fix(oauth): preserve operator model policy across reconciliation

[lidge-jun]

Summary

Closes #7092.

• Keep operator context windows, output limits, input modalities and effort translation maps through startup reconciliation and OAuth login. Per-model operator entries win over preset seeds (including case-varied model IDs); presets fill missing keys. Copilot's long-context window and tier now survive restarts, and xAI no longer replaces explicit windows with registry defaults.
• Continue refreshing model rosters, capability lists and preset-owned reasoning ladder rows. Unseeded reasoning rows survive; modelReasoningEffortsAuthoritative: true explicitly retains operator ladders over seeded rows. The existing Grok stale-ladder refresh regression remains intact.
• Document field ownership and persistence behavior. Updated the old Devin context-window and Anthropic context-limit expectations because they encoded the operator-value deletion/replacement bug. Updated rename comments to describe per-key filling.

Saved operator maps and previously materialized preset maps have no separate provenance. Existing entries are retained; future corrections to an already-saved seed require an explicit migration. Live discovery and request-time admission retain their existing limits.

Security review: explicit maintainer security review is required before merge under MAINTAINERS.md because this touches OAuth config upsert. Independent static review found no blocking correctness/security issue. Credential handling, login-owned destinations, account selection and key-retention rules are unchanged.

Verification

All runtime checks used temporary OPENCODEX_HOME and CODEX_HOME directories. No real accounts or user configuration were read or changed.

• bun install — PASS; no dependency/lockfile changes.
• bun test tests/oauth/oauth-reconcile-operator-maps.test.ts tests/oauth/oauth-provider-reconcile.test.ts tests/oauth/oauth-upsert-preserves-api-key.test.ts — 65 pass, 0 fail.
• .tmp/7092/runner/bun-darwin-aarch64/bun test tests/oauth/oauth-reconcile-operator-maps.test.ts tests/providers/model-rename-migration.test.ts (pinned Bun 1.4.3, after review fixes) — 62 pass, 0 fail.
• Regression proof against the unchanged base implementation: bun test tests/oauth/oauth-reconcile-operator-maps.test.ts — 1 pass, 11 fail before the final authoritative-ladder case was added; Copilot and xAI cases both reproduced the defect. Source was restored immediately afterward.
• bun run typecheck — PASS.
• bun run structure:check — PASS.
• bun run privacy:scan — PASS.
• bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts — 35 pass, 1 fail on host Bun 1.4.0: the remaining tooling test requires the repository's Bun 1.4.3 pin. Running that test directly with the pin resolved it: .tmp/7092/runner/bun-darwin-aarch64/bun test tests/test-layout-tooling.test.ts -t 'domain verification launches isolate tests through the pinned runner' — 1 pass, 0 fail (24 filtered out). The earlier attempt to use OCX_TEST_RUNNER_BUN while running Bun 1.4.0 also failed because this test mocks the version probe; no source changes were made to bypass it.
• (cd docs-site && bun install --frozen-lockfile) and (cd docs-site && bun run build) — PASS; 577 pages, 81,200 internal links checked.
• git diff --cached --check — PASS.

The maintainer explicitly prohibits heavy/full local suites on this shared host. bun run test, bun run prepush, and the whole tests directory were NOT RUN. Broad validation is left to PR CI's fast Ubuntu subset and a subsequent manual ci.yml dispatch with lane=all on this branch. CI results will be recorded against the exact pushed head.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults; explicit maintainer security review remains required before merge.

CI snapshot refreshed for head 0b13b47530ee5ee0804745eaa324fbbd254992d5 (2026-10-15): PR CI run SUCCESS. Test shards 1/4–4/4, storage policy, API usage, gates, Ubuntu keyring/npm-global, Docker smoke, docs site build, structure gate and aggregate ci all succeeded. Catalog async contracts, hygiene, React Doctor, label and CodeRabbit also succeeded. Latest enforce-target remains QUEUED; older cancelled attempts are not treated as passing evidence. Test-step execution was verified for shards 1 and 2.

A full cross-platform workflow_dispatch run already exists for this exact head; initial changes and Windows-runner selection jobs are QUEUED. No duplicate dispatch was started. The prior dispatch was CANCELLED and supplies no passing evidence. Full cross-platform validation and explicit maintainer security review remain outstanding.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T07:35:37.320284Z	0b13b47	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0071c9fe-68f6-48bb-8755-87365c02ad16

📥 Commits

Reviewing files that changed from the base of the PR and between c410b77 and 8a13e00.

📒 Files selected for processing: 13

• docs-site/src/content/docs/guides/model-routing.md
• scripts/test-layout/layout.json
• src/oauth/index.ts
• src/providers/model-rename-migration.ts
• structure/INDEX.md
• structure/config.md
• structure/manifest.json
• structure/providers/oauth-reconciliation.md
• tests/fixtures/test-layout-expected.json
• tests/oauth/oauth-provider-reconcile.test.ts
• tests/oauth/oauth-reconcile-operator-maps.test.ts
• tests/oauth/oauth-upsert-preserves-api-key.test.ts
• tests/providers/model-rename-migration.test.ts

+-----------------------------------------------------------------------------------------------------------------------------------------------+
| Configure, don't integrate. Implement technology choices for an application as configuration options, not through integration or engineering. |
+-----------------------------------------------------------------------------------------------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md dev maintainer-integration policy; batch integration authorized by @lidge-jun on 2026-10-15).

• Head: 8a13e00fcbe75f68b69f0e9245492e69e069c0e2 (tree ec587d8e852a1d3b6b3528a205d62805b80355bd) = this branch merged with origin/dev c410b777dc.
• Exact-head evidence: GitHub-hosted Actions for this account have not been assigning runners since 2026-10-15 13:30 UTC, so by owner decision the evidence is a full bun run test (Bun 1.4.3 test runner, root and GUI dependencies installed, GUI built) of this exact tree on a maintainer host (Linux x86_64): exit 1, 7 min, 31 failing test(s), each also failing in the same host's baseline run of dev 60bf4c7 (environment-only): Codex shim install readiness > a refused install exits unsuccessfully and preserves its re, Codex shim install readiness > keeps install advisory when the Codex config cannot be read, Codex shim install readiness > the install command surfaces readiness warnings without lea, GUI pairing client > sends one bodyless origin-bound capability and redacts rejected bodie, Node launcher PATH fallback activation > broken bundle reaches validated PATH Bun, Node launcher PATH fallback activation > inspection bundle reaches validated PATH Bun, Node launcher PATH fallback activation > missing bundle reaches validated PATH Bun, a secondary ensure parent preserves shared Grok, Codex and Claude agent bytes, ….
• Local gates on the same tree: bun run typecheck, file-size ratchet, test-layout and structure:check.
• Hosted CI checks for this head may still be queued; they are not claimed as evidence.