[abhinav-oai]

Summary

Adds managed authentication requirements for:

• allowed_login_methods
• allowed_chatgpt_workspaces
• cli_auth_credentials_store
• chatgpt_base_url

Locally available authentication requirements are applied during bootstrap, before Codex selects stored credentials or fetches cloud requirements.

Semantics

Login methods

• The map is keyed by api and chatgpt; unknown keys fail validation.
• Entries compose by key, with the higher-priority value winning.
• A configured forced_login_method is retained only if it is allowed.
• If exactly one method is allowed and none is configured, Codex forces that method.
• Denying every method or contradicting a configured forced method fails startup.

ChatGPT workspaces

• Entries compose by workspace ID; blank IDs fail validation.
• A configured forced-workspace list is intersected with the allowed set.
• Without a configured list, enabled workspace IDs become the effective restriction.
• An empty effective list denies ChatGPT workspace authentication.

Bootstrap and live configuration

• Local login-method and workspace requirements are applied before stored credential selection and cloud-requirements loading.
• Required cli_auth_credentials_store and chatgpt_base_url replace ordinary config at the same boundary.
• Exec, TUI, archive, app-server, and in-process startup all enforce the resulting authentication policy.
• App-server and in-process startup evict a stored credential that no longer satisfies policy, then continue unauthenticated.
• Account login requests load the latest config before accepting new credentials.
• Config reload re-enforces authentication policy and reloads the auth manager, including eviction of credentials that became disallowed.
• Conflicts produce source-aware startup warnings.

Stack

PRs: #28411 → #28409 → #28410 → #28412 → #28414 → #28413

Position	PR	Branch
1	Keyed shell filters	abhinav/requirements-shell-rules
2	Exact managed values	abhinav/requirements-exact-values
3	Managed auth/bootstrap — this PR	abhinav/requirements-auth-bootstrap
4	Managed OTEL	abhinav/requirements-otel
5	Managed shell policy	abhinav/requirements-shell-policy
6	App-server API/schemas	abhinav/requirements-app-server-api

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.