You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
admin: show a websocket delivery receipt's completed item count and failed write in the request-log drawer (8088803)
admin: show the highest frame class of a websocket delivery receipt in the request-log drawer (c9ec66f)
alerts: name bounded assignment state counts in incident detail and delivery summaries (1843ef4)
catalog: serve Codex catalog entries without the mirrored base_instructions to clients that read the instructions template (cc8dff5)
dev: add mix dev.pool_serving_override to set a model's Full/Lite mode on a named Pool (c907b31)
dev: enqueue the Pool catalog sync after a bundle import with --sync-catalog (94476da)
dev: let fixtures target an explicit loopback database and an in-cluster fake upstream (75fa81f)
dev: point seeded synthetic identities at a configurable fake and seed a dedicated real-traffic Pool (adc5601)
jobs: log one bounded warning line for every failed or discarded Oban job (395c007)
quota: delete account quota windows whose reset passed more than 30 days ago in runtime state cleanup (718e3c1)
telemetry: count native compaction admission clears by reason, stage and topology (79649fc)
upstreams: let an operator clear a provider-requested usage polling pause, audited (d75061f)
upstreams: log a warning when a provider Retry-After pauses usage polling for over an hour (70baa9a)
upstreams: show a provider-requested usage polling pause on the admin account card (18fe999)
upstreams: show the usage polling pause notice in the upstream cockpit (52ffa91)
websocket: log how long a socket session cleanup that outlived the socket's 100 ms wait took, under the socket's request id (c49818a)
websocket: log why an upstream websocket connection closed between requests (153f69a)
Bug Fixes
access: advance an API key's runtime epoch when an edit changes a policy field its open websockets read at the upgrade (220eb34)
access: delete an API key with a large history in background batches and audit the delete with it (8754f45)
access: keep every API key policy field an update omits instead of resetting it to all models, no enforcement and no limit (1f0d590)
access: normalize and validate the key-row policy fields Access.update_api_key receives through the policy merge (9f02de6)
access: refuse binding limits on the key-row Access.update_api_key path instead of ignoring them (c002d08)
accounting: admit a websocket turn's resend after a provider terminal failure on its turn claim with owner forwarding off (598d576)
accounting: admit the byte-identical resend of a websocket turn interrupted before any visible output (21b89b6)
accounting: admit the full resend after a previous_response_not_found refusal whose client closed the socket (2e43aa8)
accounting: admit the resend of a turn-opening websocket request after a provider stream cut before any completed output (2d41e41)
accounting: admit the resend of a turn-opening websocket request whose client left before any output (dcb3704)
accounting: chain a forwarded resend onto a client-retry successor cut before output (2cb2810)
accounting: close the forwarded chain behind an HTTPS fallback so a later websocket resend is not a second generation (60da5bc)
accounting: count a capped key's live requests for max_active_requests instead of reading its whole reservation history (02ea0d9)
accounting: count pending window tokens from a key's live requests, not every reservation it never released (c248f07)
accounting: end the reservation limit windows at the key's latest future-dated ledger entry (329a75f)
accounting: give the HTTPS fallback of a native websocket turn the websocket request's resend witness (f0ed6ca)
accounting: hold only the node a turn resend chains onto to the client-retry window (99f6abb)
accounting: judge a resend arriving mid-settlement against the turn its settlement writes (629f111)
accounting: keep a websocket delivery receipt the socket recorded before the attempt was finalized (cae4d9a)
accounting: let a turn-claim resend chain past the chain's own client-retry links (dc138e5)
accounting: make the request-log model index partial so Pool-only queries cannot pick it (0be14fa)
accounting: rebuild every recent day whose daily rollup coverage is missing or incomplete (5bd8574)
accounting: record a second websocket refusal without a turn claim under its own correlation id (687a8e8)
accounting: refuse a forwarded resend whose predecessor carries two retry links instead of raising (dff13ff)
accounting: refuse a request whose own estimate exceeds a daily or weekly key token window as a per-request 400, not a 429 with a reset hint (241d0ac)
accounting: report a served native HTTP chain node as the turn's terminal predecessor (9b1ec34)
accounting: serve the resend of a completed websocket turn the socket pushed nothing of as one successor (908a057)
admin: bound the cockpit recent-event walk to each assignment's newest 10,000 attempts and say so when older attempts were not read (46e8927)
admin: carry an API key's stored labels and every model override through the edit form (2303348)
admin: keep an empty API key operator note empty instead of saving the edit form's No notes placeholder (e0abe02)
admin: patch a Pool or upstream account filter the viewer lost out of the Request logs and Audit logs URLs (965f7bc)
admin: patch an incident filter or Pool filter the viewer lost out of the Alerts and Invites URLs (41ecf79)
admin: re-read the request logs, API keys, upstreams, stats, operators, jobs and system pages when the viewer's role or Pools change (f1b5c31)
admin: re-read the upstream cockpit, audit logs, alerts, invites, incidents and settings pages when the viewer's role or Pools change (cfadb70)
admin: reactivate a disabled or archived Pool from its card menu (ec77bda)
admin: reload the notification center on an unknown notification message shape instead of crashing the page (59ce15f)
admin: reload the notification center on the previous release's bare invalidation message (a51154a)
admin: reload the Pools page and its permissions when the viewer's role or visible Pools change (95d9e09)
admin: show a requested priority tier echoed as default as priced at priority in request logs (d49ddc5)
admin: show the reset a terminal usage-limit answer advised in the request-log list and drawer (cc4e054)
alerts: alert once for every new banked saved reset instead of once per upstream identity (5ba25a7)
alerts: carry notification center invalidations over the postgres relay (054cc70)
alerts: invalidate an operator's notification centers when their Pool assignments or role change (2409a42)
alerts: invalidate notification centers on a Pool status change and resubscribe them to the Pools their viewer can see (6d80cd3)
alerts: invalidate the notification centers of the Pools a rule or Pool delete cascades incident targets from (aedcb13)
alerts: judge unscoped quota-state rules by served models and report model_not_served for an unserved rule model (a770be6)
alerts: keep the notification center's subscribed Pools as a sorted id list so dialyzer accepts the subscription diff (2f99fb3)
alerts: reload a notification center once per incident invalidation across shared pools (7360fe7)
alerts: resolve incidents left with no rule target on the scheduled evaluation pass (dc4b2bd)
alerts: scope unscoped quota threshold rules to served models and keep unserved-model thresholds clear (92e0c39)
alerts: subscribe the owners' open notification centers to a Pool created while they are open (b25b93f)
audit: audit each upstream account the Pool editor assigns or unassigns (1a3f2f3)
audit: count audit events at most 10,000 rows past the offset on the Audit logs page and the MCP list tool (f123cee)
bridge: answer a pre-output provider usage limit on a bridged /v1 stream as its HTTP twin, failover included (f6a886e)
catalog: leave out a served Codex model entry the requesting client cannot decode instead of letting it discard the whole Pool catalog (ff0fb58)
catalog: select a catalog representation from a User-Agent only when it is a Codex build's (08bde33)
catalog: select the served catalog representation from the request User-Agent on /models as on every turn (96e6d88)
continuity: take an expired, unrenewed HTTP session lease over at the synchronous renewal and record owner refusals (6cd9164)
deps: update dependency daisyui to v5.7.43 (#427) (5a29f78)
dev: accept the optional upstream base URL in the full seed's run contract (87e47af)
dev: close the run key's unredeemed replay entitlements before the compaction fixture releases (07c0aca)
dev: declare the provider's Fast tier on the full seed's gpt-6 source assignments (ea04495)
dev: declare the provider's service tiers on the Codex compaction fixture model (00517c6)
dev: declare the provider's service tiers on the OpenAI v1 fixture's gpt-6 text models (ec91840)
dev: disable background jobs before mix dev.mcp_fixture boots the application (81450e1)
dev: disable background jobs before the fixture and seed tasks boot the application (c6b02c1)
dev: import upstream account bundles as access-token-only copies by default (12dc83d)
dev: let the QA phase supervisor end the phase from the cap marker so a TERM the wrapper never acts on cannot defeat the cap (ff2057a)
dev: name the model slug in the perf seed's per-source metadata so its Pool routes (2ab525a)
dev: repeat the QA phase cancellation TERM until the supervisor has exited (80ee3ca)
dev: seed the full profile's expiry fixtures with an access token only (7377f6c)
dev: serve a Codex-decodable model entry from the compaction smoke fixture Pool (7c79aa8)
dev: serve the OpenAI V1 fixture catalog as entries the released Codex client decodes (d6013b3)
dev: watch only this checkout's web, asset and translation directories for live reload (1915204)
events: deliver relayed pool and status notifications once per node (15f20e2)
events: listen again when the postgres notifications process restarts (2bc7263)
events: skip a postgres notification whose relay raises instead of exiting the bridge (225c03c)
finalization: advise the Pool's soonest return on a relayed provider usage-limit 429 (2dea067)
finalization: answer a provider usage-limit 429 on the last candidate with the terminal usage_limit_reached and its reset (1a8c2bd)
finalization: answer a relayed native 429 with the tokens the released client classifies it by (11fbb59)
finalization: read the invalid previous_response_id message at runtime so Metadata keeps no compile-time dependency on ErrorCodes (e1d7b99)
finalization: record a provider usage-limit 429 as the account's quota denial and keep it out of route health (3dc8cfa)
finalization: relay the provider's unsupported-parameter detail body as unsupported_parameter with its param (fa9cdb4)
finalization: send Retry-After with a relayed native 429 that names its reset (be73365)
gateway: accept native websocket turn metadata up to 256 KiB so a client's tool inventory does not refuse its turns (cad028c)
gateway: acknowledge a delivered local owner turn as completed when its completion arrives during socket termination (ff70790)
gateway: admit the Codex 0.156.0 post_turn compaction phase on the native websocket (aa7c50b)
gateway: align the compaction resend terminal codes with the Codex 0.156.0 retry classification (3754d56)
gateway: answer a final native HTTP provider 4xx refusal as the Pooler-authored 400 naming its status (9e1aab2)
gateway: answer a key policy denial no resend can pass, model_not_allowed and the per-request estimate caps, 400 invalid_request_error instead of 403 (7807e3d)
gateway: answer a native non-relayable provider 400 with the Pooler-authored refusal error instead of an empty body (c1d159a)
gateway: answer a native non-streaming validation rejection with the Pooler error and relay a Chat input path as messages (8ac695e)
gateway: answer a provider 4xx refusal on the websocket-bridged /v1 stream like the HTTP path (e8e7e66)
gateway: answer a transient database failure before dispatch with a retryable 503 (8bdbb04)
gateway: answer a transient database failure in request preparation, the websocket turn claim and the replay intent with a retryable 503 (44b7e29)
gateway: answer an API key policy window refusal 429 with its retry hint and a per-request cap 403 on every transport, and give a forwarded retry successor the same refusal (5e1bc65)
gateway: answer the HTTP resend of an HTTP turn refused with a validation 400 with that refusal instead of dispatching it again (cbb965a)
gateway: answer the HTTPS resend of a finally refused websocket turn with its refusal before reserving (12df91d)
gateway: arm a pre-visible owner turn's replay before the closing socket drains its response tasks (e019949)
gateway: cap the websocket owner's lease renewal at a third of the ttl and bound the renewal setting by it (7802acb)
gateway: classify a response.incomplete naming a spend or credit limit as a failed turn (071589e)
gateway: clear an admitted compaction once when its reservation loses the database (ab5aea0)
gateway: close reconnectable Codex sessions retired past the expired-alias retention in runtime cleanup (4aad9ba)
gateway: derive the owner's own turn descriptor under the thread claim scope and refuse replay controls against it (443077c)
gateway: derive the provider session-id from prompt_cache_key on native HTTP routes when the client sends none (2bb8d34)
gateway: derive the provider session-id from the local continuity alias on native HTTP routes when there is no prompt_cache_key (43e2067)
gateway: drop a call item's own call_id used as its id from a replayed /v1 Responses input item (9ac037d)
gateway: fence a bridged /v1 turn's continuity by the owner lease it took over (431f06a)
gateway: keep a remote owner's native compaction admission refusal instead of reporting a crash (6d90f0c)
gateway: keep websocket terminals refused with invalid_value, invalid_type or string_above_max_length health-neutral (abeeaa2)
gateway: label the owner's native compaction admission clear on client detach and cancel (c695f65)
gateway: log a refused reconnect socket's no-op owner-detach cleanup at info (67a5b3d)
gateway: make a resume admitted by the native compaction runtime proof hold its durable resume claim (946a986)
gateway: name the bounded reason on the continuity registration failure line (fef99f0)
gateway: name the cause of every direct upstream session native compaction admission clear (a98895c)
gateway: name the cause of every owner-side native compaction admission clear (b78abb4)
gateway: name the code the client received on the owner websocket replay rejection line (a4e72b3)
gateway: pin an input_image file_id the Pool bridged to the assignment holding the file (062cb31)
gateway: re-key a steered turn request only when it is further along the turn than the claim's holder (c9c1cb3)
gateway: read the remote admission refusal vocabulary from NativeCompactionAdmission instead of a forwarder copy (08043bb)
gateway: read the websocket rejection terminal frame without a clause dialyzer proves unreachable (852e259)
gateway: record a route failure for an HTTP 5xx or 429 on the last candidate and the compact route (069f0ba)
gateway: record a terminating socket's delivery receipt where the task takes its acknowledgement (eff6416)
gateway: record one downstream delivery receipt per response task when a socket terminates (b05c880)
gateway: record provider rejection fields on native websocket attempts refused with a wrapped 4xx (4f401d1)
gateway: record the reset a terminal usage-limit answer advised on its row and log line (b7ba9ca)
gateway: relay a validation rejection's input index in the client's own positions (2dc4eaf)
gateway: relay only the public Responses event vocabulary on the /v1 Responses SSE stream (04b9eb4)
gateway: relay only the public Responses event vocabulary on the public /v1/responses websocket (6c43dbd)
gateway: release a collected owner delivery without waiting for an owner completion that never follows (0569951)
gateway: resolve a half-open circuit probe answered by an HTTP client error instead of leaving it in flight (6fd441c)
gateway: send a provider 4xx refusal to the public /v1/responses websocket as the HTTP path's error event (41c7152)
gateway: serve a steered request of a native HTTP turn and chain an identical HTTP compaction resend (062d830)
gateway: serve a steered request of a turn sent as full history on a new websocket or over HTTPS after a websocket opener (10fd3fa)
gateway: serve the released client's resend of a compaction it never completed as one chained successor (fa55ea1)
gateway: stop an owner lease renewal that outlives its budget from disconnecting more pooled connections (14e39c2)
instance-settings: invalidate every role's settings cache through a Postgres NOTIFY (bdec68e)
jobs: announce a failed Pool or API key deletion after Oban writes the job's final state (42c8b1a)
mcp: count request logs at most 10,000 rows past the offset and say whether the total is exact (a43d9a3)
migrations: cancel a migration lock wait only while the backend is still in the sampled wait (078f40b)
migrations: say which blocking-session fields another database role hides instead of printing unknown (9fb74e7)
migrations: wait out older transactions for concurrent index builds and name the blocking sessions (aaed8bb)
onboarding: hand out the documented Codex provider config with model_catalog_url and api_key_model_discovery (1fa1495)
openai: accept an input_image file_id in /v1 tool output and a detail on a marked message image (f0291ed)
openai: carry a Chat image_url.detail into the input_image and refuse one outside the provider enum (0aabb4e)
openai: carry and validate image_url.detail in /v1 role tool items and Cline tool-result images (dfa51af)
openai: carry the image_url parts of a Chat tool message into the function_call_output (b6f92d1)
openai: drop a null detail from a /v1 message input_image as from a tool-output one (4bd7909)
openai: forward a /v1 tool-output input_image detail on Full and refuse one outside the provider enum (467d93f)
payloads: send the declared Lite prefix on a request anchored on a response served in Full (b0f0ae9)
payloads: send the Lite tools manifest and instructions only on a request that opens the provider context (def8579)
platform: stop heartbeat writes that outlive their budget from disconnecting a second pooled connection (ffd48fb)
pools: delete a large archived Pool in background batches and audit the delete in its own transaction (06c45a7)
pools: name the deletion worker with a literal so the Pool deletion context has no compile-time dependency on it (50a4d53)
pools: type the deletion request's errors as the atoms and terms it returns so the Pools facade's error mapping type-checks (5e98003)
pricing: keep a requested priority tier when the Codex backend echoes default (ef4bdde)
quota: drop expired rows from a logical window while a sibling reports a future reset (3e71e3a)
quota: ignore quota windows past retention on every read surface so decisions never wait for the prune (995c3f0)
quota: measure a newer relative claim's countdown against the kept reset in the usage-with-existing-reset merge (82f2db8)
quota: measure a same-cycle usage poll's countdown against the pinned reset instead of keeping the stored one (1d39b1d)
quota: prune expired quota windows whose saved-reset confirmation marker has lapsed (1199567)
reconciliation: count stale and expired priming evidence on the effective quota view (5e297b5)
resets: let the automatic trigger scan read the confirmed Usage API view the lock reads (1ce7054)
routing: advise a provider-blocked account's exhausted-window reset and the soonest reset of an all-exhausted Pool (e5305aa)
routing: advise a workspace-denied account's earliest fresh reset instead of the marked row's (c620b1d)
routing: advise Retry-After on circuit refusals raised after route filtering and on the file route (7325f51)
routing: advise Retry-After until the earliest open circuit probes on a Pool's retryable 503 (2e916fb)
routing: answer an all-exhausted Pool with the provider's terminal 429 usage_limit_reached and its earliest reset (978966c)
routing: exclude an account a provider usage-limit refusal names until its reset, whatever the reached type (cebc53b)
routing: exclude an account the provider refused at workspace level from every model and Pool on the first 429 (9eb90b6)
routing: move a native turn to a held-back partition once when its selected partition runs out on a provider usage limit (3db85e9)
routing: name a blank, oversized or non-string prompt_cache_key in the locality reason instead of prompt_cache_key_absent (122a956)
routing: read the valid canonical assignment ids the pre-dispatch pass always sets, without the unreachable nil fallback dialyzer flags (0e90cfb)
routing: record route_excluded for a prompt_cache_key sent to a route that never seeds locality (bca7988)
routing: record websocket_transport as the locality reason of a websocket turn instead of prompt_cache_key_absent (77188c4)
settings: bound the owner lease ttl by one pre-dispatch statement plus the synchronous renewal (ebabe3e)
settings: drop the unreachable fallback clause of the owner lease renewal clamp log that dialyzer flags (9e5869d)
status: reload the admin status view when a freshness event names a newer revision (747b0dc)
streaming: announce a withheld SSE preamble to the Codex idle timer with one keepalive data event (dcee0c6)
streaming: frame a multi-line upstream websocket text as one SSE event on the HTTP SSE bridge (fe1ef8e)
streaming: stamp a native HTTP turn visible on the first output it shows the client, not on a withheld preamble (e28d369)
upstreams: scope the usage polling pause to the provider account instead of the credential epoch (41c4aad)
v1: answer an anchored /v1/responses request that cannot reach its producing connection with previous_response_not_found (deddcc2)
v1: type a redacted upstream 429 as rate_limit_error instead of server_error (1696532)
v1: type a redacted upstream 4xx refusal as invalid_request_error instead of server_error (52d6bc4)
v1: type the masked public websocket failure of a provider 429 as rate_limit_error (86c1d60)
web: choose the dev dashboard routes at compile time so dev Dialyzer stays clean (8405ce6)
websocket: admit the released client's anchored pre-turn compaction under the admission its previous turn armed instead of refusing it 503 (e48cde2)
websocket: answer a closing socket's early owner detach without waiting for an owner still starting its upstream (c00ebff)
websocket: answer a deferred final compaction turn on the active-turn reconnect route through the ordinary owner preflight instead of refusing it 503 (280c0f3)
websocket: answer a finally refused turn's resend with its refusal on the direct websocket turn claim too (1d7bc34)
websocket: answer a provider usage-limit frame on the last candidate with the terminal wrapped 429 and the Pool's advice (adc04a9)
websocket: answer invalid_model in the replay preflight for a disallowed model the Pool lists but does not serve, as HTTP does (6e9ca76)
websocket: answer the provider's codeless invalid previous_response_id refusal with previous_response_not_found and admit the client's full resend (5c50894)
websocket: answer the resend of a turn whose provider refusal was final with that refusal instead of duplicate_turn (d6993f5)
websocket: apply a closing socket's own detach that reaches the owner after the socket's exit, instead of refusing it stale_downstream (d3a901f)
websocket: arm a closing socket's pre-visible replay without a database read and fail a stalled arm instead of stopping the owner (72d071e)
websocket: bind a queued resend's owner replay intent when the preflight names its predecessor (ea88372)
websocket: clear a native compaction admission armed for a socket another socket replaced at the owner (c367a8b)
websocket: complete an unknown-code provider 4xx refusal health-neutrally like its HTTP answer (0a31e44)
websocket: defer the owner-forwarded turn interrupt of a closing socket that already pushed its task's terminal (8f43cab)
websocket: drop the admission-answer branches dialyzer proves unreachable for atom refusal reasons (1877461)
websocket: fence a closing downstream the owner accepted nothing of so its resend is served on the first retry (a2a7aeb)
websocket: fold an owner admission refusal outside both vocabularies into invalid_transition at the owner's node (745cf73)
websocket: forget a finished response task's model without adding the key to socket state (31e6538)
websocket: give a native turn queued behind the previous turn's task the owner replay binding when it is dequeued (b001ce4)
websocket: give a remote owner detach the owner's call budget so a slow replay arm is not read as a lost owner (3d18cb1)
websocket: give the remote owner role probe the owner call budget and probe only the owner node (db0eb27)
websocket: give the remote V4 replay reconciliation the owner call budget (4e4dc16)
websocket: give up the request claim of a row closed before anything reached the provider, instead of fencing every resend (92a0097)
websocket: keep a turn pre-visible until output or a terminal reaches the client, not on response.created (601ebc9)
websocket: keep a turn whose terminal already reached the downstream when its socket detaches so its own result settles it (70093f8)
websocket: key a native compaction the socket queued behind the settling turn from its admission binding, so the owner never runs it as an unknown turn (4530ea2)
websocket: lead a turn frame's newer window to the socket's session so a cut turn's reconnect redeems its replay (fdb0719)
websocket: let a different turn from the session's next socket retire an armed pre-visible replay (5e756c3)
websocket: let a direct task whose terminal the socket already pushed settle its own turn when the socket closes (2136ec2)
websocket: let a full-history turn carrying the provider's compaction checkpoint leave an exhausted account like its HTTPS fallback (91befe5)
websocket: let a request frame wait for the upstream websocket session instead of a fixed one-second call bound (0d1d687)
websocket: let cancel_remote_downstream accept the per-call downstream the abandon fallback passes (f7f44db)
websocket: let the released client's first retry of a compaction whose socket already closed take the running compaction over, and let a same-claim resend with owner forwarding off wait for its running predecessor (d4b1f20)
websocket: let the released client's retry take over a collected full-history compaction whose socket already closed, instead of meeting the owner busy until that socket's detach (acb2d68)
websocket: let the replacement socket that already attached reattach to a lost owner generation (3ab3333)
websocket: log a witness-less owner-detach interrupt of a socket cut before its turn started as routine (844e7b8)
websocket: log every refused native compaction reservation with the owner's cause, whichever route decided it (d8db3eb)
websocket: log the native compaction deferral stage when the dequeue refuses a deferred turn whose owner could not be asked (91dd5e7)
websocket: name quota_rejection and advanced_http_resume on the client resend admission line (47ade1e)
websocket: never arm a native compaction for replay, so its cut settles and its resend is chained (f1a26d0)
websocket: ping the upstream websocket while a submitted turn waits for the provider (f7b8102)
websocket: recognise the released client's full-history resend of an anchored turn as the same request (cd57d36)
websocket: record a delivered receipt for a public websocket turn whose completed terminal reached the client before it closed (f38ef8c)
websocket: record a delivered receipt for a turn whose completed terminal a terminating socket already pushed (d25f8a5)
websocket: record a delivery receipt from what was written before the connection's first failed write (023e760)
websocket: record a refusal made before a request's claim under the socket's request id, never under the claim it would fence (7e08ad4)
websocket: record a timed-out remote response.processed forward as failed with an unknown upstream delivery (55da5a0)
websocket: record an admitted native compaction under the claim its full-history resend derives (86e7403)
websocket: record and log a model the key or the Pool refuses in the owner's replay preflight, after its rollback (bdaeece)
websocket: record provider rejection fields for a multi-line error frame and never a Pooler-derived code (1561aaa)
websocket: record the 429 a websocket usage-limit refusal answered, with its advised reset, and log it (3451871)
websocket: record the receipt of a socket-authored error frame after Bandit wrote it (5d19843)
websocket: record the requested, effective and enforced model on a replay-preflight model refusal as the fresh path does (09e72c8)
websocket: refuse a native anchored turn whose connection last served the other Full/Lite mode (eca88af)
websocket: refuse a non-finite remote turn budget override at the dispatch boundary (33033fd)
websocket: refuse a remote turn submission that reaches the owner after its abandon (e7adcae)
websocket: refuse a timed-out turn submission whose abandon found no owner registered on the owner node (8372a90)
websocket: refuse an incremental compaction the owner granted no admission before dispatch instead of billing it and wedging its turn (6e4481b)
websocket: refuse only a Lite anchored turn on a connection whose last response was served in Full (7697a51)
websocket: relay a withheld-advice usage limit classified on the websocket and redacted with its circuit wait on /v1 (c476c0c)
websocket: release a turn claim whose reservation rolled back instead of leaving it to fence every resend (bdeffd4)
websocket: reopen a public /v1 turn's owner leg for the task's failover attempt so its frames and commit probe are answered at once (a09dbf4)
websocket: run a deferred final compaction turn whose owner holds no admission as the ordinary turn instead of refusing it 503 (1aed625)
websocket: send a codeless or unrelayable provider 400 to the native websocket client as the wrapped error instead of a retryable response.failed (38cf7cd)
websocket: send a demoting provider 403 as the final wrapped 400 when the Pool has no other routable assignment (d6e64e3)
websocket: send a final provider 4xx refusal to the native websocket client as the wrapped 400 instead of a retryable response.failed (90933ad)
websocket: send a provider validation refusal to the native websocket client as the wrapped error the HTTP answer relays (870272e)
websocket: send the Pooler-written message naming the status for a kept provider 401 or demoting 403 refusal (5e72ccb)
websocket: serve a steered frame anchored on the response its own turn just completed on the socket (a646e38)
websocket: serve the grown resend of a turn cut after completed items as one successor when it appends exactly the items the socket pushed (53d718f)
websocket: serve the identical resend of a turn cut after only lifecycle, item-opening and delta frames as one successor (4730682)
websocket: start the client-retry window of a turn cut by a failed downstream write at that failure (0f9bae8)
websocket: stop a direct response task its client left before any output before interrupting its request (5dc0ab9)
websocket: stop a pre-visible direct task only while it waits on its upstream request (e525f36)
websocket: stop a timed-out client-retry turn at a remote owner instead of letting it stream to a client that got its error (bb08e6c)
websocket: stop a timed-out turn on an owner node without the abandon through its per-call cancel instead of the detach that armed a replay (7b8a2be)
websocket: stop detaching the downstream after a remote response.processed forward times out (48c93e9)
websocket: stop only the timed-out turn at a remote owner instead of detaching the connected socket (e275fd7)
websocket: stop the predecessor's task before invalidating the upstream connection at the handoff soft timeout (5924c6b)
websocket: take in the terminating socket's post-cleanup drain only the results of the tasks it awaits (046b147)
websocket: take over the running turn a reconnecting socket inherited when it sends its own request (d0e5c9c)
websocket: wait for, or refuse, a same-turn claim while that turn's previous request still runs, instead of a 500 (b548cf5)
Performance Improvements
admin: count request logs at most 10,000 rows past the current page (ac47139)
admin: list the request-log model filter from an index instead of scanning every request (d1b94f8)
admin: probe each window request for the identity's attempt in the cockpit Pool contribution instead of joining its grouped history (924b197)
admin: walk an upstream account's recent cockpit events from its own attempts (27ff8af)
db: index the foreign keys a Pool, assignment, key, identity or session delete looks up (248d2f3)
gateway: probe each window turn's request by primary key in the dashboard turn statuses instead of joining the Pools' requests (9d70dd4)
gateway: resolve a native HTTP turn claim once per request and hash its input once for both witness variants (0aeb6d7)
Reverts
upstreams: remove the operator clear for a provider-requested usage polling pause (899bf5a)
Tests
access: sample a lock wait again when its pg_stat_activity query names no relation (9e97fc4)
accounting: give the request-log model plan test a production-shaped history and assert its statistics (c86417a)
accounting: hold the enforcement-clock test's pending reservation on a live request (afab76a)
accounting: honour pricing_ref in model_fixture and price the explicit-ref case only through the ref (e540ae7)
accounting: pin that the minute replay job and the superseding retirement each settle an interrupted turn once (ddc4d40)
accounting: plan the Observatory contract on empty relations so earlier tests' bloat cannot mask or flip it (745a89d)
accounting: sample a lock-order wait again when its pg_stat_activity query names no relation (d70fff1)
accounting: seed the retained active-count history in batch and split the replay mutation races (9f55343)
admin: analyze the bulk cockpit fixtures and assert populated statistics before measuring the recent-event walk (299e5c4)
admin: keep the Spark convergence cards inside the quota freshness TTL until the page renders (b40d995)
admin: start dense cockpit fixture attempts at their admission and budget every recent-event probe (96f9345)
alerts: pin alert state and routing for a window whose only exhausted row describes an ended cycle (40b117d)
await tasks under named detection budgets instead of fixed one-second waits (26a4f09)
block the reliability QA preparation fixture until released so only the cap can end it (90e679a)
bound hosted shell output classification by reductions instead of wall-clock time (8e91a39)
bridge: pin continuity of the session's next turn after a bridged usage-limit failover (1a80144)
catalog: make the default gateway fixture model a catalog entry the released Codex client decodes (91ca543)
compat: alias WebsocketTurnIdentity in the contract test's claim scope helper (5d20e27)
compat: state the thread-or-session claim scope of the native websocket turn key in the matrix (5e44572)
config: let a shared-sandbox checkout wait behind a long holder instead of dropping it after 100 ms (465a6af)
config: point the test CodexAuth issuer at a closed loopback port (3dad966)
continuity: expect the rejected request row for a pre-reservation owner refusal in the reservation test (4f0e0fe)
deletion: pin the scheduling and reactivation race, an interrupted job run, the jobs explorer and a turn on a key being deleted (7d743bb)
dev: cover the tool-compatibility certification preference for gpt-6-sol (703b141)
dev: cover the tool-compatibility certification's exact gpt-6 family discovery (be35785)
dev: record that each jobs-off fixture task writes the disabled Oban env before app.start (1fe71a2)
drop hardcoded Codex client versions from test names, comments and provenance lines (ab6eb27)
drop measured-on Codex versions from the owner-forwarding replay test comments (6ed3206)
drop measured-on Codex versions from the websocket resend test comments (90c7e6d)
fake-upstream: refuse a model the account cannot serve before previous_response_id over HTTP, as the provider does (950c039)
fake-upstream: refuse previous_response_id over HTTP the way the provider does (9c49004)
freeze the drain wait-failure clock and give the metrics sampler a local name (224ba95)
gateway: expect owner_unavailable for replay intents refused on a session binding or Pool mismatch (fe03bc1)
gateway: expect owner-forwarded public websocket turns to drop codex.* controls (8cb42d3)
gateway: expect the public websocket to drop the owner-forwarded metadata event (b9bb69c)
gateway: keep the owner-lease renewal tests' pre-dispatch window off the short heartbeat ttl (719924a)
gateway: leave bitmap index entries out of the turn-status plan budget (4e9d9f6)
gateway: pin post-turn compaction, client exit and resume on a new socket at both topologies (7cf1eb6)
gateway: wait for transport messages under named detection budgets (ab41d5d)
give short detection budgets and fixture releases the named 15 s and 60 s bounds (638fbf2)
hold the cross-assignment failover behind an upgrade barrier instead of a 100 ms connect timeout (b127eea)
hold websocket test teardown until every deferred termination cleanup has finished (e7e0959)
jobs: settle the simultaneous stale-recovery reconcilers one after the other in both orders (badb6ca)
keep ExUnit's failure exit status when the duration guard also fails the run (f56667e)
migrations: flatten the lock-wait waiter session helper below the credo nesting limit (a5b9b61)
move bare gpt-5.6 family references to gpt-6 and certify the dev tool smoke on the gpt-6 family (9647858)
move the remaining short detection waits in four gateway and controller test files to named 15 s budgets (1994885)
move the websocket accounting, payload and owner-death detection waits to named 15 s budgets (6bd52f5)
openai: pin a /v1 message and tool-output input_image file_id on Full and Lite models (8b72a92)
persistence: gate the COMMIT-deadline renewal on a lock the test holds and prove the trigger ran, instead of racing a 2 s sleep (fb3fb36)
pin the unresponsive leaked-owner drain bound end to end in the drop-on-exit acceptance (1292c59)
platform: give every call into a BEAM peer a 15 s detection budget (56adec2)
platform: keep make test-fast's duration candidates file out of the guard's probe VMs (8c4d011)
platform: publish a BEAM peer's presence through the production heartbeat (d6c9f90)
poll committed rows, owner state and LiveView loads on a monotonic 15 s deadline instead of a one-second or attempt-counted budget (c699609)
quota: keep sampling the pruner's lock wait until pg_stat_activity names its wait event (14c601a)
register the relay runtime, admission and activity registry test processes under local names (0c0317a)
replace retired gpt-5.4, gpt-5.5 and gpt-5.6 model ids in tests and dev fixtures (e4ac10f)
replace the retired gpt-5.4-mini default and test model with gpt-6-luna (49c4879)
replace the retired model ids in the payload normalizer test (347aeb5)
report tests over the normal duration limit instead of failing the run (d069caf)
resets: pin that a workspace marker on the target does not decide automatic redemption (4a0e1bc)
routing: bind the pinned-session failover arm's session to the refusing account deterministically (b798099)
run the make test-fast acceptance under a test run namespace instead of skipping every case (12335f4)
runtime: wait for backend websocket and reset probe messages under named detection budgets (b89604c)
saved-resets: give barrier waits the detection budget and outlast it at every task handoff (236a97c)
saved-resets: give the 200-member cohort lock test's siblings only the rows its claim reads (b5fab8a)
support: restore daily_rollup_coverages rows a sync test's commits make across 00:00 UTC (9022bc6)
support: start every sync case-template test at the configured Logger level after the queued handler removals (d3b035e)
support: wait for every running websocket session cleanup before the sandbox owner stops or committed rows are deleted (07af6eb)
telemetry: compare only the prometheus reporter test's own series across concurrent scrapes (34e209e)
usage: anchor the monthly-only /v1/usage test at the current time so the 30-day retention keeps its window (6573612)
usage: pin the usage routes answering no_upstream_usage once an account's only evidence is past retention (71751ab)
use gpt-6-sol as the cleartext model fallback in the quota parser identity test (34617df)
v1: expect rate_limit_error on the redacted upstream 429 that cannot impersonate a cap denial (9289c89)
v1: expire the silent bridge's preflight once the provider holds the request and give the provider barriers a detection budget (fe7c0db)
v1: wait for file upload and websocket bridge messages under named detection budgets (5e14217)
wait for domain, fake upstream and relay messages under named detection budgets (197f14d)
wait on the 15 s detection budget in the rate-limit, sandbox-allowance, trace and accounting-boundary receives (631dbe7)
websocket: await the socket's deferred cleanup before reading a rollout-shutdown drain (b0812b3)
websocket: await the socket's deferred cleanup before reading an aborted delivery receipt (427846f)
websocket: capture the withheld-advice refusal line until the refused turn's row settles (5ea4f86)
websocket: correct the retry claim in the missing-provenance compaction refusal pin (c4fa1d6)
websocket: count the full-history compaction cut rows only once every row settled (7f91717)
websocket: deliver the keepalive and pong-deadline timer messages in the pong-liveness tests (09ed12b)
websocket: drive the findings#168 provenance fixture through an authenticated key and a routable model (abb1aea)
websocket: drop an unverified persistent_term claim from the remote turn timeout test (9c9745b)
websocket: expect the retryable service_unavailable when the compaction reservation loses its database connection (6145c44)
websocket: expire the upstream upgrade deadline on a clock the test answers, not an 80 ms timer (993e877)
websocket: fail the owner's replay arm on a real pool checkout drop instead of the sandbox queue (81727cc)
websocket: give the rollout drain tests their own owner registry (0009331)
websocket: hold the connection-limit turns on the held session timeouts and keep the owner harness barriers beyond the detection budget (fd78edc)
websocket: hold the upgrade, pong-deadline and caller-death scenarios on held timeouts (5da66a6)
websocket: hold the upstream websocket session tests' in-flight turns beyond the scenario timeouts and move their waits to 15 s budgets (aa0b50c)
websocket: inject the owner's terminal-delivery timeout in the result-first tests and move their waits to 15 s budgets (cd2a317)
websocket: keep log capture open from fence install until teardown so cleanup_deferred never reaches the console (42b5268)
websocket: let the public websocket receive helpers take only their own connection's socket messages (04fb3c7)
websocket: let the real-owner rollout drain test drain owners in its own registry (d95db1e)
websocket: name the ledger row of the refused-retry diagnostics in the pre-turn compaction cut scenario (d884d90)
websocket: pin a native continuation refused before its claim under the socket's request id, taking neither the request nor the turn claim (d6b5ac1)
websocket: pin a post-visible close, an owner death under the abandon and a submission between the abandon's lookups on remote turns (95867c9)
websocket: pin that a closed socket's late early-detach call cannot fence the downstream that replaced it (9dacb56)
websocket: pin that a completed-item cut's original generation is stopped beside its served grown resend (0378017)
websocket: pin that a Full-served turn forwards a client-built Lite-shaped request as sent (69ae0c7)
websocket: pin that a late resend of an interrupted turn is served once with owner forwarding off (ed7bdeb)
websocket: pin that a queued later turn meets every replay-preflight refusal again in the ordinary checks (4966ae7)
websocket: pin that a remote-owner turn's attempt names the proxy executor recovery asks about (4a6c8c4)
websocket: pin that a reserved websocket request always carries its turn, so the direct interrupt never meets a reservation it cannot release (28aa2ee)
websocket: pin that parent and subagent sockets of one root session keep their own compaction admissions (7a83135)
websocket: pin the 429 row of a withheld-advice usage limit on every websocket and bridged surface (d6587ed)
websocket: pin the all-exhausted terminal 429 and its retry-after on the public /v1/responses websocket (9bd1e45)
websocket: pin the corrected single settlement of a direct turn whose provider answers after its client left post-visible (aa69bef)
websocket: pin the frame window alias guard with two live processes on one thread and a held alias row (b916c2f)
websocket: pin the HTTPS fallback after a two-request websocket resend chain (1c6403a)
websocket: pin the key of a native compaction queued behind the settling turn, and that no resend of it is a second provider generation while it runs (e44b462)
websocket: pin the missing-provenance compaction refusal on a replacement socket and why its item cannot carry the turn (9922623)
websocket: pin the provider's model refusal of an anchored turn on its producing connection as a final refusal, not the anchor-miss retry event (5c1d144)
websocket: pin the replay cleanup sweep settling a consumed replay whose dispatch lookups failed (5590311)
websocket: pin the reply, row and refusal line of a turn whose key enforces a model the Pool does not serve (52ad892)
websocket: pin the row, log line and model metadata of a compaction frame refused for a model the key may not use (9cd80bb)
websocket: pin the stale_owner refusal of the next turn after an old owner node's per-call cancel and the reconnected socket's service (42db784)
websocket: pin the take-over wait bound of a cut compaction's first retry and accept only that bound in the cleanup-held arms (c7d67ec)
websocket: re-run the usage-limit answers and the held-back partition hop over a remote owner on a peer node (9f6bcbd)
websocket: read the turn-authority rows after the socket's session cleanup signals it finished, not when terminate returns (5cf5f60)
websocket: read what the session cleanup writes only after it finished, not after terminate/2 returns (1b10adb)
websocket: release a collected compaction that ends in a provider error, and refuse a remote item mismatch with 409 (4ceee1d)
websocket: release the cleanup fence only after its log holder has closed both captures (cbe4828)
websocket: release the held provider of a cut post-visible turn only once the original settled, not on its delivery receipt (906698a)
websocket: release the owner recovery only once the closing socket's early owner call is queued at the starting replacement owner (09f7c30)
websocket: resend a spent pre-turn compaction only after the socket stops tracking its response task (bfe9ab4)
websocket: return the public websocket decoder state once for a read without a complete text frame (292c489)
websocket: run the admitted compaction cut with the session's owner on a peer node (e424f94)
websocket: run the pre-turn compaction cut peer arms on one warmed peer per module (f2a9bbb)
websocket: send the next compaction retry once the closed connection's session cleanup finished, and say what the cleanup fence tracks (c4dd3d6)
websocket: send the refused anchored compaction only after the socket stops tracking the first turn's task (429ce63)
websocket: send the settlement-held arm's next retry once the cut compaction has fully settled (e1819fc)
websocket: serve the next /v1 turn after an owner-collected lineage compaction, owner local and on a peer node (513a010)
websocket: settle the dispatched turn of the second same-process socket before both terminate, not after a 15 s owner drain (5f272b5)
websocket: space the partial-output resend test's row polls (41c4c96)
websocket: stop a provider-terminal resend test's Pool owners and read only a test's own owner (d153c35)
websocket: stop only a test's own Pool owners at teardown instead of every owner in the registry (13ef6fd)
websocket: stop retrying a dropped sandbox checkout in the last two settlement polls (415fbb2)
websocket: stop retrying a dropped sandbox checkout in the settlement polls (e11851e)
websocket: stop the owners of each owner-forwarding continuation test's Pool before the sandbox owner exits (d8f2cf7)
websocket: wait on the rollout-drain T5 terminate and drain tasks with named detection budgets (bb0e8de)
web: wait for admin, ingress and sampler messages under named detection budgets (7b78327)
Miscellaneous Chores
codex: announce and smoke-test the released Codex client 0.156.1 (c36dbc7)
deps: present the Pooler upstream identity as Codex 0.156.0 (f1d6e12)
