v1.17.0 — the effective codex model

Every bridge artifact now records codex-model-effective — the model the invocation actually resolved to — and --resume auto will not continue a Codex thread that ran under a different one.

Why

The bridge passes no --model unless a caller supplies one, so a run inherits whatever the installed codex-cli resolves to. That value moves: the bundled default changed twice inside 0.144 → 0.153 alone. Until now both a before and an after artifact recorded codex-model-requested: null, so --resume auto matched them and silently continued a thread across a model change.

Observed live while building this: two runs three hours apart on the same machine resolved to gpt-5.6-sol and then gpt-6-astra, and nothing in the artifacts distinguished them.

How the model is resolved

Before the spawn, in three steps:

1. --model passed → that value, no probe.
2. Else codex doctor --json → the configured model.
3. Else codex debug models → the catalog default, computed with Codex's own rule (entries sorted by priority ascending, first visibility: "list" wins).

Step 3 is the load-bearing one. codex doctor reports the literal placeholder <default> when nothing is configured — it can say THAT a default is in use but never WHICH, and "which" is exactly the value that moves between releases. Neither probe runs a model turn or costs tokens.

Behavior change — no action required

• --resume auto whose newest candidate ran under a different model now falls back to a fresh run instead of continuing that thread. Where an older candidate matches, it resumes that one.
• An explicit --resume <path> records the effective model but never blocks on a mismatch. The asymmetry is deliberate: it stops silent cross-model resumes without overriding a path you named on purpose.
• Unknown on either side never excludes. An artifact predating this release, or a machine where the probes fail, behaves exactly as before — the key is simply omitted.

What review caught

Codex found two ways the gate could still be bypassed, both rooted in one fact: a resumed artifact inherits the thread id it resumed from. Rejecting an artifact for a model mismatch therefore has to reject older artifacts pointing at that same thread — including a resume-failed one, whose eligibility check would otherwise hide its provenance from discovery. Eligibility and provenance are now separate concerns in resume.mjs.

Also in this release

• Three smoke probes over the two codex surfaces the resolver reads. They judge codex's stdout content rather than its exit status, matching what the resolver does, so an unrelated failing doctor check does not produce a false red.
• A fix for a pre-existing test race: the missing-template test moved the real templates/codex/research.md aside while another test file read it, failing about half of full-suite runs once timing shifted.

Details in docs/decisions.md (both 2026-06-20 entries, one deferral now closed) and docs/measurements.md (2026-09-06).