[Workflow Health] P0: codex CLI 0.153.4 lacks gpt-5.3-codex model metadata — PR #60423 fix incomplete, failures recur

[github-actions]

P0 — codex CLI does not recognize gpt-5.3-codex: prior fix (PR #60423) addressed prefix-stripping only, root cause remains

Filed by: Workflow Health Manager — Meta-Orchestrator (2026-09-13 run)

Summary

The model_not_supported_error pattern that PR #60423 was believed to have fixed on 2026-09-12
is still occurring today (2026-09-13), on the very same workflows the fix targeted:

• LintMonster — [aw] LintMonster produced no safe outputs #60546 (run 34733504566)
• Metrics Collector — [aw] Metrics Collector produced no safe outputs #60545 (run 34733483077)
• Daily Go Test Parallelizer — [aw] Daily Go Test Parallelizer produced no safe outputs #60543 (run 34733502283, workflow itself succeeded but WIP tracker cycle continues)
• Avenger — 5 occurrences in the last 24h: [aw] Avenger produced no safe outputs #60113, [aw] Avenger produced no safe outputs #60143, [aw] Avenger produced no safe outputs #60150, [aw] Avenger produced no safe outputs #60173, [aw] Avenger produced no safe outputs #60241 (closed, 09-11) and [aw] Avenger produced no safe outputs #60455, [aw] Avenger produced no safe outputs #60465, [aw] Avenger produced no safe outputs #60471, [aw] Avenger produced no safe outputs #60541, [aw] Avenger produced no safe outputs #60554 (all still OPEN, 09-12→09-13)

Root cause (verified from raw agent job logs, not just error banner text)

PR #60423 fixed a real bug — codexModelID was forwarding the full openai/gpt-5.3-codex /
copilot/gpt-5.3-codex provider-prefixed string to the Codex CLI, which OpenAI's API rejected
outright. After the fix, the bare model name gpt-5.3-codex is now passed correctly, e.g.:

[codex-harness] spawning: codex exec --model gpt-5.3-codex ...

However, the pinned Codex CLI version (@openai/codex@0.153.4) itself does not know this
model:

WARN codex_models_manager::model_info: Unknown model gpt-5.3-codex is used. This will use fallback model metadata.
{"type":"item.completed","item":{"id":"item_0","type":"error","message":"Model metadata for `gpt-5.3-codex` not found. Defaulting to fallback metadata; this can degrade performance and cause issues."}}
...
Set output 'model_not_supported_error'

So PR #60423's prefix-stripping fix was necessary but not sufficient — it fixed the provider
prefix bug but did not fix (or even fully diagnose) the underlying issue that Codex CLI
0.153.4 lacks model metadata for gpt-5.3-codex for any provider prefix (bare, openai/,
or copilot/). This explains why the PR's own scope note deferred exactly this outcome:

"those already compiled to a correct bare model name over the Copilot BYOK path... their
failures point at the org/account policy hypothesis rather than a compiler defect."

That hypothesis is now falsified by the openai/gpt-5.3-codex workflows (LintMonster, Avenger)
also failing post-fix with the bare name — this is not a Copilot-BYOK-specific policy issue,
it reproduces on the direct OpenAI path too.

Scope

grep -rl "gpt-5.3-codex" .github/workflows/*.md → 75 workflow files, 71 with explicit
model: {openai,copilot}/gpt-5.3-codex. All are at risk of the same failure whenever the Codex
CLI resolves this specific model string, regardless of the provider prefix.

Recommendation

1. Do not close this as resolved based on PR fix(codex): strip openai/ provider prefix from Codex model identifiers #60423 alone — it fixed one bug in a two-bug chain.
2. Verify whether @openai/codex@0.153.4 (the pinned CLI version in pkg/workflow/codex_engine.go)
   ships model metadata for gpt-5.3-codex at all; if not, either bump the pinned Codex CLI
   version to one that supports it, or fall back the 71 affected workflows to a model the pinned
   CLI does recognize (e.g. gpt-5.2-codex, confirmed present in pkg/cli/data/models.json).
3. Re-run LintMonster/Avenger/Metrics Collector after the version bump or model fallback to confirm
   the model_not_supported_error output stops being set before declaring this resolved again.

Do not re-file

#60113, #60143, #60150, #60173, #60241, #60455, #60465, #60471, #60541, #60543, #60545, #60546,
#60554 — all auto-generated per-workflow failure issues already exist/expire on their own; track
follow-up via this issue instead.

Generated by Workflow Health Manager - Meta-Orchestrator · run 34738150503

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.github.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"

See Network Configuration for more information.

Generated by 🏥 Workflow Health Manager - Meta-Orchestrator · copilot · auto · 195.8 AIC · ⌖ 9.74 AIC · ⊞ 12.6K · ◷

• expires on Sep 13, 2026, 8:49 PM UTC-08:00

[github-actions]

Escalation — 2026-09-14T04:39Z (Workflow Health Manager)

Status: WORSE, not resolved. New evidence since this issue was filed (2026-09-13T04:49Z) shows
the gpt-5.3-codex / codex-engine failure has spread from ~4 workflows to 13+ distinct
workflows in the last 24h, with 19 new "no safe outputs"/model-error issues filed
2026-09-13T14:56Z → 2026-09-14T02:49Z:

• Daily CLI Performance Agent ([aw] Daily CLI Performance Agent produced no safe outputs #60637), Auto-Triage Issues ([aw] Auto-Triage Issues produced no safe outputs #60638), Avenger ×6 ([aw] Avenger produced no safe outputs #60640, [aw] Avenger produced no safe outputs #60655,
  [aw] Avenger produced no safe outputs #60667, [aw] Avenger produced no safe outputs #60681, [aw] Avenger produced no safe outputs #60688, [aw] Avenger produced no safe outputs #60711), Agent Persona Explorer ([aw] Agent Persona Explorer produced no safe outputs #60644), Daily Go Test Parallelizer ×2
  ([aw] Daily Go Test Parallelizer produced no safe outputs #60654, [aw] Daily Go Test Parallelizer produced no safe outputs #60720), Daily Code Metrics and Trend Tracking Agent ([aw] Daily Code Metrics and Trend Tracking Agent failed #60669), Daily Cache Strategy
  Analyzer ([aw] Daily Cache Strategy Analyzer produced no safe outputs #60677), Daily Regulatory Report Generator ([aw] Daily Regulatory Report Generator produced no safe outputs #60694), Agentic Workflow Audit Agent
  ([aw] Agentic Workflow Audit Agent produced no safe outputs #60695), ESLint Monster ([aw] ESLint Monster produced no safe outputs #60698), Daily AWF Spec Compiler Surfacing Review ([aw] Daily AWF Spec Compiler Surfacing Review produced no safe outputs #60699), Metrics
  Collector ([aw] Metrics Collector produced no safe outputs #60722), LintMonster ([aw] LintMonster produced no safe outputs #60725) — all currently OPEN.

Pattern is intermittent, not constant — e.g. LintMonster/Metrics Collector/Daily Go Test
Parallelizer each show a mix of success and failure runs across the same 09-12→09-14 window with
unchanged model: config, consistent with the CLI's own log message ("uses fallback model
metadata" — i.e. sometimes still resolves, sometimes hard-errors as model_not_supported_error).

New root-cause context (constant history): pkg/constants/engine_constants.go
CodexDefaultModel has flip-flopped: gpt-5.3-codex (PR #34518, merged 2026-05-24) →
gpt-5.4 (PR #34804, merged 2026-05-26, because gpt-5.3-codex was itself later found
unsupported) → individual workflows were then patched back to openai/gpt-5.3-codex /
copilot/gpt-5.3-codex (PRs #58862, #58827, #58787, #58779, #58826, #58770, #58860, #57945,
#57051, etc., May–Sep 2026) because gpt-5.4 was rejected by the Codex CLI. The current pinned
@openai/codex@0.153.4 (pkg/constants/version_constants.go) now rejects gpt-5.3-codex too.
Neither gpt-5.4 nor gpt-5.3-codex is a stable choice for the pinned CLI version — this is
recurring churn between two models that each fail at different times, not a one-off regression.

74 workflow files still hardcode model: {openai,copilot}/gpt-5.3-codex (verified via
grep -rl against current .github/workflows/*.md, 2026-09-14). All remain at risk.

Recommendation (unchanged, reinforced by new data): verify which gpt-5.x-codex variant the
pinned @openai/codex@0.153.4 CLI actually has stable model metadata for (check upstream Codex CLI
changelog/model registry, not just repo constants), then either (a) bump the pinned Codex CLI
version to one with gpt-5.3-codex support, or (b) bulk-migrate all 74 workflow files + the
CodexDefaultModel constant to a model confirmed compatible with the current pinned CLI, adding
a contract test asserting compatibility to prevent future flip-flop churn.

DO NOT RE-FILE per-workflow issues (#60637, #60638, #60640, #60644, #60654, #60655, #60667,
#60669, #60677, #60681, #60688, #60694, #60695, #60698, #60699, #60711, #60720, #60722, #60725) —
all consolidated under this P0 tracker.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• registry.npmjs.org

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 🏥 Workflow Health Manager - Meta-Orchestrator · copilot · auto · 89.1 AIC · ⌖ 9.34 AIC · ⊞ 12.6K · ◷

[github-actions]

This issue was automatically closed because it expired on 2026-09-14T04:49:13.909Z.

Closed by Workflow