@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/server/chat-completions.ts

@@ -40,6 +40,9 @@ import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
 import {
+  assignNativeLogConversationId,
+  fillHermesLogConversationFallback,
+  nativeLogConversationIdFromHeaders,
   getOrAllocateRequestSessionLane,
   linkRequestSessionLane,
 } from "./request-log-conversation";
@@ -69,7 +72,7 @@ import {
   assertRouteAllowedByScope,
   resolveAdmissionModelScope,
 } from "./admission-model-scope";
-import type { DataPlaneAdmission } from "./auth-cors";
+import { resolveContextPrincipal, type DataPlaneAdmission } from "./auth-cors";
 import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
@@ -81,6 +84,7 @@ import { createNativeChatComboSource, handleNativeChatCompletions, nativeChatDec
 import { upstreamWireForAdapter, type ProtocolReasonCode } from "../protocols/contract";
 import { createProtocolEnvelope } from "../protocols/envelope";
 import { featuresFromChatBody } from "../protocols/features";
+import { credentialDomainFor } from "../protocols/opaque-state";
 import { checkRepresentable, unrepresentableMessage } from "../protocols/guard";
 import { requestPathForLane } from "../protocols/path";
 import { resolveProtocolSettings } from "../protocols/settings";
@@ -113,6 +117,10 @@ export async function handleChatCompletions(
   logCtx: RequestLogContext,
   logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
 ): Promise<Response> {
+  // Set before routing so pre-dispatch refusals stay correlated. A Hermes-only id is marked as a
+  // fallback, so a native id resolved later on the Responses bridge still replaces it.
+  assignNativeLogConversationId(logCtx, nativeLogConversationIdFromHeaders(req.headers));
+  fillHermesLogConversationFallback(logCtx, req.headers);
   const translatorBudget = createTranslatorBudget();
   try {
     let response = await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds);
@@ -344,7 +352,13 @@ async function handleChatCompletionsWithBudget(
       directConversation = chatConversationToIr(chatBody, chatBody.model as string);
       internalBody = chatSettingsBody(chatBody);
     } else {
-      internalBody = chatToResponsesBody(chatBody);
+      internalBody = chatToResponsesBody(chatBody, {
+        // #7429: only a route that is and stays first-party Anthropic may receive signed thinking
+        // a Chat client returns; a combo, policy or rewritten route resolves its target later.
+        acceptAnthropicReasoningSignatures: settledRoute !== null && !routeMayChangeCredentialDomain
+          && settledRoute.provider.adapter === "anthropic"
+          && credentialDomainFor(settledRoute.provider)?.firstPartyAnthropic === true,
+      });
     }
     if (effortRow) {
       internalBody.reasoning = {
@@ -413,6 +427,7 @@ async function handleChatCompletionsWithBudget(
   // Unresolved combos are checked after their concrete child route is selected in Responses.
   if (settledRoute && !settledRoute.combo && isCanonicalOpenAiForwardProvider(settledRoute.provider)
     && isCodexReserveHelperUnsupported(config, settledRoute.modelId, logIds?.admission, visionDescribeTerminal)) {
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
     return chatCompletionsErrorResponse(400, CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE, "invalid_request_error");
   }
   const nativeCallerAuth = captureExplicitOpenAiCallerAuth(req.headers, config);
@@ -491,6 +506,8 @@ async function handleChatCompletionsWithBudget(
     // #1686: the Chat surface translates its body and replays here, so the admission fact has
     // to ride along or a bearer-admitted Chat caller would still be refused by Direct.
     ...(logIds?.admission ? { admission: logIds.admission } : {}),
+    // The bridge request carries no caller credential, so resolve the replay principal here.
+    replayPrincipal: { clientPrincipalId: resolveContextPrincipal(req, config, logIds?.admission) },
     abortSignal: req.signal,
     // Body is Responses-shaped by now, but the client spoke Chat Completions.
     inboundWire: "chat",
@@ -505,6 +522,9 @@ async function handleChatCompletionsWithBudget(
     ...(envelope && nativeChatCombos ? {
       protocolSource: createNativeChatComboSource({
         req, config, envelope, requestedModel, requestedStream: stream, translatorBudget,
+        // Children run without logIds; the request's admission rides the source so their
+        // replay scope resolves the same caller principal as every other surface.
+        ...(logIds?.admission ? { admission: logIds.admission } : {}),
       }),
     } : {}),
     // Terminal vision-describe marker (roadmap 180): the bridge rebuilds

package/src/server/chat-native-reasoning.ts

@@ -7,11 +7,17 @@ import { reasoningReplayConversationIdFromResponsesRequest, sessionIdHeaderFromR
 
 type Rec = Record<string, unknown>;
 
-export function nativeChatReplayScope(headers: Headers): OcxReasoningReplayScopeRef | undefined {
+export function nativeChatReplayScope(
+  headers: Headers,
+  clientPrincipalId: string | undefined,
+): OcxReasoningReplayScopeRef | undefined {
   const clientThreadId = reasoningReplayConversationIdFromResponsesRequest({
     threadIdHeader: headers.get("thread-id"), sessionIdHeader: sessionIdHeaderFromRequest(headers),
   });
-  return clientThreadId ? { clientThreadId } : undefined;
+  return clientThreadId ? {
+    clientThreadId,
+    ...(clientPrincipalId ? { clientPrincipalId } : {}),
+  } : undefined;
 }
 
 /** Rebind before EVERY build: a key rotation must not retrieve another credential's reasoning. */
@@ -42,7 +48,8 @@ export function nativeChatReasoningCapture(
   const maxBytes = 256 * 1024;
   let bytes = 0;
   let callCount = 0;
-  let disabled = !scope?.current || !chatReasoningReplayPolicy(provider, modelId).preserve;
+  let disabled = !scope?.clientPrincipalId || !scope.current
+    || !chatReasoningReplayPolicy(provider, modelId).preserve;
   const discard = () => {
     budget.releaseRetained(bytes, accounting);
     bytes = 0;

package/src/server/chat-native.ts

@@ -24,6 +24,7 @@ import {
 } from "../lib/errors";
 import { reportDispatchSends, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../lib/request-execution-budget";
 import type { AdmissionLease } from "../lib/admission";
+import { resolveContextPrincipal, type DataPlaneAdmission } from "./auth-cors";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
@@ -179,7 +180,7 @@ export interface HandleNativeChatOptions {
   req: Request;
   config: OcxConfig;
   logCtx: RequestLogContext;
-  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease };
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission };
   route: RouteResult;
   chatBody: Rec;
   requestedModel: string;
@@ -209,6 +210,12 @@ export interface NativeChatExecution extends HandleNativeChatOptions {
   onFirstOutput?: () => void;
   /** The lease a streamed body holds; defaults to `logIds.turnAdmissionLease`. */
   turnAdmissionLease?: AdmissionLease;
+  /**
+   * The request's resolved data-plane admission, when the caller carries it without `logIds`.
+   * A combo child runs on the parent's log row, so it receives the admitted identity here or
+   * its reasoning replay scope can never establish a caller principal (PF-07).
+   */
+  admission?: DataPlaneAdmission;
 }
 
 /**
@@ -246,6 +253,8 @@ export function createNativeChatComboSource(input: {
   requestedModel: string;
   requestedStream: boolean;
   translatorBudget: TranslatorBudget;
+  /** The request's data-plane admission; native children inherit it for replay scope. */
+  admission?: DataPlaneAdmission;
 }): ComboProtocolSource {
   return {
     inbound: "chat",
@@ -264,6 +273,7 @@ export function createNativeChatComboSource(input: {
       comboDispatchPermit: child.comboDispatchPermit,
       onFirstOutput: child.onFirstOutput,
       ...(child.turnAdmissionLease ? { turnAdmissionLease: child.turnAdmissionLease } : {}),
+      ...(input.admission ? { admission: input.admission } : {}),
     }, child.attemptHandle),
   };
 }
@@ -340,7 +350,8 @@ export async function runNativeChatAttempt(
   const physicalBudget = sendBudget ?? createInferenceSendBudget(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
-  const replayScope = nativeChatReplayScope(req.headers);
+  const replayScope = nativeChatReplayScope(req.headers,
+    resolveContextPrincipal(req, config, execution.admission ?? logIds?.admission));
   let retainedRequestBytes = 0;
   const releaseRetainedRequest = () => {
     if (retainedRequestBytes === 0) return;

package/src/server/claude-messages.ts

@@ -100,6 +100,7 @@ import {
   isApiAuthRequired,
   isDataPlaneAdmissionSecret,
   isProxyAdmissionSecret,
+  resolveContextPrincipal,
   type RequestPolicyView,
   type DataPlaneAdmission,
 } from "./auth-cors";
@@ -1117,6 +1118,8 @@ async function handleClaudeMessagesWithBudget(
     // Routing keeps Claude-only sidecar overrides; admission policy must follow the live owner.
     codexAuthPolicy: config,
     ...(logIds?.admission ? { admission: logIds.admission } : {}),
+    // The translated request never forwards the caller credential; resolve the principal first.
+    replayPrincipal: { clientPrincipalId: resolveContextPrincipal(req, config, logIds?.admission) },
     ...(logIds?.turnAdmissionLease ? { turnAdmissionLease: logIds.turnAdmissionLease } : {}),
     abortSignal: req.signal,
     promptCacheKeyIsSharedCohort: cacheKeySource === "system",

package/src/server/gui-session.ts

@@ -1,6 +1,7 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import type { OcxConfig } from "../types";
 import { canonicalGuiBrowserOrigin, standaloneGuiPairingOrigin } from "../lib/gui-pair-capability";
+import { authorizationCredential } from "../lib/authorization-scheme";
 import {
   isAllowedManagementOrigin,
   isApiAuthRequired,
@@ -409,7 +410,7 @@ function isPairingTransportPermitted(origin: string): boolean {
 
 function requestCredential(req: Request): string | null {
   return req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
+    || authorizationCredential(req.headers)
     || null;
 }
 

package/src/server/index/link-listener.ts

@@ -1,4 +1,5 @@
 import { createLinkRelaySessions } from "./link-relay-sessions";
+import { createLinkPeerObservations, type LinkPeerEntry } from "../../link/peer-report";
 import type { Server } from "bun";
 import {
   emptyLinkStore,
@@ -9,6 +10,7 @@ import {
 import { linkStorePath } from "../../link/paths";
 import { linkRouteAllowed } from "../../link/routes";
 import { withConfigMutationLockSync } from "../../config/mutation-lock";
+import { registerFallbackLinkResolver } from "../../routing/fallback-policy";
 
 export const LINK_INGRESS_HOSTNAME = "opencodex-link.invalid";
 
@@ -51,6 +53,8 @@ export interface LinkListenerLifecycle<T> {
   linkAdmissionKeyIds(): ReadonlySet<string>;
   onAuthenticatedCatalog(listener: (apiKeyId: string) => void): () => void;
   notifyAuthenticatedCatalog(apiKeyId: string): void;
+  /** What this Home last learned of a Child over the link; empty until it relays a request. */
+  peerObservation(linkId: string): LinkPeerEntry;
   status(): LinkListenerStatus;
   close(): Promise<void>;
   stop(): Promise<void>;
@@ -76,6 +80,7 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
   let stopped = false;
   const authenticatedCatalogListeners = new Set<(apiKeyId: string) => void>();
   let lifecycleStatus: LinkListenerStatus = { state: "off", port: null, reason: null };
+  const peers = createLinkPeerObservations();
 
   const setStatus = (state: LinkListenerStatus["state"], port: number | null, reason: string | null): void => {
     lifecycleStatus = { state, port, reason };
@@ -89,6 +94,9 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
   const readStoreForAdmission = (): LinkStore => {
     try { return readStore(storePath); } catch { return emptyLinkStore(); }
   };
+  // OCX-11: the fallback policy resolves a link data key to its link id through this slot.
+  const releaseFallbackLinkResolver = registerFallbackLinkResolver(keyId =>
+    readStoreForAdmission().links.find(link => link.apiKeyId === keyId)?.id);
 
   const bindIfNeeded = (): void => {
     if (stopped || listener || !startContext) return;
@@ -104,7 +112,7 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
       return;
     }
     const requestedPort = store.listenerPort ?? 0;
-    const sessions = createLinkRelaySessions({ fingerprints: (keyId, linkId) => {
+    const sessions = createLinkRelaySessions({ peers, fingerprints: (keyId, linkId) => {
       if (!readStoreForAdmission().links.some(link => link.id === linkId && link.apiKeyId === keyId)) return [];
       return startContext?.keyFingerprints?.(keyId) ?? [];
     } });
@@ -214,12 +222,14 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
     notifyAuthenticatedCatalog(apiKeyId) {
       for (const listener of authenticatedCatalogListeners) listener(apiKeyId);
     },
+    peerObservation: linkId => peers.get(linkId),
     status() {
       return { ...lifecycleStatus };
     },
     close,
     async stop() {
       stopped = true;
+      releaseFallbackLinkResolver();
       // Process shutdown is deliberately forceful, unlike last-link removal. Every
       // authenticated socket is closed, and the client transport cannot reconnect it.
       relaySessions?.abortReservations();

package/src/server/index/link-management.ts

@@ -14,22 +14,69 @@ import type { ManagementSessionControl } from "../management-auth";
 import { runPassiveRead } from "../../lib/passive-read";
 import { LINK_CODEX_SETTINGS_PATH, linkManagementRouteAllowed, linkManagementTarget } from "../../link/management-routes";
 import { projectHomeCodexSettings } from "../../link/codex-settings";
+import { homeLinkChildParity, LINK_CHILD_PARITY_MAX_BYTES, LINK_CHILD_PARITY_PATH, parseLinkChildParityReport } from "../../link/child-parity";
+import { linkStorePath } from "../../link/paths";
+import { readLinkStore } from "../../link/store";
+import { readBoundedResponseBytes } from "../../lib/bounded-body";
 import { packageVersion } from "../../lib/package-version";
 
 const VERSION = packageVersion("0.0.0");
 const KEPT_RESPONSE_HEADERS = ["content-type", "content-language", "etag", "last-modified"];
+const REPORT_READ_TIMEOUT_MS = 5_000;
 
 function notFound(): Response {
   return Response.json({ error: "not_found" }, { status: 404, headers: { "cache-control": "no-store" } });
 }
 
+function refused(status: number, code: string): Response {
+  return Response.json({ error: code }, { status, headers: { "cache-control": "no-store" } });
+}
+
+/**
+ * `POST` {@link LINK_CHILD_PARITY_PATH}: the Child's apply report (OCX-6). The one write the link
+ * accepts, handled here, before and apart from the read-only table, so it never widens what a
+ * read may do. It is admitted only for the link the admitting key belongs to, reads at most
+ * {@link LINK_CHILD_PARITY_MAX_BYTES} and changes nothing but the in-memory report.
+ */
+async function handleChildParityReport(req: Request, url: URL, admittedKeyId: string | undefined): Promise<Response> {
+  if (req.method !== "POST" || url.search !== "" || req.headers.has("upgrade")) return notFound();
+  if (!admittedKeyId) return refused(403, "link_key_required");
+  const declared = Number(req.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declared) && declared > LINK_CHILD_PARITY_MAX_BYTES) return refused(413, "report_too_large");
+  let bytes: Uint8Array;
+  try {
+    const read = await readBoundedResponseBytes(new Response(req.body), {
+      maxBytes: LINK_CHILD_PARITY_MAX_BYTES,
+      signal: AbortSignal.timeout(REPORT_READ_TIMEOUT_MS),
+    });
+    if (read.oversized) return refused(413, "report_too_large");
+    bytes = read.bytes;
+  } catch {
+    return refused(400, "invalid_report");
+  }
+  let report: ReturnType<typeof parseLinkChildParityReport>;
+  try {
+    report = parseLinkChildParityReport(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)));
+  } catch {
+    report = null;
+  }
+  if (!report) return refused(400, "invalid_report");
+  let links: ReturnType<typeof readLinkStore>["links"];
+  try { links = readLinkStore(linkStorePath()).links; } catch { return refused(503, "link_store_unavailable"); }
+  if (!links.some(link => link.id === report.linkId && link.apiKeyId === admittedKeyId)) return refused(403, "link_mismatch");
+  homeLinkChildParity.record(report, new Set(links.map(link => link.id)));
+  return new Response(null, { status: 204, headers: { "cache-control": "no-store" } });
+}
+
 export async function handleLinkManagementRequest(
   req: Request,
   url: URL,
   config: OcxConfig,
   deps: ManagementApiDeps,
   sessionControl?: ManagementSessionControl,
+  admittedKeyId?: string,
 ): Promise<Response> {
+  if (url.pathname === LINK_CHILD_PARITY_PATH) return handleChildParityReport(req, url, admittedKeyId);
   if (!linkManagementRouteAllowed(url, req)) return notFound();
   if (url.pathname === LINK_CODEX_SETTINGS_PATH) {
     return Response.json(projectHomeCodexSettings(config, VERSION), { headers: { "cache-control": "no-store" } });

package/src/server/index/link-relay-sessions.ts

@@ -1,8 +1,9 @@
 import type { Server } from "bun";
 import {
   LINK_RELAY_AUTH_PATH, LINK_RELAY_AUTH_TIMEOUT_MS, LINK_RELAY_AUTH_VERSION,
-  LINK_RELAY_SESSION_HEADER, linkRelayProof, linkRelayProofMatches,
+  LINK_RELAY_PROBE_HEADER, LINK_RELAY_SESSION_HEADER, linkRelayProof, linkRelayProofMatches,
 } from "../../link/relay-auth";
+import { parseLinkPeerReport, type LinkPeerObservations } from "../../link/peer-report";
 
 interface Session {
   peer: string;
@@ -18,6 +19,8 @@ export interface LinkRelaySessionOptions {
   fingerprints: (keyId: string, linkId: string) => readonly string[];
   /** Tests can use a bounded shorter reservation; production uses five seconds. */
   reservationMs?: number;
+  /** Where a verified challenge records the Child's report, and a known link's version mismatch. */
+  peers?: LinkPeerObservations;
 }
 
 /** One book per bound listener. A pending proof reserves the bind before the data request arrives. */
@@ -64,21 +67,31 @@ export function createLinkRelaySessions(options: LinkRelaySessionOptions) {
         if (closing || req.method !== "GET" || sessions.size >= 256 || req.headers.has("upgrade")
           || req.headers.has("authorization") || req.headers.has("x-opencodex-api-key")) return refuse();
         const q = url.searchParams;
-        if (q.get("version") !== LINK_RELAY_AUTH_VERSION || [...q.keys()].length !== 5
-          || ["version", "key", "link", "nonce", "proof"].some(name => q.getAll(name).length !== 1)) return refuse();
+        if ([...q.keys()].length !== 5 || ["version", "key", "link", "nonce", "proof"].some(name => q.getAll(name).length !== 1)) return refuse();
         const keyId = q.get("key")!, linkId = q.get("link")!, nonce = q.get("nonce")!;
+        if (q.get("version") !== LINK_RELAY_AUTH_VERSION) {
+          // Unverifiable, but only for a link and key this Home issued: status names the mismatch.
+          const version = q.get("version")!;
+          if (/^[1-9]\d{0,3}$/.test(version) && options.fingerprints(keyId, linkId).length > 0) options.peers?.refuse(linkId, version);
+          return refuse();
+        }
         const peer = peerOf(req, server as Server<unknown>);
         if (!peer || sessions.has(nonce)) return refuse();
         const fingerprint = options.fingerprints(keyId, linkId).find(candidate =>
           linkRelayProofMatches(q.get("proof"), linkRelayProof(candidate, "caller", keyId, linkId, nonce)));
         if (!fingerprint) return refuse();
-        const release = acquire();
-        const timer = setTimeout(() => { consume(nonce)?.release(); }, reservationMs);
-        sessions.set(nonce, { peer, keyId, linkId, fingerprint, release, timer, expiresAt: Date.now() + reservationMs });
-        return new Response(null, { status: 204, headers: {
+        options.peers?.observe(linkId, LINK_RELAY_AUTH_VERSION, parseLinkPeerReport(req.headers));
+        const answer = () => new Response(null, { status: 204, headers: {
           "x-opencodex-link-proof": linkRelayProof(fingerprint, "listener", keyId, linkId, nonce)!,
           "cache-control": "no-store",
         } });
+        // A readiness probe closes after this answer and sends no data request, so it reserves
+        // nothing: no session to consume, no capacity and no drain lease held until expiry.
+        if (req.headers.get(LINK_RELAY_PROBE_HEADER) === "1") return answer();
+        const release = acquire();
+        const timer = setTimeout(() => { consume(nonce)?.release(); }, reservationMs);
+        sessions.set(nonce, { peer, keyId, linkId, fingerprint, release, timer, expiresAt: Date.now() + reservationMs });
+        return answer();
       }
       const nonce = req.headers.get(LINK_RELAY_SESSION_HEADER);
       let release: () => void;

package/src/server/index/optional-listeners.ts

@@ -14,7 +14,9 @@ import {
   type LinkListenerStatus,
 } from "./link-listener";
 import { createLinkSupervisor, type LinkSupervisor } from "../../link/supervisor";
+import { flushLinkDiagnostics, recordLinkDiagnostic } from "../../link/diagnostics";
 import { linkManagementRouteAllowed } from "../../link/management-routes";
+import { linkChildParityRouteAllowed } from "../../link/child-parity";
 import { saveConfigPreservingClaudeCode } from "../../config/live-reconcile";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { startJevQuotaActivation } from "../../combos/jev-quota-activation";
@@ -38,6 +40,7 @@ export interface OptionalListenerSet<T> {
   linkAdmissionKeyIds(): ReadonlySet<string>;
   onAuthenticatedCatalog(listener: (apiKeyId: string) => void): () => void;
   notifyAuthenticatedCatalog(apiKeyId: string): void;
+  peerObservation(linkId: string): import("../../link/peer-report").LinkPeerEntry;
   status(): LinkListenerStatus;
   linkStatus(): LinkListenerStatus;
   linkSupervisor(): LinkSupervisor;
@@ -54,6 +57,9 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
   let activeConfig: OcxConfig | undefined;
   let stopJevQuotaActivation: (() => void) | undefined;
   const supervisor = createLinkSupervisor({
+    // Tunnel state changes and their causes reach <configDir>/link/diagnostics.jsonl (bounded).
+    diagnostic: recordLinkDiagnostic,
+    flushDiagnostics: flushLinkDiagnostics,
     apiKeys: () => activeConfig?.apiKeys ?? [],
     revokeApiKey: id => {
       if (!activeConfig) return false;
@@ -83,11 +89,14 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
     },
     // The Home's link listener admits the data plane plus the read-only management relay
     // (#6957). The Child's own ingress keeps the data-only table, so a local caller on the Child
-    // cannot reach the Home's management reads without the Child's dashboard session.
-    linkRouteAllowed: (url, req) => linkRouteAllowed(url, req) || linkManagementRouteAllowed(url, req),
+    // cannot reach the Home's management reads without the Child's dashboard session. The one
+    // write is the Child's apply report (OCX-6), which changes only an in-memory status field.
+    linkRouteAllowed: (url, req) => linkRouteAllowed(url, req) || linkManagementRouteAllowed(url, req)
+      || linkChildParityRouteAllowed(url, req),
     linkAdmissionKeyIds: () => linkListener.linkAdmissionKeyIds(),
     onAuthenticatedCatalog: listener => linkListener.onAuthenticatedCatalog(listener),
     notifyAuthenticatedCatalog: apiKeyId => linkListener.notifyAuthenticatedCatalog(apiKeyId),
+    peerObservation: linkId => linkListener.peerObservation(linkId),
     status: () => linkListener.status(),
     linkStatus: () => linkListener.status(),
     linkSupervisor: () => supervisor,

package/src/server/index/serve-options.ts

@@ -204,11 +204,13 @@ import type { ReadinessGate } from "../readiness";
 import type { WorkflowRefusalLog } from "../workflow-refusal";
 
 import { readyProtocolMetadata } from "../../remote/protocol";
+import { homeInstanceId, stampServedBy } from "../../remote/served-by";
 import { modelCapabilityFields } from "../models-capabilities";
 import { createWebsocketHandler } from "./websocket-handler";
 import { reasoningArchiveErrorResponse } from "../responses/reasoning-archive-error";
 import { withGrokSessionIdentity } from "../../grok/session-identity";
 import { withCallerSessionIdentity } from "../caller-session-identity";
+import { agentAssertionUnsupportedResponse, hasAgentAssertionAuthorization } from "../../lib/authorization-scheme";
 
 export type ServerIngress = "public" | "unauthenticated-loopback" | "hub-management" | "claude-intercept" | "hub-link";
 
@@ -370,6 +372,10 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         : ingress === "unauthenticated-loopback" || ingress === "claude-intercept"
           ? loopbackPolicy()
           : config;
+      // Codex runtime agent assertion_only (Authorization: AgentAssertion) is refused before
+      // admission or routing: it is never a bearer, never an admission secret, and no pool or
+      // routed credential may stand in for it.
+      if (hasAgentAssertionAuthorization(req.headers)) return withCors(agentAssertionUnsupportedResponse(), req, policy);
       if (ingress === "hub-link") {
         const admission = resolveApiAuth(req, policy);
         if (!admission) return withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy);
@@ -380,7 +386,10 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // the shared table in src/link/management-routes.ts; never reachable on another ingress.
         if (isLinkManagementPath(requestUrl.pathname)) {
           const { handleLinkManagementRequest } = await import("./link-management");
-          return withCors(await handleLinkManagementRequest(req, requestUrl, config, requestManagementApiDeps, managementSessionControl), req, policy);
+          return withCors(await handleLinkManagementRequest(
+            req, requestUrl, config, requestManagementApiDeps, managementSessionControl,
+            admission.kind === "configured" ? admission.keyId : undefined,
+          ), req, policy);
         }
       }
       const url = requestUrl;
@@ -408,11 +417,13 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const message = "OpenCodex package files changed while this proxy was running; it restarts on its own, or run 'ocx restart' ('ocx service restart' for a background service).";
         const fencedPort = ctx.boundPort ?? requestServer.port ?? listenPort;
         const fencedHealth = url.pathname === "/healthz";
+        const fencedInstanceId = fencedHealth ? homeInstanceId() : undefined;
         const response = fencedHealth || readyzPath !== undefined
           ? jsonResponse({
               status: "restart_required",
               service: "opencodex",
               version: VERSION,
+              ...(fencedInstanceId ? { instanceId: fencedInstanceId } : {}),
               uptime: process.uptime(),
               pid: process.pid,
               port: fencedPort,
@@ -623,10 +634,13 @@ export function createServeOptions(ctx: ServeOptionsContext) {
       if (url.pathname === "/healthz" && req.method === "GET") {
         // service/pid/port let CLI liveness reject foreign 200s and verify pid identity.
         const healthPort = ctx.server.port ?? listenPort;
+        // Opaque Home instance id (src/remote/served-by.ts); omitted until the identity exists.
+        const instanceId = homeInstanceId();
         const response = jsonResponse({
           status: "ok",
           service: "opencodex",
           version: VERSION,
+          ...(instanceId ? { instanceId } : {}),
           uptime: process.uptime(),
           pid: process.pid,
           port: healthPort,
@@ -1977,5 +1991,8 @@ export function createServeOptions(ctx: ServeOptionsContext) {
     },
     websocket: createWebsocketHandler(ctx, requestMetrics),
   } as const;
-  return serveOptions;
+  const routeFetch = serveOptions.fetch;
+  // x-opencodex-served-by on GET /v1/models, whichever branch answered (src/remote/served-by.ts).
+  return { ...serveOptions, fetch: async (req: Request, requestServer: Server<WsData>): Promise<Response> =>
+    stampServedBy(req.method, codexCompatibleUrl(req.url).pathname, await routeFetch(req, requestServer)) } as const;
 }

package/src/server/live.ts

@@ -88,6 +88,10 @@ export const LIVE_SIDEBAND_API_ROOT = "https://api.openai.com/v1";
  * upstream the caller was addressing, so there is nothing to scope it away from. That is not
  * true of the images sidecar, which strips it deliberately and keeps doing so.
  *
+ * `voice-session-id` is the client-generated voice session id Codex 0.164 forwards on WebSocket,
+ * WebRTC and existing-call transports (openai/codex#53784). It is a separate identity from the
+ * realtime session id carried in `x-session-id`, so neither may stand in for the other.
+ *
  * Every name here is relayed only when the caller sent it. Nothing on this list is invented,
  * which is what keeps a caller that omits one byte-identical upstream. Auth headers
  * (`authorization`, `chatgpt-account-id`) stay proxy-owned and are never taken from this list.
@@ -100,6 +104,7 @@ export const LIVE_CLIENT_PROTOCOL_HEADERS = [
   "originator",
   "x-oai-attestation",
   "x-codex-turn-metadata",
+  "voice-session-id",
 ] as const;
 
 /**

package/src/server/local-management-read-client.ts

@@ -51,7 +51,7 @@ export interface LocalManagementReadRequestDeps extends LocalManagementReadDeps
  */
 export async function fetchBoundLocalManagementRead(
   target: LiveProxy,
-  path: LocalManagementReadPath,
+  path: LocalManagementReadPath | `${LocalManagementReadPath}?${string}`,
   deps: LocalManagementReadRequestDeps = {},
 ): Promise<LocalManagementReadResult> {
   if (
@@ -89,6 +89,8 @@ export async function fetchBoundLocalManagementRead(
     const timeoutMs = deps.timeoutMs ?? 4_000;
     const url = `http://${probeHostname(target.hostname)}:${target.port}${path}`;
     const init: RequestInit = {
+      redirect: "error",
+      credentials: "omit",
       headers: {
         [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
         [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,

package/src/server/management/combo-routes.ts

@@ -208,7 +208,6 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const {
       clearComboSelectionState,
       clearComboTargetCooldowns,
-      comboConfigError,
       comboDisabledModelId,
       comboDisabledModelSelectors,
       comboModelId,
@@ -225,6 +224,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...requestedCombo,
       ...(!Object.hasOwn(requestedCombo, "decisionQuotaSignals") && requestedCombo.strategy === "jev" && previous?.decisionQuotaSignals !== undefined ? { decisionQuotaSignals: previous.decisionQuotaSignals } : {}),
       ...(!Object.hasOwn(requestedCombo, "decisionQuotaTiers") && requestedCombo.strategy === "jev" && previous?.decisionQuotaTiers !== undefined ? { decisionQuotaTiers: previous.decisionQuotaTiers } : {}),
+      // The dashboard does not edit the session pin (#7525): an omitted field keeps it on a JEV save.
+      ...(!Object.hasOwn(requestedCombo, "sessionPin") && requestedCombo.strategy === "jev" && previous?.sessionPin != null ? { sessionPin: previous.sessionPin } : {}),
       ...(!Object.hasOwn(requestedCombo, "allowMeteredTargets") && previous?.allowMeteredTargets === true
         ? { allowMeteredTargets: true }
         : {}),
@@ -257,7 +258,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(Array.isArray(requestedCombo.targets) && Array.isArray(previous?.targets)
         ? {
             targets: requestedCombo.targets.map(target => {
-              // A non-record entry stays as the client sent it so comboConfigError reports it.
+              // A non-record entry stays as the client sent it so comboConfigIssues reports it.
               // Reading `lastResort` off it here would throw in place of that structured 400.
               if (!isPlainRecord(target)) return target;
               if (["lastResort", "metered"].every(key => Object.hasOwn(target, key))) return target;
@@ -331,8 +332,13 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       excludeComboId: sourceId,
       normalizeDecisionModel: (model: string) => normalizeDecisionModelSelector(prospectiveConfig, model),
     };
-    const error = comboConfigError(id, effectiveCombo, config.providers, validationOptions);
-    if (error) return jsonResponse({ error }, 400);
+    // `field` names the top-level combo field of the first issue, so a client can tell a target or
+    // JEV-setting refusal from an alias or rename one without parsing the message (#7579).
+    const invalid = comboConfigIssues(id, effectiveCombo, config.providers, validationOptions)[0];
+    if (invalid) {
+      const field = invalid.path[0];
+      return jsonResponse({ error: invalid.message, ...(typeof field === "string" ? { field } : {}) }, 400);
+    }
     for (const [otherId, combo] of Object.entries(nextCombos)) {
       if (typeof combo.decisionModel !== "string") continue;
       const issue = otherId === id ? undefined : comboConfigIssues(otherId, combo, config.providers, {

package/src/server/management/context.ts

@@ -156,7 +156,7 @@ export interface ManagementApiDeps {
   codexPromptPaths?: CodexPromptPaths;
   /** Link seams are getters so the optional listener and supervisor are singletons. */
   linkSupervisor?: () => LinkSupervisor;
-  linkListener?: () => Pick<LinkListenerLifecycle<unknown>, "ensureStarted" | "status" | "close" | "onAuthenticatedCatalog"> & Partial<Pick<import("../index/optional-listeners").OptionalListenerSet<unknown>, "ensureClaudeIntercept" | "claudeInterceptOutcome">>;
+  linkListener?: () => Pick<LinkListenerLifecycle<unknown>, "ensureStarted" | "status" | "close" | "onAuthenticatedCatalog"> & Partial<Pick<LinkListenerLifecycle<unknown>, "peerObservation">> & Partial<Pick<import("../index/optional-listeners").OptionalListenerSet<unknown>, "ensureClaudeIntercept" | "claudeInterceptOutcome">>;
   readLinkStore?: () => LinkStore;
   writeLinkStore?: (store: LinkStore) => void;
   linkKnownHostsPath?: () => string;