fix: remove Codex voice account-usage policy

[eandualem]

Codex voice calls were rejected whenever the account reported available credits, even with included usage remaining, and the runtime could stop active calls based on account-usage polling. Remove both runtime policies and let the provider decide whether a session can start or continue. Provider refusals, ChatGPT authentication, API-key stripping and transport cleanup remain intact.

Keep /api/voice/usage as on-demand diagnostics with its existing fields; allowed is always true and reason null. The old ceiling and polling settings remain accepted as deprecated no-ops. Update the voice/configuration/API documentation and add regressions for credits, exhausted windows, spend-control flags and unavailable diagnostics.

Validation: make check in a clean copy: 2,963 passed, one database test skipped; 57 focused Codex voice tests passed. No live call or billing change.

Local review: Codex CLI 0.159.0, gpt-6-astra, high effort, one completed round, zero findings. A separate surveyor source review also found zero issues. The earlier Claude Fable review attempt could not execute because of its account limit; it is not counted as a completed review. Full test results above were obtained outside the reviewer’s read-only sandbox.

Part of #83.

Summary by CodeRabbit

• Changes
  • Codex voice calls are no longer limited or stopped based on account usage, credit balances, or usage checks. The provider determines whether calls can start or continue and reports any refusals.
  • The usage endpoint remains available for diagnostics; its response no longer indicates that usage blocks calls.
  • Usage ceiling and check-interval settings are deprecated and no longer affect calls.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6d4f688f-883b-4616-8d60-285cf219de3b

📥 Commits

Reviewing files that changed from the base of the PR and between 72537fd and f080f9e.

📒 Files selected for processing (11)

• AGENTS.md
• CHANGELOG.md
• README.md
• docs/api.md
• docs/configuration.md
• docs/voice.md
• src/assistant_runtime/app/voice/_codex.py
• src/assistant_runtime/app/voice/_transport.py
• src/assistant_runtime/app/voice/config.py
• src/assistant_runtime/app/voice/interface.py
• tests/unit/app/voice/test_codex.py

💤 Files with no reviewable changes (1)

• src/assistant_runtime/app/voice/_transport.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Codex voice no longer checks account usage to admit calls or polls usage to stop active calls. The usage endpoint remains available for diagnostics, and its report always allows calls without a refusal reason.

Changes

Codex voice account-usage handling

Layer / File(s)	Summary
Keep usage reporting diagnostic-only src/assistant_runtime/app/voice/_codex.py, src/assistant_runtime/app/voice/config.py, src/assistant_runtime/app/voice/interface.py, docs/api.md, tests/unit/app/voice/test_codex.py	The usage report retains available usage and credit diagnostics but always reports calls as allowed with no refusal reason. Rate-limit methods and fields are no longer required by the protocol check. Configuration and API documentation describe the diagnostic-only behavior.
Remove usage checks from the call lifecycle src/assistant_runtime/app/voice/_codex.py, src/assistant_runtime/app/voice/_transport.py, docs/voice.md, AGENTS.md, CHANGELOG.md, README.md, docs/configuration.md, tests/unit/app/voice/test_codex.py	Call creation starts the app-server and checks the ChatGPT login without checking usage. The transport no longer polls usage or stops active calls based on usage data. Tests and documentation reflect the updated call behavior and deprecated settings.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant CodexTransport
  participant CodexAppServer
  participant VoiceCall
  CodexTransport->>CodexAppServer: Ensure app-server is running
  CodexTransport->>CodexAppServer: Check ChatGPT login
  CodexTransport->>VoiceCall: Create call without a usage report

Loading

Merge Risk: ⚪ Minimal · up to f080f

Codex voice now leaves account-usage admission to the provider while retaining on-demand diagnostics. No actionable merge-blocking issue is established in the supplied evidence; merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to f080f

Authentication, provider refusals and call cleanup remain intact. Calls now rely on the provider rather than local usage limits, and the provider’s spending and exhaustion behavior has not been independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly affected resource is voice usage against the local CLI’s ChatGPT account. Calls previously denied by local usage policy can now reach that account’s provider admission decision, while runtime-wide session capacity remains enforced. Provider-paid-credit behavior is not established by repository evidence.

Trust Boundaries and Controls

• observed — The provider credential boundary remains separate from caller input: Codex transport returns no API credential, strips OPENAI_API_KEY and CODEX_API_KEY from the subprocess environment, and verifies ChatGPT login at startup and call creation. Provider refusal still reaches the call path after local usage enforcement is removed.

Resilience and Maintainability Implications

• observed — Allocation and finalization uncertainty are not converted into automatic retries or guaranteed cleanup claims. Service setup failures release local ownership, and unattached provider sessions receive best-effort abandonment, limiting duplicate allocation and stranded-session exposure.

Hardening Proposals

• proposed — If preventing paid-credit consumption is an operational requirement, verify that guarantee at the provider boundary before relying on provider-only admission. Neither the deprecated local settings nor allowed=true establish that guarantee.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.30% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 4 files. (6 skipped: 6…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing the Codex voice account-usage policy.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 9.30% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 4 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}