Status: LIVE_FAIL_CLOSED / REAL_CODEX_ACCEPTANCE_PENDING / PRODUCTION_NO_GO

Protocol: rumbo-continuity-relay/v1

Current runtime:

R11-EXACT-SINGLE-COMMAND-PROBE

The relay is the continuity transport between ChatGPT-side workflows and a real local Codex runtime. It is not product-production authority and it does not synthesize a local runtime acceptance.

R11 preserves the R10 scoped-device, authenticated-provenance, isolated-Codex and secret-scrubbed shell controls, and additionally proves an exact single local probe command.

Current controls include:

• GPT/admin use dedicated environment-held bearers;
• a Codex device receives a short-lived per-device bearer only after explicit approval of its exact inspected pairing contract;
• device credentials are scoped to CODEX_REAL_RUNTIME_ACCEPTANCE_V6;
• the legacy shared Codex bearer is rejected;
• Codex ACK and reverse response must come from the same authenticated pairing/token;
• device inbox access is disabled and ACK/message targets are constrained;
• pairing contracts bind bootstrap SHA-256, lane, challenge id and challenge SHA-256;
• Codex runs with isolated CODEX_HOME, --ignore-user-config, --ignore-rules, --ask-for-approval never, --sandbox read-only and --ephemeral;
• model-reachable shell commands use shell_environment_policy.inherit="core";
• default KEY/SECRET/TOKEN exclusions stay enabled;
• explicit excludes cover CODEX_HOME, OPENAI_*, *PASS*, *CREDENTIAL*, *AUTH* and *COOKIE*;
• a hash-pinned local environment probe must report no CODEX_HOME, no OPENAI_* and zero sensitive-name matches without printing names or values;
• device tokens are effectively capped at 15 minutes, self-revoke on success, attempt fail-closed revocation on error, and must be inactive before final GPT ACK;
• the exact runtime probe has a 90-second Codex exec timeout; timeout is fail-closed and still triggers the failure-revocation path;
• exactly one shell command must start and complete with the same item id;
• the observed command must equal the generated hash-pinned probe wrapper command;
• second commands plus file-change, web, MCP and collab tool items are rejected;
• audit events are append-only and hash chained;
• production_go=false.

Public read-only bootstrap endpoints:

• GET /v1/bootstrap/codex-device/metadata
• GET /v1/bootstrap/codex-device.py
• GET /v1/bootstrap/codex-device.ps1

Current metadata:

• schema: rumbo-codex-device-bootstrap/v5
• runtime: R11-EXACT-SINGLE-COMMAND-PROBE
• launcher version: 7.2
• Python launcher SHA-256: 490907dc0adc4e7adcf65d76fdaa6d8ca9649fcd0a87e02a3163bdbdfccf132d
• Python launcher bytes: 29735
• Windows launcher SHA-256: c67925a8780253aa39fdd653d1c67c3581cf5e23a5a6a70c95c41e4f57fc4cbf
• Windows launcher bytes: 5106
• Python minimum: 3.11
• canonical release: GPT_CODEX_CONTEXT_BRIDGE_V1_6
• canonical release SHA-256: cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b
• canonical Skill SHA-256: 152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068
• Skill MD SHA-256: 224197fb56be75ae395fb2e4e2eb48f3bd64d1e187df5799fd6d661e4d1ec09f
• plugin: rumbo-gpt-codex-continuity@1.2.0
• plugin manifest SHA-256: c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27
• environment probe SHA-256: 8dff8e38c986fabdea627183745fb643bfbcb8c9262e915f6d1f8447d90a2f72

The PowerShell launcher performs Codex/Python preflight, fetches live metadata, downloads the hash-pinned Python launcher, runs --preflight-only, and only then starts the device-code flow. It embeds no relay bearer or OpenAI API key.

Active lane:

CODEX_REAL_RUNTIME_ACCEPTANCE_V6

V1, V2, V3, V4 and V5 are explicitly:

SUPERSEDED_BY_CODEX_REAL_RUNTIME_ACCEPTANCE_V6

Current challenge:

• message id: 1638b61d-86e0-470e-8f2c-138fd9db966c
• message SHA-256: 45afab1a27f762accf1b045c91656ff1bddf5c97009b922f335da93c81b3b653
• challenge revision: 1
• checkpoint SHA-256: 0da5fdad8dbcbbdc41550bc49ea3ae0672d23afe7fd55e3ec0ecb933066ee8b6
• acceptance deadline: 2026-09-02T03:15:00Z

Current evidence-derived state:

PENDING_CODEX_ACK

mechanical_checks_passed=false

A valid reverse response must prove the scrubbed shell environment and the exact one-command wrapper/event contract. A mechanical PASS still stops at PENDING_CHATGPT_ACK until semantic review and the exact GPT ACK are recorded.

Promotion merge target:

main@208

Post-promotion canonical evaluation:

01a04c94-d54d-71a4-a0d6-a59bffc50773

Result: PASS.

Post-promotion exact-command audit:

01a04c95-470c-73d6-91a3-c25d867c4c26

Result: PASS.

Observed:

• runtime: R11-EXACT-SINGLE-COMMAND-PROBE
• bootstrap schema: v5
• exact Python and Windows download/hash binding: PASS
• exact-single-command/same-item-id/collab rejection audit: PASS
• V1/V2/V3/V4/V5 superseded by V6
• V6: PENDING_CODEX_ACK
• lane revision: 1
• lane checkpoint: 0da5fdad8dbcbbdc41550bc49ea3ae0672d23afe7fd55e3ec0ecb933066ee8b6
• live V6 Codex ACKs: 0
• live V6 Codex responses: 0
• active V6 device tokens: 0
• pending V6 pairings: 0
• audit chain: PASS
• production_go=false
• authentic Windows runtime: NOT_PROVEN

No synthetic/branch/post-promotion selftest satisfies the authentic Windows Codex gate.

continuity_runtime_watch.ts is active every 15 minutes. It resolves the current acceptance lane dynamically, verifies the audit chain, tracks both launcher hashes and flags contract drift or evidence requiring action.

Latest manual post-promotion run:

01a04c95-61c6-744b-940f-cbb8e61e8cbd — PASS / no drift / not urgent.

The relay still contains historical fail-closed R2 guard primitives, but current R2 GitHub authority is separated into dedicated services:

• GitHub App custody broker: R2_GITHUB_APP_CUSTODY_BROKER_V1_3_OBSERVER_JOURNAL_PINNED
• observer: R2_GITHUB_OBSERVER_V1_6_DURABLE_REOBSERVATION_JOURNAL
• authorizer: DEDICATED_R2_AUTHORIZER_V3_6_OBSERVER_JOURNAL_PINNED
• deployer: R2_DEPLOYER_CONTROLLER_V3_7_OBSERVER_JOURNAL_PINNED

Observer V1.6 durably journals every fresh signed re-observation, including repeated observations of the same PR/head, in a reconstructable full-receipt v2 ledger.

Those boundaries do not make this relay product-production authority.

This relay can prove continuity transport and, only when authentic evidence satisfies the full acceptance contract, the real Codex runtime roundtrip.

It cannot by itself authorize a GitHub merge, production deployment, paid plan, repository-visibility change or product-production GO.

Current product-production state remains NO_GO.