fix: resolve workflow gaps exposed by frontier evals

Clarify plan-review ordering and fallback modes, preserve deploy readiness gates, honor configured merge methods, correct benchmark and canary contracts, and restore vendored installs on setup failure. Cover recovery with real-shell regressions.

Co-Authored-By: OpenAI Codex <noreply@openai.com>
This commit is contained in:
Garry Tan
2026-09-09 04:20:08 +00:00
co-authored by OpenAI Codex
parent a9f9ec5f08
commit 1f678a5b81
28 changed files with 317 additions and 130 deletions
+1 -1
View File
@@ -839,7 +839,7 @@ ${litmusItems}
- ALWAYS preserve visited vs unvisited link distinction (visited links must have a different color)
- NEVER float headings between paragraphs (heading must be visually closer to the section it introduces than to the preceding section)
**AI Slop blacklist** (the 10 patterns that scream "AI-generated"):
**AI Slop blacklist** (the ${AI_SLOP_BLACKLIST.length} patterns that scream "AI-generated"):
${slopItems}
Source: [OpenAI "Designing Delightful Frontends with GPT-5.4"](https://developers.openai.com/blog/designing-delightful-frontends-with-gpt-5-4) (Mar 2026) + gstack design methodology.`;
+6 -4
View File
@@ -639,12 +639,14 @@ review. The user turns this off only by asking explicitly
${codexPreflight({ disabledBehavior: 'skip-all' })}
When the mode is \`ready\`, \`not_installed\`, or \`not_authed\`, print one line so the off-switch
On \`under_codex\`, no in-host substitute is defined here: skip this outside-voice section and continue to the required outputs. Do not invoke Codex again or label a self-review as independent.
For all other non-disabled modes (\`ready\`, \`not_installed\`, \`not_authed\`, \`broken_install\`, \`model_unusable\`), print one line so the off-switch
stays discoverable: "Running the outside voice automatically (standard step). Disable: \`gstack-config set codex_reviews disabled\`."
**Construct the plan review prompt** (for \`ready\`, \`not_installed\`, and \`not_authed\` — skip only on \`disabled\`).
**Construct the plan review prompt** for every remaining mode, including all Claude fallback modes (skip on \`disabled\` or \`under_codex\`).
Read the plan file being reviewed (the file the user pointed this review at, or the branch
diff scope). If a CEO plan document was written in Step 0D-POST, read that too — it contains
diff scope). If a CEO plan document from an earlier \`/plan-ceo-review\` Step 0D-POST is available, read that too — it contains
the scope decisions and vision.
Construct this prompt (substitute the actual plan content — if plan content exceeds 30KB,
@@ -690,7 +692,7 @@ CODEX SAYS (plan review — outside voice):
- Timeout: "Codex timed out after 5 minutes." Fall back to the Claude subagent below.
- Empty response: "Codex returned no response." Fall back to the Claude subagent below.
**If \`CODEX_MODE: not_installed\` or \`not_authed\` (or Codex errored at runtime):**
**If \`CODEX_MODE: not_installed\`, \`not_authed\`, \`broken_install\`, or \`model_unusable\` (or Codex errored at runtime):**
Dispatch via the Agent tool with \`run_in_background: false\` (subagents default to background since ${CC_BACKGROUND_DEFAULT_SINCE}; the findings must land before the workflow continues). The subagent has fresh context and no conversation bias — but it is the SAME model family, not an outside model; weigh its agreement accordingly.
Bound it the same way as Codex: cap the dispatch at a 5-minute timeout so "never blocking"