Align Codex target probe bytes and continuation cookie order

.downstream/native-domains.md

@@ -105,6 +105,10 @@ plaintext-JSON wire protocol. They do not enter the business zstd encoder after
 clearing old body headers. This leaves the saved compression setting and normal
 generation unchanged. Candidate status records `source_request_encoding`, and
 verification records the actual encoding of each shot.
+Target probes use the pinned byte template with the actual selected model and
+effective tier. Continuation keeps the target's `__cflb` before the fixed borrowed
+`__oailb`, as the pinned replacement helper does. Ordinary business bodies and
+cookie ordering are unchanged.
 It has a 90-second budget. Each target/model is validated with two completed
 HTTP 200 streams, at most 45 seconds each: the first must return STATE, and
 the second may omit STATE or return the same value. Qualification includes
@@ -194,9 +198,11 @@ is still required. This matches native streaming continuation instead of assumin
 all output is repeated inside `response.completed`.
 
 The HTTP-only `scenario: probe_contract` compares a fixed candidate under three
-request bodies: pinned ranxi field order without a tier, that same body with the
-effective tier, and the current body with the same tier. With no requested tier,
-the redundant middle pair is skipped. Native identity, routing hint, model,
+request bodies: the prior sorted-map body, the current pinned template with the
+same effective tier, and the pinned template without a tier. With no effective
+tier, the redundant final pair is skipped. The older serializer runs first to
+avoid always confounding its position with later upstream failures.
+Native identity, routing hint, model,
 proxy and cookie stay fixed; each shot still gets its own legacy `session_id`.
 The original probe selects Astra; the result explicitly marks Sol as a downstream
 model extension. `probe_only: true` results carry per-shot completion and STATE

.github/scripts/prepare_test_images.py

@@ -1,18 +1,18 @@
 #!/usr/bin/env python3
-"""Preload unchanged CI image names from their publishers' alternate registries.
+"""Preload unchanged CI image names from verified immutable OCI sources.
 
 The OCI index digests below were checked against the matching Docker Hub tags.
-Postgres/Redis are Docker Official Images on ECR Public; Ryuk is published by
-Testcontainers on GHCR. No Docker Hub credentials or pull-limit workarounds are
-used. Docker verifies immutable digests; existing tests use these local aliases.
+Postgres/Redis are Docker Official Images via Google's Docker Hub cache; Ryuk
+is published by Testcontainers on GHCR. Docker verifies immutable digests;
+existing tests use these unchanged local aliases and no credentials are rotated.
 """
 
 import subprocess
 
 
 IMAGES = (
-    ("public.ecr.aws/docker/library/postgres@sha256:aa6eb304ddb6dd26df23d05db4e5cb05af8951cda3e0dc57731b771e0ef4ab29", "postgres:18.1-alpine3.23"),
-    ("public.ecr.aws/docker/library/redis@sha256:0514fa59e3d84e2f3be66731c5401fc2a85b8ea71b49c0116c850f6a558076f4", "redis:8.4-alpine"),
+    ("mirror.gcr.io/library/postgres@sha256:aa6eb304ddb6dd26df23d05db4e5cb05af8951cda3e0dc57731b771e0ef4ab29", "postgres:18.1-alpine3.23"),
+    ("mirror.gcr.io/library/redis@sha256:0514fa59e3d84e2f3be66731c5401fc2a85b8ea71b49c0116c850f6a558076f4", "redis:8.4-alpine"),
     ("ghcr.io/testcontainers/ryuk@sha256:31b31269d06603366cbfd0284708dcd2e281e8a4188e53fce3d3304439d0df3d", "testcontainers/ryuk:0.13.0"),
 )
 

backend/internal/service/codex_gateway_borrow_diagnose_contract.go

@@ -19,6 +19,7 @@ const (
 	codexBorrowProbeCurrent      = "current_final_tier"
 	codexBorrowProbePlain        = "current_plaintext"
 	codexBorrowProbeConfigured   = "current_configured_encoding"
+	codexBorrowProbeLegacySorted = "legacy_sorted_final_tier"
 )
 
 // These are observations of one fixed candidate, never qualifications usable
@@ -96,9 +97,11 @@ func (s *CodexGatewayBorrowService) diagnoseProbeContract(ctx context.Context, r
 	setOpenAICodexRoutingHint(template.Header, account, request.Model, finalTier)
 	template = template.WithContext(withCodexBorrowServiceTier(ctx, finalTier))
 	identity := borrowRequestFingerprint(template, request.Model, proxy, nil, candidate.cookie.Value)
-	shapes := []string{codexBorrowProbeRanxiLiteral, codexBorrowProbeRanxiTier, codexBorrowProbeCurrent}
+	// Reverse the earlier comparison: the legacy serializer runs first, so a
+	// later transient failure cannot always be confused with its field order.
+	shapes := []string{codexBorrowProbeLegacySorted, codexBorrowProbeCurrent, codexBorrowProbeRanxiLiteral}
 	if finalTier == "" {
-		shapes = []string{codexBorrowProbeRanxiLiteral, codexBorrowProbeCurrent}
+		shapes = []string{codexBorrowProbeLegacySorted, codexBorrowProbeCurrent}
 	}
 	if request.Comparison == "encoding" {
 		shapes = []string{codexBorrowProbePlain, codexBorrowProbeConfigured}
@@ -122,7 +125,7 @@ func (s *CodexGatewayBorrowService) diagnoseProbeContract(ctx context.Context, r
 		started := time.Now()
 		verification := s.probeTarget(operation, variant, account, request.Model, proxy, nil, candidate)
 		body := borrowRanxiLiteralPayload(request.Model, tier)
-		if shape == codexBorrowProbeCurrent || request.Comparison == "encoding" {
+		if shape == codexBorrowProbeLegacySorted {
 			body = borrowObservationPayload(request.Model, "Reply with OK.", "", tier)
 		}
 		result := CodexBorrowDiagnosticResult{Scenario: "probe_contract", Mode: "borrowed", ProbeOnly: true,

backend/internal/service/codex_gateway_borrow_diagnose_contract_test.go

@@ -59,12 +59,12 @@ func TestCodexBorrowProbeContractKeepsOneCandidateAndDoesNotQualifyBusiness(t *t
 				require.Contains(t, headers[i*2].Get("Cookie"), "__oailb=synthetic-borrowed-cookie")
 				require.Contains(t, headers[i*2+1].Get("Cookie"), "__cflb=target-route")
 			}
-			require.True(t, bytes.HasPrefix(bodies[0], []byte(`{"model":`)))
-			require.False(t, gjson.GetBytes(bodies[0], "service_tier").Exists())
 			require.True(t, bytes.HasPrefix(bodies[2], []byte(`{"model":`)))
 			require.Equal(t, "priority", gjson.GetBytes(bodies[2], "service_tier").String())
-			require.JSONEq(t, string(bodies[2]), string(bodies[4]))
-			require.NotEqual(t, string(bodies[2]), string(bodies[4]), "the final comparison changes field order only")
+			require.JSONEq(t, string(bodies[0]), string(bodies[2]))
+			require.NotEqual(t, string(bodies[0]), string(bodies[2]), "the first comparison changes field order only")
+			require.True(t, bytes.HasPrefix(bodies[4], []byte(`{"model":`)))
+			require.False(t, gjson.GetBytes(bodies[4], "service_tier").Exists())
 			require.Empty(t, s.targets)
 			require.Empty(t, s.qualifications)
 			require.Empty(t, s.Status().RecentUsage, "probe-only results cannot replace real request evidence")

backend/internal/service/codex_gateway_borrow_probe.go

@@ -214,6 +214,10 @@ func (s *CodexGatewayBorrowService) probeTarget(ctx context.Context, template *h
 	result := CodexGatewayBorrowVerification{AccountID: account.ID, Model: model, CheckedAt: time.Now(), ExpiresAt: &expires, Reason: "target_probe_failed", RequestShape: "ranxi_full", ServiceTier: codexBorrowRequestServiceTier(template)}
 	if shape, _ := ctx.Value(codexBorrowProbeShapeContextKey{}).(string); shape != "" {
 		result.RequestShape = shape
+	} else {
+		// The pinned verdict was measured with this fixed byte template, not a
+		// generic map serializer. Keep the selected model and final tier exact.
+		ctx = context.WithValue(ctx, codexBorrowProbeShapeContextKey{}, codexBorrowProbeRanxiTier)
 	}
 	ctx = withCodexBorrowServiceTier(ctx, result.ServiceTier)
 	// A two-shot STATE verdict is one observation. Releasing account capacity
@@ -254,7 +258,9 @@ func (s *CodexGatewayBorrowService) probeTarget(ctx context.Context, template *h
 	// __oailb remains the exact borrowed candidate, never a target replacement.
 	for _, cookie := range mint.cookies {
 		if cookie.Name == "__cflb" && borrowCookieScoped(cookie, "/backend-api/codex/responses") && !borrowCookieDeleted(cookie, time.Now()) {
-			cookies = append(cookies, &http.Cookie{Name: cookie.Name, Value: cookie.Value})
+			// The original replacement helper retains the target's __cflb first,
+			// then appends the pinned __oailb. No business cookie header is changed.
+			cookies = append([]*http.Cookie{{Name: cookie.Name, Value: cookie.Value}}, cookies...)
 			break
 		}
 	}
@@ -345,7 +351,7 @@ func borrowObservationRequest(ctx context.Context, headers http.Header, model, p
 	ctx = WithCodexGatewayBorrowObservation(WithHTTPUpstreamRedirectsDisabled(WithHTTPUpstreamProfile(ctx, purpose)))
 	tier := codexBorrowRequestServiceTier((&http.Request{Header: headers}).WithContext(ctx))
 	body := borrowObservationPayload(model, prompt, effort, tier)
-	if shape, _ := ctx.Value(codexBorrowProbeShapeContextKey{}).(string); shape == codexBorrowProbeRanxiLiteral || shape == codexBorrowProbeRanxiTier {
+	if shape, _ := ctx.Value(codexBorrowProbeShapeContextKey{}).(string); shape != "" && shape != codexBorrowProbeLegacySorted {
 		body = borrowRanxiLiteralPayload(model, tier)
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, chatgptCodexURL, bytes.NewReader(body))

backend/internal/service/codex_gateway_borrow_request_repair_test.go

@@ -39,6 +39,7 @@ func TestCodexBorrowProbePreservesNativeSessionAndTier(t *testing.T) {
 				body := borrowCoreBody(t, req)
 				assert.Equal(t, model, gjson.GetBytes(body, "model").String())
 				assert.Equal(t, "priority", gjson.GetBytes(body, "service_tier").String())
+				assert.Equal(t, string(borrowRanxiLiteralPayload(model, "priority")), string(body), "use the pinned probe byte template with the actual model and tier")
 				assert.Equal(t, "model="+model+";tier=priority", req.Header.Get(openAICodexRoutingHintHeader))
 				assert.Empty(t, req.Header.Get("Content-Encoding"))
 				assert.Empty(t, req.Header.Get("X-Codex-Turn-Metadata"))
@@ -49,6 +50,7 @@ func TestCodexBorrowProbePreservesNativeSessionAndTier(t *testing.T) {
 					assert.NotEqual(t, shots[0].Header.Get("session_id"), req.Header.Get("session_id"))
 					assert.Equal(t, "stable-probe-state", req.Header.Get("X-Codex-Turn-State"))
 					assert.Contains(t, req.Header.Get("Cookie"), "__cflb=target-route")
+					assert.Equal(t, "__cflb=target-route; __oailb=synthetic-borrowed-cookie", req.Header.Get("Cookie"))
 					if shots[0].Header.Get("session-id") != req.Header.Get("session-id") || shots[0].Header.Get("thread-id") != req.Header.Get("thread-id") {
 						state = "different-session-state"
 					}

backend/internal/service/grok_free_quota_gate_test.go

@@ -67,8 +67,8 @@ func TestFilterGrokFreeQuotaAccountsOnlyBlocksExplicitFreeOAuth(t *testing.T) {
 	repo := &grokFreeQuotaUsageRepoStub{stats: map[int64]*usagestats.AccountStats{
 		1: {Tokens: 475_000}, // 95% of 500k
 	}}
-	// Clear shared cache for deterministic unit tests.
-	openaiGrokFreeQuotaGateCache = sync.Map{}
+	// Each scheduler below owns a fresh cache; do not replace the shared map
+	// while unrelated asynchronous refreshes may still be writing to it.
 	scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}}
 	accounts := []Account{
 		{ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth, Credentials: map[string]any{"subscription_tier": "FREE"}},
@@ -99,7 +99,6 @@ func TestFilterGrokFreeQuotaAccountsOnlyBlocksExplicitFreeOAuth(t *testing.T) {
 
 func TestFilterGrokFreeQuotaAccountsStatsFailureFailsOpen(t *testing.T) {
 	repo := &grokFreeQuotaUsageRepoStub{err: errors.New("usage database unavailable")}
-	openaiGrokFreeQuotaGateCache = sync.Map{}
 	scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}}
 	accounts := []Account{{
 		ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth,
@@ -139,7 +138,6 @@ func TestFilterGrokFreeQuotaAccountsRecoversAfterRollingUsageFalls(t *testing.T)
 	repo := &grokFreeQuotaUsageRepoStub{stats: map[int64]*usagestats.AccountStats{
 		1: {Tokens: 490_000},
 	}}
-	openaiGrokFreeQuotaGateCache = sync.Map{}
 	scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}}
 	accounts := []Account{{
 		ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth,
@@ -201,7 +199,6 @@ func TestIsExplicitGrokFreeOAuthAccount_OnlyExactFree(t *testing.T) {
 func TestOpenAIAccountSchedulerLoadBalanceAppliesGrokFreeQuotaGate(t *testing.T) {
 	cfg := grokFreeQuotaTestConfig()
 	cfg.RunMode = config.RunModeSimple
-	openaiGrokFreeQuotaGateCache = sync.Map{}
 	accounts := []Account{
 		{ID: 1, Platform: PlatformGrok, Type: AccountTypeOAuth, Status: StatusActive, Schedulable: true, Concurrency: 1, Credentials: map[string]any{"subscription_tier": "free"}},
 		{ID: 2, Platform: PlatformGrok, Type: AccountTypeOAuth, Status: StatusActive, Schedulable: true, Concurrency: 1, Credentials: map[string]any{"subscription_tier": "pro"}},
@@ -241,7 +238,6 @@ func TestGrokFreeQuotaGateIsSchedulerOnlyAdminPathUnfiltered(t *testing.T) {
 	repo := &grokFreeQuotaUsageRepoStub{stats: map[int64]*usagestats.AccountStats{
 		9: {Tokens: 500_000},
 	}}
-	openaiGrokFreeQuotaGateCache = sync.Map{}
 	scheduler := &defaultOpenAIAccountScheduler{service: &OpenAIGatewayService{cfg: grokFreeQuotaTestConfig(), usageLogRepo: repo}}
 	overGate := Account{ID: 9, Platform: PlatformGrok, Type: AccountTypeOAuth, Credentials: map[string]any{"subscription_tier": "FREE"}}
 	require.Eventually(t, func() bool {