Codex dated holds (R6): a host-agnostic 0.159.3 hold on the Linux pin row, held status, TUI notice key

[seathatflowsinourveins]

Draft. The inventory recount waits for #674, which is re-pinning docs/decisions/2026-10-02-new-wsl-client-configuration.md. The coordinator (CC) re-ACKs before this PR leaves draft. Until then, tests.test_new_wsl_client_config fails on exactly the two record assertions listed below, and on nothing else.

Scope

• What this PR changes, in one or two sentences: it implements R6, "per-host Codex pins", as a host-agnostic dated hold on the single Linux codex pin row.
  • holds[] holds 0.159.3 until 2026-11-04 (X18, the Codex 0.159.3 -> 0.160.0 with the Python SDK pair: pins, qualification receipt, tests and checkpoint #626 landing exception).
  • scripts/adoption_status.py --pinned-versions reports a host on that version as held, not drift, until that date. From that date on it reports drift and states the expiry.
  • tools/adoption/apply_codex_lane.py still refuses such a host, and its refusal now names the hold.
  • The PR also adds an expiry and schema test, the Codex TUI notice key "gpt-6.1-sol" = 4, and a decision record.
• Base commit: 6af8e55bd (origin/main at push). The branch was cut at 33efbc3b6 and rebased onto 6af8e55bd by docs/lanes.md's hot-file protocol, because CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681 changed manifests/evidence.json.
• Lane: lane:foundation
• Owned paths touched:
  • adoption/pins-linux-x86_64.json
  • adoption/templates/codex.config.template.toml
  • scripts/adoption_status.py
  • tools/adoption/apply_codex_lane.py
  • tests/test_adoption_status.py
  • tests/test_codex_worker_lane.py
  • tests/test_pin_holds.py (new)
  • docs/decisions/2026-10-04-codex-dated-holds.md (new)
  • hot files, in the last commit only: manifests/stack.json (a reference to the hold, since that row carries no install data) and manifests/evidence.json (main's copy, re-registered)

SOTA sources

• OSV-Scanner ignoreUntil, the expiry precedent, at v2.6.0 (tag commit e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6):
  • https://github.com/google/osv-scanner/blob/v2.6.0/docs/configuration.md L27-34: ignoreUntil is an "Optional exception expiry date".
  • https://github.com/google/osv-scanner/blob/v2.6.0/internal/config/config.go#L149-L157: an ignore applies only while ignoreUntil.After(time.Now()), so it stops on its date.
  • The in-repo use of this precedent is .github/osv-scanner.toml with tests/test_osv_lockfile_coverage.py ignore_entry_problems (until <= date.today() is expired), plus .grype.yaml "Re-review by".
• Codex rust-v0.160.0, for the TUI notice key. The tag object is 79b1b666f2e8551f8abbbca34957227f67f3f553, which peels to a956835d020762cb2b570053af06f643a11c0ecc (git ls-remote), read from a pinned sparse clone:
  • https://github.com/openai/codex/blob/rust-v0.160.0/codex-rs/config/src/types.rs#L789-L795: ModelAvailabilityNuxConfig, a flattened HashMap<String, u32> of show counts per model slug. The [tui] field is at L940-L942.
  • https://github.com/openai/codex/blob/rust-v0.160.0/codex-rs/tui/src/app/startup_prompts.rs#L242: MODEL_AVAILABILITY_NUX_MAX_SHOW_COUNT: u32 = 4. L250-L266 show the notice only while the count is below 4. L281-L305 write the count back one higher per showing.
  • https://github.com/openai/codex/blob/rust-v0.160.0/codex-rs/core/src/config/edit.rs#L837-L841: set_model_availability_nux_count.
  • https://github.com/openai/codex/blob/rust-v0.160.0/codex-rs/models-manager/models.json#L245-L247: gpt-6.1-sol (slug at L178) is the bundled catalog's only availability_nux at that tag.
• npm registry metadata for 0.159.3, read 2026-10-04:
  • https://registry.npmjs.org/@openai/codex/0.159.3: dist.integrity sha512-hg4nlqCw…DkQ== and dist.shasum b49833a8…. Its optionalDependencies maps @openai/codex-linux-x64 to npm:@openai/codex@0.159.3-linux-x64.
  • https://registry.npmjs.org/@openai/codex/0.159.3-linux-x64: dist.integrity sha512-xlHydfOk…s5og== and dist.shasum 62a9c71b….

Evidence-class table

Claim	Evidence class	Command / receipt
The hold's wrapper URL and SHA-256 equal the codex row before f77a35eb2 (introduced by 85543efe5, #580). The 4,904-byte registry tarball matches them (SHA-256 31d5e584…), and its SHA-512 and SHA-1 equal the registry's dist.integrity and dist.shasum.	local_integration	git show f77a35eb2^:adoption/pins-linux-x86_64.json; registry download; sha256sum, openssl dgst -sha512, sha1sum
The hold's platform_dependency (@openai/codex@0.159.3-linux-x64, 162,464,331 bytes) is first recorded here, since no earlier record exists. SHA-512 and SHA-1 equal the registry's. SHA-256 is 0719027c… and the archive's executable SHA-256 is 8bf204b3…. No held host's installed executable was compared.	local_integration	registry download and extraction
"gpt-6.1-sol" = 4 under [tui.model_availability_nux] stops Codex's availability notice for that slug.	source_review	the rust-v0.160.0 lines above
A host still on 0.159.3 now prints codex: 0.159.3 held until 2026-11-04 (X18: …), and codex leaves mismatched for held. The base revision's script on the same pins file lists codex as mismatched.	local_integration	python3 scripts/adoption_status.py --pinned-versions on one held host, 2026-10-04
Before until, a hold is held. On and after until, it is drift and the expiry is stated. Any other version, a failing probe or a malformed hold is drift.	synthetic	tests.test_adoption_status.DatedHoldTests (9 tests)
Every hold is complete and unexpired, at most 90 days away, at most one per row, and never the pin itself.	synthetic (structural plus mutants)	tests.test_pin_holds
The lane still refuses a held codex, and its refusal names the hold and its until date.	synthetic	tests.test_codex_worker_lane ApplyFlowTests (fake codex)
The new tests detect the behaviour, not just pass. Six in-process mutations each fail them: no hold matching, < for <=, held not excluded, no well-formedness filter, and the live hold on its until date (two checks).	synthetic	in-process mock.patch controls

Local commands run

$ TMPDIR=<scratch> nice -n 19 python3 -m unittest tests.test_pin_holds            -> exit 0 (6 tests OK)
$ TMPDIR=<scratch> nice -n 19 python3 -m unittest tests.test_adoption_status      -> exit 0 (137 OK)
$ TMPDIR=<scratch> nice -n 19 python3 -m unittest tests.test_codex_worker_lane    -> exit 0 (108 OK, 10 skipped: opt-in real-codex integration tests)
$ TMPDIR=<scratch> nice -n 19 python3 -m unittest tests.test_osv_lockfile_coverage -> exit 0 (57 OK)
$ TMPDIR=<scratch> nice -n 19 python3 -m unittest tests.test_render_config        -> exit 0 (36 OK)
$ TMPDIR=<scratch> nice -n 19 python3 -m unittest tests.test_new_wsl_client_config -> exit 1 (159 run, 2 expected failures, below)
$ python3 scripts/adoption_status.py                    -> exit 0 (default run execs no probe; unchanged)
$ python3 scripts/adoption_status.py --pinned-versions  -> exit 0
    pinned versions: 2 matched, mismatched: rtk, ai-memory, mcporter, held: codex, unchecked: context-mode
      codex: 0.159.3 held until 2026-11-04 (X18: hosts not yet switched stay on 0.159.3 until retired (#626 landing exception))
$ python3 scripts/validate.py                           -> exit 0 ("hashed_files": 9880, "status": "passed")
$ python3 scripts/evidence_manifest.py --check          -> exit 0
$ python3 scripts/validate_convergence.py --all-recorded -> exit 0
$ git diff --check origin/main...HEAD                   -> exit 0

The rtk, ai-memory and mcporter mismatches are that host's own drift, unchanged by this PR.

Expected failures in tests.test_new_wsl_client_config (both come from docs/decisions/2026-10-02-new-wsl-client-configuration.md, which this PR does not edit):

• RecordTests.test_the_counts_that_the_record_states_are_the_ones_check_prints: Tuples differ: (385, 293, 200, 93, 80, 41, 39, 12) != (386, 293, 200, 93, 81, 41, 40, 12).
• RecordTests.test_the_record_holds_the_tables_the_tool_prints: the record's not-wired table lacks the one new row | `codex/config/tui.model_availability_nux."gpt-6.1-sol"` | `not_wired` | … |, which follows the gpt-6-astra row.

The measured new counts are 386 pieces, 293 wired (200 practice, 93 through a slot), 81 not wired (41 through a slot that does not install, 40 by their own entry), 12 authorization. new_wsl_client_config.py --check itself passes, because the map's existing tui.model_availability_nux* entry covers the piece. The recount after #674 changes three places in that record: the "Today:" counts, Decision 14's "80 pieces are not wired" (to 81), and the new table row.

Full suite (python3 -m unittest, before the rebase and registration): 10,278 tests, 4 failures.

• The two failures above are expected.
• test_catalog_freshness_propose…test_general_publication_validator_passes_after_the_run failed only because the registry was not yet updated. After the last commit it exits 0.
• test_windows_terminal_defaults…test_the_installed_client_knows_no_notification_type_without_a_decision scans the installed Claude Code binary on that host. That binary knows an auth_storage_failure type the test's own table lacks. The failure is pre-existing and unrelated: neither that table nor the overlay is touched here, and CI skips the test.

Decision record

docs/decisions/2026-10-04-codex-dated-holds.md. It covers the design and these alternatives:

• per-host pin rows, which would put host names in the portable repository;
• no repository record, which leaves status red with no recorded reason;
• moving the pin back.

It cites the in-repo precedent (.github/osv-scanner.toml ignoreUntil plus reason, and .grype.yaml "Re-review by"). Its overturn condition is that the held hosts retire or switch, and the hold is then deleted, or that a second concurrent hold is needed, and per-host rows are revisited. The test fails on a second hold and names the record.

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (none changed).
• New/changed workflows declare top-level permissions: contents: read (none changed).
• No secrets are printed, logged or committed; no new required secret was added.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head c2aa04fcdeb3fd832781154e613224e335aeae2e. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned FINDINGS at 84245a3e59ec; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with its 1 P1 item(s) resolved in one repair round as recorded.

Observed main 8c32a84b246da66e43a6188c973741b09329e223. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 8c32a84b246da66e43a6188c973741b09329e223 head c2aa04fcdeb3fd832781154e613224e335aeae2e base 8c32a84b246da66e43a6188c973741b09329e223 merged-tree aa4a746ec4a35c65549ebbab912ebdaf6aabf6ed merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 11, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 10, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9885 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree aa4a746ec4a35c65549ebbab912ebdaf6aabf6ed)

Required checks at this head: 8 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as df50444a4d58168c35829f3c6b1a663af9500783 (parent 8c32a84b246da66e43a6188c973741b09329e223), tree aa4a746ec4a35c65549ebbab912ebdaf6aabf6ed. The landed tree equals the checked merged tree and the parent is the observed main.