codex-proxy-rs/docs/implementation-status.md

Implementation Status

Update this file before each feature commit.

Area	Status	Commit	Verification	Notes
Scaffold	Completed	fc47967	cargo fmt --check; cargo test; cargo clippy --all-targets --all-features --locked -- -D warnings	Rust crate, lint policy, pinned TLS-sensitive dependencies, .gitignore, and minimal entry points are in place.
API contract docs	Completed	fc47967	cargo fmt --check; cargo test; cargo clippy --all-targets --all-features --locked -- -D warnings	/v1/* OpenAI-compatible body, /admin/* frontend envelope, body codes, camelCase, and request ID policy are documented.
Configuration	Completed	9ed8579 + e0680bf + cfec8ba	cargo test default_config_keeps_only_codex_backend; cargo test config_loader_merges_default_local_and_cprs_env_overrides; full fmt/test/clippy before commit	Defines Codex-only config, default/local/env loading, default YAML, Arc<AppServices> state shell, gpt-5.5 default model, and in-scope model/auth/quota/usage/logging settings fields without proxy/Ollama/provider/OpenAI-key knobs.
SQLite storage	Completed	ffec8b5 + b0c10f2	cargo test sqlite_schema_creates_accounts_and_event_tables; cargo test connect_sqlite_creates_parent_directory_for_file_database; full fmt/test/clippy before commit	Creates SQLite WAL connector, parent directory bootstrap, sqlx-managed schema for accounts/API keys/sessions/cookies/fingerprints/events, and event/account indexes.
Admin auth and client API keys	Partial	24d5799 + 4e0d1e5 + e9fdea0	cargo test client_api_key_has_proxy_prefix_and_verifies_against_hash; cargo test admin_password_hash_is_not_a_client_api_key; cargo test --test admin_login_route_test; cargo test --test admin_api_keys_route_test; full fmt/test/clippy before commit	Admin passwords use Argon2id, client API keys use cpr_ prefix plus HMAC-SHA256 with server-side pepper; /admin/login issues HttpOnly sessions and rejects client API keys as admin credentials. /admin/api-keys can create/list local client keys, and /v1/* now verifies enabled keys against SQLite instead of accepting any cpr_ string. Still missing delete/batch-delete/label/status/export/import key management.
Secret encryption	Completed	105aa58 + 228febd	cargo test secret_box_encrypts_and_decrypts_without_storing_plaintext; cargo test secret_box_load_or_create_should_reuse_existing_master_key_file; full fmt/test/clippy before commit	AES-256-GCM SecretBox stores upstream secrets as v1:<nonce>:<ciphertext> without plaintext and can load/create the runtime master key file used by repositories.
Logging and pagination	Completed	eb0341e + fc16c48 + b0c10f2 + ee0ed90 + fdb9374	cargo test event_logs_are_cursor_paginated; cargo test admin_logs_are_cursor_paginated_and_include_request_id; cargo test rotating_writer_splits_files_when_size_limit_is_reached; cargo test --test admin_usage_stats_route_test; cargo test --test v1_upstream_route_test; full fmt/test/clippy before commit	Adds cursor pagination, Page<T> camelCase serialization, admin /admin/logs query API, admin /admin/usage-stats and /admin/usage-stats/summary, event log repository, runtime tracing initialization, HTTP trace layer, date/size-based file rotation, and v1 response lifecycle events with request/account/route/model/status/latency/non-secret metadata.
TLS headers and fingerprint	Completed	1bdd08c	cargo test codex_headers_include_desktop_identity_and_turn_state; cargo tree | rg 'reqwest|rustls'; full fmt/test/clippy before commit	Adds Codex Desktop fingerprint model, exact identity/request headers, and pinned reqwest/rustls client builder.
Cookie persistence	Completed	4710926 + 5d3cc6e	cargo test cookie_jar_captures_and_replays_account_scoped_cookies; cargo test cookie_repository_encrypts_and_replays_account_scoped_cookies; full fmt/test/clippy before commit	Adds account-scoped in-memory Cookie jar and encrypted SQLite Cookie repository; Cookies are replayed only for the same account/domain.
Account pool and refresh	Partial	0f97c5c + 2f25db8 + 4dc0c9a + c2cf7a6 + 636fa79 + fdb9374	cargo test account_pool_skips_expired_disabled_banned_and_quota_exhausted_accounts; cargo test --test account_pool_scheduling_test; cargo test --test account_refresh_test; cargo test --test oauth_refresh_test; cargo test --test v1_upstream_route_test; cargo test --test account_pool_startup_test; full fmt/test/clippy before commit	Implements base account status filtering, refresh scheduler semantics, real OpenAI OAuth refresh-token exchange, 401-triggered refresh and single retry for /v1/responses, max concurrent slots, stale slot cleanup, least-used/round-robin/sticky strategies, tier priority, quota-cache filtering, Cloudflare cooldown skip, request staggering metadata, preferred account selection, exclude IDs, capacity summary, settings-backed pool construction, same-process import-to-pool sync, and startup pool snapshots from SQLite with usage-based last-used metadata. Still missing durable release-time slot state, broader upstream retry/fallback wiring, and admin account CRUD.
Account repository	Completed	14fe706	cargo test --test account_repository_test; cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test	Adds encrypted SQLite account token storage, decrypting reads, cursor pagination, status/label updates, release-time usage counter persistence, and refresh-token-preserving token updates.
Translation	Completed	eff182e	cargo test chat_completion_translates_to_codex_response_request; full fmt/test/clippy before commit	Adds OpenAI Chat request types, Codex Responses request type, translation, and OpenAI-compatible error body helper.
HTTP routes	Partial	ab0ad8f + 3830b21 + 6179d44 + cfec8ba + 6341336 + 228febd + c2cf7a6 + e9fdea0 + ee0ed90 + fdb9374	cargo test v1_requires_client_api_key_not_admin_cookie; cargo test models_route_returns_openai_compatible_codex_model_list; cargo test --test admin_settings_route_test; cargo test --test model_catalog_test; cargo test --test admin_accounts_route_test; cargo test --test admin_api_keys_route_test; cargo test --test admin_usage_stats_route_test; cargo test --test v1_upstream_route_test; full fmt/test/clippy before commit	Adds Axum router, health route, /v1/models, /v1/models/catalog, /v1/models/{id}, /v1/models/{id}/info, /debug/models, /admin/accounts, /admin/accounts/import, /admin/api-keys, /admin/usage-stats, /admin/usage-stats/summary, /v1/responses HTTP SSE collection and stream:true passthrough through imported Codex accounts, /v1 unauthorized OpenAI error body, global request-id response header, binary listener, gpt-5.5 as the default/test model baseline, and read-only /admin/settings with admin-session auth and lower camelCase envelope. /admin/accounts reads metadata only and does not decrypt tokens for list views. Still missing OAuth/device/CLI account login flows, admin account mutation/health/quota/Cookie routes, full admin API-key mutation/export/import routes, settings mutation/persistence, diagnostics, backend model refresh, model cache persistence, and WebSocket Responses routes.
Admin/frontend response contract	Completed	1c34ea7 + b0c10f2	cargo test admin_envelope_serializes_lower_camel_case_request_id; cargo test admin_logs_reject_missing_admin_session_cookie; cargo test v1_response_has_request_id_header_without_admin_body_field; full fmt/test/clippy before commit	Adds reusable admin envelopes with body codes, lower camelCase JSON, paginated list shape, requestId bodies, admin session cookie enforcement, and keeps /v1/* OpenAI-compatible.
HTTP auth boundary	Completed	cec4607 + e9fdea0	cargo test --test http_auth_test; cargo test --test routes_responses_test; cargo test --test admin_api_keys_route_test; cargo test --test admin_logs_route_test; cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test	Adds a real src/http/auth.rs boundary for client API key and admin session cookie parsing. /v1/* accepts only enabled local Bearer cpr_... client API keys verified from SQLite, admin session parsing ignores client API keys, and route handlers no longer own ad hoc credential parsing.
Model catalog	Partial	6341336	cargo test --test model_catalog_test; cargo test model_catalog_route_returns_codex_metadata_without_alias_entries; full fmt/test/clippy before commit	Adds a native static Codex model catalog with gpt-5.5 default, configured aliases, reasoning/service-tier suffix parsing, OpenAI-compatible /v1/models, extended catalog/detail/info routes, and debug summary. Still missing backend Codex model fetching per plan, cache persistence, /admin/refresh-models, plan allowlist integration from fetched models, and full model metadata parity.
Upstream lifecycle	Partial	88cad87 + 225fbff + c2cf7a6 + 636fa79 + ee0ed90 + fdb9374	cargo test responses_route_rejects_non_codex_provider_models; cargo test v1_requires_client_api_key_not_admin_cookie; cargo test --test codex_sse_usage_test; cargo test --test codex_client_test; cargo test --test oauth_refresh_test; cargo test --test v1_upstream_route_test; cargo test --test account_pool_startup_test; full fmt/test/clippy before commit	/v1 enforces client API key shape, rejects non-Codex provider models through the model catalog, returns OpenAI-compatible errors, includes reusable SSE/usage helpers, sends Codex Desktop HTTP SSE requests through imported accounts, replays/captures encrypted Cookies, collects response.completed for non-streaming clients, passes through client stream:true SSE, refreshes and retries once after upstream 401 when a refresh token is stored, records token usage, writes v1 lifecycle event logs, and restores the account pool from SQLite on startup. Still missing rate-limit header capture, retry/fallback across accounts beyond refresh retry, 429 quota cache, 402/403 classification, and previous-response/session affinity.
Codex WebSocket boundary	Completed	cc0516d	cargo test --test codex_websocket_test; cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test	Adds src/codex/websocket.rs with tested transport classification for HTTP SSE versus WebSocket-only requests. previous_response_id and explicit WebSocket requests now fail through a typed boundary instead of being silently downgraded; real WebSocket transport remains an upstream lifecycle follow-up.
Fingerprint updates	Partial	dd26d31 + e32220a	cargo test update_manifest_updates_app_version_and_build_number; cargo test fingerprint_updater_fetches_manifest_and_persists_history; full fmt/test/clippy before commit	Parses a JSON update manifest and persists app version/build number history to SQLite. Still missing original appcast XML polling, update-state persistence, runtime header fingerprint selection from the latest stored fingerprint, and optional local Codex.app Chromium extraction.
Runtime docs and packaging	Completed	33b63f3	cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test; cargo run; curl -s -i http://127.0.0.1:8080/health	README scope, .env.example, Dockerfile, compose file, and health smoke test are complete.