Landscape-sweep GPT-6 lane through OmniRoute: lane-local Codex home with the token stack at max effort (stacked on #385)

[seathatflowsinourveins]

What

This PR routes the landscape-sweep harness's GPT-6 lane through the local OmniRoute gateway, at max effort and with the full token stack. Operator direction, 2026-09-27: "run the full 20 layer sweep, full parallel but first resolute with the omniroute wire with full token effiency practice first and we proceed via them".

• build_args.py --gpt6-provider omniroute --codex-host <HOST> stages a lane-local Codex home, <work-dir>/codex-home/, with two files:
  • config.toml: the OmniRoute provider block, plus the token-stack [mcp_servers.*] tables of adoption/templates/codex.config.template.toml, rendered for the host by the checkout's own tools/adoption/render_config.py (load_host_values, render_one). The servers are serena, ai-memory, socraticode, headroom, codebase-memory, qmd and context-mode.
    • Provider block: model = "cx/gpt-6-astra", model_provider = "omniroute", model_reasoning_effort = "max", and [model_providers.omniroute] with a loopback base_url ending in /v1, env_key = "OMNIROUTE_API_KEY", requires_openai_auth = false and wire_api = "responses".
    • supports_websockets stays unset: OmniRoute's WebSocket bridge drops the client-version headers that its HTTP /v1/responses path forwards.
    • Project and hook trust are deliberately absent.
  • stack-worker.config.toml: the Codex worker profile, copied verbatim, from --stack-worker-profile or adoption/templates/codex.stack-worker.config.toml.
• codex_job.py runs a gateway lane with CODEX_HOME=<work-dir>/codex-home, without --ignore-user-config (which would drop that home's config.toml), and with -p stack-worker.
• Key handling:
  • The key comes from $OMNIROUTE_API_KEY in the harness's environment.
  • For the current keyless loopback gateway (omniroute setup --non-interactive, REQUIRE_API_KEY=false), the staged placeholder local-loopback fills an unset variable, because Codex's env_key only needs the variable to exist. A real key in the environment wins.
  • --omniroute-require-key stages no placeholder; a job without the variable then ends with exit 6 before codex starts.
• Guards:
  • --quota-stop-percent is refused for a gateway lane, since the probe reads the native login.
  • --omniroute-base-url must be loopback.
  • inputs.json records the provider, so a gateway run never reuses a native result.
  • Model names may carry a provider prefix.
• Native default: unchanged. The existing argv test still passes.

Parity against the live gateway, 2026-09-27 07:02Z. The gateway build was OmniRoute 3.8.51 = release/v3.8.51 a58000c7 + upstream PR #14904 (BUILD_SHA bf0255649). The lane was staged from this branch merged with #389, using the committed default profile.

• Passed:
  • staging exit 0;
  • codex exec exit 0 in 29 s;
  • the shell tool;
  • the MCP call ctx_execute (context-mode), which returned mcp-ok;
  • --output-schema output;
  • usage reported;
  • the rollout turn_context effort max;
  • the gateway's call_logs, whose reasoning row reads reasoning_effort_requested=max, reasoning_effort_upstream=max.
• Failed: web search. Codex's standalone web.run POSTs <base_url>/alpha/search, and this build answers 404 Unknown API route: /v1/alpha/search. The upstream implementation is diegosouzapw/OmniRoute PR #13788: open, deferred-v3.8.52, base release/v3.8.51, 2 new files. It uses OmniRoute's search registry, with keyless DuckDuckGo-lite as the fallback, not OpenAI's hosted search. The gateway owner is cherry-picking it. The check is re-run before the full sweep, and the sweep records the search backend as a lane limit.

Review

GPT-6 cross-family review (gpt-6-astra, effort max, read-only), two rounds:

• r1 at 5b43474: needs_changes (1 high, 2 medium, 1 low). The repair is 8780d93.
  • high: the shell snapshot wrote the key to shell_snapshots/*.sh at mode 0644. Now shell_snapshot = false.
  • medium: no web search for Astra through a custom provider. Now supports_standalone_web_search and standalone_web_search.
  • medium: the default profile was absent.
  • low: the MCP header forms.
• r2 at 8780d93: needs_changes.
  • The high and the search medium were resolved.
  • The profile medium is resolved by PR-D: Codex worker lane: Codex's own config writer, RTK text inline with exceptions, max-effort stack-worker profile #389, which puts the profile on main. After the merge, staging with no profile flag exits 0.
  • The low was only partly repaired: nested env tables in other TOML spellings were dropped silently. Fixed in 1e81cce: a whole-table comparison against the full parse, plus literal-quoted and dot-spaced headers. Both new tests fail on 8780d93's code.

Tests

• 13 new tests (9 build, 4 runner):
  • OmniRouteLaneBuildTests: a real render of the template for adoption/hosts/example.json; all 7 MCP servers, the provider block and valid TOML (tomllib); no trust tables and no unrendered ${…}; the refusals; the require-key option; the native default unchanged.
  • OmniRouteLaneRunnerTests: the exact argv; the environment's CODEX_HOME; the key present; no start without a key; the placeholder used only when the variable is unset.
• python3 -m unittest tests.test_landscape_sweep_harness tests.test_saturation_ledger: 166 run, OK (3 skipped). With tests.test_codex_worker_lane after merging main (PR-D: Codex worker lane: Codex's own config writer, RTK text inline with exceptions, max-effort stack-worker profile #389): 206 run, OK (5 skipped).
• scripts/validate.py and scripts/build_ecosystem.py --check: passed.

SOTA sources

• Codex config reference (model_providers, env_key, wire_api, requires_openai_auth, CODEX_HOME, profiles): https://developers.openai.com/codex/config-reference
• Codex profile-v2 layering, $CODEX_HOME/<name>.config.toml for --profile <name>: codex-rs/config/src/config_layer_source.rs at rust-v0.157.1, as cited by the stack-worker profile.
• OmniRoute's supported non-interactive setup and its Codex CLI configuration ("Local unauthenticated OmniRoute"), release/v3.8.51 at a58000c7, as verified by the token lane: https://github.com/diegosouzapw/OmniRoute
• The checkout's own renderer: tools/adoption/render_config.py.

🤖 Generated with Claude Code

https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5

[seathatflowsinourveins]

GPT-6 cross-family re-check of the repair (8780d93): needs_changes. Findings and their state at 1e81cce:

Finding	GPT-6 re-check	Now
High: shell snapshot writes the provider key at 0644	resolved. With the repaired config, zero snapshot files were written using a synthetic key. With snapshots on as a control, a 0644 file held the key.	resolved
Medium: no web search for Astra through a custom provider	resolved. The loopback capture shows tools.web__run, and turning the capability off removes it (matches codex-rs/ext/web-search/src/extension.rs at rust-v0.157.1).	resolved in config; live search through OmniRoute is still unqualified, and the parity probe covers it
Medium: default worker profile absent	unresolved. Default staging still exits 2 until adoption/templates/codex.stack-worker.config.toml exists	resolves when #389 (PR-D) lands the profile. #389 merges first; after merging main here, staging runs with the default profile
Low: MCP extraction	partly repaired. After [mcp_servers.demo], an env table spelled [mcp_servers.'demo'.env] or [ mcp_servers . demo . env ] was dropped silently, because the check compared server names only	fixed in 1e81cce: see below

What 1e81cce changes:

• The check compares the parsed mcp_servers table of the extraction with the whole rendered config's, nested settings included, and fails closed naming the servers that differ.
• The header pattern accepts literal-quoted names and spaces around the dots.
• Staging refuses without tomllib instead of skipping the check.
• The failing control: both new tests fail against 8780d93's build_args.py.
• The real template rendered for this host still yields all 7 servers, env tables included, equal to the full parse.

Also from the re-check: no new independent defects. An absolute --codex-host path containing spaces staged cleanly, and only the stem reached staged.json and config.toml.

Checks at 1e81cce: python3 -m unittest tests.test_saturation_ledger tests.test_landscape_sweep_harness gave 166 run, OK (3 skipped). python3 scripts/validate.py passed.

Merge order stays #389 → this PR → parity probe on the fixed OmniRoute build → full 20-layer foundation sweep.

🤖 Generated with Claude Code

https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5