Date: 2026-08-28/29 UTC Branch: r6-device-bootstrap Fork baseline: main version 50 Branch version before this receipt: 39 Scope: secretless real-device bootstrap for the existing Codex runtime acceptance gate Production: NO_GO

The durable gate remains CODEX_REAL_RUNTIME_ACCEPTANCE_V1. R6 does not replace R5 pairing recovery, R4 acceptance verification, R3 fail-closed external guard, or the exact challenge.

Exact challenge:

• id: f7ca12d8-226a-43b9-9fc0-bd9ede8548af
• message SHA-256: 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979
• lane checkpoint SHA-256: d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962
• live acceptance state during branch validation: PENDING_CODEX_ACK

The remaining physical gate depended on a pre-shared pairing secret and an opaque activation ZIP whose latest sidecar was observable but whose bytes/regeneration receipt were not available in the current File Library surface.

R6 introduces a public device-code bootstrap with no embedded credentials:

1. real Codex host starts a device session;
2. server returns a 256-bit device code plus a short human code;
3. only the short code is pasted into an authenticated RUMBO/ChatGPT conversation;
4. GPT/admin approval atomically authorizes that exact hash-bound device session;
5. the local host polls using the secret device code and only then receives the Codex bearer;
6. local bootstrap confirms pairing, reconstructs and verifies the plugin, ACKs the exact challenge, and publishes the nonce-bound reverse response;
7. final ChatGPT semantic review/ACK remains separate.

• raw device/user codes are never persisted; only SHA-256 values are stored;
• 32-byte device-code entropy;
• unbiased short-code generation via rejection sampling;
• pending-session limits: 3 per client fingerprint, 100 global;
• client fingerprint stores only SHA-256 of network/user-agent material;
• approval requires GPT/admin bearer;
• start cannot approve;
• pre-approval poll returns 202 and no bearer;
• approval is atomic against expiry;
• device/token-delivery sensitive changes compensate audit-append failure;
• real pairing issue/reissue paths compensate audit-append failure;
• active pairing from another channel fails closed;
• production_go=false throughout.

Path: /v1/bootstrap/codex-device.py Metadata path: /v1/bootstrap/codex-device/metadata Launcher version: 1.3 Python minimum: 3.11 Bytes: 13,466 SHA-256: 5bd101b674bcc4cc6f6e842d285c486857cb73b20211c375706067eba71fbcd6 Embedded credentials: false

Launcher properties:

• canonical V1.6 Skill ZIP SHA verification;
• safe ZIP path validation;
• clean plugin staging rather than hybrid overlay;
• official-format .codex-plugin/plugin.json and personal marketplace entry;
• plugin, cache and marketplace backups;
• rollback of plugin/cache/marketplace on handled installation failure;
• codex plugin add invocation;
• plugin list check plus material cached-SKILL byte verification;
• exact-byte runtime receipt SHA;
• receipt binds exact challenge id/SHA, challenge nonce and bootstrap script SHA;
• crash/retry resume verifies manifest, marketplace, plugin list and cache before reuse;
• exact challenge ACK only;
• deterministic idempotent reverse-response request id;
• final ChatGPT ACK is never fabricated.

Local sandbox syntax compilation of these exact bytes: PASS.

Bootstrap HTTP integrity:

• evaluation id: 01a04b79-fc0c-779d-8dd6-b1428bf9a932
• HTTP 200
• bytes: 13,466 exact
• body SHA-256: exact
• X-SHA256: exact
• launcher v1.3 marker: PASS
• exact receipt-byte hash marker: PASS
• resume verifier: PASS
• nonce receipt binding: PASS
• plugin/marketplace/cache rollback markers: PASS

Device separation self-test:

• final evaluation id: 01a04b7a-34c5-71bd-b230-3f314a00c4ce
• start: HTTP 201
• pre-approval poll: HTTP 202
• unauthenticated approval: HTTP 401
• GPT approval: HTTP 200
• approval replay: IDEMPOTENT_PASS
• token delivered: false
• real codex-v4 pairing touched: false
• fixture cleanup: PASS

Note: an earlier self-test evaluation printed all functional checks PASS but ended with a false cleanup failure because the test used 0 || -1. Database inspection proved the row had been deleted. The test assertion was corrected to nullish handling and the final evaluation above passed. Synthetic approval audit events are preserved in the append-only audit chain and are not represented as real runtime evidence.

Integrated branch regression:

• evaluation id: 01a04b7a-222f-77bf-9a1b-b08e25952f67
• implementation: R6-DEVICE-BOOTSTRAP
• acceptance: PENDING_CODEX_ACK
• lane revision: 1
• checkpoint exact: PASS
• audit_chain_ok: true
• launcher metadata exact: PASS
• production_go: false
• real_codex_runtime: NOT_PROVEN_BY_THIS_TEST

Final static/adversarial audit:

• 26/26 security/invariant checks PASS
• R5 pairing recovery preserved
• R4 acceptance verifier preserved
• R2_ALLOW_MERGE_AUTHORIZATION absent
• no self-test HTTP route
• no literal bearer/API/GitHub credential in launcher
• no production promotion path added

• real pairing id codex-v4: no row
• device self-test fixture rows: none
• challenge ACK: NOT_PROVEN
• Codex reverse response: NOT_PROVEN
• final GPT ACK: NOT_PROVEN

R6 branch may be promoted because it makes the physical gate safer and recoverable without performing that gate.

Promotion does NOT mean:

• REAL_CODEX_RUNTIME_PASS
• REAL_CODEX_ACK
• REAL_CODEX_RESPONSE
• FINAL_CHATGPT_ACK
• PRODUCT_GO
• PRODUCTION_GO

After promotion, main must be revalidated for health, launcher bytes/hash, device separation, acceptance/checkpoint, audit chain, zero codex-v4 row, and remote-device availability.