[Dimkox]

Why

Issue #235 needs an exact-request admission boundary before any account rotation or provider continuation can be enabled. The retained preview slice also copied unvalidated account/preview values, allowing structured data and string subclasses to invoke copy hooks or escape the intended fixed errors.

Changes

• Add an offline preview that binds the exact canonical request bytes and byte length, policy, cost contract, account metadata, caller binding, generation/revision, root identity and expiry.
• Recheck that binding without provider calls or credential reads. A successful result is ready_for_review with both dispatch_permitted=false and account_identity_verified=false.
• Validate account metadata and preview string fields as exact built-in strings before copying or comparing them. Cycles, copy hooks and string subclasses are refused with fixed errors and no hook invocation.
• Document the limits and register the module in the architecture model. Four source files changed.

The preview checksum is unkeyed and reproducible; it is not authentication, provenance or account authority. The root observation is point-in-time, not a workspace lock. Existing openai_model_request.dispatch still unconditionally refuses with data_admission_unavailable before claims or network. No live adapter is qualified by this delivery.

Qualified source

• HEAD: a1eb5fa01fb27f1e88fbf9d8aedcfaf47a3b7886
• Tree: 8b99b3027e44d3972c4287b32c00193a854a5f36
• Actual base/main: d6c2c109991ca4f9fc7b6924ef5b7dab08ac204e
• Fingerprint: 5b78538ea56a23d0e042ef124e115fe6f3aae756b38fcaf0d622b8e508a3bd2e
• Reviewed context: af104b6f8a941b0e1796cf25b040f6b642a969964a8eb1c0e642e26f8ca2b2e1

Verification

• The two malformed-input regressions first failed in all 44 relevant subcases. After the repair, admission/request/continuation controls passed: 89 tests and 332 subtests.
• Clean published-source native named controls passed independently; they were observations, not the final qualification.
• Independent code and security reviews passed on this exact source/context. Code review killed four critical mutants. The replacement security reviewer ran its own no-effects controls and killed two fresh mutants, explicitly separating inherited observations from its own work.
• The final full native PR gate passed. Core discovery: six workers, 502.191 seconds, exit 0. Fresh branch-aware overall coverage: 81.51%. Factory and pilot runners passed.
• Ruff, Bandit, OpenGrep, online OSV for 84 pinned dependencies, architecture, governance, secret/SQL checks and source/context stability passed.
• Five verifier checks are explicitly skipped, including PostgreSQL container execution for the declared repository-sandbox capability. Skips are not represented as passes.
• Three actual source/context-bound receipts exist. Native status reports zero evidence gaps and zero package-completeness findings.
• Required Linux and Windows, GitHub Actions App15368, passed on the exact qualified head: Actions run. Optional macOS and Entire Gates were still in progress at the recorded pre-merge observation. Review threads were empty.

Preserved failed attempts and limits

The first full attempt stopped before tests because the cost detector classified the endpoint string in a self.assertEqual as a paid call. This false positive remains tracked in issue #220. The separate runtime contract records enforced zero live calls/spend; the positive v1 schema minima are conservative upper bounds only, not live permission. Its actual enforcement symbol is the tested, unconditionally refusing dispatch. The added contract invalidated the old scope record, which was rebound through the native API using the existing owner consent. No paid-run approval was created.

The second attempt stopped because the local invocation omitted online OSV configuration. Both actual FAIL reports are retained. The final run enabled OSV and independently passed; no detector, test, threshold or guard was weakened to obtain it.

Tracking and recovery

This is a source prerequisite for #235 / GZDEV-39; the broader six-client rotator remains open. It does not publish a version or activate a provider.

If a fixed-error escape, accepted changed/expired preview or any grant/journal/network effect appears, hold delivery and repair the isolated branch, or use a reviewed forward-fix/revert PR after merge. Keep dispatch unavailable and repeat fresh source-bound reviews and gates. Reviewer scratch cleanup observations remain the separate existing issue #297.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T11:35:23.773899Z	a1eb5fa	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.