feat(llm): run pipeline stages on a ChatGPT plan via the Codex CLI

[snowopsdev]

Why

Operators pay per token for every pipeline stage. Many already hold a ChatGPT plan that includes Codex, so this adds a third provider that spends that plan instead of an API key.

The prefix carries the routing. A model id of codex/gpt-5.6-terra selects the provider, which preserves the module's stated invariant that the id alone decides the provider. The alternative, a separate provider column on the catalog, adds a second thing to keep in sync with the id.

Scope

cms/src/lib/llmProvider.ts gains a third LlmProvider and a ProviderRequirement tagged union. The old shape assumed every provider authenticates through one environment variable, which Codex does not. requirementForModel is now the single branch point; envVarNameForModel and apiKeyForModel read its result and return undefined for Codex.

cms/src/lib/codexAuth.ts is new. checkCodexLogin shells codex login status. ensureManagedCodexHome builds a private CODEX_HOME holding a minimal config plus a symlink to the operator's auth.json. Nothing reads the token.

cms/src/lib/codexCompletion.ts is new. One thread per call, read-only sandbox, scratch working directory, approvals off, SDK imported dynamically.

pipeline/src/llm.ts collapses the provider ternary that existed twice, at completeJSON and inside createLlmClient, into one exhaustive completeJSONLive switch, and adds completeJSONCodex.

pipeline/src/models.ts branches the preflight on requirement kind. The environment message is unchanged to the byte. pipeline/src/config.ts accepts a Codex login as a third credential but does not let one flip mock mode to live.

cms/src/lib/llmCatalog.ts generates six codex/ entries from the OpenAI rows so a mirror cannot drift from the price it estimates. Migration 20260902_210000_codex_model_options adds those six labels to seven Postgres enums.

cms/src/lib/brandVoiceExtract.ts, workspaceReadiness.ts and the runtime banner learn the new requirement. Out of scope: hosted multi-tenant use, and any storage of credentials.

Tradeoffs

Codex is an agent runtime, not a completion endpoint. A trivial prompt billed 15,767 input tokens because it loads its own preamble every call. Roughly 15k of overhead per stage is the price of the plan billing, so API keys stay the default and this is opt-in.

Cost rows are estimates at API rates, marked provider = codex. The plan bills in its own included usage, so the dollar figure is indicative. The alternative, logging zero, would have made the reports lie by omission.

Each call runs in a managed CODEX_HOME rather than the operator's own. -c 'mcp_servers={}' was measured and does not work, because -c merges into the config table rather than replacing it.

Blast Radius

LlmProvider is shared by both workspaces and by the CMS content-run job, so widening it touched two exhaustive Record types. Existing Anthropic and OpenAI paths are untouched at runtime; the only change to them is that one duplicated ternary became one switch.

The migration only adds enum labels. Postgres cannot drop them, so down is a no-op. ADD VALUE IF NOT EXISTS keeps it idempotent.

The readiness fingerprint is the one silent risk, since a change would stale every prior verification run. A pinned hash test proves a workspace with no Codex stage fingerprints byte-identically.

Verification

Typecheck and lint clean across both workspaces, 0 errors.

621 pipeline unit tests and 305 CMS integration tests pass, including new suites for provider routing, the auth helpers, the adapter, the client switch, the preflight gate, and readiness.

End to end against the real product, not the harness. Saving codex/gpt-5.6-terra into the Models global succeeds, which exercises the enum migration. The preflight with no login throws before any stage runs and names codex login. Mock mode with a codex/ model returns the fixture and never loads the SDK. costUsd('codex/gpt-5.6-terra', 1e6, 1e6) returns 14.

Two live probes against the real CLI confirmed the managed home. With the operator's own config, stderr carried repeated rmcp::transport::worker failures. With the managed home, stderr was clean, no notify process launched, and the agent returned exactly {"ok":true}.

Live, against the operator's ChatGPT plan.

All six catalog ids answer and return valid JSON. Input-token overhead measured per call: sol 17322, terra 17487, luna 15920, 5.5 16527, 5.4 15172, 5.4-mini 14824.

A full completeJSONLogged call on codex/gpt-5.6-luna wrote this row, which is the single call site every stage routes through:

stage=generate  provider=codex  model=codex/gpt-5.6-luna
input_tokens=15955  output_tokens=17  cost_usd=0.0032114
response={"ok": true, "title": "Clemson vs LSU"}

The cost is exact against the catalog rate, 15955 at $0.2/1M plus 17 at $1.2/1M. No notify process launched.

The web-search path returned webSearchRequests: 1 with a real source URL, confirming web_search items are counted and webSearchMode reaches the CLI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T21:42:43.301418Z	0790eab	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0790eabf9a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".