lidge-jun · lidge-jun · Sep 8, 2026 · Sep 8, 2026 · chatgpt-codex-connector · Sep 8, 2026
@@ -0,0 +1,65 @@
+# 000 — Plan and live manifest
+
+Unit: `devlog/_plan/260908_provider_runtime_stack`. Session `01a080e2-1dfc-7082-bff8-5043215bdd35`.
+Snapshot: 2026-09-08T12:00Z (fetch), `origin/dev` = `29bb221c3`
+(`Merge pull request #4021 from lidge-jun/codex/release-248-record`).
+Carry worktree: `/private/tmp/ocx-prs-stack-01a080e2` (linked worktree of the main checkout;
+`core.worktree` unset, toplevel verified).
+
+## Objective
+
+Land the open provider-runtime contributor PRs on `dev` as one ordinary manual dependent PR
+stack, integrated with the repository's provider discipline (test layout, provider marks,
+docs-site sections, contributor attribution), and merge the stack bottom-up into `dev`
+after a single green final-head CI run. Constraints given by the maintainer:
+
+- Never run the local product suite, typecheck, build, or install. Every one of those is
+  labelled NOT RUN in the delivery record. Hosted CI on the final head is the only proof.
+- Every mutating Git command runs as `git -c core.hooksPath=/dev/null` (the repository
+  `postmerge` hook can otherwise install dependencies and typecheck). Push with
+  `--no-verify`.
+- CI runs once, on the top of the stack. Merge only if that head is green.
+- Ordinary dependent PR bases, no GitHub native stack registration (DEV-STACK-OPT-IN-01).
+- Cherry-pick, reimplement, squash, or rebase are all permitted. Original authors stay
+  as commit authors (`cherry-pick -x`) or in a `Co-authored-by` trailer.
+- Subagents: `anthropic/claude-opus-5` unlimited; Aside browser delegation unlimited.
+- Out of scope: release/publish, `main`/`preview` promotion, unrelated subsystems.
+
+## Work-phase map (one PABCD cycle each)
+
+| WP | Scope | Doc |
+|----|-------|-----|
+| wp1 | Docs-only roadmap: this manifest, layer plan (010), conflict map (011), mark sourcing (012), secondary dispositions (013) | 000-013 |
+| wp2 | Carry L1-L3 (CodeBuddy #3340, Qoder Global #3349, Qoder CN #3350) onto `dev` with layout registration | 020 |
+| wp3 | L4 marks + display names + docs-site sections + attribution; accepted secondary layers | 030 |
+| wp4 | Publish, final-head CI, bottom-up admin merge, ancestry proof, closeouts, delivery record | 040, 060 |
+
+## Manifest (exact head at snapshot)
+
+| PR | Author | Head | Base | Mergeable vs dev | +/- | Files | Commits | Draft |
+|----|--------|------|------|------------------|-----|-------|---------|-------|
+| #3340 | Flowershangfromthebranches | `4b705e92d` | dev | clean (merge-tree) | 2108/6 | 17 | 4 | yes |
+| #3349 | Flowershangfromthebranches | `4ac98bd4d` | dev | CONFLICTING (`tests/providers/provider-connection-test.test.ts`, import-path only) | 2683/14 | 30 | 4 (3 shared with #3340) | yes |
+| #3350 | Flowershangfromthebranches | `a4e805084` | dev | conflicts inherited from #3349 | 2834/16 | 30 | 5 (4 shared) | yes |
+| #3010 | Liang-Psych | `2e3582328` | dev | CONFLICTING; OAuth/private-protocol design the maintainer review rejected | 1474/2 | 11 | 18 | yes |
+
+The three Flowershangfromthebranches PRs are already a contributor-declared chain
+(#3340 → #3349 → #3350); #3349 and #3350 GitHub diffs include the lower layers because
+each targets `dev`. The carry keeps that chain shape but rebases each layer onto its
+parent so every PR diff is layer-only (DEV-STACK-03).
+
+## Maintainer review state carried into this unit
+
+The prior maintainer reviews (grok-bot, 2026-09-03) on all three PRs left these open items,
+now dispositioned here:
+
+| Item | Disposition |
+|------|-------------|
+| AUP / terms acceptance for headless CLI proxy routing (CodeBuddy, Qoder) | Maintainer decided in this session by authorizing the landing. Recorded in 040. |
+| Provider marks missing in `gui/src/provider-icons.ts` | wp3, per the Meta precedent `81a1fc1cc` (#3338): first-party SVG with source notes, or documented initials tile when terms forbid. See 012. |
+| docs-site guide lacks a Qoder Global/CN section | wp3. CodeBuddy section already exists at `guides/providers.md:620`. |
+| Shared `coding-agent/protocol.ts` error classification broadened in the Qoder commit | Kept in L2 where the contributor put it; audit (wp2 A-phase) checks CodeBuddy fixture coverage. |
+| `qoder` promoted from free-directory reference id to runtime seed with `preserveCustomDestination` | Kept; parity test in the carried commits asserts the flag. |
+| #3010 relationship | Superseded by #3350 once landed; close with credit to Liang-Psych. |
+| Tests at `tests/` root | Blocker on current `dev`: layout guard. Fixed per layer in wp2. |
+| Draft readiness checklist (contributor-side) | Not applicable; maintainer carries the PRs under admin authority. Originals close as superseded. |
@@ -0,0 +1,34 @@
+# 010 — Layer plan
+
+Stack shape (merge bottom-up, ordinary dependent bases):
+
+| # | Branch | Base | Thesis | Source commits |
+|---|--------|------|--------|----------------|
+| 1 | `codex/prs-l1-codebuddy` | `dev` | CodeBuddy Global/CN headless CLI providers + shared `coding-agent` runtime | #3340: `7e56b6399`, `f651611f1`, `18530f8e8`, `4b705e92d` (cherry-pick -x) + layout fix commit |
+| 2 | `codex/prs-l2-qoder-global` | L1 | Qoder Global PAT provider, account-scoped live model discovery | #3349: `4ac98bd4d` (cherry-pick -x, import-path conflict resolved) + layout fix commit |
+| 3 | `codex/prs-l3-qoder-cn` | L2 | Qoder CN PAT profile | #3350: `a4e805084` (cherry-pick -x) |
+| 4 | `codex/prs-l4-marks-docs` | L3 | Provider marks, display names, docs-site Qoder section, CREDITS | new maintainer commits |
+| 5+ | `codex/prs-l5-*` | L4 | Secondary PRs accepted by 013 triage, one layer each | cherry-pick -x |
+
+Layer rules:
+
+- Each layer builds at its own tip. The layout-guard fix for a layer's tests lives in
+  that layer, not deferred upward.
+- Original author preserved by `cherry-pick -x` (author field + `(cherry picked from
+  commit …)` line). Maintainer-authored repair commits carry no trailer because they
+  are not the contributor's work; the PR body names the source PR.
+- PR bodies use the repository template and carry the stack map (DEV-STACK-03).
+- Only the top layer's head gets CI. Lower PRs are opened for review navigation and
+  merge order; their own PR CI may run (`pull_request` trigger) but is not the gate.
+
+Verification plan (hosted only):
+
+1. Push all layers with `--no-verify`.
+2. If the top PR's `pull_request` CI skips platform lanes, dispatch
+   `gh workflow run ci.yml -R lidge-jun/opencodex --ref <top-branch> -f lane=all`.
+3. Record run id, every job conclusion; skipped/cancelled are not passing.
+4. Merge bottom-up with `--admin`, retarget the next child to `dev` after each parent
+   lands, keep parent branches until no open child targets them.
+5. After the top merge: `git fetch origin dev`; every merge SHA must satisfy
+   `git merge-base --is-ancestor <sha> origin/dev`; `git rev-parse origin/dev^{tree}`
+   must equal the certified head's tree (or a diff limited to merge-commit metadata).
@@ -0,0 +1,24 @@
+# 011 — Conflict map (measured)
+
+Method: `git merge-tree --write-tree origin/dev refs/pr/<n>` and the actual cherry-picks in
+the carry worktree.
+
+| Layer | Conflicting file | Nature | Resolution |
+|-------|------------------|--------|------------|
+| L1 | none | `tests/providers/provider-registry-parity.test.ts` auto-merged | — |
+| L1 | `tests/codebuddy-adapter.test.ts`, `tests/codebuddy-protocol.test.ts` | Not a git conflict; layout guard (`tests/test-layout.test.ts`) rejects root test files since `260905_test_modularization_and_windows` | Move to `tests/providers/`, rewrite `../src` → `../../src`, `./helpers` → `../helpers`; register in `scripts/test-layout/layout.json` `explicit` and `tests/fixtures/test-layout-expected.json`. Commit `769e4208f`. |
+| L2 | `tests/providers/provider-connection-test.test.ts` | Import block: dev moved the file into `tests/providers/`; the PR adds one `setFetchQoderModelsForTests` import against the old path | Keep dev's `../../src` paths, add the Qoder import at the same depth. |
+| L2 | `tests/qoder-adapter.test.ts`, `tests/qoder-live-models.test.ts` | Layout guard, as L1 | Same move + registration. Commit `094cb93d0`. |
+| L3 | `tests/providers/qoder-adapter.test.ts`, `tests/providers/qoder-live-models.test.ts` | The CN commit edits the same import lines the L2 layout commit moved | Take the CN import set (adds `QODER_CN_PROFILE`, `resolveQoderProfile`) at the new depth. |
+
+Auto-merged without conflict (git content merge, needs the wp2 audit to confirm semantics):
+`README.md`, `docs-site/.../guides/providers.md`, `docs-site/.../reference/configuration/providers.md`,
+`src/codex/catalog/provider-fetch.ts`, `src/providers/registry.ts`,
+`src/server/management/provider-routes.ts`, `tests/adapters/adapter-*-conformance.test.ts`,
+`tests/adapters/adapter-registry-authority.test.ts`, `tests/providers/provider-registry-parity.test.ts`.
+
+Known dev-side drift since the PR base (`81a1fc1cc`, 2026-09-03) that touches carried files:
+provider namespace ownership (`bbea77a48`), Nous catalog limits (`5cd71ec91`), OrcaRouter
+PKCE (`c41232aa5`), keychain restore ownership (`924b65799`), BigModel repairs. The wp2 audit
+reads each of these against the carried edits in `provider-fetch.ts`, `model-cache.ts`, and
+`registry.ts`.
@@ -0,0 +1,23 @@
+# 012 — Mark sourcing decision
+
+Research agent (claude-opus-5) verified on the public web, 2026-09-08. Assets held outside the
+repo at `/tmp/ocx-marks/` until wp3 commits them.
+
+| id | Decision | File | Source | Terms basis |
+|----|----------|------|--------|-------------|
+| `qoder` | ship | `qoder.svg` | `https://qoder.com/favIcon.svg` (declared site icon; 73,379 B; viewBox `0 0 206 206`; byte-identical on `qoder.cn`, `qoder.com.cn`, and the schema.org Organization logo URL) | Qoder ToS (BRIGHT ZENITH, 2026-04-29) reserves rights generally, no mark-use prohibition; same posture as `meta.svg` |
+| `qoder-cn` | ship, shared asset | `qoder.svg` | same file | CN agreement (通义云启（杭州）信息技术有限公司 + Alibaba Cloud, 2026-05-20) §五(a) reserves 商标 rights without restricting third-party use |
+| `codebuddy` | initials tile, documented | none | mark exists (`…/web/ide/logo.svg`) | CodeBuddy service agreement §9.3 "Tencent Logo": no use of Tencent brand features "under any circumstances" without written consent |
+| `codebuddy-cn` | initials tile, documented | none | same | same clause on `codebuddy.cn/document/term` |
+
+Wiring consequences:
+
+- `gui/tests/provider-icons.test.ts` derives the asset stem from `providerId.split("-")[0]`,
+  so committing `qoder.svg` fails the unwired-asset check for both `qoder` and `qoder-cn`
+  until each has its own alias row (the Meta commit pinned both ids for the same reason).
+- Do not mask `qoder.svg`: light plate + dark glyph, both neutral inks, 94.5% opaque; a
+  mask collapses it into a filled box (README "plate problem").
+- Display names: `qoder` → "Qoder", `qoder-cn` → "Qoder CN", `codebuddy` → "CodeBuddy",
+  `codebuddy-cn` → "CodeBuddy CN".
+- The CodeBuddy refusal goes into `gui/public/provider-icons/README.md` because no test
+  can detect an absent mark; without the note a later pass would re-fetch the logo.
@@ -0,0 +1,23 @@
+# 013 — Secondary PR dispositions (bounded triage, read-only)
+
+Method: `gh pr view`, `git merge-tree --write-tree` against `origin/dev` and against the L3
+head `85ad0a29a`, blob reads. No bun command run. Triage agent: claude-opus-5.
+
+| PR | Author | Size | Conflicts vs dev / vs stack | C4 surface | Maintainer state | Layout | Verdict |
+|---|---|---|---|---|---|---|---|
+| #3990 Hermes source-preserving YAML | rrmlima | 5 files +106/−44 | none / none | no | approved ("머지하세요") | already mapped | INCLUDE → L5 |
+| #3988 Gemini model-tail continue nudge | rrmlima | 2 files +51/−14 | none / none | no | approved after CI | already mapped | INCLUDE → L6 |
+| #3833 Command Code native integration | rrmlima | 9 files +256/−4 | none / none | no | stale review mostly fixed | layout trap: `command-code-client.test.ts` seeds to `providers` (`layout.json:14`), explicit `clients` entry would trip the seed-mismatch check (`test-layout-tooling.test.ts:282`); needs rename or `pinnedOverrides` — design call | DEFER |
+| #3952 openai-chat freeform + Moonshot Responses | yxr1995-maker | 9 files +467/−11 | none / none | no | "지금 형태로는 merge하지 마세요"; bundles three changes; `apply-patch-envelope.ts:51-59` fence stripping can truncate legit bodies; flips `moonshot` adapter default | DEFER (split required) |
+| #3639 EntraID for Azure Foundry | chrisoro | 39 files +590/−62 | none / none | yes (new `@azure/identity` dep, new credential path) | hygiene-blocked, security review required | — | REJECT for this stack |
+| #3283 Antigravity pool + Gemini 3.8 | vanch007 | 14 files +960/−53 | 2 / 2 (`responses/parser.ts`, `server/responses/core.ts`) | yes | "merge 비추천"; competes with #2562 | — | REJECT |
+| #3282 Copilot context tier | Simon-Opopeee | 39 files +521/−14 | 8 / 8 | yes | provider guard missing, screenshot missing, hygiene-blocked | root test file | REJECT |
+| #2230 Gemini OAuth accounts | ppvia | 33 files +1637/−61 | 16 / 16 | yes (embedded OAuth client secret) | maintainer-sponsored security review mandatory | unregistered tests | REJECT |
+
+#3990 and #3988 are pairwise clean with each other and with every other candidate
+(`merge-tree` exit 0 for all combinations). Both are runtime-scope, no auth/credential/workflow
+surface, and the maintainer already approved their content. They become L5 and L6 above the
+marks layer, each cherry-picked with `-x` to keep rrmlima as author.
+
+DEFER/REJECT items are not closed by this unit; their disposition is recorded here for the
+next triage pass.
@@ -0,0 +1,23 @@
+# 020 — wp2: carry L1–L3 with layout registration
+
+Status at write time: carried in the worktree, unpublished. Heads: L1 `769e4208f`,
+L2 `094cb93d0`, L3 `85ad0a29a` (pre-audit-fix).
+
+## Audit round 1 (claude-opus-5, adversarial, read-only) — NEAR-PASS
+
+| # | Finding | Disposition |
+|---|---------|-------------|
+| 1 | Qoder catalog branch in `src/codex/catalog/provider-fetch.ts` (4 hint calls, ~1598–1628) omits `captured.effectiveAlias`, which `45045623b` (#3601) threaded through every sibling branch. Git auto-merged because lines do not overlap. | FOLD — maintainer fix commit on L2 appends the argument to all four calls. |
+| 2 | `tests/adapters/adapter-tool-conformance.test.ts` exempts `codebuddy`/`qoder` with a bare `continue`; a future tool bridge would keep passing silently. | RESIDUAL — v1 contract is `--tools ""`, documented in registry notes and docs-site. A guard test cannot be validated locally under the no-local-suite rule; deferred to a follow-up that can run it. |
+| 3 | `src/adapters/coding-agent/protocol.ts:198` matches bare `authentication`, so vendor text like "authentication service degraded" becomes a 401 `invalid_api_key`, which drives reauth messaging and key-pool rotation. | FOLD — anchor to credential verdicts (`authentication (?:failed|error|required)`, `unauthorized`). Existing fixture "Not logged in; invalid token" still classifies 401. |
+| 4 | `qoder`/`qoder-cn` seed `noVisionModels` with the full roster, advertising image input the adapter rejects. | REBUT — this is the repository convention (`registry.ts:912`, parity test :388, CodeBuddy CN roster §二十九): membership routes images through the vision sidecar and the fail-closed strip applies to every such provider. The adapter's 400 is the defense when an image reaches it without the sidecar path. |
+
+Non-blocking notes carried: CodeBuddy Global roster has no `noVisionModels` (static, vendor
+manifest); `docs/qoder-cli-provider.md` lives outside docs-site (kept, wp3 adds the published
+section); `--effort` vs `--reasoning-effort` rests on vendor manifests.
+
+Clean under audit: registry contract shape, seed parity fields, `qoder` free-directory
+promotion + `preserveCustomDestination`, `authorityIdentity` backward compatibility,
+connection-test path ordering, layout-guard JSON (delta is exactly the four new keys),
+privacy (PAT redaction, allowlisted child env, SHA-256 fingerprint), CI path (no docs-site
+build or provider enumeration on `pull_request`).
@@ -0,0 +1,15 @@
+# 030 — wp3: L4 marks/docs/credits, L5–L6 secondary layers
+
+L4 `codex/prs-l4-marks-docs` (maintainer-authored):
+
+- `gui/public/provider-icons/qoder.svg` from `/tmp/ocx-marks/qoder.svg` (verbatim).
+- `gui/src/provider-icons.ts`: aliases `qoder`/`qoder-cn` → `qoder.svg`; display names
+  Qoder, Qoder CN, CodeBuddy, CodeBuddy CN. No CodeBuddy asset (012).
+- `gui/public/provider-icons/README.md`: Qoder provenance + CodeBuddy refusal note (012 text).
+- `docs-site/src/content/docs/guides/providers.md`: "Official Qoder CLI (Global & CN)"
+  section after the CodeBuddy section; reference/configuration adapter list adds `qoder`.
+- `CREDITS.md`: not needed — original commits keep the contributor as author.
+
+L5 `codex/prs-l5-hermes-yaml`: cherry-pick -x `a1fe9caeb` (#3990, rrmlima).
+L6 `codex/prs-l6-gemini-tail`: cherry-pick -x `1837b8f99` (#3988; commit author is
+`root`, so add `Co-authored-by: rrmlima` via the PR body/merge commit).
@@ -0,0 +1,16 @@
+# 040 — wp4: publish, CI, merge, prove, close
+
+1. Push six branches `--no-verify` with `-c core.hooksPath=/dev/null`.
+2. Open PRs bottom-up with explicit `--base` (L1→dev, L2→L1, …), template body + stack map.
+3. Dispatch `ci.yml` `lane=all` on the L6 head; record run id and every job.
+4. On green: merge L1 with `--admin --match-head-commit`, retarget L2 to `dev`, repeat.
+   Keep parent branches until no child targets them.
+5. Fetch `dev`; assert each merge SHA is an ancestor; compare `dev^{tree}` to the certified
+   L6 tree.
+6. Close #3340/#3349/#3350 superseded (credit Flowershangfromthebranches), #3990/#3988
+   superseded (credit rrmlima), #3010 superseded by the landed Qoder CN PAT provider
+   (credit Liang-Psych).
+7. Write 060 ledger; move unit to `_fin`.
+
+AUP decision: the maintainer authorized landing these headless-CLI PAT providers in this
+session (2026-09-08); recorded here as the maintainer decision the prior reviews asked for.