Skip to content
This repository was archived by the owner on Jul 4, 2026. It is now read-only.

fix(runtime): route custom Codex Responses through app-server - #6

Merged
kingsleydon merged 1 commit into
phalafrom
codex/custom-codex-responses-app-server
May 20, 2026
Merged

fix(runtime): route custom Codex Responses through app-server#6
kingsleydon merged 1 commit into
phalafrom
codex/custom-codex-responses-app-server

Conversation

@kingsleydon

Copy link
Copy Markdown

Summary

  • allow custom providers resolved with api_mode=codex_responses to opt into codex_app_server
  • apply the app-server rewrite across named custom providers, legacy custom_providers, credential-pool results, and bare custom runtime fallback
  • keep custom chat_completions providers on the default runtime
  • update Codex app-server docs and skill guidance

Tests

  • pytest tests/hermes_cli/test_runtime_provider_resolution.py tests/agent/transports/test_codex_app_server_runtime.py

@kingsleydon
kingsleydon force-pushed the codex/custom-codex-responses-app-server branch from f22ac8a to fe258cd Compare May 20, 2026 11:18
@kingsleydon
kingsleydon force-pushed the codex/custom-codex-responses-app-server branch from fe258cd to 8dda100 Compare May 20, 2026 11:29
@kingsleydon
kingsleydon merged this pull request into phala May 20, 2026
5 checks passed
kingsleydon pushed a commit that referenced this pull request May 27, 2026
…te + cell_size_check + synchronous=FULL)

Production corruption #6 left b-tree pages with zeroed headers but intact old cell content — the Bug E pattern. This fix applies three pragma calls on every connect():

- synchronous=FULL (was NORMAL): closes the WAL-checkpoint reordering window where a crash between WAL commit and main-DB write leaves a partially-written b-tree page header. Cost is <1ms per commit on local SSD; negligible at kanban write volume.

- secure_delete=ON: forces SQLite to zero freed page bytes on disk. If a torn write or hardware fault later corrupts a page, the underlying cell content is zero, so corruption is detectable and no stale rows can resurface as live data.

- cell_size_check=ON: adds a read-side guard so corrupt cells surface as errors at read time rather than as silent wrong-data returns.

All three are connection-scoped and re-applied on every connect(). secure_delete also writes a persistent flag into the DB header on the first call against a fresh DB, making the protection durable across processes for new DBs.

Tests added for all four required cases: each pragma active on a fresh connection, and all three re-applied after close+reopen. Also adds the required negative test (migration path does not reset pragmas).
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant