hack-ink · yvette-carlisle · Jun 9, 2026 · Jun 9, 2026
diff --git a/artifacts/github/bundles/openai-codex-pr-26202.json b/artifacts/github/bundles/openai-codex-pr-26202.json
@@ -0,0 +1,122 @@
+{
+  "analysis_mode": "pr_first",
+  "commits": [
+    {
+      "author": "nornagon-openai",
+      "committed_at": "2026-06-03T16:50:44Z",
+      "message": "Restore release symbol artifacts with line tables",
+      "sha": "95202ed2120c490f12f954daeb9ca8167f4e6dc8",
+      "url": "https://github.com/openai/codex/commit/95202ed2120c490f12f954daeb9ca8167f4e6dc8"
+    },
+    {
+      "author": "nornagon-openai",
+      "committed_at": "2026-06-04T16:27:04Z",
+      "message": "Merge remote-tracking branch 'origin/main' into nornagon/codex/release-symbol-line-tables",
+      "sha": "c7f7ad74df9090665b12869705c54268794d289d",
+      "url": "https://github.com/openai/codex/commit/c7f7ad74df9090665b12869705c54268794d289d"
+    },
+    {
+      "author": "nornagon-openai",
+      "committed_at": "2026-06-05T03:37:00Z",
+      "message": "Merge remote-tracking branch 'origin/main' into nornagon/codex/release-symbol-line-tables",
+      "sha": "69c1858bc0c90ef389b581719229395e42676ed3",
+      "url": "https://github.com/openai/codex/commit/69c1858bc0c90ef389b581719229395e42676ed3"
+    },
+    {
+      "author": "nornagon-openai",
+      "committed_at": "2026-06-05T17:01:11Z",
+      "message": "Move release symbol profile into Cargo config",
+      "sha": "0fd91f10f38d70146f7b1d6ed6a3df34207c97cd",
+      "url": "https://github.com/openai/codex/commit/0fd91f10f38d70146f7b1d6ed6a3df34207c97cd"
+    },
+    {
+      "author": "nornagon-openai",
+      "committed_at": "2026-06-08T17:10:16Z",
+      "message": "Merge remote-tracking branch 'origin/main' into nornagon/codex/release-symbol-line-tables",
+      "sha": "c7a47e5b23d8f0bf2742a052139eda48ab4982d6",
+      "url": "https://github.com/openai/codex/commit/c7a47e5b23d8f0bf2742a052139eda48ab4982d6"
+    }
+  ],
+  "default_branch": "main",
+  "docs_refs": [],
+  "examples_refs": [],
+  "extracted_flags": [
+    "PDB",
+    "CARGO_PROFILE_RELEASE_DEBUG=full",
+    "ARM",
+    "YAML",
+    "--check",
+    "EOF",
+    "--target",
+    "--artifact-name",
+    "--release-dir",
+    "--archive-dir",
+    "--binaries",
+    "--help",
+    "RUNNER_TEMP",
+    "OBJCOPY",
+    "STRIP",
+    "--only-keep-debug",
+    "--strip-debug",
+    "--strip-unneeded",
+    "--add-gnu-debuglink",
+    "AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME",
+    "AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME",
+    "GITHUB_WORKSPACE",
+    "WINDOWS_BINARIES",
+    "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO",
+    "CLI",
+    "DEBIAN_FRONTEND=noninteractive",
+    "--no-install-recommends",
+    "CODEX_BWRAP_SHA256=${digest}\"",
+    "GITHUB_ENV",
+    "--bin",
+    "--release",
+    "--timings"
+  ],
+  "files": [
+    {
+      "additions": 119,
+      "deletions": 0,
+      "patch_excerpt": "@@ -0,0 +1,119 @@\n+#!/usr/bin/env bash\n+set -euo pipefail\n+\n+usage() {\n+  cat <<'EOF'\n+Usage: archive-release-symbols-and-strip-binaries.sh \\\n+  --target <rust-target> \\\n+  --artifact-name <artifact-name> \\\n+  --release-dir <dir> \\\n+  --archive-dir <dir> \\\n+  --binaries \"<space-delimited binary basenames>\"\n+EOF\n+}\n+\n+target=\"\"\n+artifact_name=\"\"\n+release_dir=\"\"\n+archive_dir=\"\"\n+binaries=\"\"\n+\n+while [[ $# -gt 0 ]]; do\n+  case \"$1\" in\n+    --target)\n+      target=\"${2:?--target requires a value}\"\n+      shift 2\n+      ;;\n+    --artifact-name)\n+      artifact_name=\"${2:?--artifact-name requires a value}\"\n+      shift 2\n+      ;;\n+    --release-dir)\n+      release_dir=\"${2:?--release-dir requires a value}\"\n+      shift 2\n+      ;;\n+    --archive-dir)\n+      archive_dir=\"${2:?--archive-dir requires a value}\"\n+      shift 2\n+      ;;\n+    --binaries)\n+      binaries=\"${2:?--binaries requires a ...",
+      "path": ".github/scripts/archive-release-symbols-and-strip-binaries.sh",
+      "status": "added"
+    },
+    {
+      "additions": 31,
+      "deletions": 2,
+      "patch_excerpt": "@@ -112,10 +112,22 @@ jobs:\n       - name: Stage Windows binaries\n         shell: bash\n         run: |\n-          output_dir=\"target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}\"\n+          release_dir=\"target/${{ matrix.target }}/release\"\n+          output_dir=\"$release_dir/staged-${{ matrix.bundle }}\"\n           mkdir -p \"$output_dir\"\n           for binary in ${{ matrix.binaries }}; do\n-            cp \"target/${{ matrix.target }}/release/${binary}.exe\" \"$output_dir/${binary}.exe\"\n+            pdb_name=\"${binary//-/_}\"\n+            pdb_path=\"$release_dir/${pdb_name}.pdb\"\n+            if [[ ! -f \"$pdb_path\" ]]; then\n+              pdb_path=\"$release_dir/${binary}.pdb\"\n+            fi\n+            if [[ ! -f \"$pdb_path\" ]]; then\n+              echo \"PDB for $binary not found at $release_dir/${pdb_name}.pdb or $release_dir/${binary}.pdb\" >&2\n+              exit 1\n+            f...",
+      "path": ".github/workflows/rust-release-windows.yml",
+      "status": "modified"
+    },
+    {
+      "additions": 38,
+      "deletions": 1,
+      "patch_excerpt": "@@ -64,6 +64,8 @@ jobs:\n       run:\n         working-directory: codex-rs\n     env:\n+      # macOS release packages archive packed dSYM bundles before stripping.\n+      CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(matrix.target, 'apple-darwin') && 'packed' || 'off' }}\n       # Use the git CLI instead of Cargo's libgit2 path for git dependencies.\n       # macOS release runners have intermittently failed to fetch nested\n       # submodules through SecureTransport/libgit2, especially libwebrtc's\n@@ -163,7 +165,7 @@ jobs:\n         run: |\n           set -euo pipefail\n           sudo apt-get update -y\n-          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev\n+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends binutils pkg-config libcap-dev\n       - uses: dtolnay/rust-toolchain@e081816240890017053e...",
+      "path": ".github/workflows/rust-release.yml",
+      "status": "modified"
+    },
+    {
+      "additions": 4,
+      "deletions": 3,
+      "patch_excerpt": "@@ -501,10 +501,11 @@ strip = \"symbols\"\n \n [profile.release]\n lto = \"thin\"\n+debug = \"line-tables-only\"\n split-debuginfo = \"off\"\n-# Because we bundle some of these executables with the TypeScript CLI, we\n-# remove everything to make the binary as small as possible.\n-strip = \"symbols\"\n+# Keep release binaries symbolicateable until packaging has archived the\n+# sidecar symbols and stripped the binaries.\n+strip = false\n \n # See https://github.com/openai/codex/issues/1411 for details.\n codegen-units = 1",
+      "path": "codex-rs/Cargo.toml",
+      "status": "modified"
+    }
+  ],
+  "linked_issues": [],
+  "notes": [
+    "Built from GitHub pull-request, commits, files, and repo endpoints."
+  ],
+  "primary_pr": {
+    "body": "## Summary\n\n- Restore separate release symbol archives for macOS, Linux, and Windows binaries.\n- Build release binaries with `line-tables-only` debuginfo instead of full debuginfo.\n- Strip Unix distribution binaries after extracting symbols, preserve Windows PDBs, and keep symbol archives available to the release job.\n- Strip the packaged Linux `bwrap` binary before hashing it so the embedded digest matches the distributed bytes.\n\n## Root cause\n\nThe first symbol-artifact implementation enabled `CARGO_PROFILE_RELEASE_DEBUG=full`. In the June 2 release runs, macOS ARM primary builds reached the 90-minute timeout while still inside `Cargo build`. After the symbol changes were reverted, the same primary build completed in about 22 minutes. The archive step itself completed in tens of seconds when reached.\n\nRust's `line-tables-only` debuginfo level preserves function names and source locations for symbolication without emitting the heavier variable and type information from full debuginfo.\n\n## Validation\n\n- Ran `just fmt` from `codex-rs`.\n- Ran `just test-github-scripts` from the repository root: 23 tests passed.\n- Ran `bash -n` and `shellcheck` on `.github/scripts/archive-release-symbols-and-strip-binaries.sh`.\n- Parsed both modified workflows as YAML and ran `git diff --check`.\n- Built a macOS release smoke binary with `line-tables-only`, archived its dSYM through the restored script, stripped the production binary, and verified that `atos` resolves `symbol_smoke_function` to `main.rs:2`.\n- Ran Linux archive-script control-flow coverage with stubbed `objcopy` and `strip` commands.\n- Ran Windows PDB archive staging coverage and verified underscore-emitted Rust PDB names are staged under shipped hyphenated binary names.\n\n## Follow-up\n\nThe release workflow only runs for tags or manual dispatches, so CI cannot dry-run the full release matrix on this PR. The next release run will verify runner time and memory behavior under `line-tables-only`.\n",
+    "labels": [],
+    "merged_at": "2026-06-08T17:16:37Z",
+    "number": 26202,
+    "state": "merged",
+    "title": "[codex] Restore release symbol artifacts with line tables",
+    "url": "https://github.com/openai/codex/pull/26202"
+  },
+  "repo": "openai/codex",
+  "schema": "github_change_bundle/v1"
+}
diff --git a/artifacts/github/bundles/openai-codex-pr-26230.json b/artifacts/github/bundles/openai-codex-pr-26230.json
@@ -0,0 +1,111 @@
+{
+  "analysis_mode": "pr_first",
+  "commits": [
+    {
+      "author": "viyatb-oai",
+      "committed_at": "2026-06-03T17:31:13Z",
+      "message": "fix: preserve Auto Review across config and tasks",
+      "sha": "d6528ccc954f1768a3d7d080bba8162b59d982a1",
+      "url": "https://github.com/openai/codex/commit/d6528ccc954f1768a3d7d080bba8162b59d982a1"
+    },
+    {
+      "author": "viyatb-oai",
+      "committed_at": "2026-06-05T17:26:03Z",
+      "message": "fix: align app-server auto review serialization",
+      "sha": "bf84a984d0233936cf29c72dd60d704b9182d569",
+      "url": "https://github.com/openai/codex/commit/bf84a984d0233936cf29c72dd60d704b9182d569"
+    },
+    {
+      "author": "saud-oai",
+      "committed_at": "2026-06-08T18:35:16Z",
+      "message": "Merge branch 'main' into codex/viyatb/guardian-auto-review-continuity",
+      "sha": "8e14f2d413ef8a826d45a0602573148c6c7ac358",
+      "url": "https://github.com/openai/codex/commit/8e14f2d413ef8a826d45a0602573148c6c7ac358"
+    }
+  ],
+  "default_branch": "main",
+  "docs_refs": [],
+  "examples_refs": [],
+  "extracted_flags": [
+    "TUI",
+    "MDM"
+  ],
+  "files": [
+    {
+      "additions": 1,
+      "deletions": 1,
+      "patch_excerpt": "@@ -233,7 +233,7 @@ impl From<CoreAskForApproval> for AskForApproval {\n pub enum ApprovalsReviewer {\n     #[serde(rename = \"user\")]\n     User,\n-    #[serde(rename = \"guardian_subagent\", alias = \"auto_review\")]\n+    #[serde(rename = \"auto_review\", alias = \"guardian_subagent\")]\n     AutoReview,\n }",
+      "path": "codex-rs/app-server-protocol/src/protocol/v2/shared.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 1,
+      "deletions": 1,
+      "patch_excerpt": "@@ -65,7 +65,7 @@ fn approvals_reviewer_serializes_auto_review_and_accepts_legacy_guardian_subagen\n     );\n     assert_eq!(\n         serde_json::to_string(&ApprovalsReviewer::AutoReview).expect(\"serialize reviewer\"),\n-        \"\\\"guardian_subagent\\\"\"\n+        \"\\\"auto_review\\\"\"\n     );\n \n     for value in [\"user\", \"auto_review\", \"guardian_subagent\"] {",
+      "path": "codex-rs/app-server-protocol/src/protocol/v2/tests.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 1,
+      "deletions": 1,
+      "patch_excerpt": "@@ -1467,7 +1467,7 @@ foo = \"xyzzy\"\n             TomlValue::Table(toml::map::Map::from_iter([(\n                 \"allowed_approvals_reviewers\".to_string(),\n                 TomlValue::Array(vec![\n-                    TomlValue::String(\"guardian_subagent\".to_string()),\n+                    TomlValue::String(\"auto_review\".to_string()),\n                     TomlValue::String(\"user\".to_string()),\n                 ]),\n             )]))",
+      "path": "codex-rs/config/src/loader/mod.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 1,
+      "deletions": 0,
+      "patch_excerpt": "@@ -262,6 +262,7 @@ pub(crate) fn apply_spawn_agent_runtime_overrides(\n         .map_err(|err| {\n             FunctionCallError::RespondToModel(format!(\"approval_policy is invalid: {err}\"))\n         })?;\n+    config.approvals_reviewer = turn.config.approvals_reviewer;\n     config.permissions.shell_environment_policy = turn.shell_environment_policy.clone();\n     config.codex_linux_sandbox_exe = turn.codex_linux_sandbox_exe.clone();\n     #[allow(deprecated)]",
+      "path": "codex-rs/core/src/tools/handlers/multi_agents_common.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 5,
+      "deletions": 0,
+      "patch_excerpt": "@@ -24,6 +24,7 @@ use codex_model_provider::create_model_provider;\n use codex_model_provider_info::built_in_model_providers;\n use codex_protocol::AgentPath;\n use codex_protocol::ThreadId;\n+use codex_protocol::config_types::ApprovalsReviewer;\n use codex_protocol::config_types::ServiceTier;\n use codex_protocol::config_types::ShellEnvironmentPolicy;\n use codex_protocol::models::BaseInstructions;\n@@ -2331,6 +2332,9 @@ async fn spawn_agent_reapplies_runtime_sandbox_after_role_config() {\n     turn.approval_policy\n         .set(AskForApproval::OnRequest)\n         .expect(\"approval policy should be set\");\n+    let mut config = (*turn.config).clone();\n+    config.approvals_reviewer = ApprovalsReviewer::AutoReview;\n+    set_turn_config(&mut turn, config);\n     turn.permission_profile = expected_permission_profile.clone();\n     assert_ne!(\n         expected_permission_profile,\n@@ -2370,6 +2374,7 @@...",
+      "path": "codex-rs/core/src/tools/handlers/multi_agents_tests.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 3,
+      "deletions": 3,
+      "patch_excerpt": "@@ -166,8 +166,8 @@ pub enum ApprovalsReviewer {\n     #[default]\n     #[serde(rename = \"user\")]\n     User,\n-    #[serde(rename = \"guardian_subagent\", alias = \"auto_review\")]\n-    #[strum(serialize = \"guardian_subagent\")]\n+    #[serde(rename = \"auto_review\", alias = \"guardian_subagent\")]\n+    #[strum(serialize = \"auto_review\")]\n     AutoReview,\n }\n \n@@ -760,7 +760,7 @@ mod tests {\n         );\n         assert_eq!(\n             serde_json::to_string(&ApprovalsReviewer::AutoReview).expect(\"serialize reviewer\"),\n-            \"\\\"guardian_subagent\\\"\"\n+            \"\\\"auto_review\\\"\"\n         );\n \n         for value in [\"user\", \"auto_review\", \"guardian_subagent\"] {",
+      "path": "codex-rs/protocol/src/config_types.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 2,
+      "deletions": 2,
+      "patch_excerpt": "@@ -1824,7 +1824,7 @@ async fn update_feature_flags_enabling_guardian_selects_auto_review() -> Result<\n \n     let config = std::fs::read_to_string(codex_home.path().join(\"config.toml\"))?;\n     assert!(config.contains(\"guardian_approval = true\"));\n-    assert!(config.contains(\"approvals_reviewer = \\\"guardian_subagent\\\"\"));\n+    assert!(config.contains(\"approvals_reviewer = \\\"auto_review\\\"\"));\n     assert!(config.contains(\"approval_policy = \\\"on-request\\\"\"));\n     assert!(config.contains(\"sandbox_mode = \\\"workspace-write\\\"\"));\n     app_server.shutdown().await?;\n@@ -1988,7 +1988,7 @@ async fn update_feature_flags_enabling_guardian_overrides_explicit_manual_review\n     );\n \n     let config = std::fs::read_to_string(codex_home.path().join(\"config.toml\"))?;\n-    assert!(config.contains(\"approvals_reviewer = \\\"guardian_subagent\\\"\"));\n+    assert!(config.contains(\"approvals_reviewer = \\\"auto_rev...",
+      "path": "codex-rs/tui/src/app/tests.rs",
+      "status": "modified"
+    },
+    {
+      "additions": 2,
+      "deletions": 2,
+      "patch_excerpt": "@@ -755,7 +755,7 @@ mod tests {\n             \"allowed_approval_policies: on-request (source: {requirements_source})\"\n         )));\n         assert!(rendered.contains(\n-            \"allowed_approvals_reviewers: guardian_subagent (source: MDM managed_config.toml (legacy))\"\n+            \"allowed_approvals_reviewers: auto_review (source: MDM managed_config.toml (legacy))\"\n         ));\n         assert!(\n             rendered.contains(\n@@ -818,7 +818,7 @@ mod tests {\n \n         let rendered = render_to_text(&render_debug_config_lines(&stack));\n         assert!(rendered.contains(\n-            \"allowed_approvals_reviewers: guardian_subagent (source: MDM managed_config.toml (legacy))\"\n+            \"allowed_approvals_reviewers: auto_review (source: MDM managed_config.toml (legacy))\"\n         ));\n         assert!(!rendered.contains(\"Requirements:\\n  <none>\"));\n     }",
+      "path": "codex-rs/tui/src/debug_config.rs",
+      "status": "modified"
+    }
+  ],
+  "linked_issues": [
+    "#26231",
+    "#26334",
+    "#26333",
+    "#26232"
+  ],
+  "notes": [
+    "Built from GitHub pull-request, commits, files, and repo endpoints."
+  ],
+  "primary_pr": {
+    "body": "## Why\n\nAuto Review should remain the effective approval reviewer when settings cross runtime boundaries. A config or app-server round trip must not change the reviewer identity, and delegated work must not silently fall back to user review.\n\nThis requires both a stable canonical serialized value and propagation of the effective setting. `auto_review` is the canonical value across protocol and app-server output, while `guardian_subagent` remains accepted as backward-compatible input.\n\n## What changed\n\n- serialize `ApprovalsReviewer::AutoReview` consistently as `auto_review` across core protocol and app-server v2\n- continue accepting `guardian_subagent` when reading existing config or client requests\n- carry the active turn's approval reviewer into spawned agents\n- update config/debug expectations and add delegated-task regression coverage\n\n## Scope\n\nThis does not change Guardian policy or remove compatibility with existing `guardian_subagent` inputs. It preserves the selected reviewer across serialization, config reloads, app-server settings, and delegated task setup.\n\nRelated Guardian changes are split independently:\n\n- #26231 adds denials and soft denials\n- #26334 retries transient reviewer failures\n- #26333 reuses narrowly scoped low-risk approvals\n- #26232 adds TUI denial recovery\n\n## Validation\n\n- `just test -p codex-app-server-protocol` (224 passed)\n- regression coverage for delegated task reviewer propagation\n- serialization coverage for canonical `auto_review` output and legacy `guardian_subagent` input\n",
+    "labels": [],
+    "merged_at": "2026-06-08T18:59:51Z",
+    "number": 26230,
+    "state": "merged",
+    "title": "fix: preserve auto review across config and delegation",
+    "url": "https://github.com/openai/codex/pull/26230"
+  },
+  "repo": "openai/codex",
+  "schema": "github_change_bundle/v1"
+}