Separate protocol identifiers from Provider identities and centralize shared
request facts and observations in gateway-protocol. Keep endpoint models
and private continuation state owned by Providers.
Reorganize the architecture documentation and clarify the shutdown guarantees
for buffered charges and observations.
Validated with workspace formatting, strict Clippy, 3013 affected-module
tests and 16 architecture checks. One reference-binary TLS test is ignored.
Co-authored-by: Codex <noreply@openai.com>
Observe top-level output_config.effort before the OpenAI encoder rejects
Messages payloads. Reuse the protocol parser without inferring an effort
from thinking budgets or changing upstream conversion behavior.
Cover absent and explicit effort values, native Messages forwarding, and
Messages-to-Responses conversion. Document the observation contract.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* fix(openai): rotate new round-robin sessions without affinity hits
Strict affinity keeps a session on one account, but the shared request
cursor advanced on every scheduling load, including affinity hits. A new
session then took whatever slot that request volume happened to leave.
Advance a separate session cursor only when round-robin assigns an
account, and keep the request cursor for other strategies.
* fix(openai): advance round robin when an account assignment succeeds
Commit the session binding and round-robin cursor together after acquiring the account lease. Release a conflicting lease before retrying so concurrent first requests share a binding without consuming extra turns. Count delegated selections and preserve explicit plugin picks.
Verified with OpenAI provider tests, store tests against Redis and PostgreSQL, architecture checks, and workspace Clippy.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: koeria <riennie@qq.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Treat x-retry-metadata: NO_MORE_RETRY as a hard signal to skip
same-account backoff and transport recovery, even when Retry-After
is within maxRetryAfterSeconds. Capacity failures still rotate under
the existing policy; server_error still returns the upstream error.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Reuse connection-scoped peer discovery for native HTTP and WebSocket forwarding. Strip the route header for ordinary upstreams and leave explicit plugin forwarding changes to plugins.
Co-authored-by: Codex <noreply@openai.com>
Compare native HTTP, custom CA HTTP, and WebSocket ClientHello captures with an official Codex executable on the same platform. Document the explicit reference test workflow.
Co-authored-by: Codex <noreply@openai.com>
Limit default tier omission to Messages-to-OAuth conversion so native Responses retain their requested tier and routing hint.
Co-authored-by: Codex <noreply@openai.com>
Persist validated directories per credential revision. Restore them in bulk and refresh only missing, expired, or changed accounts with paced background requests. Filter large pools using current per-account evidence while preserving unknown and explicitly allowed candidates.
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): redeem reset credits when weekly quota runs low
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): observe weekly quota recovery after the last reset credit
Keep checking the local quota snapshot while recovery is unconfirmed. Once recovery is observed with no cards left, return to daily discovery.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep the Linux ClientHello fixture and compare system-native TLS on other platforms. Let the loopback WebSocket handshake finish before advancing idle time, and accept a peer reset on cancellation with unread frames.
Co-authored-by: Codex <noreply@openai.com>
Discover models per account so the Codex picker includes models unique to an eligible group member. Use account-specific catalog evidence when selecting a credential for native Responses requests.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use saved request and upstream facts to show the same error origin in the usage list and detail. Distinguish WebSocket error statuses from HTTP responses and preserve unknown delivery state for intermediate attempts.
Update the Linux OpenSSL bindings to 0.10.80 to address the dependency audit findings.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Support Responses, Chat Completions and Messages ingress with Responses
or Messages API upstreams in the existing OpenAI provider.
Share generation admission and delivery, preserve native protocol payloads,
and translate cross-protocol tools, reasoning, streams and usage. Add
Messages token counting and editable upstream protocol settings.
Co-authored-by: Codex <noreply@openai.com>
* feat(keys): add explicit budget windows with safe retries
Add revision-checked daily and weekly windows across admission, settlement
and queries. Reuse the existing budget ledger for atomic window updates,
latest-operation replay and audit records.
Expose typed SDK callbacks while keeping account associations and cycle
decisions in plugins.
Refs #658
Co-authored-by: Codex <noreply@openai.com>
* fix(keys): preserve budget accounting across window changes
Keep restored balances when historical charges are unavailable and reject window changes that would require those charges. Honor future start times after release and report actual spending windows to peers.
Require an explicit null to release a window through the plugin SDK.
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): preserve budget window precision across SDK calls
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Pin SQLx to the upstream commit supporting libsqlite3-sys 0.39.x and lock libsqlite3-sys to 0.39.1 to resolve RUSTSEC-2026-0459. Preserve the PostgreSQL transaction cancellation fix.
Co-authored-by: Codex <noreply@openai.com>
Use a single five-field Cron expression and allow lightweight warmup when
quota windows lack active evidence, without extra quota refreshes.
Reset saved schedules and disable warmup in migration 0040 while keeping
the configured model.
Co-authored-by: Codex <noreply@openai.com>
Supervise scheduling lease release tasks and drain them within a bounded shutdown budget. Preserve other instances and the existing TTL fallback.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Read update candidates from the published channel table and advance it only after the release assets are public. Keep the tagged preparation commit separate from the publication commit.
Co-authored-by: Codex <noreply@openai.com>
* fix(admin): preserve proxy capacity in OAuth pending state
Persist the saved proxy's WebSocket capacity in the shared pending
authorization codec and restore it before the Store checks the snapshot.
Keep genuine proxy changes and disabled proxies rejected.
Co-authored-by: Codex <noreply@openai.com>
* docs(deploy): clarify OAuth proxy upgrade guidance
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Drive each worker exit from the prepared generation so scheduling delays cannot turn a post-registration crash into a registration failure.
Co-authored-by: Codex <noreply@openai.com>
Publish an immutable channel snapshot with each release and advance a fixed release pointer only after public assets pass verification. Check the exact platform package before notifying clients.
Co-authored-by: Codex <noreply@openai.com>
Use client_metadata to verify nested service tier fields survive fast-mode handling while preserving outbound tier and billing assertions.
Co-authored-by: Codex <noreply@openai.com>
Use the configured affinity mode for content and cache-key bindings, including strict waiting and binding store failures. Cover queue rejection, cancellation, migration, and preferred spillover, and document the scheduling boundaries.
Refs #623
Co-authored-by: Codex <noreply@openai.com>
Use the client cache key or the opening messages as a tenant-scoped scheduling preference. Keep explicit sessions and continuation ownership separate, and allow spillover when the preferred account is busy.
Refs #622
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
dependabot[bot]
Ke WangandCodex