Plug-and-play startup repair / 即開即用啟動修復

[DingDingChae]

🚀 Plug-and-play startup repair

Important

Work started at 2026-08-04T22:31:37-04:00 on main. The objective is a real one-action local start: a normal local user must not need to understand or supply an OpenCodex admission API key, while deliberate LAN exposure stays authenticated.

Current evidence

Check	Result
Repository update	Fast-forwarded main from dd425dc to �cf2e785; three pre-existing documentation edits were preserved.
Fresh source default	getDefaultConfig() selects the built-in openai forward provider and explicitly needs no provider API key.
Machine state	Saved bind is

[DingDingChae]

🧭 Coordination checkpoint

• Three independent read-only investigations are running: runtime reproduction, desktop/GUI onboarding, and setup/docs regression history.
• The canonical instruction repository currently has no open issues.
• GitHub Projects was checked once and is unavailable to the active repository account: gh project list --owner Ding-Ding-Projects returned missing required scopes [read:project]. Per project policy, Project mutations are skipped for this task; implementation and verification continue.

Note

Discussion #7 remains the rolling evidence record. No source change has been claimed yet.

🇭🇰 廣東話

三路調查已經開工：runtime、desktop/GUI onboarding、同 setup/docs 歷史各自獨立驗證。指令 repository 而家冇 open issue。GitHub Projects 因 active account 冇
ead:project scope 用唔到；呢單會照做實作同驗證，唔會為咗一格 Project 卡住架車。

[DingDingChae]

🔎 Root cause verified / 已確認根因

Important

This was two independent failures, not a missing upstream API key.

呢次係 兩個獨立故障，唔係少咗上游 API key；個畫面見到 key 就即刻捉錯賊，認真熱心但方向錯晒。 😅

Area	Evidence	Current state
Provider onboarding	Fresh config uses the built-in openai forward provider through the existing ChatGPT/Codex login, but Dashboard and onboarding treated only hasApiKey === true as configured.	Regression fix and focused tests in progress.
Local connection	Settings history commit 39c9d264fe73c72fe03c82c27134680bd300278a changed the bind from 127.0.0.1 to 0.0.0.0; non-loopback mode correctly requires an OpenCodex admission key.	Restored to loopback-only because this task requests local plug-and-play.
Windows startup	Port 10100 had an orphaned Windows TCP listener for a PID no longer present, while hard-pinned startup disabled the safe dead-row cleanup.	Moved the live service to 10101; source repair and regression coverage in progress.

✅ Live recovery evidence

• hostname: 127.0.0.1
• port: 10101
• /healthz: healthy, PID 28080
• unauthenticated malformed /v1/responses: HTTP 400 Invalid JSON body — it reached request parsing and did not return the admission-key 401
• Codex routing: openai_base_url = "http://127.0.0.1:10101/v1", with no env_http_headers admission-key entry

🧪 Local regression checks so far

33 passed, 0 failed across provider configuration status, blank ocx init selection, hard-pinned startup reclamation, and the full port-reclaimer suite. TypeScript typecheck is green.

廣東話總結：而家部機已經返到「撳掣就開」嘅本機模式，唔使 OpenCodex connection key；程式碼修復繼續緊，會防止 Dashboard 再將 ChatGPT login 扮成欠 API key，同埋唔畀 Windows 幽靈 port 再扮看更。 👻

[DingDingChae]

🧪 Fresh-profile runtime proof / 全新設定實機驗證

Note

Current state: implemented and under final verification on codex/plug-and-play-startup; not committed, merged, or released yet.

Evidence

Check	Verified result
Fresh isolated desktop profile	Application opened directly to the dashboard without an API-key setup prompt
Default provider	OpenAI (Codex login) rendered under Ready
Provider summary	1 Ready · 0 Needs setup · 0 Disabled
Runtime	Loopback proxy reported healthy; the public provider DTO reported authMode: forward, hasApiKey: false, configurationStatus: ready, configurationReason: forward
GUI suite	Full GUI suite exited 0; focused changed-surface suites are also green
Static/build gates	TypeScript, privacy scan, GUI production build, documentation production build, and whitespace checks are green
Docs output	186 pages built; 190 HTML files indexed and checked
Security review	No P0–P2 finding remained after provider-status, auth-surface, and non-terminating port-reclaim hardening

Review corrections already incorporated

• Public readiness never probes whether a chosen environment-variable name exists.
• Vertex ADC remains ready while its optional API key stays manageable.
• An inferred loopback/local display mode is not serialized onto an unrelated provider save.
• Windows TCP cleanup never terminates a process and fails closed for current, live, unparseable, or uncertain owners.
• CLOSE_WAIT/ESTABLISHED-only ghosts are evaluated from the fresh all-state snapshot even after the LISTEN row disappears.

香港粵語同步

今次唔係得個測試燈扮醒：全新獨立設定真係開到桌面版，OpenAI（Codex login）直接落咗 Ready，Needs setup 係 0，API key 提示終於唔再無端端衝出嚟做門神。🫖

而家只差完整 root 測試矩陣、最後兩輪獨立覆核、整合及遠端驗證；未完成之前唔會扮已出貨。

Recorded: 2026-08-04T23:33:07.9270661-04:00

[DingDingChae]

📚 Documentation surfaces synchronized

Note

Base-repository implementation is still uncommitted and under the complete root test matrix. This milestone covers external documentation state only.

• ✅ Repository website field now points to the canonical live site: https://opencodex.me/
• ✅ Canonical homepage and Quickstart both returned HTTP 200.
• ✅ Project wiki now documents the keyless ocx start → ocx codex path and separates ChatGPT login, optional upstream credentials, and the non-loopback admission key.
• ✅ Wiki commit 0f7bd1dd92d887c2d4d27bca33c3844996b48608 is verified on the wiki master branch.
• 🟡 Base implementation/release state: not yet committed, merged, or released.

香港粵語

Repo 網站欄已經指返正式 opencodex.me，首頁同 Quickstart 都係 HTTP 200；wiki 亦補齊兩步即開同三種 credential 分工。文件枱面執好咗，但 base code 仲跑緊完整測試，未會偷步扮出貨。📚🥟

[DingDingChae]

🚀 Main integration published / 已經合併到 main

Note

Verification state: running. The exact commit is on main; GitHub Actions has not been called successful yet.

Item	Evidence
Commit	b83d61e6512026ecf5ef3357e8c48387b4ae6496
Local provider/startup checks	125 focused root tests passed; 29/29 final Windows reclaim/security subset
Dashboard	874/874 tests, 10,221 assertions; build completed
Root tail matrix	1,030/1,030 tests across the explicitly captured final 78 files after repairing a 1-second subprocess timing flake
Static checks	TypeScript and privacy scan passed; diff check clean
Runtime	Real off-screen Electron launch: Online, 1 Ready, 0 Needs setup, OpenAI (Codex login), no provider-key prompt
Documentation	186 pages built; 190 HTML files indexed and checked
Wiki	0f7bd1dd92d887c2d4d27bca33c3844996b48608

What changed

The dashboard now consumes a server-authored provider configuration status instead of guessing that every provider without an API key is broken. ChatGPT/Codex forwarding, OAuth, local runtimes, loopback endpoints, and Vertex external authentication no longer receive a fake API-key setup prompt. Blank ocx init input selects the existing keyless Codex route. Windows port recovery no longer terminates processes and fails closed around live or ambiguous owners.

The old status logic was basically a nightclub bouncer charging localhost a cover fee. The guest list now has actual names on it.

香港粵語

今次已經將真正嘅 plug-and-play 修正合併到 main：ChatGPT/Codex 轉送、OAuth、本機模型、loopback 同 Vertex 外部認證，都唔會再畀 dashboard 屈佢「欠 API key」。空白 ocx init 會直接揀現成 Codex 路線；Windows 收 port 亦唔會亂掂生猛程序。

舊邏輯好似夜場看更見人就收不存在嘅入場費；而家終於識睇 guest list。CI 同 Squirrel release 仍然建置中，未有扮綠燈。

[DingDingChae]

🚨 Lifecycle regression investigation resumed

Important

A shipped Windows installation was found with fresh PID/runtime records but a dead process and an unreachable configured port. The proxy is healthy again after an identity-verified ocx ensure; the repository repair is still in progress, not yet pushed or CI-verified.

🚀 Work started

Field	Current value
Start	2026-08-08T13:34:19-04:00
Working branch	codex/fix-proxy-offline from origin/dev at c0ad57ad
Rolling record	This existing startup-repair Discussion
Current live recovery	/healthz verified on the configured local endpoint after ocx ensure
Remote state	No task commit or push yet

🔎 Evidence established so far

• Reproduced the externally visible state: PID/runtime files existed, the recorded PID was dead, and the health endpoint was unreachable.
• Restored the user's proxy with the detached, health-confirming ocx ensure path and rechecked ocx health --json successfully.
• Confirmed the earlier startup repair (b83d61e6) shipped in build-137; this report is a remaining lifecycle regression, not merely an unreleased fix.
• Found that the dev lifecycle path can stop an installed service and then spawn a direct child marked OCX_SERVICE=1. That child can later exit expecting a stopped supervisor to replace it, leaving routing pointed at nothing.
• Found that ocx service start currently prints success immediately after manager dispatch without proving /healthz came online.
• Found that detached ensure/tray starts hard-pin the configured port even though foreground startup already supports a safe alternate port.
• Implement the user's requested automatic fallback to another safe port when the preferred port is unavailable.
• Add the requested manual remote IP/hostname + port connection flow, with validation, accessibility, i18n, tests, and docs.

Planned repair contract

1. A start/restart command may report success only after an identity-verified OpenCodex health response.
2. Explicit restart must preserve service ownership: restart the installed manager when viable; otherwise start an ordinary detached process that never impersonates a supervisor.
3. A blocked preferred port must trigger a safe alternative-port selection where the endpoint can be synchronized, rather than a false started/offline result.
4. Remote connection accepts a user-entered IP/hostname and port, validates the endpoint, and makes connection state explicit.
5. Focused lifecycle and GUI regressions run before the full Bun, GUI, privacy, and docs gates.

Note

This is a process-lifecycle defect. The primary evidence is PID ownership, listener identity, /healthz, and automated tests; no request bodies, credentials, or account identifiers are being inspected or published.

廣東話進度 🥟

今次唔再俾個 service 撳完鐘就當自己返咗工：未見到真 /healthz，一律唔准報「started」。舊 port 塞車就安全轉第二個 port；直開 child 亦唔可以戴住 OCX_SERVICE=1 假扮有 supervisor，否則 supervisor 根本冇返工，個 proxy 仲喺門口等人接更，成件事荒謬到似茶樓派籌但廚房未開火。

手動 remote IP/hostname + port 連線亦已加入今次範圍；完成後會用真 build、真測試同真 CI 證據交代，唔會靠「應該得」三個字頂住先。

[DingDingChae]

🧩 Milestone — lifecycle matrix green; legacy dashboard cutover underway

Important

Everything described here is still branch-only, uncommitted work. No push, pull request, CI result, or release is being claimed yet.

✅ Lifecycle and fallback-port checkpoint

The focused lifecycle matrix now reports 208 passed / 0 failed across 12 test files. The implementation under test covers:

• explicit restart bypassing the autostart preference gate;
• preserving installed service ownership instead of replacing a stopped manager with an unmanaged child;
• removing the false OCX_SERVICE=1 marker from direct detached children;
• treating the configured port as a preference for automatic launches while keeping explicit --port, update restart, and in-place dashboard restart strict;
• recording the actual listener in runtime state without rewriting the configured preferred port;
• waiting for identity-correlated health before a service/direct start can report success;
• finding an already-live proxy even when the PID file is absent or unreadable.

Root typecheck passed before the final focused tweaks. A broader bun run test reached later API suites without reporting an assertion failure, then Bun 1.3.14 terminated on an internal assertion after 43.4 seconds. One clean retry is running; this is not being counted as a passing full suite.

🎨 User-requested hard cutover from the legacy dashboard

A genuine capture of the installed 2.11.0 runtime confirmed that it is still serving the legacy dashboard; this is not just browser cache. The requested response is therefore a hard Material 3 cutover, not another cache-busting patch.

The latest Material 3 GUI cannot be copied blindly: it spans 313 changed GUI paths and expects management routes that the current dev backend does not yet expose. It also comes from a line where management authentication was removed. The in-progress port therefore keeps dev's stricter same-origin, in-memory admin-session wrapper and is inventorying each required backend route rather than shipping decorative pages that fail with 404/401.

Current branch-only GUI work includes:

• the latest Material 3 shell and product screens replacing the legacy visual system;
• the manual IP/hostname + port connection flow;
• credential-free navigation using noopener,noreferrer;
• validation that rejects schemes, userinfo, paths, query/fragment syntax, ambiguous leading-zero IPv4, invalid host labels, and ports outside 1–65535;
• preservation of remote admin-token prompting in the destination tab instead of putting credentials in a URL or persistent storage.

The preliminary remote-endpoint suite reports 9 passed / 44 assertions. Full GUI build, lint, i18n, interaction tests, backend compatibility, and real hidden-desktop capture remain pending.

Why the old UI cannot remain as a fallback

Keeping both bundles would recreate the defect in a quieter costume: a healthy proxy could still serve whichever stale tree happened to be packaged. The target contract is one version-matched GUI bundle, a no-store HTML entry point, content-hashed assets, and an explicit build freshness gate so source changes cannot photograph or package yesterday's renderer.

廣東話摘要 🥟

Lifecycle 嗰邊而家 208 個測試全過：restart 唔可以熄完機就扮收工，service manager 邊個揸匙就由邊個開返，direct child 亦唔准戴住 OCX_SERVICE=1 假鬍鬚扮 supervisor。自動開機遇到舊 port 塞車會轉安全新 port，但使用者明確寫 --port、update 同 dashboard 原地 restart 仍然守死原 endpoint，唔會偷雞搬檔。

GUI 嗰邊已確認 2.11.0 真係仲送緊舊畫面，唔係 browser 鬧情緒。依家做緊完整 Material 3 換班：保留 dev 嚴格 admin auth，逐條補 backend contract，唔會整一排靚 tab 出嚟，撳落去全部 404，好似酒樓餐牌印金邊但廚房得熱水。

Verification state: focused lifecycle and endpoint tests are green; full repository/GUI/runtime/CI evidence is still running or pending.

[DingDingChae]

🧪 Adversarial lifecycle review reopened the repair

Status at 2026-08-08T14:25:41-04:00: branch-only, uncommitted, and not pushed. No CI or release result is being claimed.

The first lifecycle implementation passed its focused suites, but an independent read-only refutation found failure paths that the happy-path tests did not exercise. Work is continuing before any commit:

Severity	Confirmed gap	Required correction
P0	Service-manager stop errors could be swallowed and reported as stopped	Prove the manager is non-running; preserve the child and shared configuration when state is uncertain
P0	A failed proxy stop could still restore/strip client configuration beneath a live proxy	Gate every teardown on positive stop proof
P1	Concurrent starts could both pass preflight, then the bind loser could hop to a fallback port	Add startup serialization and re-probe OpenCodex identity on bind collision
P1	Service readiness could accept an unrelated direct proxy	Require manager-running evidence and a service-correlated identity
P1	Dashboard restart accepted the OS spawn event before replacement health	Require stable PID-correlated health for direct restart; require an actively viable supervisor otherwise
P1	Ordinary explicit-port startup could invoke Windows TCP-row deletion	Disable row deletion for generic start --port; reserve it for a positively identified stopped process
P1	Task Scheduler query failures could look like absence	Carry present / absent / unknown; fail closed on unknown
P2	Restart treated post-stop configuration warnings like an unsafe stop	Return a structured stop outcome and restart whenever manager/proxy stopping is proven safe

Material 3 and management API checkpoint

• The currently installed npm package @bitkyc08/opencodex@2.11.0 was inspected locally and genuinely contains the retired dashboard bundle. This is not being attributed to browser cache.
• The source dashboard now completes a production Material 3 build and emits ocx-gui-build.json with generation, package version, and a source-content hash.
• A package/runtime identity gate is under test so a missing, legacy, or stale dashboard cannot be silently packed or served.
• The authenticated compatibility backend is type-safe and has 139 tests / 1,026 expectations passing across 14 focused files.
• The new management-route auth matrix verifies missing and data-plane credentials receive 401; an admin credential reaches each protected family. Only the bounded one-time pairing claim intentionally bypasses management auth.
• Manual IP/hostname + port navigation, memory-only remote admin authentication, and noopener,noreferrer behavior are in focused GUI testing.

粵語進度 / Cantonese progress

第一輪 lifecycle 修補雖然 focused tests 全綠，但獨立反證 review 捉到幾條真實失敗路徑：service manager 停唔到時仍有機會被當成功、兩個同時 start 可能各自開一個 proxy、dashboard restart 亦只見到 child process 出世就當健康。呢啲未修妥之前唔會 commit、push 或報 CI 成功。

Material 3 方面，source build 已經成功，backend auth matrix 亦有 139 個 tests / 1,026 個 expectations 通過；而家繼續跑完整 GUI gates，同時加 build identity 防線，避免舊 bundle 再扮新 dashboard 出貨。

Next evidence gates

• Failure-mode lifecycle regressions pass
• Full GUI tests, lint, i18n lint, and production build pass
• Root typecheck, privacy scan, and full suite pass without an assertion failure
• Real hidden-desktop capture shows the Material 3 dashboard and manual remote dialog
• Exact commit, push, and remote CI evidence are posted separately

[DingDingChae]

🔐 Branch-only milestone — security review closed the obvious trapdoors

Important

Status at 2026-08-08T14:49:16-04:00: all work below is still uncommitted and unpushed on codex/fix-proxy-offline from base c0ad57ad. This is evidence of local progress, not a release claim.

What changed

Area	Branch-only result
GUI identity	The package gate now hashes shared/m3/** as well as gui/**; a changed shared tab/theme primitive can no longer ride beside a stale bundle wearing a valid badge.
Static serving	Only the package-owned gui/dist can be served; sibling fallbacks and symlink escapes fail closed. HTML receives a per-response script nonce, restrictive CSP, nosniff, and no-referrer.
Dashboard privacy	The 1% dim-sum card is now offline emoji art. A decorative dumpling no longer phones an image host from a credential-bearing dashboard.
Export safety	API-key exports contain no secret-derived prefix. A 12-character custom key is covered by regression and does not appear anywhere in the exported data.
Archive safety	Encrypted 7z requests are refused before spawn because 7-Zip would expose the password in process arguments. Every option is allow-listed and bounded; split-volume output is rejected by the single-file endpoint.
Remote machine actions	App launch/install and “open in VS Code” require a known, live loopback listener. An authenticated remote dashboard cannot turn its management credential into package installation or process launch.
Headless parity	Real ocx changelog, ocx export, ocx host, ocx launch, and ocx terminal resources now exist locally. Final dispatcher wiring is intentionally waiting for the lifecycle coordinator to release the shared switch block.

Verification so far

• ✅ Full GUI suite: 897 passed / 0 failed / 10,343 assertions.
• ✅ GUI lint, TypeScript build, production build, and i18n lint.
• ✅ Backend + M3 focused matrix: 221 passed / 0 failed / 1,363 assertions.
• ✅ Packaging/header focused matrix: 9 passed / 0 failed; offline dim-sum matrix: 9 passed / 0 failed.
• ✅ New headless-command smoke: 3 passed / 0 failed / 20 assertions.
• ✅ Root typecheck, privacy scan, and git diff --check.
• ⏳ Lifecycle adversarial matrix, integrated full root suite, isolated port-fallback smoke, package smoke, real after-capture, commit/push, and CI remain pending.

粵語進度 / Cantonese progress

今輪唔係幫舊介面搽脂粉，而係將幾個真正危險嘅窿封實：共享 M3 原始碼而家會影響 build identity；隔籬目錄唔可以扮自己係 dashboard；裝 app、開程式同 VS Code 只可以由已知 loopback listener 做；7z 密碼亦唔再坐喺 process arguments 度周街遊。連隻 1% 點心都改做離線 emoji——一隻蝦餃唔值得向第三方報到。

不過現時仍然只係本地分支，未 commit、未 push、未過完整整合測試，所以未可以扮畢業禮。下一步係收口 lifecycle 測試、接好 CLI dispatcher，再做真正 blocked-port、stop/restart 同 package smoke。

— Automated collaborator update; no credentials, machine paths, or private runtime state included.

[DingDingChae]

🧪 Final refutation reopened three lifecycle edges

Important

This checkpoint describes uncommitted branch work. Nothing below has reached dev, and the user's currently healthy proxy has not been stopped or replaced.

What is already verified

Lane	Evidence
Automatic port fallback	A real two-process Windows regression leaves the foreign preferred-port listener untouched, preserves the configured preference, and permits exactly one fallback OpenCodex daemon.
Original lifecycle repair set	413 passed, 0 failed across 23 focused files, including stop/restart ordering, manager ownership, service readiness, dashboard recycle, and Windows scheduler diagnostics.
Material 3 cutover	898 passed, 0 failed in the full GUI suite; lint, i18n lint, TypeScript, production build, build identity, privacy, and CSP gates are green.
M3 backend and security	221 focused tests passed; management authentication remains mandatory, remote machine actions are loopback-gated, exports reveal no key-derived substring, and unsafe 7z password transport is unavailable in both API and UI.
Headless parity	Five real CLI resources are wired and documented; 17 focused tests passed. Full-state backups refuse stdout/overwrite and harden an empty destination before the first secret byte is written.

Three concrete lifecycle blockers found by the final read-only refuter

1. A crash after creating—but before completing—the startup-lock owner file can leave a zero-byte/partial record that no later start can reclaim.
2. PID-less legacy health can inherit a supervised marker from runtime state and be accepted as a service-owned replacement without PID correlation.
3. One native WinSW installation path still collapses an unknown Task Scheduler query into “absent,” risking two installed supervisors.

All three are now assigned with focused regressions. The frozen full-suite run was deliberately stopped because continuing it against code already known to require changes would produce misleading evidence.

Deployment finding: same npm name, different product line

The installed upstream CLI and this fork currently share the same npm package identity. A same-name global tarball installation is therefore revert-prone: npm can reinstall the upstream latest, and the interactive updater points at that feed.

The safe urgent cutover will use a versioned portable fork build outside node_modules, a stable wrapper, an integrity-checked rollback package, and explicit proof that ocx update is inert for that portable build. Separately, both updater paths are being changed to fail before any stop when a concrete registry version cannot be resolved.

Next verification gates

• Re-run the lifecycle refutation tests after the three fixes.
• Verify updater lookup failure never reaches tray, service, proxy stop, or replacement.
• Restart the full root suite from one frozen tree.
• Build and inspect the package; reject any legacy GUI asset/fallback.
• Run an isolated portable-install lifecycle smoke with a foreign preferred-port listener.
• Capture the real Material 3 dashboard and manual remote-connection dialog from that built artifact.
• Commit, push, open the integration PR, and report remote CI truthfully.

---

🧧 廣東話進度

今次最後反駁測試真係有料到：舊碼仲藏住三隻曱甴——半寫 lock 可以永久塞死啟動、冇 PID 都可以扮 service 仔、Task Scheduler 查唔到竟然當冇裝。三隻都已經捉到正，依家逐隻加測試再封門。

另外 npm 同名撞車都確認咗：直接全域安裝個 fork，遲啲可能俾 upstream latest 換返舊 UI，簡直係修好道門再自己開窗。今次會用可回滾 portable build 做安全切換；未證明晒之前，唔會扮完成、唔會亂停而家健康緊嘅 proxy。 🥟

[DingDingChae]

🚀 Pushed repair candidate / 已推送修復候選

The complete repair candidate is now pushed as
b9b632cdc60194dbe33e0a45cef7114f297e102a
on codex/fix-proxy-offline. The remote branch tip was read back and matches that exact SHA.

完整修復候選已推送到 codex/fix-proxy-offline，遠端分支亦已重新讀取確認，SHA 與本地完全一致。

What is now in the pushed commit / 已推送內容

Area	Verified behavior
Proxy lifecycle	Explicit restart no longer obeys the autostart preference gate; stop/restart preserve service ownership, fail closed on uncertain manager state, and require stable identity-correlated health.
Port recovery	Automatic launchers treat config.port as a preference and hop safely; explicit --port remains strict; foreign listeners are not terminated or reset.
Old dashboard	The legacy shell is removed and the package gate accepts only the Material 3 generation with a matching package/source identity.
Remote connection	The Material 3 shell accepts a manually entered IPv4, IPv6, or hostname plus port and opens the credential-free remote dashboard URL in a protected new tab.
Authentication	Same-origin in-memory admin sessions remain mandatory; remote dashboards prompt for the remote ADMIN credential; data-plane keys are not management credentials.
Headless parity	Changelog, export, host, launch, and terminal resources have documented CLI counterparts.
Security	Secret-bearing exports are redacted, custom sandbox keys cannot mutate live config, machine-launch actions are loopback-only, unsafe 7z password transport is disabled, and GUI static serving is package-owned with a restrictive nonce CSP.
Updater	Registry failures or malformed versions abort before service, tray, proxy, or package mutation and the install target is pinned to the resolved concrete version.

Evidence / 驗證證據

Test and build matrix

Gate	Result
Full root Bun suite	6,180 passed · 3 platform skips · 0 failed · 31,794 assertions · 453 files
Full GUI suite	898 passed · 0 failed · 10,340 assertions · 135 files
GUI lint / i18n lint / TypeScript / production build	passed
Docs build	146 pages built
Root typecheck	passed
Privacy scan after all new files were staged	passed
Cached diff check	passed

Real package and portable lifecycle proof

• npm pack produced 466 files with SHA-256
  97c40dfff0e71a84dc65fe7449486f7bab75398e87e091c6ffa975e50e962bd4.
• The archive contains uiGeneration: material-3, package 2.7.41, source hash
  sha256:93b7ac3a0d969731893405260a8b4d3d5ae34396315982cbea697b3f41703822.
• It contains only the new hashed GUI assets; the prior index-BynIEIV-… bundle and legacy source entries are absent.
• From an extracted versioned portable directory, a stable foreign HTTP service occupied configured port 54747.
• ocx ensure left that service alive and started OpenCodex on 57732; ocx host status --json reported 57732 while config.port stayed 54747.
• With codexAutoStart=false, explicit ocx restart still replaced the proxy successfully on 57742.
• Portable ocx update --yes correctly reported source-install handling and left the running PID unchanged.
• ocx stop removed only the OpenCodex PID/runtime/listener; the foreign service remained healthy until the isolated harness cleaned up its own process.

Visible baseline / 可見基準

The captured pre-repair installation below is the genuine legacy bundle that kept reappearing. A genuine post-repair capture is not claimed yet: the required cheap headless capture provider is not available inside the current agent session, so no substitute browser or mock image will be passed off as evidence.

Note

Next: open the dev pull request, let remote CI judge the pushed commit, record the required dev2-go follow-up, and perform the live portable handoff only with the verified rollback package ready.

Note

下一步：開出以 dev 為目標的 PR、等待遠端 CI 實測、記錄 dev2-go 對等工作，然後在回滾套件已驗證的前提下才進行實機 portable 切換。

[DingDingChae]

🔎 Review and integration checkpoint / 審核及整合進度

The pushed candidate is now PR #16, correctly targeting dev at commit b9b632cd.

Integration record	Current state
Pull request	Open, ready for review
GitHub Actions	Queued/running; no remote success claimed yet
Security label	security-review
Project #1 item	In progress
Native-port tracking	Issue #17, labeled needs-go-port
Required approval	Blocked by current reviewer permissions

Governance blocker

MAINTAINERS.md requires one maintainer approval and explicit security review. GitHub rejected formal requests for all three listed maintainers with HTTP 422 (“Reviews may only be requested from collaborators”); the repository currently exposes only read-level visibility for those accounts. The exact blocker is recorded on PR #16.

Warning

The PR will not be self-approved or merged around the documented policy. Remote CI and the live portable handoff can continue independently, but default-branch integration remains honestly blocked until an eligible maintainer approves or repository permissions are corrected.

PR #16 已正確指向 dev，Project #1 已標記為 In progress，而 dev2-go 對等工作亦已由 #17 持久記錄。現時真正 blocker 係 GitHub reviewer 權限，並非測試或程式碼；我唔會自行批核或繞過規則。

[DingDingChae]

🧾 Commit-identical package receipt / 與 commit 完全一致的套件收據

Important

Correction to the preceding package receipt: after the first archive was tested, the cached diff gate removed one trailing blank line from an M3 source stylesheet before commit. That did not change runtime behavior, but it did change the authoritative GUI source hash. The first archive therefore remains valid behavior evidence, but it is not the artifact selected for deployment.

The GUI was rebuilt from pushed commit b9b632cd, then packed and smoked again.

Final receipt	Value
Archive SHA-256	5c9740a0e1ee92585a488548cb4115506444ebe6ef2c613080b7e2feeb78cfc6
Package files	466
GUI generation	material-3
Package version	2.7.41
GUI source hash	sha256:71f63d1de518623462c0f4c23d73edb154c8782b44503379008400fe241234c6
Preferred foreign port	54749
Automatic fallback	54889
Explicit restart fallback with autostart disabled	54897
Portable update	Kept PID 15712 unchanged
Foreign service	Stayed alive through ensure, restart, update, and OpenCodex stop

The PR body now carries this corrected final receipt. Earlier comments are intentionally left intact as chronological evidence rather than edited into a different past.

第一次 archive 做完 smoke 後，cached diff gate 再清走咗一行純空白；功能冇變，但 source hash 會變，所以我重新由已推送 commit build、pack 同 smoke。上表先係最終可部署收據，之前紀錄保留作時間線證據，唔會偷偷改寫歷史。

[DingDingChae]

🧾 Yum-tong preservation checkpoint

This shutdown pass has preserved and pushed the recoverable work without claiming integration:

• Packaging repair: 8e4abba on PR fix(proxy): recover lifecycle and retire the legacy dashboard #16’s branch.
• Pricing correctness: 9534e27.
• Copilot Desktop/API Access: 2e4a054.
• Global-memory/update docs: 4551ee4.
• Windows user-PATH repair: 031e993.

Local gates for the substantive lanes are green where run: focused tests, typecheck, privacy scans, GUI lint/i18n, and the docs build. The main integration is not yet safe: origin/main and origin/dev diverge with conflicts, PR #16 needs maintainer/security review and a Go-port handoff, PR #14 still lacks fresh final CI/capture evidence, and open Pages/Go-port issues remain. Remote workflows for the new pushes are still in flight; no release or green default-branch verdict is claimed.

廣東話

今次 shutdown pass 已經保存同 push 晒可復原工作，但未扮 integration 完成。各 lane 都有真 commit 同本地 gate 證據；main/dev 仲有實際 merge conflicts，PR #16 要 maintainer/security review 同 Go-port handoff，PR #14 仲欠 final CI/capture，Pages 同 Go-port issues 亦未收口。新 pushes 嘅 workflows 仲行緊，未有 release 或 default branch green 結論。