Persist upstream Radar review artifacts

artifacts/github/impact/openai-codex-pr-27371.json

@@ -0,0 +1,48 @@
+{
+  "schema": "upstream_impact/v1",
+  "slug": "openai-codex-pr-27371",
+  "repo": "openai/codex",
+  "source_refs": {
+    "items": [
+      {
+        "kind": "pull_request",
+        "title": "Expose explicit dynamic tool namespaces in thread start",
+        "url": "https://github.com/openai/codex/pull/27371",
+        "meta": "Merged 2026-06-15T15:35:58Z"
+      },
+      {
+        "kind": "pull_request",
+        "title": "Source-backed Decodex upstream review",
+        "url": "https://github.com/openai/codex/pull/27371",
+        "meta": "artifacts/github/reviews/openai-codex-pr-27371.review.json"
+      }
+    ]
+  },
+  "observed_change": "Codex `thread/start.dynamicTools` now accepts tagged top-level function and namespace objects while normalizing legacy flat arrays and rejecting mixed legacy/canonical formats.",
+  "public_signal_decision": "publish",
+  "control_plane_impact": "compat_risk",
+  "publisher_angle": "operator_impact",
+  "confidence": "confirmed",
+  "evidence": [
+    "PR #27371 describes the canonical `dynamicTools` API as explicit top-level functions and namespace objects, while preserving fully legacy flat arrays.",
+    "`DynamicToolSpec` is now a tagged function-or-namespace protocol type exported through the app-server v2 schema.",
+    "`ThreadStartParams.dynamic_tools` deserializes through `normalize_dynamic_tool_specs`, which rejects mixed legacy and canonical formats.",
+    "App-server validation now checks namespace names, descriptions, reserved Responses API namespace collisions, duplicate namespaces, empty namespaces, and deferred top-level functions.",
+    "The README example and app-server integration tests cover the canonical namespace request shape and migration-sensitive invalid inputs.",
+    "The source-backed review is recorded at `artifacts/github/reviews/openai-codex-pr-27371.review.json`."
+  ],
+  "candidate_followups": [
+    "Audit Decodex app-server request builders and schemas for flat-only dynamic-tool assumptions.",
+    "Preserve namespace descriptions and nested tool lists in any Control Plane UI or artifact that renders app-server dynamic tools.",
+    "Add preflight validation for mixed legacy/canonical dynamic-tool arrays before Decodex sends `thread/start` requests."
+  ],
+  "social_notes": [
+    "Frame this as the app-server dynamic-tool API gaining an explicit namespace shape, not as removal of legacy flat arrays.",
+    "Mention that legacy flat arrays still normalize when used consistently, but mixed legacy/canonical arrays are rejected."
+  ],
+  "caveats": [
+    "The upstream PR keeps legacy flat arrays accepted for compatibility.",
+    "The feature is still under the experimental `thread/start.dynamicTools` surface.",
+    "Exact Decodex implementation changes require a separate follow-up if local Control Plane code sends or renders dynamic tools."
+  ]
+}

artifacts/github/impact/openai-codex-pr-28143.json

@@ -0,0 +1,49 @@
+{
+  "schema": "upstream_impact/v1",
+  "slug": "openai-codex-pr-28143",
+  "repo": "openai/codex",
+  "source_refs": {
+    "items": [
+      {
+        "kind": "pull_request",
+        "title": "feat(app-server): expose rate-limit reset credits",
+        "url": "https://github.com/openai/codex/pull/28143",
+        "meta": "Merged 2026-06-15T21:54:02Z"
+      },
+      {
+        "kind": "pull_request",
+        "title": "Source-backed Decodex upstream review",
+        "url": "https://github.com/openai/codex/pull/28143",
+        "meta": "artifacts/github/reviews/openai-codex-pr-28143.review.json"
+      }
+    ]
+  },
+  "observed_change": "Codex app-server now reports earned rate-limit reset credits in `account/rateLimits/read` and adds `account/rateLimitResetCredit/consume` with caller-supplied idempotency.",
+  "public_signal_decision": "publish",
+  "control_plane_impact": "candidate",
+  "publisher_angle": "operator_impact",
+  "confidence": "confirmed",
+  "evidence": [
+    "`GetAccountRateLimitsResponse` now includes nullable `rateLimitResetCredits` with `availableCount`.",
+    "The app-server protocol adds `account/rateLimitResetCredit/consume` with a non-empty `idempotencyKey` request parameter.",
+    "The consume response returns only an `outcome`; upstream docs tell clients to refetch `account/rateLimits/read` for updated window state.",
+    "Consume outcomes are camelCase: `reset`, `nothingToReset`, `noCredit`, and `alreadyRedeemed`.",
+    "The app-server processor requires ChatGPT-backed auth and maps backend reset-credit responses through a bounded timeout.",
+    "The source-backed review is recorded at `artifacts/github/reviews/openai-codex-pr-28143.review.json`."
+  ],
+  "candidate_followups": [
+    "Audit Decodex account and rate-limit read models for the nullable `rateLimitResetCredits` field.",
+    "Consider a guarded Control Plane action for consuming a reset credit with a stable idempotency key per logical user request.",
+    "After any consume action, refetch `account/rateLimits/read` instead of deriving updated windows from the consume response."
+  ],
+  "social_notes": [
+    "Frame this as an app-server account API capability for earned rate-limit reset credits.",
+    "Avoid implying automatic Decodex support until a separate Control Plane adoption issue is implemented.",
+    "Mention idempotency and refetch behavior because they are the operational details client authors need."
+  ],
+  "caveats": [
+    "The feature depends on ChatGPT-backed Codex auth and backend reset-credit availability.",
+    "The reset count is exposed on the read snapshot, not as a pushed notification update.",
+    "The upstream PR is protocol/backend foundation for a TUI `/usage` flow in a separate PR."
+  ]
+}