Skip to content

[WRONG BRANCH] fix(codex): preserve cache affinity across model detours - #515

Draft
luvs01 wants to merge 28 commits into
devfrom
codex/propose-fix-for-cache-affinity-vulnerability
Draft

luvs01 wants to merge 28 commits into
devfrom
codex/propose-fix-for-cache-affinity-vulnerability

Conversation

@luvs01

@luvs01 luvs01 commented Sep 14, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The model-entitlement detour path still used the proactive autoSwitchThreshold headroom predicate and could delete an ordinary thread affinity when pool.cacheAffinity is enabled, causing ordinary requests to move off a cache-warm account before genuine exhaustion.
  • The intent of pool.cacheAffinity is to delay moving a bound conversation until the account is actually exhausted or cannot serve, so the detour path must use the same exhaustion semantics as the live-affinity rebind logic.

Description

  • Add hasCodexSharedStateQuotaHeadroom(...) in src/codex/routing.ts which preserves the old threshold behaviour for new/unbound selection but uses a 100% exhaustion boundary when pool.cacheAffinity is true and the strategy is quota.
  • Replace uses of hasCodexQuotaHeadroom(...) in shared-state/affinity checks with hasCodexSharedStateQuotaHeadroom(...) so shared selection, ordinary thread-affinity preservation, and active-selection preservation follow the new cache-affinity semantics.
  • Ensure shared-health checks continue to reject truly unavailable accounts by keeping failover and unrecovered quota-refusal checks in the preservation predicates.
  • Add a focused regression test in tests/codex-integration/codex-routing.test.ts that exercises A (bound, > threshold) → gated-model detour B → ordinary A with pool.cacheAffinity: true.
  • Update the OpenAI Pool policy text in structure/providers/openai-tiers.md to document that model detours preserve ordinary bindings under cache-affinity until genuine exhaustion.

Testing

  • Ran node_modules/.bin/bun test tests/codex-integration/codex-routing.test.ts and observed focused routing tests pass: 182 passed, 1 skipped, 0 failed.
  • Ran the single focused test for the new case with the --test-name-pattern filter and it passed.
  • Ran node_modules/.bin/bun run typecheck and node_modules/.bin/bun run structure:check, both succeeded.
  • Attempted the full suite with node_modules/.bin/bun run test; the environment-running full suite exited nonzero with numerous unrelated server/auth fixture failures and timeouts in this environment, but the focused routing coverage for the changed logic is green.

Codex Task

lidge-jun and others added 27 commits September 6, 2026 01:08
…43-01a07240

[WRONG BRANCH] chore(release): promote verified candidate to 2.43.0
…in-07c0

chore(release): promote validated 2.44.0 to main
Promote frozen dev source cf9f662; no new runtime changes. Candidate CI34061274315 and service34061276621 are the validation references. Publication waits for successful validation and the final main push CI at the exact release SHA.
Promote frozen dev source cf9f662 as 2.45.0.

The repository owner explicitly authorized this main/preview release promotion and admin PR-only merge. This is a release-specific owner decision, not an independent approval or the dev-only maintainer exception.

Frozen candidate full CI34061274315 passed all25jobs after one unchanged-source rerun of Windows5; the initial holder busy assertion remains recorded without a root-cause resolution claim. Service lifecycle34061276621 passed Linux/macOS/Windows. Dev version pre-move3812 is merged. Publication still requires this actual main merge SHA's own successful push CI and Service lifecycle. No local suites were run.
[WRONG BRANCH] chore(release): promote verified 2.46.0 to main
[WRONG BRANCH] release: promote 2.47.0 to main
[WRONG BRANCH] release: apply final roster correction to main
[WRONG BRANCH] release: promote 2.48.0 to main
…in-01a08498

release: promote verified 2.49.0 product tree to main
Promotes the audited freeze SHA 12c248f unchanged. The resulting tree is byte-identical to that commit's tree, d8f5a71, so what ships is exactly what the six-lane regression audit read.
…in-01a08a81

[WRONG BRANCH] release: promote verified 2.50.0 product tree to main
[WRONG BRANCH] release: promote verified 2.51.0 product tree to main
Product tree is dev at 7bfb2ad. Only package.json differs, carrying the
stable channel version 2.52.0.

This promotion follows a CI repair and a regression sweep: dev had drifted 79
commits past its last finished run and the one run allowed to complete had
failed. lidge-jun#4390 fixed an integration test that never denied anything and had been
red on dev since lidge-jun#4342; lidge-jun#4396/lidge-jun#4397/lidge-jun#4398 closed four gaps in the quota
avoidance contract lidge-jun#4368 introduced; lidge-jun#4403 made a port fixture deterministic.
release: promote verified 2.52.0 product tree to main
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)
  • ^dev$
  • ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a74cce7b-9642-4e3b-b63d-9d087e368d4d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 14, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-14T00:24:54.988823Z 588cb85 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 588cb85c0d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/codex/routing.ts
getPoolAccountPlanForSelection(config, accountId, selectionOptions),
now,
);
return isUnknownUsage(usage) || usage < 100;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Honor a disabled auto-switch threshold

When accountPoolStrategy is quota, cache affinity is enabled, and autoSwitchThreshold is 0, a cached 100% reading makes this predicate false even though 0 disables usage-driven re-evaluation. During a model-gated detour, the resolver consequently deletes the ordinary thread affinity and may promote the detour account, whereas the normal affinity path deliberately keeps the binding when the threshold is disabled; this also contradicts the documented contract in docs-site/src/content/docs/reference/configuration/providers.md:505. Short-circuit to true when the configured threshold is non-positive so only actual failure evidence retires the shared state in this configuration.

AGENTS.md reference: src/AGENTS.md:L10-L10

Useful? React with 👍 / 👎.

@luvs01
luvs01 changed the base branch from main to Dev September 14, 2026 00:27
@github-actions

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the bug Something isn't working label Sep 14, 2026
@github-actions github-actions Bot changed the title fix(codex): preserve cache affinity across model detours [WRONG BRANCH] fix(codex): preserve cache affinity across model detours Sep 14, 2026
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown

⏳ DRAFT

  • wrong target branch (Dev); retarget to dev. UI screenshot required.

What to do

  • Retarget this PR to dev — all contributions go to dev.
  • Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants