From 577659a32e710e984a743c8f7bca629a772f4e37 Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 10 Oct 2026 13:59:42 +0800 Subject: [PATCH 1/3] Use the pinned Codex target probe byte template and cookie order --- .downstream/native-domains.md | 12 +++++++++--- .../codex_gateway_borrow_diagnose_contract.go | 9 ++++++--- .../codex_gateway_borrow_diagnose_contract_test.go | 8 ++++---- .../internal/service/codex_gateway_borrow_probe.go | 10 ++++++++-- .../codex_gateway_borrow_request_repair_test.go | 2 ++ 5 files changed, 29 insertions(+), 12 deletions(-) diff --git a/.downstream/native-domains.md b/.downstream/native-domains.md index d8f14d4e02a3..51153b48853a 100644 --- a/.downstream/native-domains.md +++ b/.downstream/native-domains.md @@ -105,6 +105,10 @@ plaintext-JSON wire protocol. They do not enter the business zstd encoder after clearing old body headers. This leaves the saved compression setting and normal generation unchanged. Candidate status records `source_request_encoding`, and verification records the actual encoding of each shot. +Target probes use the pinned byte template with the actual selected model and +effective tier. Continuation keeps the target's `__cflb` before the fixed borrowed +`__oailb`, as the pinned replacement helper does. Ordinary business bodies and +cookie ordering are unchanged. It has a 90-second budget. Each target/model is validated with two completed HTTP 200 streams, at most 45 seconds each: the first must return STATE, and the second may omit STATE or return the same value. Qualification includes @@ -194,9 +198,11 @@ is still required. This matches native streaming continuation instead of assumin all output is repeated inside `response.completed`. The HTTP-only `scenario: probe_contract` compares a fixed candidate under three -request bodies: pinned ranxi field order without a tier, that same body with the -effective tier, and the current body with the same tier. With no requested tier, -the redundant middle pair is skipped. Native identity, routing hint, model, +request bodies: the prior sorted-map body, the current pinned template with the +same effective tier, and the pinned template without a tier. With no effective +tier, the redundant final pair is skipped. The older serializer runs first to +avoid always confounding its position with later upstream failures. +Native identity, routing hint, model, proxy and cookie stay fixed; each shot still gets its own legacy `session_id`. The original probe selects Astra; the result explicitly marks Sol as a downstream model extension. `probe_only: true` results carry per-shot completion and STATE diff --git a/backend/internal/service/codex_gateway_borrow_diagnose_contract.go b/backend/internal/service/codex_gateway_borrow_diagnose_contract.go index 8b2c3e8f6134..665cbe97dcbe 100644 --- a/backend/internal/service/codex_gateway_borrow_diagnose_contract.go +++ b/backend/internal/service/codex_gateway_borrow_diagnose_contract.go @@ -19,6 +19,7 @@ const ( codexBorrowProbeCurrent = "current_final_tier" codexBorrowProbePlain = "current_plaintext" codexBorrowProbeConfigured = "current_configured_encoding" + codexBorrowProbeLegacySorted = "legacy_sorted_final_tier" ) // These are observations of one fixed candidate, never qualifications usable @@ -96,9 +97,11 @@ func (s *CodexGatewayBorrowService) diagnoseProbeContract(ctx context.Context, r setOpenAICodexRoutingHint(template.Header, account, request.Model, finalTier) template = template.WithContext(withCodexBorrowServiceTier(ctx, finalTier)) identity := borrowRequestFingerprint(template, request.Model, proxy, nil, candidate.cookie.Value) - shapes := []string{codexBorrowProbeRanxiLiteral, codexBorrowProbeRanxiTier, codexBorrowProbeCurrent} + // Reverse the earlier comparison: the legacy serializer runs first, so a + // later transient failure cannot always be confused with its field order. + shapes := []string{codexBorrowProbeLegacySorted, codexBorrowProbeCurrent, codexBorrowProbeRanxiLiteral} if finalTier == "" { - shapes = []string{codexBorrowProbeRanxiLiteral, codexBorrowProbeCurrent} + shapes = []string{codexBorrowProbeLegacySorted, codexBorrowProbeCurrent} } if request.Comparison == "encoding" { shapes = []string{codexBorrowProbePlain, codexBorrowProbeConfigured} @@ -122,7 +125,7 @@ func (s *CodexGatewayBorrowService) diagnoseProbeContract(ctx context.Context, r started := time.Now() verification := s.probeTarget(operation, variant, account, request.Model, proxy, nil, candidate) body := borrowRanxiLiteralPayload(request.Model, tier) - if shape == codexBorrowProbeCurrent || request.Comparison == "encoding" { + if shape == codexBorrowProbeLegacySorted { body = borrowObservationPayload(request.Model, "Reply with OK.", "", tier) } result := CodexBorrowDiagnosticResult{Scenario: "probe_contract", Mode: "borrowed", ProbeOnly: true, diff --git a/backend/internal/service/codex_gateway_borrow_diagnose_contract_test.go b/backend/internal/service/codex_gateway_borrow_diagnose_contract_test.go index 1a1c7c92094e..5c4c5c8c47e8 100644 --- a/backend/internal/service/codex_gateway_borrow_diagnose_contract_test.go +++ b/backend/internal/service/codex_gateway_borrow_diagnose_contract_test.go @@ -59,12 +59,12 @@ func TestCodexBorrowProbeContractKeepsOneCandidateAndDoesNotQualifyBusiness(t *t require.Contains(t, headers[i*2].Get("Cookie"), "__oailb=synthetic-borrowed-cookie") require.Contains(t, headers[i*2+1].Get("Cookie"), "__cflb=target-route") } - require.True(t, bytes.HasPrefix(bodies[0], []byte(`{"model":`))) - require.False(t, gjson.GetBytes(bodies[0], "service_tier").Exists()) require.True(t, bytes.HasPrefix(bodies[2], []byte(`{"model":`))) require.Equal(t, "priority", gjson.GetBytes(bodies[2], "service_tier").String()) - require.JSONEq(t, string(bodies[2]), string(bodies[4])) - require.NotEqual(t, string(bodies[2]), string(bodies[4]), "the final comparison changes field order only") + require.JSONEq(t, string(bodies[0]), string(bodies[2])) + require.NotEqual(t, string(bodies[0]), string(bodies[2]), "the first comparison changes field order only") + require.True(t, bytes.HasPrefix(bodies[4], []byte(`{"model":`))) + require.False(t, gjson.GetBytes(bodies[4], "service_tier").Exists()) require.Empty(t, s.targets) require.Empty(t, s.qualifications) require.Empty(t, s.Status().RecentUsage, "probe-only results cannot replace real request evidence") diff --git a/backend/internal/service/codex_gateway_borrow_probe.go b/backend/internal/service/codex_gateway_borrow_probe.go index 14c75034f4eb..0e3cdcf3e1c0 100644 --- a/backend/internal/service/codex_gateway_borrow_probe.go +++ b/backend/internal/service/codex_gateway_borrow_probe.go @@ -214,6 +214,10 @@ func (s *CodexGatewayBorrowService) probeTarget(ctx context.Context, template *h result := CodexGatewayBorrowVerification{AccountID: account.ID, Model: model, CheckedAt: time.Now(), ExpiresAt: &expires, Reason: "target_probe_failed", RequestShape: "ranxi_full", ServiceTier: codexBorrowRequestServiceTier(template)} if shape, _ := ctx.Value(codexBorrowProbeShapeContextKey{}).(string); shape != "" { result.RequestShape = shape + } else { + // The pinned verdict was measured with this fixed byte template, not a + // generic map serializer. Keep the selected model and final tier exact. + ctx = context.WithValue(ctx, codexBorrowProbeShapeContextKey{}, codexBorrowProbeRanxiTier) } ctx = withCodexBorrowServiceTier(ctx, result.ServiceTier) // A two-shot STATE verdict is one observation. Releasing account capacity @@ -254,7 +258,9 @@ func (s *CodexGatewayBorrowService) probeTarget(ctx context.Context, template *h // __oailb remains the exact borrowed candidate, never a target replacement. for _, cookie := range mint.cookies { if cookie.Name == "__cflb" && borrowCookieScoped(cookie, "/backend-api/codex/responses") && !borrowCookieDeleted(cookie, time.Now()) { - cookies = append(cookies, &http.Cookie{Name: cookie.Name, Value: cookie.Value}) + // The original replacement helper retains the target's __cflb first, + // then appends the pinned __oailb. No business cookie header is changed. + cookies = append([]*http.Cookie{{Name: cookie.Name, Value: cookie.Value}}, cookies...) break } } @@ -345,7 +351,7 @@ func borrowObservationRequest(ctx context.Context, headers http.Header, model, p ctx = WithCodexGatewayBorrowObservation(WithHTTPUpstreamRedirectsDisabled(WithHTTPUpstreamProfile(ctx, purpose))) tier := codexBorrowRequestServiceTier((&http.Request{Header: headers}).WithContext(ctx)) body := borrowObservationPayload(model, prompt, effort, tier) - if shape, _ := ctx.Value(codexBorrowProbeShapeContextKey{}).(string); shape == codexBorrowProbeRanxiLiteral || shape == codexBorrowProbeRanxiTier { + if shape, _ := ctx.Value(codexBorrowProbeShapeContextKey{}).(string); shape != "" && shape != codexBorrowProbeLegacySorted { body = borrowRanxiLiteralPayload(model, tier) } req, err := http.NewRequestWithContext(ctx, http.MethodPost, chatgptCodexURL, bytes.NewReader(body)) diff --git a/backend/internal/service/codex_gateway_borrow_request_repair_test.go b/backend/internal/service/codex_gateway_borrow_request_repair_test.go index e7fb10b03a28..101af8023f0f 100644 --- a/backend/internal/service/codex_gateway_borrow_request_repair_test.go +++ b/backend/internal/service/codex_gateway_borrow_request_repair_test.go @@ -39,6 +39,7 @@ func TestCodexBorrowProbePreservesNativeSessionAndTier(t *testing.T) { body := borrowCoreBody(t, req) assert.Equal(t, model, gjson.GetBytes(body, "model").String()) assert.Equal(t, "priority", gjson.GetBytes(body, "service_tier").String()) + assert.Equal(t, string(borrowRanxiLiteralPayload(model, "priority")), string(body), "use the pinned probe byte template with the actual model and tier") assert.Equal(t, "model="+model+";tier=priority", req.Header.Get(openAICodexRoutingHintHeader)) assert.Empty(t, req.Header.Get("Content-Encoding")) assert.Empty(t, req.Header.Get("X-Codex-Turn-Metadata")) @@ -49,6 +50,7 @@ func TestCodexBorrowProbePreservesNativeSessionAndTier(t *testing.T) { assert.NotEqual(t, shots[0].Header.Get("session_id"), req.Header.Get("session_id")) assert.Equal(t, "stable-probe-state", req.Header.Get("X-Codex-Turn-State")) assert.Contains(t, req.Header.Get("Cookie"), "__cflb=target-route") + assert.Equal(t, "__cflb=target-route; __oailb=synthetic-borrowed-cookie", req.Header.Get("Cookie")) if shots[0].Header.Get("session-id") != req.Header.Get("session-id") || shots[0].Header.Get("thread-id") != req.Header.Get("thread-id") { state = "different-session-state" } From 7d305af375ccf961bb39a96073170807aa89ac46 Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 10 Oct 2026 14:07:18 +0800 Subject: [PATCH 2/3] Avoid replacing a shared cache from isolated Grok test fixtures --- backend/internal/service/grok_free_quota_gate_test.go | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/backend/internal/service/grok_free_quota_gate_test.go b/backend/internal/service/grok_free_quota_gate_test.go index 45fcb7f04e23..1781037bbd14 100644 --- a/backend/internal/service/grok_free_quota_gate_test.go +++ b/backend/internal/service/grok_free_quota_gate_test.go @@ -67,8 +67,8 @@ func TestFilterGrokFreeQuotaAccountsOnlyBlocksExplicitFreeOAuth(t *testing.T) { repo := &grokFreeQuotaUsageRepoStub{stats: map[int64]*usagestats.AccountStats{ 1: {Tokens: 475_000}, // 95% of 500k }} - // Clear shared cache for deterministic unit tests. - openaiGrokFreeQuotaGateCache = sync.Map{} + // Each scheduler below owns a fresh cache; do not replace the shared map + // while unrelated asynchronous refreshes may still be writing to it. scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}} accounts := []Account{ {ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth, Credentials: map[string]any{"subscription_tier": "FREE"}}, @@ -99,7 +99,6 @@ func TestFilterGrokFreeQuotaAccountsOnlyBlocksExplicitFreeOAuth(t *testing.T) { func TestFilterGrokFreeQuotaAccountsStatsFailureFailsOpen(t *testing.T) { repo := &grokFreeQuotaUsageRepoStub{err: errors.New("usage database unavailable")} - openaiGrokFreeQuotaGateCache = sync.Map{} scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}} accounts := []Account{{ ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth, @@ -139,7 +138,6 @@ func TestFilterGrokFreeQuotaAccountsRecoversAfterRollingUsageFalls(t *testing.T) repo := &grokFreeQuotaUsageRepoStub{stats: map[int64]*usagestats.AccountStats{ 1: {Tokens: 490_000}, }} - openaiGrokFreeQuotaGateCache = sync.Map{} scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}} accounts := []Account{{ ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth, @@ -201,7 +199,6 @@ func TestIsExplicitGrokFreeOAuthAccount_OnlyExactFree(t *testing.T) { func TestOpenAIAccountSchedulerLoadBalanceAppliesGrokFreeQuotaGate(t *testing.T) { cfg := grokFreeQuotaTestConfig() cfg.RunMode = config.RunModeSimple - openaiGrokFreeQuotaGateCache = sync.Map{} accounts := []Account{ {ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth, Status: StatusActive, Schedulable: true, Concurrency: 1, Credentials: map[string]any{"subscription_tier": "free"}}, {ID: 2, Platform: PlatformGrok, Type: AccountTypeOAuth, Status: StatusActive, Schedulable: true, Concurrency: 1, Credentials: map[string]any{"subscription_tier": "pro"}}, @@ -241,7 +238,6 @@ func TestGrokFreeQuotaGateIsSchedulerOnlyAdminPathUnfiltered(t *testing.T) { repo := &grokFreeQuotaUsageRepoStub{stats: map[int64]*usagestats.AccountStats{ 9: {Tokens: 500_000}, }} - openaiGrokFreeQuotaGateCache = sync.Map{} scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}} overGate := Account{ID: 9, Platform: PlatformGrok, Type: AccountTypeOAuth, Credentials: map[string]any{"subscription_tier": "FREE"}} require.Eventually(t, func() bool { From 635cac2c4c113b69f574751f02ae015f6e64823e Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 10 Oct 2026 14:15:47 +0800 Subject: [PATCH 3/3] Use verified cache for unchanged PostgreSQL and Redis test images --- .github/scripts/prepare_test_images.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/scripts/prepare_test_images.py b/.github/scripts/prepare_test_images.py index a97cd742967d..452c35b1225d 100644 --- a/.github/scripts/prepare_test_images.py +++ b/.github/scripts/prepare_test_images.py @@ -1,18 +1,18 @@ #!/usr/bin/env python3 -"""Preload unchanged CI image names from their publishers' alternate registries. +"""Preload unchanged CI image names from verified immutable OCI sources. The OCI index digests below were checked against the matching Docker Hub tags. -Postgres/Redis are Docker Official Images on ECR Public; Ryuk is published by -Testcontainers on GHCR. No Docker Hub credentials or pull-limit workarounds are -used. Docker verifies immutable digests; existing tests use these local aliases. +Postgres/Redis are Docker Official Images via Google's Docker Hub cache; Ryuk +is published by Testcontainers on GHCR. Docker verifies immutable digests; +existing tests use these unchanged local aliases and no credentials are rotated. """ import subprocess IMAGES = ( - ("public.ecr.aws/docker/library/postgres@sha256:aa6eb304ddb6dd26df23d05db4e5cb05af8951cda3e0dc57731b771e0ef4ab29", "postgres:18.1-alpine3.23"), - ("public.ecr.aws/docker/library/redis@sha256:0514fa59e3d84e2f3be66731c5401fc2a85b8ea71b49c0116c850f6a558076f4", "redis:8.4-alpine"), + ("mirror.gcr.io/library/postgres@sha256:aa6eb304ddb6dd26df23d05db4e5cb05af8951cda3e0dc57731b771e0ef4ab29", "postgres:18.1-alpine3.23"), + ("mirror.gcr.io/library/redis@sha256:0514fa59e3d84e2f3be66731c5401fc2a85b8ea71b49c0116c850f6a558076f4", "redis:8.4-alpine"), ("ghcr.io/testcontainers/ryuk@sha256:31b31269d06603366cbfd0284708dcd2e281e8a4188e53fce3d3304439d0df3d", "testcontainers/ryuk:0.13.0"), )