on account DTOs, the ticket status events in account tests, and the fix(tickets): preserve account state during inactive credential refresh #190 credential context. Token refresh is upstream behaviour again;
• every related UI element: the row-menu items, bulk-bar buttons, modal, 用量 lines, edit-dialog section, and the routing parts of the settings page and fingerprint panel.

Kept, moved into neutral files with unchanged behaviour:

• Native Codex runtime host. It moves to codexruntime/core, its config is now {request_zstd}, and the /settings/codex-runtime endpoint and receipts are unchanged. Retired keys in the stored config or in a PUT are dropped instead of rejected, so the server still boots.
• Recovery and client identity/profile dispatch.
• Credential-owner identity hash. Only the name changes; a test pins the formula.
• Logical-turn staging and turn-state semantics.
• Response model-declaration guard. It now also covers the account test's ordinary path.
• Outbound wire observation.

Codex quality runs no longer need a route. Create binds model and reasoning_effort, validated against the account mapping and the group's effort policy, and sends go over the account's ordinary forwarding path. renew-route is gone, and runs recorded before the rebuild stay readable but read-only.

UI as approved in the local preview: the page is renamed 「Codex 运行设置」 and keeps only the compression toggle; the fingerprint panel keeps identity, UA, profile, observed request and reference. Old job rows of the retired kinds still list with their names and say they cannot be retried.

Code only: no migration. The dormant rows, settings, extra keys and the 244/245 triggers are purged in a follow-up release. On first boot the native runtime records a new normalized config hash, which bumps runtime_generation once. The encrypted config source is not rewritten.

Verification

• go build ./...; go vet on the changed packages;
• targeted tests:
  • TestValidateConfigDropsRetiredSettings
  • TestModuleServesTransportPlanFromItsConfiguration
  • TestNativeCodexStoredRetiredSettingsStillBoot
  • TestCodexCredentialOwnerIdentityIsStable
  • TestAccountTestService_OpenAIOAuthGuardsDeclaredModel
  • the rebuilt quality-run tests (validation, ordinary-path send with budget reservation, legacy ledger decode)
  • account-test handler/service tests after rebasing on fix(accounts): test Claude accounts on Sonnet 5.5, then Opus 5.5, by default #226/fix(compat): convert OpenAI reasoning effort to each Claude model's own contract #227;
• old YAML/env ticket keys load without error;
• frontend vue-tsc --noEmit, check:i18n and the specs of touched components;
• local mock-data before/after preview of every changed screen, with no console errors.

Not run: race suites locally (no cgo), real model calls.

🤖 Generated with Claude Code