[teamleaderleo]

Adds the first opt-in managed Codex runtime slice for NEXT. Harnesses can explicitly run cmux harness codex-runtime install or status; the installer downloads the official v0.156.1 macOS archive, verifies the SHA-256 pinned beside the Codex harness manifest, stages and atomically activates a versioned binary under acpmux support storage, and discovery falls back to it only when no codex is on PATH. Existing profiles and PATH installations remain authoritative.

Prior art reviewed: #26333 (harness fixtures), #21568 (selected installation remains stable during Bun updates), #21439 (trusted Settings agent updates), and #3624 (cmux harness add/list/doctor/reload). Nearby Codex PRs #24428, #24490, #21278, #856, #4048, #18302 and #26106 do not bundle or manage a Codex runtime.

This slice deliberately excludes app bundling, signing/notarization, update/removal, and profile migration; those follow-up concerns need release packaging work.

Agent-Session: deeplink/agent?id=aid-eb216cbafc54de38a870

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds an opt-in managed Codex runtime for acpmux. cmux harness codex-runtime install downloads the official Codex v0.156.1 macOS archive, verifies its SHA-256 against the hashes pinned in the Codex harness manifest, and atomically activates it by swapping a current symlink with one rename, so the runtime path stays valid at every instant and a crash leaves either the old or the new install. A successful install tells a running daemon to read its profiles again, and cmux harness codex-runtime status prints the runtime state. Activation is Unix-only, and install directories are pruned only when nothing names them and they are over an hour old, so a concurrent install is never removed mid-swap.

The managed binary is used only when a readiness marker records the same pinned version and archive hash, so an interrupted or stale install never activates. It never overrides a codex already on PATH, so existing PATH installations, profiles, and explicit configuration stay authoritative. App bundling, signing/notarization, update/removal, and profile migration are deliberately excluded and will follow in release packaging work.

^{Written for commit d9e7a7e. Summary will update on new commits.}

[blacksmith-sh]

Found 3 test failures on Blacksmith runners:

Failures

Test	View Logs
test_a_picked_signing_label_has_a_rerun_alternative (main.RunsOnFallbackTests.test_ a_picked_signing_label_has_a_rerun_alternative)/ test_a_picked_signing_label_has_a_rerun_alternative (main.RunsOnFallbackTests.test_ a_picked_signing_label_has_a_rerun_alternative)	View Logs
test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)/ test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)	View Logs
test_no_runs_on_chain_ends_on_the_reserved_side_label (main.RunsOnFallbackTests.tes t_no_runs_on_chain_ends_on_the_reserved_side_label)/ test_no_runs_on_chain_ends_on_the_reserved_side_label (main.RunsOnFallbackTests.tes t_no_runs_on_chain_ends_on_the_reserved_side_label)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review dcb9017: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28211 -f ref=lane/managed-codex-runtime-min -f platform=macos -f backend_mode=local

web and size checks: green

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4124541235001 (ad89e73fbb)
• cmux NEXT nightly 1.0.0-nightly.4124615690001 (e7a61acd4a)
• cmux NEXT nightly 1.0.0-nightly.4124926880101 (1d08cfcafe)
• cmux NEXT nightly 1.0.0-nightly.4125030115701 (b2ec1ee1b6)

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place): BLOCK at d4dec32

BLOCK

1. tree/cmux-tui/crates/acpmux/src/managed_codex.rs:81-82 — configured_path() activates any codex file under the version directory without requiring ready.json, despite installation writing that marker only after activation. An interrupted install or a manually placed/partial binary is therefore discovered and launched while status() reports ready: false. Require the readiness marker and validate the recorded version/hash before returning the path.

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place): BLOCK at b75bfb4

BLOCK

1. [P1] Non-exhaustive match prevents compilation — cmux-tui/crates/acpmux/src/cli/harness.rs:81. The following match cmd lacks a HarnessCmd::CodexRuntime arm. Rust still requires exhaustive matching after the preceding if let returns, so this produces E0004. Move the new handler into the match or explicitly cover that variant.

Build verification was unavailable because cargo is not installed.

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place on a fleet lane host; posted by the research overseer because the box host could not write to GitHub): BLOCK at 4971b29

BLOCK

1. tree/cmux-tui/crates/acpmux/src/managed_codex.rs:58 — reqwest::get runs without installing a rustls crypto provider. The workspace uses rustls-no-provider, so standalone cmux harness codex-runtime install fails before downloading because no process-level CryptoProvider is configured.

2. tree/cmux-tui/crates/acpmux/src/config/discover.rs:403-405 / tree/cmux-tui/crates/acpmux/src/hub/live_models.rs:39 — managed Codex is added only to argv, while live-model probing searches CODEX_PATH or codex on PATH. When the managed runtime is the only Codex installed, no probe runs and the model catalog falls back to a synthetic default model.

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place on a fleet lane host; posted by the research overseer because the box host could not write to GitHub): BLOCK at f37049c

BLOCK
Visual verdict: N/A — backend-only Rust diff; no UI screenshots supplied.

1. tree/cmux-tui/crates/acpmux/src/config/discover.rs:402-404 bypasses the which callback supplied to discover_harnesses_from and calls the real environment instead. The existing test at discover.rs:484-487 injects /opt/bin/codex through that callback, so discovery now finds no Codex (or the wrong path) and the test panics/fails. Preserve the injected lookup and only fall back to the managed path afterward.

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place on a fleet lane host; posted by the research overseer because the box host could not write to GitHub): SHIP at dcb9017

SHIP at dcb9017

Visual verdict: no images; Leo tries the build

No findings. Static review completed; manifests parse successfully. Rust tests could not run because Rust tooling is unavailable.

Follow-ups: none

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): SHIP at f300541

SHIP at f300541

Visual verdict: no images; Leo tries the build

No correctness findings. Reviewed installation, activation, cleanup, discovery precedence, and launch integration.

TOML validation passed. Rust tests and release downloads could not be verified: Cargo and network access were unavailable.

Follow-ups: none

[cmux-bot]

cmux-bot approves f300541: an independent review passed this exact head (next-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

A newer verdict blocks 2a9a230 (no independent SHIP at the head).

[teamleaderleo]

Review (next-review patch-id; carried): SHIP at 2a9a230

The independent SHIP at f300541 carries to this head: the PR's own change (git diff $(git merge-base feat-cmux-next HEAD) HEAD) has the same git patch-id --verbatim (9dc8442488c5d6eb) at both heads, and no merge between them was resolved by hand. Nothing new to review. A newer BLOCK, or any change to the PR's own diff, ends the carry.

[teamleaderleo]

Review (next-review patch-id; carried): SHIP at a7b2154

The independent SHIP at f300541 carries to this head: the PR's own change (git diff $(git merge-base feat-cmux-next HEAD) HEAD) has the same git patch-id --verbatim (9dc8442488c5d6eb) at both heads, and no merge between them was resolved by hand. Nothing new to review. A newer BLOCK, or any change to the PR's own diff, ends the carry.

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place on a fleet lane host; posted by the research overseer because the box host could not write to GitHub): SHIP at a7b2154

SHIP at a7b2154

Visual verdict: no images; Leo tries the build

Follow-ups: none

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place on a fleet lane host; posted by the research overseer because the box host could not write to GitHub): SHIP at d9e7a7e

SHIP at d9e7a7e

Visual verdict: no images; Leo tries the build

No findings. Static review completed; TOML parsing and pinned-value consistency checks passed. Rust tests were unavailable because the box has no Rust toolchain.

Follow-ups: none