codex-proxy-rs/docs/implementation-status.md

Implementation Status

Update this file before each feature commit.

Area	Status	Commit	Verification	Notes
Scaffold	Completed	fc47967	cargo fmt --check; cargo test; cargo clippy --all-targets --all-features --locked -- -D warnings	Rust crate, lint policy, pinned TLS-sensitive dependencies, .gitignore, and minimal entry points are in place.
API contract docs	Completed	fc47967	cargo fmt --check; cargo test; cargo clippy --all-targets --all-features --locked -- -D warnings	/v1/* OpenAI-compatible body, /admin/* frontend envelope, body codes, camelCase, and request ID policy are documented.
Configuration	Completed	9ed8579 + e0680bf + cfec8ba	cargo test default_config_keeps_only_codex_backend; cargo test config_loader_merges_default_local_and_cprs_env_overrides; full fmt/test/clippy before commit	Defines Codex-only config, default/local/env loading, default YAML, Arc<AppServices> state shell, gpt-5.5 default model, and in-scope model/auth/quota/usage/logging settings fields without proxy/Ollama/provider/OpenAI-key knobs.
SQLite storage	Completed	ffec8b5 + b0c10f2	cargo test sqlite_schema_creates_accounts_and_event_tables; cargo test connect_sqlite_creates_parent_directory_for_file_database; full fmt/test/clippy before commit	Creates SQLite WAL connector, parent directory bootstrap, sqlx-managed schema for accounts/API keys/sessions/cookies/fingerprints/events, and event/account indexes.
Admin auth and client API keys	Partial	24d5799 + 4e0d1e5 + e9fdea0	cargo test client_api_key_has_proxy_prefix_and_verifies_against_hash; cargo test admin_password_hash_is_not_a_client_api_key; cargo test --test admin_login_route_test; cargo test --test admin_api_keys_route_test; full fmt/test/clippy before commit	Admin passwords use Argon2id, client API keys use cpr_ prefix plus HMAC-SHA256 with server-side pepper; /admin/login issues HttpOnly sessions and rejects client API keys as admin credentials. /admin/api-keys can create/list local client keys, and /v1/* now verifies enabled keys against SQLite instead of accepting any cpr_ string. Still missing delete/batch-delete/label/status/export/import key management.
Secret encryption	Completed	105aa58 + 228febd	cargo test secret_box_encrypts_and_decrypts_without_storing_plaintext; cargo test secret_box_load_or_create_should_reuse_existing_master_key_file; full fmt/test/clippy before commit	AES-256-GCM SecretBox stores upstream secrets as v1:<nonce>:<ciphertext> without plaintext and can load/create the runtime master key file used by repositories.
Logging and pagination	Completed	eb0341e + fc16c48 + b0c10f2 + ee0ed90 + fdb9374 + pending	cargo test event_logs_are_cursor_paginated; cargo test admin_logs_are_cursor_paginated_and_include_request_id; cargo test rotating_writer_splits_files_when_size_limit_is_reached; cargo test --test admin_usage_stats_route_test; cargo test --test v1_upstream_route_test; full fmt/test/clippy before commit	Adds cursor pagination, Page<T> camelCase serialization, admin /admin/logs query API, admin /admin/usage-stats and /admin/usage-stats/summary, event log repository, runtime tracing initialization, HTTP trace layer, date/size-based file rotation, v1 response lifecycle events with request/account/route/model/status/latency/non-secret metadata, and non-secret account.refresh events for upstream-401 refresh failures.
TLS headers and fingerprint	Completed	1bdd08c	cargo test codex_headers_include_desktop_identity_and_turn_state; cargo tree | rg 'reqwest|rustls'; full fmt/test/clippy before commit	Adds Codex Desktop fingerprint model, exact identity/request headers, and pinned reqwest/rustls client builder.
Cookie persistence	Completed	4710926 + 5d3cc6e	cargo test cookie_jar_captures_and_replays_account_scoped_cookies; cargo test cookie_repository_encrypts_and_replays_account_scoped_cookies; full fmt/test/clippy before commit	Adds account-scoped in-memory Cookie jar and encrypted SQLite Cookie repository; Cookies are replayed only for the same account/domain.
Account pool and refresh	Partial	0f97c5c + 2f25db8 + 4dc0c9a + c2cf7a6 + 636fa79 + fdb9374	cargo test account_pool_skips_expired_disabled_banned_and_quota_exhausted_accounts; cargo test --test account_pool_scheduling_test; cargo test --test account_refresh_test; cargo test --test oauth_refresh_test; cargo test --test v1_upstream_route_test; cargo test --test account_pool_startup_test; full fmt/test/clippy before commit	Implements base account status filtering, refresh scheduler semantics, real OpenAI OAuth refresh-token exchange, 401-triggered refresh and single retry for /v1/responses, max concurrent slots, stale slot cleanup, least-used/round-robin/sticky strategies, tier priority, quota-cache filtering, Cloudflare cooldown skip, request staggering metadata, preferred account selection, exclude IDs, capacity summary, settings-backed pool construction, same-process import-to-pool sync, and startup pool snapshots from SQLite with usage-based last-used metadata. Still missing durable release-time slot state, broader upstream retry/fallback wiring, and admin account CRUD.
Account repository	Completed	14fe706	cargo test --test account_repository_test; cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test	Adds encrypted SQLite account token storage, decrypting reads, cursor pagination, status/label updates, release-time usage counter persistence, and refresh-token-preserving token updates.
Translation	Completed	eff182e	cargo test chat_completion_translates_to_codex_response_request; full fmt/test/clippy before commit	Adds OpenAI Chat request types, Codex Responses request type, translation, and OpenAI-compatible error body helper.
HTTP routes	Partial	ab0ad8f + 3830b21 + 6179d44 + cfec8ba + 6341336 + 228febd + c2cf7a6 + e9fdea0 + ee0ed90 + fdb9374	cargo test v1_requires_client_api_key_not_admin_cookie; cargo test models_route_returns_openai_compatible_codex_model_list; cargo test --test admin_settings_route_test; cargo test --test model_catalog_test; cargo test --test admin_accounts_route_test; cargo test --test admin_api_keys_route_test; cargo test --test admin_usage_stats_route_test; cargo test --test v1_upstream_route_test; full fmt/test/clippy before commit	Adds Axum router, health route, /v1/models, /v1/models/catalog, /v1/models/{id}, /v1/models/{id}/info, /debug/models, /admin/accounts, /admin/accounts/import, /admin/api-keys, /admin/usage-stats, /admin/usage-stats/summary, /v1/responses HTTP SSE collection and stream:true passthrough through imported Codex accounts, /v1 unauthorized OpenAI error body, global request-id response header, binary listener, gpt-5.5 as the default/test model baseline, and read-only /admin/settings with admin-session auth and lower camelCase envelope. /admin/accounts reads metadata only and does not decrypt tokens for list views. Still missing OAuth/device/CLI account login flows, admin account mutation/health/quota/Cookie routes, full admin API-key mutation/export/import routes, settings mutation/persistence, diagnostics, backend model refresh, model cache persistence, and WebSocket Responses routes.
Admin/frontend response contract	Completed	1c34ea7 + b0c10f2	cargo test admin_envelope_serializes_lower_camel_case_request_id; cargo test admin_logs_reject_missing_admin_session_cookie; cargo test v1_response_has_request_id_header_without_admin_body_field; full fmt/test/clippy before commit	Adds reusable admin envelopes with body codes, lower camelCase JSON, paginated list shape, requestId bodies, admin session cookie enforcement, and keeps /v1/* OpenAI-compatible.
HTTP auth boundary	Completed	cec4607 + e9fdea0	cargo test --test http_auth_test; cargo test --test routes_responses_test; cargo test --test admin_api_keys_route_test; cargo test --test admin_logs_route_test; cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test	Adds a real src/http/auth.rs boundary for client API key and admin session cookie parsing. /v1/* accepts only enabled local Bearer cpr_... client API keys verified from SQLite, admin session parsing ignores client API keys, and route handlers no longer own ad hoc credential parsing.
Model catalog	Partial	6341336	cargo test --test model_catalog_test; cargo test model_catalog_route_returns_codex_metadata_without_alias_entries; full fmt/test/clippy before commit	Adds a native static Codex model catalog with gpt-5.5 default, configured aliases, reasoning/service-tier suffix parsing, OpenAI-compatible /v1/models, extended catalog/detail/info routes, and debug summary. Still missing backend Codex model fetching per plan, cache persistence, /admin/refresh-models, plan allowlist integration from fetched models, and full model metadata parity.
Upstream lifecycle	Partial	88cad87 + 225fbff + c2cf7a6 + 636fa79 + ee0ed90 + fdb9374 + pending	cargo test responses_route_rejects_non_codex_provider_models; cargo test v1_requires_client_api_key_not_admin_cookie; cargo test --test codex_sse_usage_test; cargo test --test codex_client_test; cargo test --test oauth_refresh_test; cargo test --test v1_upstream_route_test; cargo test --test account_pool_startup_test; full fmt/test/clippy before commit	/v1 enforces client API key shape, rejects non-Codex provider models through the model catalog, returns OpenAI-compatible errors, includes reusable SSE/usage helpers, sends Codex Desktop HTTP SSE requests through imported accounts, replays/captures encrypted Cookies, collects response.completed for non-streaming clients, passes through client stream:true SSE, refreshes and retries once after upstream 401 when a refresh token is stored, records token usage, writes v1 lifecycle event logs, records refresh failure classification for upstream 401, and restores the account pool from SQLite on startup. Still missing rate-limit header capture, retry/fallback across accounts beyond refresh retry, 429 quota cache, 402/403 classification, and previous-response/session affinity.
Codex WebSocket boundary	Completed	cc0516d	cargo test --test codex_websocket_test; cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test	Adds src/codex/websocket.rs with tested transport classification for HTTP SSE versus WebSocket-only requests. previous_response_id and explicit WebSocket requests now fail through a typed boundary instead of being silently downgraded; real WebSocket transport remains an upstream lifecycle follow-up.
Fingerprint updates	Partial	dd26d31 + e32220a	cargo test update_manifest_updates_app_version_and_build_number; cargo test fingerprint_updater_fetches_manifest_and_persists_history; full fmt/test/clippy before commit	Parses a JSON update manifest and persists app version/build number history to SQLite. Still missing original appcast XML polling, update-state persistence, runtime header fingerprint selection from the latest stored fingerprint, and optional local Codex.app Chromium extraction.
Runtime docs and packaging	Completed	33b63f3	cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; cargo test; cargo run; curl -s -i http://127.0.0.1:8080/health	README scope, .env.example, Dockerfile, compose file, and health smoke test are complete.