ci: add reviewed Codex unstable integration lane - #11
Merged
Conversation
codex-unstable needs to carry preview topics above the generated production output, but the earlier prototype discovered every matching *-unstable ref. A branch push could therefore enroll unreviewed code, and replaying that prototype would also drop the reviewed-topic controls already protecting codex. Add a lane-aware preview path that keeps published config authoritative. An explicit local enable creates a bot-authored, tree-identical child of the current Codex output so the first preview pull request has a safe target without relaxing strict ancestry. Preview topics enter only through an authenticated reviewed merge into that branch; bare suffix refs stay inert. Prepare stable and preview candidates from one snapshot, run independent exact-SHA staging CI, and publish both lanes, meta, topics, and staging cleanup with one leased atomic push. Keep releases restricted to codex, preserve stable v1 no-op behavior, and fail closed on cross-lane ancestry, forged sentinels, stale staging, and unsafe workflow changes. t/t9905-codex-branch.sh now covers all 66 existing production cases and 29 preview admission, lifecycle, graph, recovery, and publication cases.
ttaylorr-oai
force-pushed
the
ttaylorr/codex-unstable
branch
from
August 5, 2026 01:42
e5a7ff8 to
f2abda3
Compare
ttaylorr-oai
changed the title
ttaylorr-oai
marked this pull request as ready for review
August 5, 2026 01:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce a reviewed preview integration lane above generated
codexwithout letting branch names enroll code.??/codex/*-unstablerefs remain inert.Meta/rebuild --local --enable-unstablecreates a bot-authored, tree-identical child of the currentcodexoutput so the first preview PR has a strict-descendant target.Rollout order: merge this into
meta; update the enrolled automation topic and rebuildcodex; update the existing livecodex-unstableruleset; enable the empty preview lane; then review and merge the first*-unstablePR before rebuilding again.Validation:
t/t9905-codex-branch.shpasses all 95 cases: the 66 existing production cases plus 29 preview admission, lifecycle, graph, recovery, staging, and release-isolation cases.