Preregister the GPT-6 family routing test (astra/sol/luna x max/medium) on the frozen 8-K extraction task

[seathatflowsinourveins]

This PR preregisters a measured routing test for the GPT-6 family. Nothing is run in this PR.

The user asked on 2026-09-26 to get the most out of the GPT-6 family cleanly, with token saving as the base layer. Today every GPT-6 step uses gpt-6-astra at max. The test asks: for a mechanical, deterministically scored stage, which family member and effort matches astra/max at lower token cost? Stages like that could then route to it, and the shared weekly quota would do more work.

• Task: the frozen li26 8-K item-extraction task. It uses the same 360 public filings (li26's own verify-inputs: 360, inputs_sha256 2a5c8c9b…), the same header-item labels, and li26's scoring functions, imported and hash-pinned.
• Batches: 25, in frozen order, each at most 15 filings and under 110,000 bytes. The layout's sha256 is frozen, and every arm uses the same batches.
• Arms: A0 gpt-6-astra/max (control), A1 astra/medium, S0 gpt-6-sol/max, S1 sol/medium, L0 gpt-6-luna/max and L1 luna/medium. Never ultra. Each model runs at its default service tier.
• Frozen rule: an arm is routable when three things hold: the paired-bootstrap lower bound of micro-F1(arm − A0) is at least −0.02 (10,000 resamples, seed 20260926), JSON-valid is at least 0.98, and every batch completed. The recommendation is the cheapest routable arm by mean billed tokens per filing (uncached input plus output; Codex's output already includes reasoning), and only if its known cost is strictly below A0's. Ties go to wall time. A0 can win (keep_default). Quota percentages are context only, since other sessions share the account.
• Isolation:
  • one call per batch, at most 3 concurrent, sharing the host's Codex slot locks;
  • a per-call CODEX_HOME and scratch HOME/TMPDIR/cwd outside every repository, and an allowlisted environment;
  • agents, web search, shell and other tools are disabled by config. A tool use fails the call, and an unknown session item stops the arm.
  • A real usage-limit event (Codex's own error/turn.failed events only) publishes LIMIT immediately and exits 3. An outage exits 4.
  • Raw outputs go only to a 0700 private state directory; the decision file holds aggregates.

Review record

• Claude Opus: 1 high and 4 medium findings.
• GPT-6-Astra: 1 high and 4 medium. The shared high: a costlier arm could route when the control's usage was incomplete.
• All confirmed findings were fixed in one repair round, and 8 targeted mutations are each caught by a test. One request was partly rejected, with the reason given in the plan: a delay before re-queueing a failed batch.
• The isolation claims rest on a committed loopback fake-provider probe under bwrap --unshare-net (isolation-probe/), plus reads of the pinned source. The first real run must confirm that session records hold only message and reasoning items.

Tests: tests.test_gpt6_family_tiering_20260926 ran 39, OK, and the related contract and manifest suites pass. validate.py, validate_convergence.py --all-recorded (24 records) and run_arm.py verify-frozen all pass.

CI fixes (2026-09-26, workstation coordinator)

• validate-macos (run 36261746664) failed a test this PR added, not a flake. RunnerTests.test_codex_command_line_homes_environment_and_private_files saw __CF_USER_TEXT_ENCODING in the fake codex's own environment. run_arm.py's call_env passes only CHILD_ENV_ALLOWLIST plus CODEX_HOME, HOME and TMPDIR. macOS CoreFoundation adds __CF_* and VERSIONER_* keys to a process even when exec received an explicit environment, and the fake codex is a Python child. The test now drops those names before comparing, on darwin only (passed_env), and keeps the exact set elsewhere. The RUST_LOG and OPENAI_API_KEY assertions are unchanged. run_arm.py and every other frozen input are unchanged; the test file is not in frozen_inputs and is re-registered in the hot-file commit. macOS cannot run locally, so the new CI run's validate-macos is the only real check for this fix.
• validate (run 36270619115) failed because the job limit cancelled it ("The job has exceeded the maximum execution time of 10m0s") after 6295 tests had printed OK in 529s. This branch now carries the same timeout-minutes: 20 hunk as Retain the 2026-09-26 sweep's 32 layer inputs (SHA256SUMS) for the verdict wave's GPT-6 re-votes #363, byte-identical so either PR merges cleanly after the other. That makes this PR's change lane:shared under docs/lanes.md, because the workflow serves both lanes.
• Local checks at b435cdf9 all exited 0: validate.py, evidence_manifest.py --check, component_matrix.py --check, new_host_grand_list.py --check, build_ecosystem.py --check, zizmor 1.30.1 --offline, and main's verdict_review_gate.py. tests.test_gpt6_family_tiering_20260926 and the workflow and verdict-gate modules ran 272, OK.

Lane consolidation: on 2026-09-26 the user shut down the other lane sessions and assigned this work to the workstation coordinator ("no other peers live, i shut them with the token save repos install into our native workflow and github workflow , harness update and sota foundation of our session as main task"); this quote stands in for the trading lane's ack.

SOTA sources

• Codex CLI 0.157.1: the bundled model catalog (codex debug models --bundled; the family, efforts and default tiers) and the pinned codex-rs sources for config keys and auth storage.
• The li26 preregistration (Preregister latest-local-model qualification on the RTX 4090 (8-K item extraction; Qwen3.8 + past-weeks releases) #323/Local-model qualification results on the RTX 4090: C2 (Qwen3.8-27B fully on GPU + MTP) 5x decode at equal F1, now serving #342), whose data, labels and scoring this test reuses.
• The macOS environment fix: CPython Lib/test/test_subprocess.py at main 1e8ff18a1215, test_empty_env's is_env_var_to_ignore ("This excludes some CF* and VERSIONER* keys MacOS insists on adding even when the environment in exec is empty").
• The timeout change: GitHub Actions workflow syntax, jobs.<job_id>.timeout-minutes ("The maximum number of minutes to let a job run before GitHub automatically cancels it. Default: 360").

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.