feat: native Codex gateway borrowing and pelican comparisons

.downstream/gateway-borrow-notices.md

@@ -0,0 +1,35 @@
+# Gateway borrowing implementation sources
+
+The native Cookie lease, two-shot STATE qualification and WebSocket anchor
+behavior were adapted from [ranxi2001/sub2api](https://github.com/ranxi2001/sub2api),
+commit `5ca3cca21eeaf4ca8a694a7f2f8f0ecd9575c549`, under LGPL-3.0. The source
+files are `codex_gateway_pin.go`, `astra_routing_upstream.go`,
+`astra_target_validation.go`, `openai_codex_state_probe.go`,
+`openai_codex_ws_anchor.go`, `pelicanHtml.ts` and the pelican preview components.
+The repository [LICENSE](../LICENSE) retains the LGPL-3.0 terms.
+
+HTML fence selection also references `web/src/lib/render.ts` from
+[iwyxdxl/gpttesticu](https://github.com/iwyxdxl/gpttesticu), commit
+`1b3e237c15dcdf89c4aa66d3521f8d6485d6da4a`. Its MIT notice follows.
+
+MIT License
+
+Copyright (c) 2026 iwyxdxl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

.downstream/native-domains.md

@@ -17,6 +17,47 @@ other key or a non-boolean value (including `null`), returns HTTP 400 and stores
 nothing. While no Codex runtime row is stored,
 `gateway.openai_codex_request_zstd` decides the compression switch.
 
+## Codex gateway borrowing
+
+`GET/PUT /admin/codex-gateway-borrow/config` owns one JSON setting,
+`codex_gateway_borrow_config`: `enabled`, `source_account_ids`,
+`target_account_ids` and `models`. A missing row is off with empty account
+lists and the two models `gpt-6-astra` and `gpt-6.1-sol`. Only existing OpenAI
+OAuth-like accounts can be selected; the source and target lists are disjoint.
+The extension never rewrites account model mappings, proxies, WS switches,
+groups, quota or scheduling state. Normal credential refresh remains available.
+
+Source acquisition shares one process-local `__oailb` candidate. Its maximum
+lease is 230 seconds, capped by an earlier upstream expiry; receiving the same
+value during a live lease does not extend it. Source preparation is sequential
+and has a 90-second budget. Each target/model is validated with two completed
+HTTP 200 streams, at most 45 seconds each: the first must return STATE, and
+the second may omit STATE or return the same value. Qualification includes
+the target identity, actual model, exit, client headers, STATE and TLS profile.
+Source and target probes use separate HTTP/TLS pools. Business WS connections
+stay in the ordinary account pool, with fixed one-hour continuation anchors.
+
+Status/config/history reads do not call models. Saving an enabled config starts
+one finite preparation; business cache misses prepare synchronously. There is
+no renewal timer. `/prepare` and `/verify` explicitly prepare or revalidate.
+All probes only record observations, including failures before business dispatch.
+
+`POST /admin/codex-gateway-borrow/tests` accepts a timestamped UUIDv7 and explicit
+account/model pairs. It sends the fixed pelican prompt once per pair, only with
+matching unexpired qualification, using at most three shared generation slots
+and serializing each account. It does not prepare missing routes. An expired
+or future UUID is rejected; replaying a saved UUID cannot dispatch again.
+Migration 275 adds only this feature's task/result tables. Records expire 24
+hours after task creation, disappear from reads immediately, and are removed
+by scoped minute cleanup. Output/errors retain their original bytes.
+
+Result previews use short random capability URLs under
+`/codex-gateway-borrow/preview/`, an opaque script-enabled sandbox and their own
+response CSP. Inline animation and external scripts/styles/fonts/images are
+allowed. Preview documents receive no administrator token or UI bridge.
+Adaptation sources and retained notices are in
+[gateway borrowing notices](gateway-borrow-notices.md).
+
 ## Startup and stored data
 
 Migrations run first. Migration 264 stops startup, changing nothing, on a

.github/workflows/downstream-verify.yml

@@ -41,6 +41,11 @@ jobs:
       - name: Service tests
         working-directory: backend
         run: go test -p=1 -tags unit ./internal/service -run 'Test.*(Refusal|CyberPolicy|Continuation|InvalidEncryptedContent|PreviousResponseNotFound|CapacityShed|RequestScopedTransient|ServerOverloaded|AlphaSearch|SelectedWorkspace)|Test(UpdateService|NormalizeAccountTaxonomyName|AccountTaxonomyRules|AccountTestReasoningValidated|FilterConsoleAccounts|AccountConsolePlan|AccountFacetMatcher)' -count=1
+      - name: Native gateway borrowing contracts
+        working-directory: backend
+        run: |
+          go test -p=1 -tags unit ./internal/service ./internal/repository ./internal/handler ./internal/handler/admin -run '^TestCodexGatewayBorrow' -count=1
+          go test -p=1 -tags integration ./internal/repository -run '^TestCodexGatewayBorrowTestRepositoryIntegrationLifecycle$' -count=1
       - name: Upstream automation classifier tests
         run: |
           python3 .github/scripts/test_upstream_risk.py
@@ -135,6 +140,9 @@ jobs:
             src/components/payment/__tests__/StripePaymentInline.contrast.spec.ts \
             src/views/user/__tests__/StripePaymentView.spec.ts \
             src/views/admin/__tests__/ReasoningRecoveryView.spec.ts \
+            src/api/admin/__tests__/codexGatewayBorrow.spec.ts \
+            src/components/admin/codex/__tests__/BorrowPelicanPreview.spec.ts \
+            src/views/admin/__tests__/CodexGatewayBorrowView.spec.ts \
             src/components/account/__tests__/EditAccountModal.spec.ts \
             src/utils/__tests__/openaiProtocolModeEdits.spec.ts \
             src/components/account/__tests__/ModelWhitelistSelector.spec.ts \

backend/cmd/server/wire.go

@@ -130,6 +130,9 @@ func provideCleanup(
 	antigravityOAuth *service.AntigravityOAuthService,
 	grokOAuth *service.GrokOAuthService,
 	openAIGateway *service.OpenAIGatewayService,
+	codexGatewayBorrow *service.CodexGatewayBorrowService,
+	codexGatewayBorrowTests *service.CodexGatewayBorrowTestRunner,
+	codexGatewayBorrowPreview *service.CodexGatewayBorrowPreviewService,
 	scheduledTestRunner *service.ScheduledTestRunnerService,
 	upstreamModelCatalogRefresh *service.UpstreamModelCatalogRefreshService,
 	backupSvc *service.BackupService,
@@ -157,6 +160,18 @@ func provideCleanup(
 
 		// 应用层清理步骤可并行执行，基础设施资源（Redis/Ent）最后按顺序关闭。
 		parallelSteps := []cleanupStep{
+			{"CodexGatewayBorrow", func() error {
+				if codexGatewayBorrow != nil {
+					codexGatewayBorrow.Stop()
+				}
+				if codexGatewayBorrowTests != nil {
+					codexGatewayBorrowTests.Stop()
+				}
+				if codexGatewayBorrowPreview != nil {
+					codexGatewayBorrowPreview.Stop()
+				}
+				return nil
+			}},
 			{"PluginManager", func() error {
 				if pluginManager != nil {
 					pluginManager.Stop()

backend/cmd/server/wire_gen_test.go

@@ -97,6 +97,9 @@ func minimalDependencyCleanup(gatewayCache service.GatewayCache, autoReset *serv
 		antigravityOAuthSvc,
 		nil, // grokOAuth
 		nil, // openAIGateway
+		nil, // codexGatewayBorrow
+		nil, // codexGatewayBorrowTests
+		nil, // codexGatewayBorrowPreview
 		nil, // scheduledTestRunner
 		nil, // upstreamModelCatalogRefresh
 		nil, // backupSvc