[WRONG BRANCH] release: promote dev to main for 2.27.0

.github/CODEOWNERS

@@ -1,11 +1,11 @@
 # Default reviewers
-* @lidge-jun @Ingwannu @Wibias
+* @lidge-jun @Ingwannu
 
 # High-impact runtime behavior
-/src/adapters/ @lidge-jun @Ingwannu @Wibias
-/src/providers/ @lidge-jun @Ingwannu @Wibias
-/src/codex/ @lidge-jun @Ingwannu @Wibias
-/src/server/ @lidge-jun @Ingwannu @Wibias
+/src/adapters/ @lidge-jun @Ingwannu
+/src/providers/ @lidge-jun @Ingwannu
+/src/codex/ @lidge-jun @Ingwannu
+/src/server/ @lidge-jun @Ingwannu
 
 # Repository automation and release security
 /.github/ @lidge-jun @Ingwannu

.github/workflows/ci.yml

@@ -607,7 +607,11 @@ jobs:
           bun run build
 
       - name: Test
-        run: bun test --isolate tests --shard=${{ matrix.shard }}/4
+        # --timeout: the Linux batches and the macOS control both pass 60000; this leg was
+        # the only one left on Bun's 5s default, and it is the slowest hardware on the board.
+        # Three of its failures were the default firing on tests that had not hung — the
+        # composed-acceptance cases spawn a real `ocx start` and were still working at 41s.
+        run: bun test --isolate --timeout 60000 tests --shard=${{ matrix.shard }}/4
 
       - name: CLI help smoke
         run: bun run src/cli/index.ts help

MAINTAINERS.md

@@ -9,14 +9,23 @@ review and merge policy.
 | --- | --- | --- |
 | [@lidge-jun](https://github.com/lidge-jun) | Project owner | Project direction, releases, repository administration, and final governance decisions |
 | [@Ingwannu](https://github.com/Ingwannu) | Maintainer | Issue and pull-request triage, `dev` integration, security review, and repository maintenance |
-| [@Wibias](https://github.com/Wibias) | Maintainer | Issue and pull-request triage, `dev` integration, and provider/CI maintenance |
 
 The table describes project responsibilities. Actual repository permissions remain controlled
 through GitHub repository settings.
 
 `dev` is the only integration line. The former `dev2-go` carry duty is retired;
 see [The retired `dev2-go` line](#the-retired-dev2-go-line).
 
+## Former maintainers
+
+| GitHub account | Project role | Period |
+| --- | --- | --- |
+| [@Wibias](https://github.com/Wibias) | Maintainer | 2026-07-27 – 2026-08-19 |
+
+Former maintainers keep contributor standing and are welcome to open issues and pull requests like
+anyone else. Authorship credit in git history, release notes, and code comments is not rewritten
+when a maintainer steps down.
+
 ## Review and merge policy
 
 - Pull requests target `dev`. It is the only integration line, and promotion to
@@ -98,17 +107,35 @@ Adding or removing a maintainer requires:
 
 ### Change log
 
+- 2026-08-19 — [@Wibias](https://github.com/Wibias) stepped down as a maintainer
+  and is now a contributor. This follows his own decision to stop developing
+  opencodex; it is not a disciplinary action, and it was made with the owner's
+  agreement (requirement 1). Requirement 2 does not apply to a maintainer's own
+  resignation, which needs no second maintainer to ratify it. Requirement 3 is
+  met by this file and `.github/CODEOWNERS`, where the default-reviewer line
+  and the four runtime paths that listed him (`/src/adapters/`,
+  `/src/providers/`, `/src/codex/`, `/src/server/`) drop back to the two
+  remaining maintainers. Repository permission was reduced to read access at
+  the same time, so the roster and the GitHub settings agree again.
+
+  Nothing he authored is being unwound. His commits, the pull requests he
+  merged, the release-note attributions, and the code comments citing his
+  reviews stay exactly as they are, and the trust-lane gate derived from his
+  work in `.github/scripts/pr-sponsored-surface.cjs` keeps its attribution.
+  Returning to the maintainer table later would go through the same three
+  requirements that govern every addition.
+
 - 2026-07-27 — [@Wibias](https://github.com/Wibias) added as a maintainer.
   Requirement 1 (agreement from the project owner) is met: the owner requested
   the addition. **Requirement 2 (review by another current maintainer) was
   never satisfied in the form this document describes.** The three commits that
   carried the addition (`a2693c02`, `dc3a4ade`, `02bbd47a`) landed on `dev` as
   direct owner pushes with no associated pull request, so no second maintainer
   reviewed them. Requirement 3 is met by this file and `.github/CODEOWNERS`.
-  The addition is in effect regardless: @Wibias holds write access on the
-  repository and has been merging pull requests since 2026-07-26. This entry
-  records the gap rather than papering over it — a later maintainer change
-  should go through a reviewed pull request.
+  The addition took effect regardless: @Wibias held write access on the
+  repository and merged pull requests from 2026-07-26 until he stepped down on
+  2026-08-19. This entry records the gap rather than papering over it — a later
+  maintainer change should go through a reviewed pull request.
 
   Scope covers issue and pull-request triage, `dev` integration, and
   provider/CI maintenance. (This entry originally also described carrying

devlog/_plan/260818_fastwire_b2_openrouter/evidence/README.md

@@ -0,0 +1,16 @@
+# Evidence — FastWire B2 (OpenRouter)
+
+`010_logs_openrouter_priority_lower_bound.png` — Logs table with three seeded OpenRouter
+requests on `openai/gpt-5.6-sol`, captured against a local proxy with a temporary
+`OPENCODEX_HOME`:
+
+| Row | Attempt outcome | Rendering |
+| --- | --- | --- |
+| `or-priority-confirmed` | upstream echoed `service_tier: "priority"` | `≥$0.1105` — priced at the standard rate but marked a floor, because OpenRouter publishes no bundled tier price and documents priority as higher cost |
+| `or-priority-declined` | upstream echoed `service_tier: "default"` | `~$0.1105` — a real downgrade, so no floor marker |
+| `or-standard` | no tier requested | `~$0.1105` |
+
+All three totals match on purpose: without a bundled priority price every row is computed at
+the standard rate, so the only thing that differs is whether the cost is presented as an
+estimate (`~$`) or as a known lower bound (`≥$`). The marker matches the convention used by
+the parallel xAI unit (#2072).

devlog/_plan/260818_megafile_split_program/010_wp1_types_value_leaves.md

@@ -0,0 +1,104 @@
+# WP1 — types.ts value-leaf extraction (stacked PR 1 of the split program)
+
+Unit: devlog/_plan/260818_megafile_split_program. Risk basis: 000_risk_assessment.md.
+Branch: codex/split-wp1-types on dev @ b04cd26e7 (post FastWire B0/B1 merge).
+Class: C2 (mechanical move, shared-runtime file, full-suite gate).
+
+## Loop spec
+
+- Archetype: pure-move refactor, zero behavior change.
+- Trigger: split program WP1, lowest-risk opener.
+- Goal: src/types.ts stops carrying runtime value code; values live in leaves;
+  every existing import keeps working via re-export.
+- Non-goals: NO type-cluster split yet (OcxConfig/OcxProviderConfig stay),
+  NO consumer retargeting to leaf paths, NO behavior or signature change.
+- Verifier: bun run typecheck && bun run test (full — shared runtime file).
+- Stop: both green + core-lab-boundary green; PR opened against dev.
+- Memory artifact: this doc + ledger attests.
+
+## Scope (IN)
+
+Extract the two VALUE clusters from src/types.ts (1867 lines) into leaves:
+
+1. src/types/tools.ts — lines ~236-292:
+   namespacedToolName, toolChoiceAliases, toolAllowedByChoice,
+   resolveToolChoiceWireName, modelInList, OcxToolChoice (type),
+   isAllowedToolChoice, toolChoiceToolPredicate.
+   Needs `import type { OcxTool } from "../types"` — type-only, erased at
+   runtime, so the types.ts -> tools.ts re-export is NOT a runtime cycle.
+2. src/types/wire.ts — lines ~1760-1839:
+   UPSTREAM_HTTP_VERSION_VALUES, UpstreamHttpVersion, 
+   REASONING_SUMMARY_DELIVERY_VALUES, ReasoningSummaryDelivery,
+   CodexAccountMode, OPENAI_PROVIDER_TIER_VERSION,
+   MODEL_ADAPTER_OVERRIDE_ALLOWED, ANTHROPIC_WIRE_MODELS (internal),
+   anthropicWireModelsForProvider (internal), captureWireAdapterHardPins,
+   isWirePinnedModel, pinnedWireAdapter. Self-contained, no imports.
+
+src/types.ts keeps every current export via `export ... from "./types/..."`;
+type-only names re-exported with `export type`.
+
+## Scope (OUT)
+
+- All interface/type clusters stay in types.ts this PR.
+- No import-path changes anywhere else in src/ or tests/.
+- No lab imports anywhere new (types is on the protected graph as a value
+  import from responses/core.ts: modelInList, namespacedToolName).
+
+## File change map
+
+- ADD src/types/tools.ts (~60 lines incl. docs)
+- ADD src/types/wire.ts (~85 lines incl. docs)
+- EDIT src/types.ts: delete moved bodies, add two re-export blocks at the
+  same positions; net -120 lines.
+
+## Accept criteria
+
+1. bun run typecheck exit 0.
+2. bun run test full suite: same pass count as base (13k+), 0 fail.
+3. tests/core-lab-boundary.test.ts green (covers the new static edges
+   types.ts -> types/tools.ts, types/wire.ts on the protected walk).
+4. rg confirms no consumer file changed: git diff --stat touches exactly 3
+   files.
+5. Value identity preserved: MODEL_ADAPTER_OVERRIDE_ALLOWED still a single
+   ReadonlySet instance (only one declaration site, re-export not re-create).
+
+Activation grounding: criterion 3's scenario is the existing boundary test
+run; criterion 5's scenario is the full suite (service-tier tests compare
+set membership through both import paths).
+
+## Verifier reality (PLAN-VERIFIER-REAL-01)
+
+- bun run typecheck: exists in package.json, reads src/ via tsconfig
+  include ["src"] — observes both new files. To be run in C.
+- bun run test: tests/ suite imports ../src/types in 400 files — observes
+  the barrel; core-lab-boundary walks the import graph from the three
+  protected roots which reach types.ts — observes the new edges.
+
+## Stacked-PR plan (DEV-STACK-01)
+
+PR 1 (this): value leaves + barrel. Target: dev.
+PR 2 (next cycle): type-cluster split (request/config/provider/accounts)
+stacked on PR 1's head branch.
+Later cycles per 000_risk_assessment.md order (config leaves, registry, ...).
+
+## Audit amendments (A-phase, 2 auditors: grok-4.6 NEAR-PASS / gpt-5.6-sol FAIL->fixed)
+
+1. CYCLE FIX (sol blocker): OcxTool (lines 211-232) moves INTO types/tools.ts.
+   tools.ts imports NOTHING from ../types — dependency is strictly one-way
+   (types.ts -> types/tools.ts). types.ts re-exports OcxTool as a type.
+2. RECIPE FIX (grok finding 7): `export type { X } from` does not BIND X in
+   the barrel. types.ts still uses OcxTool (line 106), OcxToolChoice (299),
+   UpstreamHttpVersion (1455), CodexAccountMode (1470),
+   ReasoningSummaryDelivery (1574) — so the barrel adds a local
+   `import type { OcxTool, OcxToolChoice } from "./types/tools"` and
+   `import type { UpstreamHttpVersion, ReasoningSummaryDelivery,
+   CodexAccountMode } from "./types/wire"` next to the Kiro import.
+3. OcxToolChoice + its guards travel with tools.ts (they are one cluster).
+4. Extensionless specifiers only (lab walker resolves `${base}.ts`).
+5. AC4 corrected: scope proof = `git diff --stat <base>..HEAD -- src tests`
+   showing exactly 3 src files; devlog/plan files are committed separately.
+6. AC5 proof corrected: identity is preserved by ESM re-export semantics
+   (single declaration site); drop the false 'both import paths' claim.
+7. Protected-roots note corrected: PROTECTED has 4 files; only
+   responses/core.ts puts types.ts on the runtime graph (core.ts:63).
+

devlog/_plan/260818_megafile_split_program/020_wp1b_type_clusters.md

@@ -0,0 +1,94 @@
+# WP1b — types.ts type-cluster split (stacked PR 2, layer 2 of the stack)
+
+Stack (DEV-STACK-01/03): layer 1 = #2019 (codex/split-wp1-types, value leaves).
+This layer: codex/split-wp1b-type-clusters, base = codex/split-wp1-types.
+Thesis: src/types.ts becomes a pure barrel; all type clusters move to leaves.
+Class: C2 pure-move, type-only (zero runtime code moves in this layer).
+
+## Loop spec
+
+- Archetype: pure-move refactor, zero behavior change (type-only).
+- Verifier: bun run typecheck + full bun run test on lidge (remote contract).
+- Stop: green + PR opened with base codex/split-wp1-types + stack map in body.
+
+## Measured dependency structure (one-way, no cycles)
+
+- request cluster (lines 6-368): needs KiroOAuthMetadata (oauth/types),
+  OcxTool + OcxToolChoice (types/tools). Nothing else external.
+- config cluster (370-1180): needs OcxProviderConfig only (provider cluster).
+- provider cluster (1183-1698): needs UpstreamHttpVersion x2,
+  ReasoningSummaryDelivery x3, CodexAccountMode x2 (types/wire).
+- accounts cluster (1700-1729): self-contained.
+
+## File change map
+
+- ADD src/types/request.ts  <- lines 6-368 + import type {KiroOAuthMetadata}
+  from ../oauth/types, import type {OcxTool, OcxToolChoice} from ./tools
+- ADD src/types/config.ts   <- lines 370-1180 + import type
+  {OcxProviderConfig} from ./provider
+- ADD src/types/provider.ts <- lines 1183-1698 + import type {...} from ./wire
+- ADD src/types/accounts.ts <- lines 1700-1729, no imports
+- EDIT src/types.ts -> pure barrel (~30 lines): export type blocks for the 4
+  new leaves + existing tools/wire re-exports (values stay `export {}`,
+  types stay `export type {}`). KiroOAuthMetadata import dropped from barrel.
+
+## Accept criteria
+
+1. typecheck exit 0. 2. lidge full suite 0 fail (>= 13201 pass baseline).
+3. core-lab-boundary green (barrel value re-exports still walked; type-only
+   leaves are erased so runtime graph SHRINKS, never grows).
+4. Source diff: exactly 5 files under src/ (4 adds + barrel).
+5. Public surface byte-compatible: src/index.ts exports (OcxConfig, OcxContext,
+   OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxRequestOptions, OcxTool,
+   AdapterEvent) all still resolve from ./types.
+
+## Risks
+
+- `export type ... from` binds nothing locally (WP1 lesson) — but the new
+  barrel needs NO local bindings once all interfaces leave; only the 4
+  import-type lines vanish too. Residual: none expected.
+- interface merging/declaration duplication: each name must exist in exactly
+  one leaf; grep-verify no name appears in two files.
+- Tests importing `import * as types from ../src/types` (namespace): type-only
+  namespaces erased; runtime namespace keeps the same value exports via
+  tools/wire re-exports. No test currently reads a VALUE that moves (nothing
+  moves at runtime this layer).
+
+
+## Audit amendments round 2 (grok-4.6 NEAR-PASS / sol FAIL -> both fixed)
+
+CORRECTED extract ranges (file is 1727 lines):
+
+- request.ts:  lines 5-211 (incl. leading JSDoc) + 224-364
+  + import type { KiroOAuthMetadata } from ../oauth/types
+  + import type { OcxTool, OcxToolChoice } from ./tools
+  + import type { TierDecision, TierObservationContext } from ./provider
+    (OcxRequestOptions.tierDecision:235 / tierObservation:237 — missed edge)
+- config.ts:   lines 366-1181 (incl. closing brace 1181) MINUS the
+  RefreshPolicy block (1074-1080, moves to provider — see below)
+  + import type { OcxProviderConfig, RefreshPolicy } is WRONG — instead:
+  + import type { OcxProviderConfig } from ./provider (604)
+  + import type { CodexAccount } from ./accounts (874 — missed edge)
+- provider.ts: lines 1183-1687 + RefreshPolicy block (1074-1080; sole
+  consumer is OcxProviderConfig.refreshPolicy:1484 — relocation keeps the
+  graph one-way, avoids the config<->provider cycle)
+  + import type { UpstreamHttpVersion, ReasoningSummaryDelivery,
+    CodexAccountMode } from ./wire
+  + REWRITE 2 inline type-query paths (1659, 1665):
+    import("./adapters/cursor/...") -> import("../adapters/cursor/...")
+- accounts.ts: lines 1700-1727, no imports
+- BARREL KEEPS lines 213-222 (tools value re-exports) and 1689-1698 (wire
+  value re-exports): RUNTIME blocks, must NOT enter type-only leaves.
+  Final barrel = 2 value blocks + 4 export type blocks, named re-exports
+  only, NO export * (would duplicate runtime names).
+- The 3 import type lines at 1-3 vanish with their consumers.
+- Barrel needs RefreshPolicy re-exported from ./provider (was ./config).
+
+Corrected one-way graph: request -> {oauth, tools, provider};
+config -> {provider, accounts}; provider -> wire; accounts -> none.
+
+Both auditors confirmed: no namespace imports, no runtime dynamic import of
+types.ts (all import("...types").X hits are erased type queries), no textual
+test pins, lab walker unaffected while value blocks stay in barrel,
+src/index.ts keeps resolving. AC4 corrected: 5 files under src.
+

devlog/_plan/260818_megafile_split_program/030_wp2a_provider_name_leaf.md

@@ -0,0 +1,62 @@
+# WP2a-1 — config provider-name leaf (cycle breaker; parallel PR off dev)
+
+Branch codex/split-wp2a-config-names on dev@aaf04690e. NOT stacked on the
+types stack (disjoint files, DEV-STACK-01 'independent parts -> parallel PRs').
+Class C2 pure move + 2 consumer retargets. Risk basis 000_risk_assessment.md
+WP2a; highest-leverage low-risk config extraction: breaks the existing
+config <-> routing/profile import cycle.
+
+## Loop spec
+
+- Goal: isValidProviderName/hasOwnProvider live in a leaf with no heavy deps;
+  routing/profile.ts and router.ts stop importing them through the 3900-line
+  config barrel (which loads Zod + bun:sqlite + registry transitively).
+- Non-goals: no other config extraction this PR; management write-path
+  callers keep importing from ./config (barrel re-export).
+- Verifier: typecheck + lidge full suite + core-lab-boundary.
+
+## File change map
+
+- ADD src/config/provider-name.ts: RESERVED_PROVIDER_NAMES,
+  PROVIDER_NAME_PATTERN (both module-private consts, config.ts 738-750),
+  isValidProviderName (762), hasOwnProvider (769). Zero imports.
+- EDIT src/config.ts: delete moved bodies; add
+  `export { isValidProviderName, hasOwnProvider } from "./config/provider-name"`;
+  internal call sites (1150, 1390, 1597 + others) need a local
+  `import { ... } from "./config/provider-name"` since re-export binds nothing
+  (WP1 lesson).
+- EDIT src/routing/profile.ts:16: import hasOwnProvider from
+  ../config/provider-name (cycle edge profile->config removed).
+- EDIT src/router.ts:11: split import — hasOwnProvider from
+  ./config/provider-name, resolveEnvValue stays from ./config.
+
+## Accept criteria
+
+1. typecheck exit 0. 2. lidge full suite 0 fail (baseline 13201 pass).
+3. core-lab-boundary green (router edge now reaches a leaf with no imports —
+   protected graph shrinks).
+4. rg 'from "../config"' src/routing/profile.ts -> no hasOwnProvider import
+   through the barrel (cycle gone; remaining profile imports from config: none
+   expected — verify, else keep others intact).
+5. Source diff: exactly 4 files under src/.
+
+## Risks
+
+- config.ts superRefine calls isValidProviderName internally — the local
+  import must land before schema evaluation (top of file, hoisted; ESM fine).
+- routing/profile.ts may import more than hasOwnProvider from ../config —
+  verify and leave other names on the barrel.
+
+
+## Audit amendments (grok PASS / sol NEAR-PASS)
+
+- Internal call sites are EXACTLY 3 (1150, 1390 isValidProviderName; 1597
+  hasOwnProvider), all inside superRefine callbacks — no TDZ risk.
+- AC3 claim corrected: the protected graph does NOT shrink (router keeps the
+  barrel edge for resolveEnvValue; the leaf adds one dead-end module). The
+  real win is the config<->profile cycle break. core-lab-boundary stays
+  green either way.
+- profile.ts imports nothing else from ../config — cycle fully gone.
+- Tests importing isValidProviderName via barrel: config.test.ts:13,
+  policy-execution.test.ts:6 — barrel re-export preserves both.
+