Switch runtime to cloud config bundle#24622

joeflorencio-openai · 2026-05-26T17:08:38Z

Summary

Adapts the moved codex-cloud-config crate from the legacy cloud requirements endpoint to the new config bundle endpoint.
Switches runtime consumers from CloudRequirementsLoader to CloudConfigBundleLoader so one shared bundle supplies cloud-delivered config and requirements.
Removes the legacy cloud requirements domain loader path.

Details

This intentionally keeps codex-cloud-config monolithic for review lineage: the previous PR establishes the crate move, and this PR shows the behavior change against that moved implementation. A follow-up PR splits the module back into focused files.

The new bundle path preserves the important cloud requirements loader semantics where intended: account-scoped signed cache, 30 minute TTL, 5 minute refresh cadence, retry/backoff, auth recovery, and fail-closed startup loading. The cached payload changes from a single requirements TOML string to the backend-delivered bundle, and validation rejects malformed config or requirements fragments before cache write/use.

github-actions · 2026-05-26T17:08:51Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

joeflorencio-openai · 2026-05-26T17:14:27Z

recheck

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 438e65ef09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

joeflorencio-openai · 2026-05-28T22:24:03Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f2b36ab920

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

bolinfest · 2026-06-02T04:27:45Z

        }
        Err(err) => {
-            warn!(error = %err, "Failed to preload config for cloud requirements");
-            // TODO(gt): Make cloud requirements preload failures blocking once we can fail-closed.


Is this TODO still relevant?

This TODO isn't worded quite right, but the general theme is still relevant. The TUI codepath fails closed in this case, where the app server doesn't and is left in a state that can't fetch config bundles. Let me replace this with a more accurate TODO comment, and can address it in a follow up PR.

bolinfest · 2026-06-02T04:29:16Z

+const CLOUD_REQUIREMENTS_FETCH_ATTEMPT_METRIC: &str = "codex.cloud_config_bundle.fetch_attempt";
+const CLOUD_REQUIREMENTS_FETCH_FINAL_METRIC: &str = "codex.cloud_config_bundle.fetch_final";
+const CLOUD_REQUIREMENTS_LOAD_METRIC: &str = "codex.cloud_config_bundle.load";


Is this change going to mess up any reporting?

There's just an internal developer dashboard for this by a member on our team - don't think anyone is actively looking at it. Would rather have this metric have a correct name long term though. Will update the dash accordingly.

bolinfest · 2026-06-02T04:29:48Z

 const CLOUD_REQUIREMENTS_AUTH_RECOVERY_FAILED_MESSAGE: &str = concat!(
    "Your authentication session could not be refreshed automatically. ",
    "Please log out and sign in again."
 );
 const CLOUD_REQUIREMENTS_CACHE_WRITE_HMAC_KEY: &[u8] =
-    b"codex-cloud-requirements-cache-v3-064f8542-75b4-494c-a294-97d3ce597271";
+    b"codex-cloud-config-bundle-cache-v1-6160ae70-bcfd-4ca8-a99b-40f73b3b072e";


I assume this was done in coordination with some backend system?

No, this hash is purely local. There's a slack thread back in January started by George Thomas where you, Gav, and George discussed this and agreed on this repo local HMAC approach.

bolinfest · 2026-06-02T04:31:51Z

    cache_path: PathBuf,
+    codex_home: PathBuf,


Prefer AbsolutePathBuf to PathBuf.

bolinfest · 2026-06-02T04:35:11Z

@@ -614,6 +674,11 @@ impl CloudRequirementsService {
        if !verify_cache_signature(&payload_bytes, &cache_file.signature) {
            return Err(CacheLoadStatus::CacheSignatureInvalid);
        }
+        if cache_file.signed_payload.version != CLOUD_CONFIG_BUNDLE_CACHE_VERSION {


Are we confident that when CLOUD_CONFIG_BUNDLE_CACHE_VERSION inevitably changes, we'll be sure to support both old and new versions? Should we be embedding v1 into any type names?

We just need to be able to signal incompatibility - backwards compatibility is not necessary. Since this is just locally caching a remote payload, a version mismatch means the cache file on disk is generated from a different codex harness that uses an incompatible format, and we should just refetch and store a new cache file.

bolinfest · 2026-06-02T04:54:23Z

-/// any unset fields.
+/// If available, load requirements from the platform system `requirements.toml`
+/// location as a requirements layer.
 #[doc(hidden)]


Can you delete this #[doc(hidden)] thing while you're here?

bolinfest · 2026-06-02T04:55:07Z

-/// If available, apply requirements from the platform system
-/// `requirements.toml` location to `config_requirements_toml` by filling in
-/// any unset fields.
+/// If available, load requirements from the platform system `requirements.toml`


"platform's"?

bolinfest · 2026-06-02T04:57:23Z


-    for (source, config) in managed_config_from_mdm
-        .map(|config| {
+    let mut layers = Vec::new();


If you want to get fancy:

Suggested change

let mut layers = Vec::new();

let mut layers = Vec::with_capacity(managed_config.len() + managed_config_from_mdm.map_or(0, |_| 1));

bolinfest · 2026-06-02T04:59:13Z

+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct CloudConfigBundle {
+    pub config_toml: CloudConfigTomlBundle,


Should all these fields be pub?

codex-cloud-config uses these fields, so they need to be public with how the code is currently structured.

bolinfest · 2026-06-02T05:01:10Z

 mod skills_config;
 mod state;
 mod strict_config;
+#[doc(hidden)]


Adapt the moved codex-cloud-config crate from the legacy cloud requirements endpoint to the new config bundle endpoint, while keeping the implementation in one file so the prior PR's move remains easy to review. The loader still preserves the old cloud requirements cache/fetch semantics where intentional: account-scoped signed cache, 30 minute TTL, 5 minute background refresh cadence, auth recovery, retry/backoff, and fail-closed startup loading. The cached payload changes from a single requirements TOML string to the backend-delivered config bundle, and validation now ensures malformed config or requirements fragments are rejected before cache write/use.\n\nSwitch runtime consumers from CloudRequirementsLoader to CloudConfigBundleLoader so config construction uses one shared bundle for both cloud-delivered config and requirements. This removes the legacy cloud requirements domain loader path, wires the bundle through app-server, TUI, exec, core config construction, hooks/network tests, and updates diagnostics/error handling to report cloud config bundle failures.\n\nKeep codex-cloud-config monolithic in this PR for review lineage. The follow-up PR is a pure module split that moves the same implementation back into focused files once the behavior diff has been reviewed.\n\nVerification: just fmt; just test -p codex-cloud-config; git diff --cached --check.

Clarify the app-server preload TODO now that bootstrap config preload failures can leave non-strict startup without installed cloud/thread config loaders. Store cloud config service paths as AbsolutePathBuf, use whole-object assertions in cache/auth tests, rename the cache test helper to create_test_service, and clean up the requirements loader docs and allocation per review feedback.

Update the remaining core connector test to use CloudConfigBundleFixture instead of the removed CloudRequirementsLoader path. Add the cache-test-local Path import after moving cloud-config service paths to AbsolutePathBuf so Bazel test compilation sees the type in module scope.

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from f9a036b to 7f490c5 Compare May 26, 2026 20:20

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch 2 times, most recently from 33f45ee to 78a0d84 Compare May 26, 2026 20:32

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch 2 times, most recently from 9f9cea6 to d38594c Compare May 26, 2026 20:46

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 78a0d84 to 438e65e Compare May 26, 2026 20:46

joeflorencio-openai marked this pull request as ready for review May 26, 2026 21:32

joeflorencio-openai requested a review from a team as a code owner May 26, 2026 21:32

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 438e65e to 194afd0 Compare May 26, 2026 21:37

chatgpt-codex-connector Bot reviewed May 26, 2026

View reviewed changes

Comment thread codex-rs/config/src/loader/mod.rs Outdated

Comment thread codex-rs/exec/src/lib.rs

Comment thread codex-rs/config/src/loader/mod.rs Outdated

Comment thread codex-rs/tui/src/lib.rs Outdated

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch 2 times, most recently from dc90f07 to da8a6d7 Compare May 28, 2026 19:52

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch 2 times, most recently from cc9ec27 to fae0096 Compare May 28, 2026 20:52

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from da8a6d7 to 4b922aa Compare May 28, 2026 20:52

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from fae0096 to ccc0c6a Compare May 28, 2026 20:56

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 4b922aa to b14d255 Compare May 28, 2026 20:56

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from ccc0c6a to ee9df4f Compare May 28, 2026 21:49

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from b14d255 to 81a9b2c Compare May 28, 2026 21:49

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from ee9df4f to 1f13fcf Compare May 28, 2026 22:11

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch 2 times, most recently from 2d4d4ea to f2b36ab Compare May 28, 2026 22:20

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from 1f13fcf to 4333622 Compare May 28, 2026 22:20

chatgpt-codex-connector Bot reviewed May 28, 2026

View reviewed changes

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from 4333622 to be7117f Compare May 28, 2026 23:54

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from f2b36ab to bd5f010 Compare May 28, 2026 23:54

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from be7117f to c4f0868 Compare May 29, 2026 00:21

github-actions Bot mentioned this pull request May 30, 2026

📊 AI CLI 工具社区动态日报 2026-05-30 zx0828/big_model_radar#77

Open

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from ce00443 to 9256aaa Compare May 31, 2026 18:28

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from a919f8f to 7be8ebe Compare May 31, 2026 18:28

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 9256aaa to 662d8ba Compare May 31, 2026 18:54

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from 7be8ebe to 7fe4768 Compare May 31, 2026 18:54

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 662d8ba to cd05603 Compare May 31, 2026 19:04

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from 7fe4768 to 3bd41f0 Compare May 31, 2026 19:04

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch 4 times, most recently from fb6482e to 2396470 Compare May 31, 2026 20:27

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from 3bd41f0 to bbf7c52 Compare May 31, 2026 22:11

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 2396470 to 8d67707 Compare May 31, 2026 22:11

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from bbf7c52 to fbfc181 Compare May 31, 2026 22:16

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 8d67707 to 42f2427 Compare May 31, 2026 22:16

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from fbfc181 to 06b8025 Compare May 31, 2026 22:55

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 1e185ff to a1729b9 Compare May 31, 2026 22:55

joeflorencio-openai force-pushed the dev/joeflorencio/cloud-config-bundle-transport branch from 06b8025 to 486805b Compare June 1, 2026 18:34

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch 5 times, most recently from ea0c385 to 3a5ae03 Compare June 1, 2026 23:30

Base automatically changed from dev/joeflorencio/cloud-config-bundle-transport to main June 1, 2026 23:43

joeflorencio-openai force-pushed the dev/joeflorencio/switch-runtime-cloud-config-bundle branch from 3a5ae03 to 4a1e94d Compare June 1, 2026 23:45

bolinfest approved these changes Jun 2, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jun 2, 2026

📊 AI CLI 工具社区动态日报 2026-06-02 litang9/big_model_radar#1

Open

joeflorencio-openai added 3 commits June 2, 2026 11:53

	let mut layers = Vec::new();
	let mut layers = Vec::with_capacity(managed_config.len() + managed_config_from_mdm.map_or(0, \|_\| 1));

Conversation

joeflorencio-openai commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joeflorencio-openai commented May 26, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joeflorencio-openai commented May 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joeflorencio-openai commented May 26, 2026 •

edited

Loading

github-actions Bot commented May 26, 2026 •

edited

Loading