[HERMES#69022] fix(codex): gate Pro models by account catalog

[69k4xmdfm2-blip]

Summary

• stop synthesizing account-ineligible gpt-5.6-*-pro variants in the curated and forward-compatible Codex catalogs
• preserve a Pro variant when the authenticated live catalog explicitly advertises it
• classify ChatGPT Codex HTTP 400 model is not supported when using Codex as model_not_found, non-retryable, with fallback enabled

Root cause

The OAuth account catalog advertises Sol/Terra/Luna but no *-pro variants. Hermes nevertheless injected three Pro slugs into both fallback and forward-compatible discovery, allowing deterministic HTTP 400 failures in main and auxiliary tasks.

Tests

Strict TDD was used: the new behavior tests failed before the production changes.

Final branch after merging current origin/main:

224 passed in 7.42s

Command:

python -m pytest tests/hermes_cli/test_codex_models.py tests/agent/test_error_classifier.py -q -o 'addopts='

Coverage added:

• curated fallback excludes unverified Pro variants
• live discovery exposes Pro only when explicitly advertised
• the real Codex 400 wording and a capitalization/prefix variant both activate fallback

Compatibility

If OpenAI later grants Pro entitlement and returns a Pro slug from the live account catalog, Hermes keeps and displays it. Only synthetic/unverified Pro entries are removed.

Rollback

Revert f9f835313; no config or schema migration is involved.

[alt-glitch]

This was generated by AI during triage.

Related: #61665 removes the same unsupported Codex -pro defaults, while #67867 redesigns live-catalog authority. This patch additionally maps the documented OAuth 400 to fallback; please choose the desired consolidation scope.

[69k4xmdfm2-blip]

Closing this PR to consolidate with #61665 and #67867.

• fix(codex): drop unsupported pro defaults #61665 covers removal of the unsupported synthetic gpt-5.6-*-pro defaults.
• fix(codex): preserve live model catalog authority #67867 covers authoritative live OAuth catalog handling.
• The unique part of this PR is classifying the documented OAuth 400 (model is not supported when using Codex) as non-retryable model_not_found with fallback enabled. Maintainers can reuse the focused changes and tests in agent/error_classifier.py and tests/agent/test_error_classifier.py from commit f9f835313 if useful.

No separate follow-up PR is planned.