Add files using upload-large-folder tool

.github/ISSUE_TEMPLATE/1-codex-app.yml

@@ -0,0 +1,54 @@
+name: 🖥️ Codex App Bug
+description: Report an issue with the Codex App
+labels:
+  - app
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting a new issue, please search for existing issues to see if your issue has already been reported.
+        If it has, please add a 👍 reaction (no need to leave a comment) to the existing issue instead of creating a new one.
+
+  - type: input
+    id: version
+    attributes:
+      label: What version of the Codex App are you using (From “About Codex” dialog)?
+    validations:
+      required: true
+  - type: input
+    id: plan
+    attributes:
+      label: What subscription do you have?
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: What platform is your computer?
+      description: |
+        For macOS and Linux: copy the output of `uname -mprs`
+        For Windows: copy the output of `"$([Environment]::OSVersion | ForEach-Object VersionString) $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" })"` in the PowerShell console
+  - type: textarea
+    id: actual
+    attributes:
+      label: What issue are you seeing?
+      description: Please include the full error messages and prompts with PII redacted. If possible, please provide text instead of a screenshot.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: What steps can reproduce the bug?
+      description: Explain the bug and provide a code snippet that can reproduce it. Please include session id, token limit usage, context window usage if applicable.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What is the expected behavior?
+      description: If possible, please provide text instead of a screenshot.
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional information
+      description: Is there anything else you think we should know?

.github/ISSUE_TEMPLATE/2-extension.yml

@@ -0,0 +1,61 @@
+name: 🧑‍💻 IDE Extension Bug
+description: Report an issue with the IDE extension
+labels:
+  - extension
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting a new issue, please search for existing issues to see if your issue has already been reported.
+        If it has, please add a 👍 reaction (no need to leave a comment) to the existing issue instead of creating a new one.
+
+  - type: input
+    id: version
+    attributes:
+      label: What version of the IDE extension are you using?
+    validations:
+      required: true
+  - type: input
+    id: plan
+    attributes:
+      label: What subscription do you have?
+    validations:
+      required: true
+  - type: input
+    id: ide
+    attributes:
+      label: Which IDE are you using?
+      description: Like `VS Code`, `Cursor`, `Windsurf`, etc.
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: What platform is your computer?
+      description: |
+        For macOS and Linux: copy the output of `uname -mprs`
+        For Windows: copy the output of `"$([Environment]::OSVersion | ForEach-Object VersionString) $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" })"` in the PowerShell console
+  - type: textarea
+    id: actual
+    attributes:
+      label: What issue are you seeing?
+      description: Please include the full error messages and prompts with PII redacted. If possible, please provide text instead of a screenshot.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: What steps can reproduce the bug?
+      description: Explain the bug and provide a code snippet that can reproduce it.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What is the expected behavior?
+      description: If possible, please provide text instead of a screenshot.
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional information
+      description: Is there anything else you think we should know?

.github/ISSUE_TEMPLATE/3-cli.yml

@@ -0,0 +1,81 @@
+name: 💻 CLI Bug
+description: Report an issue in the Codex CLI
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting a new issue, please search for existing issues to see if your issue has already been reported.
+        If it has, please add a 👍 reaction (no need to leave a comment) to the existing issue instead of creating a new one.
+
+        Make sure you are running the [latest](https://npmjs.com/package/@openai/codex) version of Codex CLI. The bug you are experiencing may already have been fixed.
+
+        If your version supports it, please run `codex doctor --json` and paste the output in the "Codex doctor report" field below. This helps us diagnose install, config, auth, terminal, MCP, network, and local state issues.
+
+  - type: input
+    id: version
+    attributes:
+      label: What version of Codex CLI is running?
+      description: use `codex --version`
+    validations:
+      required: true
+  - type: input
+    id: plan
+    attributes:
+      label: What subscription do you have?
+    validations:
+      required: true
+  - type: input
+    id: model
+    attributes:
+      label: Which model were you using?
+      description: Like `gpt-5.2`, `gpt-5.2-codex`, etc.
+  - type: input
+    id: platform
+    attributes:
+      label: What platform is your computer?
+      description: |
+        For macOS and Linux: copy the output of `uname -mprs`
+        For Windows: copy the output of `"$([Environment]::OSVersion | ForEach-Object VersionString) $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" })"` in the PowerShell console
+  - type: input
+    id: terminal
+    attributes:
+      label: What terminal emulator and version are you using (if applicable)?
+      description: |
+        Also note any multiplexer in use (screen / tmux / zellij).
+        E.g., VS Code, Terminal.app, iTerm2, Ghostty, Windows Terminal (WSL / PowerShell)
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Codex doctor report
+      description: |
+        If available, run `codex doctor --json` and paste the full output here.
+
+        The report is designed to redact secrets, but please review it before submitting.
+        If your Codex version does not support `doctor`, write `not available`.
+      render: json
+  - type: textarea
+    id: actual
+    attributes:
+      label: What issue are you seeing?
+      description: Please include the full error messages and prompts with PII redacted. If possible, please provide text instead of a screenshot.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: What steps can reproduce the bug?
+      description: Explain the bug and provide a code snippet that can reproduce it. Please include thread id if applicable.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What is the expected behavior?
+      description: If possible, please provide text instead of a screenshot.
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional information
+      description: Is there anything else you think we should know?

.github/ISSUE_TEMPLATE/4-bug-report.yml

@@ -0,0 +1,37 @@
+name: 🪲 Other Bug
+description: Report an issue in Codex Web, integrations, or other Codex components
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting a new issue, please search for existing issues to see if your issue has already been reported.
+        If it has, please add a 👍 reaction (no need to leave a comment) to the existing issue instead of creating a new one.
+
+        If you need help or support using Codex and are not reporting a bug, please post on [codex/discussions](https://github.com/openai/codex/discussions), where you can ask questions or engage with others on ideas for how to improve codex.
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: What issue are you seeing?
+      description: Please include the full error messages and prompts with PII redacted. If possible, please provide text instead of a screenshot.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: What steps can reproduce the bug?
+      description: Explain the bug and provide a code snippet that can reproduce it.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What is the expected behavior?
+      description: If possible, please provide text instead of a screenshot.
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional information
+      description: Is there anything else you think we should know?

.github/ISSUE_TEMPLATE/5-feature-request.yml

@@ -0,0 +1,32 @@
+name: 🎁 Feature Request
+description: Propose a new feature for Codex
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Is Codex missing a feature that you'd like to see? Feel free to propose it here.
+
+        Before you submit a feature:
+        1. Search existing issues for similar features. If you find one, 👍 it rather than opening a new one.
+        2. The Codex team will try to balance the varying needs of the community when prioritizing or rejecting new features. Not all features will be accepted. See [Contributing](https://github.com/openai/codex/blob/main/docs/contributing.md) for more details.
+
+  - type: input
+    id: variant
+    attributes:
+      label: What variant of Codex are you using?
+      description: (e.g., App, IDE Extension, CLI, Web)
+    validations:
+      required: true
+  - type: textarea
+    id: feature
+    attributes:
+      label: What feature would you like to see?
+    validations:
+      required: true
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional information
+      description: Is there anything else you think we should know?

.github/ISSUE_TEMPLATE/6-docs-issue.yml

@@ -0,0 +1,27 @@
+name: 📗 Documentation Issue
+description: Tell us if there is missing or incorrect documentation
+labels: [documentation]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for submitting a documentation request. It helps make Codex better.
+  - type: dropdown
+    attributes:
+      label: What is the type of issue?
+      multiple: true
+      options:
+        - Documentation is missing
+        - Documentation is incorrect
+        - Documentation is confusing
+        - Example code is not working
+        - Something else
+  - type: textarea
+    attributes:
+      label: What is the issue?
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Where did you find it?
+      description: If possible, please provide the URL(s) where you found this issue.

.github/actions/check-clean-worktree/action.yml

@@ -0,0 +1,19 @@
+name: check-clean-worktree
+description: Fail when a CI job leaves tracked changes or untracked files in the repository worktree.
+
+runs:
+  using: composite
+  steps:
+    - name: Check for a clean worktree
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        status="$(git -C "${GITHUB_WORKSPACE}" status --porcelain=v1 --untracked-files=normal --ignore-submodules=none)"
+        if [[ -z "${status}" ]]; then
+          exit 0
+        fi
+
+        echo "::error::CI job left tracked changes or untracked files in the repository worktree"
+        printf '%s\n' "${status}"
+        exit 1

.github/actions/linux-code-sign/action.yml

@@ -0,0 +1,49 @@
+name: linux-code-sign
+description: Sign Linux artifacts with cosign.
+inputs:
+  target:
+    description: Target triple for the artifacts to sign.
+    required: true
+  artifacts-dir:
+    description: Absolute path to the directory containing built binaries to sign.
+    required: true
+  binaries:
+    description: Space-delimited binary basenames to sign.
+    default: "codex codex-responses-api-proxy"
+
+runs:
+  using: composite
+  steps:
+    - name: Install cosign
+      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+
+    - name: Cosign Linux artifacts
+      shell: bash
+      env:
+        ARTIFACTS_DIR: ${{ inputs.artifacts-dir }}
+        BINARIES: ${{ inputs.binaries }}
+        COSIGN_EXPERIMENTAL: "1"
+        COSIGN_YES: "true"
+        COSIGN_OIDC_CLIENT_ID: "sigstore"
+        COSIGN_OIDC_ISSUER: "https://oauth2.sigstore.dev/auth"
+      run: |
+        set -euo pipefail
+
+        dest="$ARTIFACTS_DIR"
+        if [[ ! -d "$dest" ]]; then
+          echo "Destination $dest does not exist"
+          exit 1
+        fi
+
+        for binary in ${BINARIES}; do
+          artifact="${dest}/${binary}"
+          if [[ ! -f "$artifact" ]]; then
+            echo "Binary $artifact not found"
+            exit 1
+          fi
+
+          cosign sign-blob \
+            --yes \
+            --bundle "${artifact}.sigstore" \
+            "$artifact"
+        done

.github/actions/prepare-bazel-ci/action.yml

@@ -0,0 +1,59 @@
+name: prepare-bazel-ci
+description: Prepare a Bazel CI job with shared setup, repository cache restore, and execution logs.
+inputs:
+  target:
+    description: Target triple used for setup and cache namespacing.
+    required: true
+  cache-scope:
+    description: Logical namespace used to keep concurrent Bazel jobs from reserving the same repository cache key.
+    required: true
+outputs:
+  repository-cache-path:
+    description: Filesystem path used for the Bazel repository cache.
+    value: ${{ steps.setup_bazel.outputs.repository-cache-path }}
+  repository-cache-key:
+    description: Primary actions/cache key for the Bazel repository cache.
+    value: ${{ steps.cache_bazel_repository_key.outputs.repository-cache-key }}
+  repository-cache-hit:
+    description: Whether the Bazel repository cache restore found an exact key match.
+    value: ${{ steps.cache_bazel_repository_restore.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Bazel CI
+      id: setup_bazel
+      uses: ./.github/actions/setup-bazel-ci
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Compute bazel repository cache key
+      id: cache_bazel_repository_key
+      shell: bash
+      env:
+        CACHE_SCOPE: ${{ inputs.cache-scope }}
+        TARGET: ${{ inputs.target }}
+        CACHE_HASH: ${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
+      run: |
+        echo "repository-cache-key=bazel-cache-${CACHE_SCOPE}-${TARGET}-${CACHE_HASH}" >> "${GITHUB_OUTPUT}"
+        echo "repository-cache-restore-key=bazel-cache-${CACHE_SCOPE}-${TARGET}-" >> "${GITHUB_OUTPUT}"
+
+    # Restore the Bazel repository cache explicitly so external dependencies
+    # do not need to be re-downloaded on every CI run. Keep restore failures
+    # non-fatal so transient cache-service errors degrade to a cold build
+    # instead of failing the job.
+    - name: Restore bazel repository cache
+      id: cache_bazel_repository_restore
+      continue-on-error: true
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      with:
+        path: ${{ steps.setup_bazel.outputs.repository-cache-path }}
+        key: ${{ steps.cache_bazel_repository_key.outputs.repository-cache-key }}
+        restore-keys: |
+          ${{ steps.cache_bazel_repository_key.outputs.repository-cache-restore-key }}
+
+    - name: Set up Bazel execution logs
+      shell: bash
+      run: |
+        mkdir -p "${RUNNER_TEMP}/bazel-execution-logs"
+        echo "CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR=${RUNNER_TEMP}/bazel-execution-logs" >> "${GITHUB_ENV}"

.github/actions/setup-bazel-ci/action.yml

@@ -0,0 +1,94 @@
+name: setup-bazel-ci
+description: Prepare a Bazel CI runner with shared caches.
+inputs:
+  target:
+    description: Target triple used for cache namespacing.
+    required: true
+outputs:
+  repository-cache-path:
+    description: Filesystem path used for the Bazel repository cache.
+    value: ${{ steps.configure_bazel_repository_cache.outputs.repository-cache-path }}
+
+runs:
+  using: composite
+  steps:
+    - id: setup_ci
+      uses: ./.github/actions/setup-ci
+
+    - name: Set up Bazel
+      uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
+      # Without an explicit Bazelisk version, setup-bazel leaves PATH unchanged
+      # and Windows can use the runner's standalone Bazel, ignoring .bazelversion.
+      with:
+        bazelisk-version: 1.28.1
+        # setup-bazel writes an explicit output_base, which otherwise overrides
+        # BAZEL_OUTPUT_USER_ROOT and leaves Bazel's I/O-heavy trees on C:.
+        output-base: ${{ steps.setup_ci.outputs.bazel-output-base }}
+
+    - name: Configure Bazel repository cache
+      id: configure_bazel_repository_cache
+      shell: pwsh
+      run: |
+        "repository-cache-path=$env:BAZEL_REPOSITORY_CACHE" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+
+    - name: Expose MSVC SDK environment (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        # Bazel exec-side Rust build scripts do not reliably inherit the MSVC developer
+        # shell on GitHub-hosted Windows runners, so discover the latest VS install and
+        # ask `VsDevCmd.bat` to materialize the x64/x64 compiler + SDK environment.
+        $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+        if (-not (Test-Path $vswhere)) {
+          throw "vswhere.exe not found"
+        }
+
+        $installPath = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath 2>$null
+        if (-not $installPath) {
+          throw "Could not locate a Visual Studio installation with VC tools"
+        }
+
+        $vsDevCmd = Join-Path $installPath 'Common7\Tools\VsDevCmd.bat'
+        if (-not (Test-Path $vsDevCmd)) {
+          throw "VsDevCmd.bat not found at $vsDevCmd"
+        }
+
+        # Keep the export surface explicit: these are the paths and SDK roots that the
+        # MSVC toolchain probes need later when Bazel runs Windows exec-platform build
+        # scripts such as `aws-lc-sys`.
+        $varsToExport = @(
+          'INCLUDE',
+          'LIB',
+          'LIBPATH',
+          'PATH',
+          'UCRTVersion',
+          'UniversalCRTSdkDir',
+          'VCINSTALLDIR',
+          'VCToolsInstallDir',
+          'WindowsLibPath',
+          'WindowsSdkBinPath',
+          'WindowsSdkDir',
+          'WindowsSDKLibVersion',
+          'WindowsSDKVersion'
+        )
+
+        # `VsDevCmd.bat` is a batch file, so invoke it under `cmd.exe`, suppress its
+        # banner, then dump the resulting environment with `set`. Re-export only the
+        # approved keys into `GITHUB_ENV` so later steps inherit the same MSVC context.
+        $envLines = & cmd.exe /c ('"{0}" -no_logo -arch=x64 -host_arch=x64 >nul && set' -f $vsDevCmd)
+        foreach ($line in $envLines) {
+          if ($line -notmatch '^(.*?)=(.*)$') {
+            continue
+          }
+
+          $name = $matches[1]
+          $value = $matches[2]
+          if ($varsToExport -contains $name) {
+            "$name=$value" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          }
+        }
+
+    - name: Compute cache-stable Windows Bazel PATH
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: ./.github/scripts/compute-bazel-windows-path.ps1

.github/scripts/archive-release-symbols-and-strip-binaries.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: archive-release-symbols-and-strip-binaries.sh \
+  --target <rust-target> \
+  --artifact-name <artifact-name> \
+  --release-dir <dir> \
+  --archive-dir <dir> \
+  --binaries "<space-delimited binary basenames>"
+EOF
+}
+
+target=""
+artifact_name=""
+release_dir=""
+archive_dir=""
+binaries=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --target)
+      target="${2:?--target requires a value}"
+      shift 2
+      ;;
+    --artifact-name)
+      artifact_name="${2:?--artifact-name requires a value}"
+      shift 2
+      ;;
+    --release-dir)
+      release_dir="${2:?--release-dir requires a value}"
+      shift 2
+      ;;
+    --archive-dir)
+      archive_dir="${2:?--archive-dir requires a value}"
+      shift 2
+      ;;
+    --binaries)
+      binaries="${2:?--binaries requires a value}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unexpected argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -z "$target" || -z "$artifact_name" || -z "$release_dir" || -z "$archive_dir" || -z "$binaries" ]]; then
+  usage >&2
+  exit 1
+fi
+
+symbols_root="${RUNNER_TEMP:-/tmp}/codex-symbols-${artifact_name}"
+symbols_dir="${symbols_root}/codex-symbols-${artifact_name}"
+archive_path="${archive_dir%/}/codex-symbols-${artifact_name}.tar.gz"
+rm -rf "$symbols_root"
+mkdir -p "$symbols_dir" "$archive_dir"
+read -r -a binary_names <<< "$binaries"
+
+case "$target" in
+  *apple-darwin)
+    for binary in "${binary_names[@]}"; do
+      binary_path="${release_dir%/}/${binary}"
+      dsym_path="${binary_path}.dSYM"
+      if [[ ! -f "$binary_path" ]]; then
+        echo "Binary $binary_path not found" >&2
+        exit 1
+      fi
+      if [[ ! -d "$dsym_path" ]]; then
+        echo "dSYM $dsym_path not found" >&2
+        exit 1
+      fi
+
+      cp -RL "$dsym_path" "${symbols_dir}/${binary}.dSYM"
+      strip -S -x "$binary_path"
+    done
+    ;;
+  *linux*)
+    objcopy_bin="${OBJCOPY:-objcopy}"
+    strip_bin="${STRIP:-strip}"
+    for binary in "${binary_names[@]}"; do
+      binary_path="${release_dir%/}/${binary}"
+      debug_path="${symbols_dir}/${binary}.debug"
+      if [[ ! -f "$binary_path" ]]; then
+        echo "Binary $binary_path not found" >&2
+        exit 1
+      fi
+
+      "$objcopy_bin" --only-keep-debug "$binary_path" "$debug_path"
+      "$strip_bin" --strip-debug --strip-unneeded "$binary_path"
+      "$objcopy_bin" --add-gnu-debuglink="$debug_path" "$binary_path"
+    done
+    ;;
+  *windows*)
+    for binary in "${binary_names[@]}"; do
+      pdb_path="${release_dir%/}/${binary}.pdb"
+      if [[ ! -f "$pdb_path" ]]; then
+        echo "PDB $pdb_path not found" >&2
+        exit 1
+      fi
+
+      cp "$pdb_path" "${symbols_dir}/${binary}.pdb"
+    done
+    ;;
+  *)
+    echo "No symbols packaging support for target: $target" >&2
+    exit 1
+    ;;
+esac
+
+rm -f "$archive_path"
+tar -C "$symbols_root" -czf "$archive_path" "codex-symbols-${artifact_name}"

.github/scripts/build-codex-package-archive.sh

@@ -0,0 +1,243 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: build-codex-package-archive.sh \
+  --target <rust-target> \
+  --bundle <primary|app-server> \
+  --entrypoint-dir <dir> \
+  --archive-dir <dir> \
+  [--bwrap-bin <path>] \
+  [--code-mode-host-bin <path>] \
+  [--rg-bin <path>] \
+  [--zsh-bin <path>] \
+  [--zsh-manifest <path>] \
+  [--codex-command-runner-bin <path>] \
+  [--codex-windows-sandbox-setup-bin <path>] \
+  [--voice-release-dir <path> --release-version <release-version>] \
+  [--target-suffixed-entrypoint]
+EOF
+}
+
+target=""
+bundle=""
+entrypoint_dir=""
+archive_dir=""
+target_suffixed_entrypoint="false"
+resource_args=()
+bwrap_bin_provided="false"
+code_mode_host_bin_provided="false"
+command_runner_bin_provided="false"
+sandbox_setup_bin_provided="false"
+voice_release_dir=""
+release_version=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --target)
+      target="${2:?--target requires a value}"
+      shift 2
+      ;;
+    --bundle)
+      bundle="${2:?--bundle requires a value}"
+      shift 2
+      ;;
+    --entrypoint-dir)
+      entrypoint_dir="${2:?--entrypoint-dir requires a value}"
+      shift 2
+      ;;
+    --archive-dir)
+      archive_dir="${2:?--archive-dir requires a value}"
+      shift 2
+      ;;
+    --bwrap-bin)
+      resource_args+=(--bwrap-bin "${2:?--bwrap-bin requires a value}")
+      bwrap_bin_provided="true"
+      shift 2
+      ;;
+    --code-mode-host-bin)
+      resource_args+=(--code-mode-host-bin "${2:?--code-mode-host-bin requires a value}")
+      code_mode_host_bin_provided="true"
+      shift 2
+      ;;
+    --rg-bin)
+      resource_args+=(--rg-bin "${2:?--rg-bin requires a value}")
+      shift 2
+      ;;
+    --zsh-bin)
+      resource_args+=(--zsh-bin "${2:?--zsh-bin requires a value}")
+      shift 2
+      ;;
+    --zsh-manifest)
+      resource_args+=(--zsh-manifest "${2:?--zsh-manifest requires a value}")
+      shift 2
+      ;;
+    --codex-command-runner-bin)
+      resource_args+=(
+        --codex-command-runner-bin
+        "${2:?--codex-command-runner-bin requires a value}"
+      )
+      command_runner_bin_provided="true"
+      shift 2
+      ;;
+    --codex-windows-sandbox-setup-bin)
+      resource_args+=(
+        --codex-windows-sandbox-setup-bin
+        "${2:?--codex-windows-sandbox-setup-bin requires a value}"
+      )
+      sandbox_setup_bin_provided="true"
+      shift 2
+      ;;
+    --target-suffixed-entrypoint)
+      target_suffixed_entrypoint="true"
+      shift
+      ;;
+    --voice-release-dir)
+      voice_release_dir="${2:?--voice-release-dir requires a value}"
+      shift 2
+      ;;
+    --release-version)
+      release_version="${2:?--release-version requires a value}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unexpected argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -z "$target" || -z "$bundle" || -z "$entrypoint_dir" || -z "$archive_dir" ]]; then
+  usage >&2
+  exit 1
+fi
+if [[ ( -n "$voice_release_dir" || -n "$release_version" ) && ( -z "$voice_release_dir" || -z "$release_version" || "$bundle" != "primary" || ( "$target" != *-apple-darwin && "$target" != *-unknown-linux-musl && "$target" != *-pc-windows-msvc ) ) ]]; then
+  echo "Voice resources require a primary supported release package version" >&2
+  exit 1
+fi
+
+case "$bundle" in
+  primary)
+    variant="codex"
+    entrypoint="codex"
+    archive_stem="codex-package"
+    ;;
+  app-server)
+    variant="codex-app-server"
+    entrypoint="codex-app-server"
+    archive_stem="codex-app-server-package"
+    ;;
+  *)
+    echo "No Codex package variant for bundle: $bundle" >&2
+    exit 1
+    ;;
+esac
+
+exe_suffix=""
+case "$target" in
+  *windows*)
+    exe_suffix=".exe"
+    ;;
+esac
+
+code_mode_host_bin="${entrypoint_dir%/}/codex-code-mode-host${exe_suffix}"
+if [[ "$code_mode_host_bin_provided" == "false" && -f "$code_mode_host_bin" ]]; then
+  resource_args+=(--code-mode-host-bin "$code_mode_host_bin")
+fi
+
+entrypoint_name="$entrypoint"
+if [[ "$target_suffixed_entrypoint" == "true" ]]; then
+  entrypoint_name="${entrypoint_name}-${target}"
+fi
+
+case "$target" in
+  *linux*)
+    bwrap_bin="${entrypoint_dir%/}/bwrap"
+    if [[ "$bwrap_bin_provided" == "false" && -f "$bwrap_bin" ]]; then
+      resource_args+=(--bwrap-bin "$bwrap_bin")
+    fi
+    ;;
+  *windows*)
+    command_runner_bin="${entrypoint_dir%/}/codex-command-runner.exe"
+    sandbox_setup_bin="${entrypoint_dir%/}/codex-windows-sandbox-setup.exe"
+    if [[ "$command_runner_bin_provided" == "false" && -f "$command_runner_bin" ]]; then
+      resource_args+=(--codex-command-runner-bin "$command_runner_bin")
+    fi
+    if [[ "$sandbox_setup_bin_provided" == "false" && -f "$sandbox_setup_bin" ]]; then
+      resource_args+=(--codex-windows-sandbox-setup-bin "$sandbox_setup_bin")
+    fi
+    ;;
+esac
+
+repo_root="${GITHUB_WORKSPACE:-}"
+if [[ -z "$repo_root" ]]; then
+  repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi
+
+if command -v python3 >/dev/null 2>&1; then
+  python_bin="python3"
+else
+  python_bin="python"
+fi
+
+if ! command -v zstd >/dev/null 2>&1 && [[ -x "${repo_root}/.github/workflows/zstd" ]]; then
+  export PATH="${repo_root}/.github/workflows:${PATH}"
+fi
+
+mkdir -p "$archive_dir"
+package_dir="${RUNNER_TEMP:-/tmp}/${archive_stem}-${target}"
+gzip_archive_path="${archive_dir}/${archive_stem}-${target}.tar.gz"
+zstd_archive_path="${archive_dir}/${archive_stem}-${target}.tar.zst"
+rm -rf "$package_dir"
+
+python_args=(
+  "${repo_root}/scripts/build_codex_package.py"
+  --target "$target"
+  --variant "$variant"
+  --entrypoint-bin "${entrypoint_dir%/}/${entrypoint_name}${exe_suffix}"
+  --cargo-profile release
+  --package-dir "$package_dir"
+)
+if [[ -z "$voice_release_dir" ]]; then
+  python_args+=(--archive-output "$gzip_archive_path" --archive-output "$zstd_archive_path")
+fi
+if ((${#resource_args[@]} > 0)); then
+  python_args+=("${resource_args[@]}")
+fi
+python_args+=(--force)
+
+"$python_bin" "${python_args[@]}"
+
+if [[ -n "$voice_release_dir" ]]; then
+  voice_target="$target"
+  if [[ "$target" == *-unknown-linux-musl ]]; then
+    voice_target="${target%-musl}-gnu"
+  fi
+  voice_package="${RUNNER_TEMP:-/tmp}/${archive_stem}-voice-${target}"
+  rm -rf "$voice_package"
+  voice_helper="${voice_release_dir%/}/codex-voice-host${exe_suffix}"
+  "$python_bin" "${repo_root}/third_party/voice/assemble_package.py" \
+    --package "$package_dir" \
+    --helper "$voice_helper" \
+    --runtime "${voice_release_dir%/}/runtime" \
+    --voice-target "$voice_target" \
+    --build-commit "$(git -C "$repo_root" rev-parse HEAD)" \
+    --release-version "$release_version" \
+    --output "$voice_package"
+  PYTHONPATH="${repo_root}/scripts" "$python_bin" - \
+    "$voice_package" "$gzip_archive_path" "$zstd_archive_path" <<'PY'
+import sys
+from pathlib import Path
+from codex_package.archive import write_archive
+
+package = Path(sys.argv[1])
+for archive in sys.argv[2:]:
+    write_archive(package, Path(archive), force=True)
+PY
+fi

.github/scripts/build-zsh-release-artifact.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ "$#" -ne 1 ]]; then
+  echo "usage: $0 <archive-path>" >&2
+  exit 1
+fi
+
+archive_path="$1"
+workspace="${GITHUB_WORKSPACE:?missing GITHUB_WORKSPACE}"
+zsh_commit="${ZSH_COMMIT:?missing ZSH_COMMIT}"
+zsh_patch="${ZSH_PATCH:?missing ZSH_PATCH}"
+temp_root="${RUNNER_TEMP:-/tmp}"
+work_root="$(mktemp -d "${temp_root%/}/codex-zsh-release.XXXXXX")"
+trap 'rm -rf "$work_root"' EXIT
+
+source_root="${work_root}/zsh"
+package_root="${work_root}/codex-zsh"
+wrapper_path="${work_root}/exec-wrapper"
+stdout_path="${work_root}/stdout.txt"
+wrapper_log_path="${work_root}/wrapper.log"
+
+git clone https://git.code.sf.net/p/zsh/code "$source_root"
+cd "$source_root"
+git checkout "$zsh_commit"
+git apply "${workspace}/${zsh_patch}"
+./Util/preconfig
+./configure
+
+cores="$(command -v nproc >/dev/null 2>&1 && nproc || getconf _NPROCESSORS_ONLN)"
+make -j"${cores}"
+
+cat > "$wrapper_path" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+: "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
+printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
+file="$1"
+shift
+if [[ "$#" -eq 0 ]]; then
+  exec "$file"
+fi
+arg0="$1"
+shift
+exec -a "$arg0" "$file" "$@"
+EOF
+chmod +x "$wrapper_path"
+
+CODEX_WRAPPER_LOG="$wrapper_log_path" \
+EXEC_WRAPPER="$wrapper_path" \
+"${source_root}/Src/zsh" -fc '/bin/echo smoke-zsh' > "$stdout_path"
+
+grep -Fx "smoke-zsh" "$stdout_path"
+grep -Fx "/bin/echo" "$wrapper_log_path"
+
+mkdir -p "$package_root/bin" "$(dirname "${workspace}/${archive_path}")"
+cp "${source_root}/Src/zsh" "$package_root/bin/zsh"
+chmod +x "$package_root/bin/zsh"
+
+(cd "$work_root" && tar -czf "${workspace}/${archive_path}" codex-zsh)

.github/scripts/check_ci_results.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+"""Fail a terminal CI job unless every serialized dependency succeeded.
+
+Parent workflows pass GitHub's `toJSON(needs)` object through the NEEDS
+environment variable. Treat skipped and cancelled dependencies as failures too:
+for a required fan-in job, only an explicit success is safe to accept.
+"""
+
+import json
+import os
+
+
+def main() -> None:
+    # Keep result policy in one script so blocking-ci and postmerge-ci cannot
+    # drift in how they interpret dependency conclusions.
+    needs = json.loads(os.environ["NEEDS"])
+    failures = sorted(
+        (name, dependency["result"])
+        for name, dependency in needs.items()
+        if dependency["result"] != "success"
+    )
+
+    if failures:
+        print("CI dependencies did not succeed:")
+        for name, result in failures:
+            print(f"{name}: {result}")
+        raise SystemExit(1)
+
+    print("All CI dependencies succeeded.")
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/compute-bazel-windows-path.ps1

@@ -0,0 +1,113 @@
+<#
+BuildBuddy cache keys include the action and test environment, so Bazel should
+not inherit the full hosted-runner PATH on Windows. That PATH includes volatile
+tool entries, such as Maven, that can change independently of this repo and
+cause avoidable cache misses.
+
+This script derives a smaller, cache-stable PATH that keeps the Windows
+toolchain entries Bazel-backed CI tasks need: MSVC and Windows SDK paths,
+MinGW runtime DLL paths for gnullvm-built tests, Git, PowerShell, Node, Python,
+DotSlash, and the standard Windows system directories.
+`setup-bazel-ci` runs this after exporting the MSVC environment, and the script
+publishes the result via `GITHUB_ENV` as `CODEX_BAZEL_WINDOWS_PATH` so later
+steps can pass that explicit PATH to Bazel.
+#>
+
+$stablePathEntries = New-Object System.Collections.Generic.List[string]
+$seenEntries = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+$windowsAppsPath = if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) {
+  $null
+} else {
+  "$($env:LOCALAPPDATA)\Microsoft\WindowsApps"
+}
+$windowsDir = if ($env:WINDIR) {
+  $env:WINDIR
+} elseif ($env:SystemRoot) {
+  $env:SystemRoot
+} else {
+  $null
+}
+
+function Add-StablePathEntry {
+  param([string]$PathEntry)
+
+  if ([string]::IsNullOrWhiteSpace($PathEntry)) {
+    return
+  }
+
+  if ($seenEntries.Add($PathEntry)) {
+    [void]$stablePathEntries.Add($PathEntry)
+  }
+}
+
+foreach ($pathEntry in ($env:PATH -split ';')) {
+  if ([string]::IsNullOrWhiteSpace($pathEntry)) {
+    continue
+  }
+
+  if (
+    $pathEntry -like '*Microsoft Visual Studio*' -or
+    $pathEntry -like '*Windows Kits*' -or
+    $pathEntry -like '*Microsoft SDKs*' -or
+    $pathEntry -eq 'C:\mingw64\bin' -or
+    $pathEntry -like 'C:\msys64\*\bin' -or
+    $pathEntry -like 'C:\Program Files\Git\*' -or
+    $pathEntry -like 'C:\Program Files\PowerShell\*' -or
+    $pathEntry -like 'C:\hostedtoolcache\windows\node\*' -or
+    $pathEntry -like 'C:\hostedtoolcache\windows\Python\*' -or
+    $pathEntry -eq 'D:\a\_temp\install-dotslash\bin' -or
+    ($windowsDir -and ($pathEntry -eq $windowsDir -or $pathEntry -like "${windowsDir}\*"))
+  ) {
+    Add-StablePathEntry $pathEntry
+  }
+}
+
+$gitCommand = Get-Command git -ErrorAction SilentlyContinue
+if ($gitCommand) {
+  Add-StablePathEntry (Split-Path $gitCommand.Source -Parent)
+}
+
+$nodeCommand = Get-Command node -ErrorAction SilentlyContinue
+if ($nodeCommand) {
+  Add-StablePathEntry (Split-Path $nodeCommand.Source -Parent)
+}
+
+$python3Command = Get-Command python3 -ErrorAction SilentlyContinue
+if ($python3Command) {
+  Add-StablePathEntry (Split-Path $python3Command.Source -Parent)
+}
+
+$pythonCommand = Get-Command python -ErrorAction SilentlyContinue
+if ($pythonCommand) {
+  Add-StablePathEntry (Split-Path $pythonCommand.Source -Parent)
+}
+
+$pwshCommand = Get-Command pwsh -ErrorAction SilentlyContinue
+if ($pwshCommand) {
+  Add-StablePathEntry (Split-Path $pwshCommand.Source -Parent)
+}
+
+foreach ($mingwPath in @('C:\mingw64\bin', 'C:\msys64\mingw64\bin', 'C:\msys64\ucrt64\bin')) {
+  if (Test-Path $mingwPath) {
+    Add-StablePathEntry $mingwPath
+  }
+}
+
+if ($windowsAppsPath) {
+  Add-StablePathEntry $windowsAppsPath
+}
+
+if ($stablePathEntries.Count -eq 0) {
+  throw 'Failed to derive cache-stable Windows PATH.'
+}
+
+if ([string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
+  throw 'GITHUB_ENV must be set.'
+}
+
+$stablePath = $stablePathEntries -join ';'
+Write-Host 'Derived CODEX_BAZEL_WINDOWS_PATH entries:'
+foreach ($pathEntry in $stablePathEntries) {
+  Write-Host "  $pathEntry"
+}
+"CODEX_BAZEL_WINDOWS_PATH=$stablePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

.github/scripts/install-musl-build-tools.sh

@@ -0,0 +1,290 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${TARGET:?TARGET environment variable is required}"
+: "${GITHUB_ENV:?GITHUB_ENV environment variable is required}"
+
+apt_update_args=()
+if [[ -n "${APT_UPDATE_ARGS:-}" ]]; then
+  # shellcheck disable=SC2206
+  apt_update_args=(${APT_UPDATE_ARGS})
+fi
+
+apt_install_args=()
+if [[ -n "${APT_INSTALL_ARGS:-}" ]]; then
+  # shellcheck disable=SC2206
+  apt_install_args=(${APT_INSTALL_ARGS})
+fi
+
+sudo apt-get update "${apt_update_args[@]}"
+sudo apt-get install -y "${apt_install_args[@]}" ca-certificates curl musl-tools pkg-config libcap-dev g++ clang libc++-dev libc++abi-dev lld xz-utils perl make
+
+case "${TARGET}" in
+  x86_64-unknown-linux-musl)
+    arch="x86_64"
+    ;;
+  aarch64-unknown-linux-musl)
+    arch="aarch64"
+    ;;
+  *)
+    echo "Unexpected musl target: ${TARGET}" >&2
+    exit 1
+    ;;
+esac
+
+libcap_version="2.75"
+libcap_sha256="de4e7e064c9ba451d5234dd46e897d7c71c96a9ebf9a0c445bc04f4742d83632"
+libcap_tarball_name="libcap-${libcap_version}.tar.xz"
+libcap_download_url="https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${libcap_tarball_name}"
+
+# Use the musl toolchain as the Rust linker to avoid Zig injecting its own CRT.
+if command -v "${arch}-linux-musl-gcc" >/dev/null; then
+  musl_linker="$(command -v "${arch}-linux-musl-gcc")"
+elif command -v musl-gcc >/dev/null; then
+  musl_linker="$(command -v musl-gcc)"
+else
+  echo "musl gcc not found after install; arch=${arch}" >&2
+  exit 1
+fi
+
+OPENSSL_CC="${musl_linker}" bash "$(dirname "${BASH_SOURCE[0]}")/install-musl-openssl.sh"
+
+zig_target="${TARGET/-unknown-linux-musl/-linux-musl}"
+runner_temp="${RUNNER_TEMP:-/tmp}"
+tool_root="${runner_temp}/codex-musl-tools-${TARGET}"
+mkdir -p "${tool_root}"
+
+libcap_root="${tool_root}/libcap-${libcap_version}"
+libcap_src_root="${libcap_root}/src"
+libcap_prefix="${libcap_root}/prefix"
+libcap_pkgconfig_dir="${libcap_prefix}/lib/pkgconfig"
+
+if [[ ! -f "${libcap_prefix}/lib/libcap.a" ]]; then
+  mkdir -p "${libcap_src_root}" "${libcap_prefix}/lib" "${libcap_prefix}/include/sys" "${libcap_prefix}/include/linux" "${libcap_pkgconfig_dir}"
+  libcap_tarball="${libcap_root}/${libcap_tarball_name}"
+
+  curl -fsSL "${libcap_download_url}" -o "${libcap_tarball}"
+  echo "${libcap_sha256}  ${libcap_tarball}" | sha256sum -c -
+
+  tar -xJf "${libcap_tarball}" -C "${libcap_src_root}"
+  libcap_source_dir="${libcap_src_root}/libcap-${libcap_version}"
+  make -C "${libcap_source_dir}/libcap" -j"$(nproc)" \
+    CC="${musl_linker}" \
+    AR=ar \
+    RANLIB=ranlib
+
+  cp "${libcap_source_dir}/libcap/libcap.a" "${libcap_prefix}/lib/libcap.a"
+  cp "${libcap_source_dir}/libcap/include/uapi/linux/capability.h" "${libcap_prefix}/include/linux/capability.h"
+  cp "${libcap_source_dir}/libcap/../libcap/include/sys/capability.h" "${libcap_prefix}/include/sys/capability.h"
+
+  cat > "${libcap_pkgconfig_dir}/libcap.pc" <<EOF
+prefix=${libcap_prefix}
+exec_prefix=\${prefix}
+libdir=\${prefix}/lib
+includedir=\${prefix}/include
+
+Name: libcap
+Description: Linux capabilities
+Version: ${libcap_version}
+Libs: -L\${libdir} -lcap
+Cflags: -I\${includedir}
+EOF
+fi
+
+sysroot=""
+if command -v zig >/dev/null; then
+  zig_bin="$(command -v zig)"
+  cc="${tool_root}/zigcc"
+  cxx="${tool_root}/zigcxx"
+
+  cat >"${cc}" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+
+args=()
+skip_next=0
+pending_include=0
+for arg in "\$@"; do
+  if [[ "\${pending_include}" -eq 1 ]]; then
+    pending_include=0
+    if [[ "\${arg}" == /usr/include || "\${arg}" == /usr/include/* ]]; then
+      # Keep host-only headers available, but after the target sysroot headers.
+      args+=("-idirafter" "\${arg}")
+    else
+      args+=("-I" "\${arg}")
+    fi
+    continue
+  fi
+
+  if [[ "\${skip_next}" -eq 1 ]]; then
+    skip_next=0
+    continue
+  fi
+  case "\${arg}" in
+    --target)
+      skip_next=1
+      continue
+      ;;
+    --target=*|-target=*|-target)
+      # Drop any explicit --target/-target flags. Zig expects -target and
+      # rejects Rust triples like *-unknown-linux-musl.
+      if [[ "\${arg}" == "-target" ]]; then
+        skip_next=1
+      fi
+      continue
+      ;;
+    -I)
+      pending_include=1
+      continue
+      ;;
+    -I/usr/include|-I/usr/include/*)
+      # Avoid making glibc headers win over musl headers.
+      args+=("-idirafter" "\${arg#-I}")
+      continue
+      ;;
+    -Wp,-U_FORTIFY_SOURCE)
+      # aws-lc-sys emits this GCC preprocessor forwarding form in debug
+      # builds, but zig cc expects the define flag directly.
+      args+=("-U_FORTIFY_SOURCE")
+      continue
+      ;;
+  esac
+  args+=("\${arg}")
+done
+
+# Zig enables UBSan for debug C builds by default. Rust links these objects
+# without Zig's sanitizer runtime, so keep native dependencies uninstrumented.
+exec "${zig_bin}" cc -target "${zig_target}" "\${args[@]}" -fno-sanitize=undefined
+EOF
+  cat >"${cxx}" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+
+args=()
+skip_next=0
+pending_include=0
+for arg in "\$@"; do
+  if [[ "\${pending_include}" -eq 1 ]]; then
+    pending_include=0
+    if [[ "\${arg}" == /usr/include || "\${arg}" == /usr/include/* ]]; then
+      # Keep host-only headers available, but after the target sysroot headers.
+      args+=("-idirafter" "\${arg}")
+    else
+      args+=("-I" "\${arg}")
+    fi
+    continue
+  fi
+
+  if [[ "\${skip_next}" -eq 1 ]]; then
+    skip_next=0
+    continue
+  fi
+  case "\${arg}" in
+    --target)
+      # Drop explicit --target and its value: we always pass zig's -target below.
+      skip_next=1
+      continue
+      ;;
+    --target=*|-target=*|-target)
+      # Zig expects -target and rejects Rust triples like *-unknown-linux-musl.
+      if [[ "\${arg}" == "-target" ]]; then
+        skip_next=1
+      fi
+      continue
+      ;;
+    -I)
+      pending_include=1
+      continue
+      ;;
+    -I/usr/include|-I/usr/include/*)
+      # Avoid making glibc headers win over musl headers.
+      args+=("-idirafter" "\${arg#-I}")
+      continue
+      ;;
+    -Wp,-U_FORTIFY_SOURCE)
+      # aws-lc-sys emits this GCC forwarding form in debug builds; zig c++
+      # expects the define flag directly.
+      args+=("-U_FORTIFY_SOURCE")
+      continue
+      ;;
+  esac
+  args+=("\${arg}")
+done
+
+# Zig enables UBSan for debug C++ builds by default. Rust links these objects
+# without Zig's sanitizer runtime, so keep native dependencies uninstrumented.
+exec "${zig_bin}" c++ -target "${zig_target}" "\${args[@]}" -fno-sanitize=undefined
+EOF
+  chmod +x "${cc}" "${cxx}"
+
+  sysroot="$("${zig_bin}" cc -target "${zig_target}" -print-sysroot 2>/dev/null || true)"
+else
+  cc="${musl_linker}"
+
+  if command -v "${arch}-linux-musl-g++" >/dev/null; then
+    cxx="$(command -v "${arch}-linux-musl-g++")"
+  elif command -v musl-g++ >/dev/null; then
+    cxx="$(command -v musl-g++)"
+  else
+    cxx="${cc}"
+  fi
+fi
+
+if [[ -n "${sysroot}" && "${sysroot}" != "/" ]]; then
+  echo "BORING_BSSL_SYSROOT=${sysroot}" >> "$GITHUB_ENV"
+  boring_sysroot_var="BORING_BSSL_SYSROOT_${TARGET}"
+  boring_sysroot_var="${boring_sysroot_var//-/_}"
+  echo "${boring_sysroot_var}=${sysroot}" >> "$GITHUB_ENV"
+fi
+
+cflags="-pthread"
+cxxflags="-pthread"
+if [[ "${TARGET}" == "aarch64-unknown-linux-musl" ]]; then
+  # BoringSSL enables -Wframe-larger-than=25344 under clang and treats warnings as errors.
+  cflags="${cflags} -Wno-error=frame-larger-than"
+  cxxflags="${cxxflags} -Wno-error=frame-larger-than"
+fi
+
+echo "CFLAGS=${cflags}" >> "$GITHUB_ENV"
+echo "CXXFLAGS=${cxxflags}" >> "$GITHUB_ENV"
+echo "CC=${cc}" >> "$GITHUB_ENV"
+echo "TARGET_CC=${cc}" >> "$GITHUB_ENV"
+target_cc_var="CC_${TARGET}"
+target_cc_var="${target_cc_var//-/_}"
+echo "${target_cc_var}=${cc}" >> "$GITHUB_ENV"
+echo "CXX=${cxx}" >> "$GITHUB_ENV"
+echo "TARGET_CXX=${cxx}" >> "$GITHUB_ENV"
+target_cxx_var="CXX_${TARGET}"
+target_cxx_var="${target_cxx_var//-/_}"
+echo "${target_cxx_var}=${cxx}" >> "$GITHUB_ENV"
+
+cargo_linker_var="CARGO_TARGET_${TARGET^^}_LINKER"
+cargo_linker_var="${cargo_linker_var//-/_}"
+echo "${cargo_linker_var}=${musl_linker}" >> "$GITHUB_ENV"
+
+echo "CMAKE_C_COMPILER=${cc}" >> "$GITHUB_ENV"
+echo "CMAKE_CXX_COMPILER=${cxx}" >> "$GITHUB_ENV"
+echo "CMAKE_ARGS=-DCMAKE_HAVE_THREADS_LIBRARY=1 -DCMAKE_USE_PTHREADS_INIT=1 -DCMAKE_THREAD_LIBS_INIT=-pthread -DTHREADS_PREFER_PTHREAD_FLAG=ON" >> "$GITHUB_ENV"
+
+# Allow pkg-config resolution during cross-compilation.
+echo "PKG_CONFIG_ALLOW_CROSS=1" >> "$GITHUB_ENV"
+pkg_config_path="${libcap_pkgconfig_dir}"
+if [[ -n "${PKG_CONFIG_PATH:-}" ]]; then
+  pkg_config_path="${pkg_config_path}:${PKG_CONFIG_PATH}"
+fi
+echo "PKG_CONFIG_PATH=${pkg_config_path}" >> "$GITHUB_ENV"
+pkg_config_path_var="PKG_CONFIG_PATH_${TARGET}"
+pkg_config_path_var="${pkg_config_path_var//-/_}"
+echo "${pkg_config_path_var}=${libcap_pkgconfig_dir}" >> "$GITHUB_ENV"
+pkg_config_libdir_var="PKG_CONFIG_LIBDIR_${TARGET}"
+pkg_config_libdir_var="${pkg_config_libdir_var//-/_}"
+# Do not let musl cross-builds resolve native libraries from the host glibc
+# pkg-config directories. libcap is the only target package provided here.
+echo "${pkg_config_libdir_var}=${libcap_pkgconfig_dir}" >> "$GITHUB_ENV"
+
+if [[ -n "${sysroot}" && "${sysroot}" != "/" ]]; then
+  echo "PKG_CONFIG_SYSROOT_DIR=${sysroot}" >> "$GITHUB_ENV"
+  pkg_config_sysroot_var="PKG_CONFIG_SYSROOT_DIR_${TARGET}"
+  pkg_config_sysroot_var="${pkg_config_sysroot_var//-/_}"
+  echo "${pkg_config_sysroot_var}=${sysroot}" >> "$GITHUB_ENV"
+fi

.github/scripts/install-musl-openssl.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${TARGET:?TARGET environment variable is required}"
+: "${GITHUB_ENV:?GITHUB_ENV environment variable is required}"
+: "${OPENSSL_CC:?OPENSSL_CC must name the target musl compiler}"
+
+case "${TARGET}" in
+  x86_64-unknown-linux-musl) openssl_target="linux-x86_64" ;;
+  aarch64-unknown-linux-musl) openssl_target="linux-aarch64" ;;
+  *) echo "Unexpected musl target: ${TARGET}" >&2; exit 1 ;;
+esac
+
+# openssl-src's latest 300.x crate still contains 3.6.3. Build the upstream
+# security release until that crate catches up, keeping the existing 3.x ABI.
+openssl_version="3.6.4"
+openssl_sha256="9bffaa1ad1e07b354c21bd3324ec02fa15579f45a7d0494b3e74bc449b7333ef"
+openssl_root="${RUNNER_TEMP:-/tmp}/codex-musl-tools-${TARGET}/openssl-${openssl_version}"
+openssl_prefix="${openssl_root}/prefix"
+
+if [[ ! -f "${openssl_prefix}/.complete" ]]; then
+  mkdir -p "${openssl_root}"
+  archive="${openssl_root}/openssl-${openssl_version}.tar.gz"
+  curl -fsSL "https://github.com/openssl/openssl/releases/download/openssl-${openssl_version}/openssl-${openssl_version}.tar.gz" -o "${archive}"
+  echo "${openssl_sha256}  ${archive}" | sha256sum -c -
+  tar -xzf "${archive}" -C "${openssl_root}"
+
+  (
+    cd "${openssl_root}/openssl-${openssl_version}"
+    # Match openssl-src's default/legacy configuration for musl, including
+    # disabling shared libraries, zlib, engines, and unsupported async APIs.
+    CC="${OPENSSL_CC}" perl ./Configure "${openssl_target}" \
+      "--prefix=${openssl_prefix}" --openssldir=/usr/local/ssl --libdir=lib \
+      no-shared no-module no-tests no-comp no-zlib no-zlib-dynamic \
+      no-ssl3 no-md2 no-rc5 no-weak-ssl-ciphers no-camellia no-idea no-seed \
+      no-engine no-async -DOPENSSL_NO_SECURE_MEMORY
+    make -j"${OPENSSL_BUILD_JOBS:-$(nproc)}" build_libs
+    make install_dev
+  )
+  touch "${openssl_prefix}/.complete"
+fi
+
+# Scope these overrides to the target so host build dependencies are unaffected.
+# openssl-sys honors OPENSSL_NO_VENDOR even when Cargo enables `vendored`.
+target_env="${TARGET^^}"
+target_env="${target_env//-/_}"
+{
+  echo "${target_env}_OPENSSL_DIR=${openssl_prefix}"
+  echo "${target_env}_OPENSSL_NO_VENDOR=1"
+  echo "${target_env}_OPENSSL_STATIC=1"
+} >> "${GITHUB_ENV}"

.github/scripts/publish_r2_release.py

@@ -0,0 +1,532 @@
+#!/usr/bin/env python3
+"""Mirror a Codex GitHub Release to Cloudflare R2.
+
+Cloudflare R2 exposes an S3-compatible API, so the built-in AWS CLI uses
+standard AWS credentials and the R2 endpoint from ``AWS_ENDPOINT_URL``.
+Objects are created under ``codex/releases/<version>/`` with a validated upload
+checksum and checked using object metadata before the run succeeds. The
+versioned prefix includes every release asset plus installer-facing
+``release.json`` metadata derived from the verified downloads. Once those
+objects are verified, the same metadata advances ``codex/channels/latest`` when
+the release is marked latest and ``codex/channels/prerelease`` for prereleases.
+Stable releases also update the mutable ``codex/install.sh`` and
+``codex/install.ps1`` bootstrap aliases from their verified versioned assets.
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+import tempfile
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from pathlib import Path
+from typing import Any, NamedTuple, NoReturn
+from urllib.parse import quote
+
+BUCKET = "releases"
+PREFIX = "codex"
+REPOSITORY = "openai/codex"
+RELEASE_METADATA_NAME = "release.json"
+INSTALLER_NAMES = ("install.sh", "install.ps1")
+MAX_UPLOAD_WORKERS = 8
+# Keep this pattern in sync with release-tag validation in
+# .github/workflows/rust-release.yml.
+VERSION_RE = re.compile(
+    r"^[0-9]+\.[0-9]+\.[0-9]+(?:-(?:alpha(?:\.[0-9]+){0,2}"
+    r"|beta(?:\.[0-9]+)?))?$"
+)
+CRC64_RE = re.compile(r"^[A-Za-z0-9+/]{11}=$")
+SHA256_RE = re.compile(r"^sha256:([0-9a-f]{64})$")
+MISSING_OBJECT_RE = re.compile(r"\((?:404|NoSuchKey|NotFound)\)")
+
+
+class PublishError(RuntimeError):
+    pass
+
+
+class ReleaseAsset(NamedTuple):
+    path: Path
+    size: int
+    sha256: str
+
+
+def run_command(args: list[str]) -> str:
+    result = subprocess.run(
+        args,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    if result.stdout:
+        print(result.stdout, end="", file=sys.stderr)
+    if result.stderr:
+        print(result.stderr, end="", file=sys.stderr)
+    result.check_returncode()
+    return result.stdout or ""
+
+
+def get_release_metadata(tag: str, directory: Path, stage: str) -> list[ReleaseAsset]:
+    try:
+        metadata = json.loads(
+            run_command(
+                [
+                    "gh",
+                    "release",
+                    "view",
+                    tag,
+                    "--repo",
+                    REPOSITORY,
+                    "--json",
+                    "assets",
+                    "--jq",
+                    "[.assets[] | {name, size, state, digest}]",
+                ]
+            )
+        )
+    except (OSError, subprocess.CalledProcessError) as error:
+        raise PublishError(
+            f"GitHub release metadata request failed for {tag}: {error}"
+        ) from error
+    except json.JSONDecodeError as error:
+        raise PublishError(
+            f"invalid GitHub release metadata for {tag}: {error}"
+        ) from error
+
+    expected = {}
+    if not isinstance(metadata, list):
+        raise PublishError(f"GitHub returned invalid release metadata for {tag}")
+    for asset in metadata:
+        if not isinstance(asset, dict):
+            raise PublishError(
+                f"GitHub returned invalid release metadata for {tag}: {asset!r}"
+            )
+        # DotSlash runs concurrently, so defer its in-progress assets to finalization.
+        if stage == "assets" and asset.get("state") != "uploaded":
+            continue
+        name = asset.get("name")
+        size = asset.get("size")
+        digest = asset.get("digest")
+        match = SHA256_RE.fullmatch(digest) if isinstance(digest, str) else None
+        if (
+            not isinstance(name, str)
+            or not name
+            or name == RELEASE_METADATA_NAME
+            or name in expected
+            or type(size) is not int
+            or size < 0
+            or asset.get("state") != "uploaded"
+            or match is None
+        ):
+            raise PublishError(
+                f"GitHub returned invalid release metadata for {tag}: {asset!r}"
+            )
+        expected[name] = ReleaseAsset(directory / name, size, match.group(1))
+
+    if not expected:
+        raise PublishError(f"GitHub Release {tag} has no assets")
+    return sorted(expected.values(), key=lambda asset: asset.path.name)
+
+
+def download_assets(tag: str, directory: Path, assets: list[ReleaseAsset]) -> None:
+    if not assets:
+        return
+
+    command = [
+        "gh",
+        "release",
+        "download",
+        tag,
+        "--repo",
+        REPOSITORY,
+        "--dir",
+        str(directory),
+    ]
+    for asset in assets:
+        command.extend(["--pattern", asset.path.name])
+
+    try:
+        run_command(command)
+    except (OSError, subprocess.CalledProcessError) as error:
+        raise PublishError(
+            f"GitHub release download failed for {tag}: {error}"
+        ) from error
+
+    if any(not asset.path.is_file() for asset in assets):
+        raise PublishError("GitHub returned invalid release assets")
+
+
+def stream_digest(source: Any) -> tuple[int, str]:
+    digest = hashlib.sha256()
+    size = 0
+    while chunk := source.read(1024 * 1024):
+        digest.update(chunk)
+        size += len(chunk)
+    return size, digest.hexdigest()
+
+
+def validate_asset(asset: ReleaseAsset) -> None:
+    with asset.path.open("rb") as source:
+        size, sha256 = stream_digest(source)
+    if size != asset.size or sha256 != asset.sha256:
+        raise PublishError(
+            f"GitHub asset mismatch for {asset.path.name}: expected "
+            f"size={asset.size} sha256={asset.sha256}, got "
+            f"size={size} sha256={sha256}"
+        )
+
+
+def raise_s3(
+    action: str, key: str, error: Exception, detail: str | None = None
+) -> NoReturn:
+    raise PublishError(
+        f"could not {action} s3://{BUCKET}/{key}: {detail or error}"
+    ) from error
+
+
+def put_object(
+    endpoint: str,
+    key: str,
+    path: Path,
+    sha256: str,
+    *,
+    extra_args: list[str],
+) -> None:
+    try:
+        run_command(
+            [
+                "aws",
+                "s3",
+                "cp",
+                str(path),
+                f"s3://{BUCKET}/{key}",
+                *extra_args,
+                "--checksum-algorithm",
+                "CRC64NVME",
+                "--metadata",
+                f"sha256={sha256}",
+                "--endpoint-url",
+                endpoint,
+            ]
+        )
+    except subprocess.CalledProcessError as error:
+        raise_s3("upload", key, error, (error.stderr or "").strip())
+    except OSError as error:
+        raise_s3("upload", key, error)
+
+
+def verify_remote(
+    endpoint: str,
+    key: str,
+    expected_size: int,
+    expected_sha256: str,
+) -> None:
+    try:
+        response = json.loads(
+            run_command(
+                [
+                    "aws",
+                    "s3api",
+                    "head-object",
+                    "--bucket",
+                    BUCKET,
+                    "--key",
+                    key,
+                    "--checksum-mode",
+                    "ENABLED",
+                    "--endpoint-url",
+                    endpoint,
+                ]
+            )
+        )
+    except subprocess.CalledProcessError as error:
+        raise_s3("inspect", key, error, (error.stderr or "").strip())
+    except OSError as error:
+        raise_s3("inspect", key, error)
+    except json.JSONDecodeError as error:
+        raise PublishError(f"invalid object metadata for {key}: {error}") from error
+
+    metadata = response.get("Metadata") if isinstance(response, dict) else None
+    size = response.get("ContentLength") if isinstance(response, dict) else None
+    crc64 = response.get("ChecksumCRC64NVME") if isinstance(response, dict) else None
+    sha256 = metadata.get("sha256") if isinstance(metadata, dict) else None
+    if (
+        size != expected_size
+        or sha256 != expected_sha256
+        or not isinstance(crc64, str)
+        or not CRC64_RE.fullmatch(crc64)
+    ):
+        raise PublishError(
+            f"object metadata mismatch for {key}: expected size={expected_size} "
+            f"sha256={expected_sha256}, got size={size} sha256={sha256} "
+            f"crc64nvme={crc64}"
+        )
+
+
+def publish_installers(endpoint: str, tag: str, assets: list[ReleaseAsset]) -> None:
+    installers = {asset.path.name: asset for asset in assets}
+    missing = sorted(set(INSTALLER_NAMES) - installers.keys())
+    if missing:
+        raise PublishError(
+            f"GitHub Release {tag} is missing installer assets: {', '.join(missing)}"
+        )
+    for name in INSTALLER_NAMES:
+        asset = installers[name]
+        validate_asset(asset)
+        installer_key = f"{PREFIX}/{name}"
+        put_object(endpoint, installer_key, asset.path, asset.sha256, extra_args=[])
+        verify_remote(endpoint, installer_key, asset.size, asset.sha256)
+        print(
+            f"published and verified s3://{BUCKET}/{installer_key} "
+            f"size={asset.size} sha256={asset.sha256}",
+            file=sys.stderr,
+        )
+
+
+def publish_asset(
+    endpoint: str, version: str, asset: ReleaseAsset, *, verify: bool = True
+) -> dict[str, Any]:
+    validate_asset(asset)
+    key = f"{PREFIX}/releases/{version}/{asset.path.name}"
+    put_object(endpoint, key, asset.path, asset.sha256, extra_args=["--no-overwrite"])
+    if verify:
+        verify_remote(endpoint, key, asset.size, asset.sha256)
+    status = "published and verified" if verify else "published"
+    print(
+        f"{status} s3://{BUCKET}/{key} size={asset.size} sha256={asset.sha256}",
+        file=sys.stderr,
+    )
+    return {
+        "key": key,
+        "name": asset.path.name,
+        "sha256": asset.sha256,
+        "size": asset.size,
+    }
+
+
+def publish_assets(
+    endpoint: str, version: str, assets: list[ReleaseAsset], *, verify: bool = True
+) -> list[dict[str, Any]]:
+    if not assets:
+        return []
+
+    published = {}
+    with ThreadPoolExecutor(
+        max_workers=min(MAX_UPLOAD_WORKERS, len(assets))
+    ) as executor:
+        futures = {
+            executor.submit(
+                publish_asset, endpoint, version, asset, verify=verify
+            ): asset
+            for asset in assets
+        }
+        for future in as_completed(futures):
+            asset = futures[future]
+            published[asset.path.name] = future.result()
+    return [published[asset.path.name] for asset in assets]
+
+
+def find_published_assets(
+    endpoint: str, version: str, assets: list[ReleaseAsset]
+) -> dict[str, dict[str, Any]]:
+    published = {}
+    with ThreadPoolExecutor(
+        max_workers=min(MAX_UPLOAD_WORKERS, len(assets))
+    ) as executor:
+        futures = {
+            executor.submit(
+                verify_remote,
+                endpoint,
+                f"{PREFIX}/releases/{version}/{asset.path.name}",
+                asset.size,
+                asset.sha256,
+            ): asset
+            for asset in assets
+        }
+        for future in as_completed(futures):
+            asset = futures[future]
+            try:
+                future.result()
+            except PublishError as error:
+                cause = error.__cause__
+                if isinstance(cause, subprocess.CalledProcessError) and (
+                    MISSING_OBJECT_RE.search(cause.stderr or "")
+                ):
+                    continue
+                raise
+            published[asset.path.name] = {
+                "key": f"{PREFIX}/releases/{version}/{asset.path.name}",
+                "name": asset.path.name,
+                "sha256": asset.sha256,
+                "size": asset.size,
+            }
+    return published
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--tag", required=True)
+    parser.add_argument("--make-latest", choices=("true", "false"), required=True)
+    parser.add_argument("--prerelease", choices=("true", "false"), required=True)
+    parser.add_argument("--stage", choices=("assets", "finalize"), required=True)
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    try:
+        endpoint = os.environ.get("AWS_ENDPOINT_URL")
+        if not os.environ.get("GH_TOKEN"):
+            raise PublishError("GH_TOKEN is required")
+        if not endpoint:
+            raise PublishError("AWS_ENDPOINT_URL is required for the R2 S3 endpoint")
+
+        version = args.tag.removeprefix("rust-v")
+        if args.tag == version or not VERSION_RE.fullmatch(version):
+            raise PublishError(f"invalid rust release tag: {args.tag}")
+        with tempfile.TemporaryDirectory() as temp_dir:
+            assets_directory = Path(temp_dir) / "assets"
+            assets_directory.mkdir()
+            assets = get_release_metadata(args.tag, assets_directory, args.stage)
+
+            if args.stage == "assets":
+                download_assets(args.tag, assets_directory, assets)
+                published = publish_assets(endpoint, version, assets, verify=False)
+                print(
+                    json.dumps(
+                        {
+                            "assetCount": len(published),
+                            "assets": published,
+                            "releasePrefix": f"{PREFIX}/releases/{version}/",
+                            "stage": args.stage,
+                            "tag": args.tag,
+                            "version": version,
+                        },
+                        sort_keys=True,
+                    )
+                )
+                return 0
+
+            previously_published = find_published_assets(endpoint, version, assets)
+            remaining = [
+                asset for asset in assets if asset.path.name not in previously_published
+            ]
+            required_downloads = list(remaining)
+            if args.prerelease == "false":
+                required_downloads.extend(
+                    asset
+                    for asset in assets
+                    if asset.path.name in INSTALLER_NAMES
+                    and asset.path.name in previously_published
+                )
+            download_assets(args.tag, assets_directory, required_downloads)
+            additionally_published = {
+                asset["name"]: asset
+                for asset in publish_assets(endpoint, version, remaining)
+            }
+            published = [
+                previously_published.get(asset.path.name)
+                or additionally_published[asset.path.name]
+                for asset in assets
+            ]
+            metadata_assets = [
+                {
+                    "name": asset.path.name,
+                    "digest": f"sha256:{asset.sha256}",
+                    "browser_download_url": (
+                        f"https://releases.openai.com/{PREFIX}/releases/"
+                        f"{version}/{quote(asset.path.name, safe='')}"
+                    ),
+                }
+                for asset in assets
+            ]
+
+            metadata_path = Path(temp_dir) / RELEASE_METADATA_NAME
+            metadata_path.write_text(
+                json.dumps(
+                    {
+                        "assets": metadata_assets,
+                        "tag_name": args.tag,
+                    },
+                    indent=2,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            with metadata_path.open("rb") as source:
+                metadata_size, metadata_sha256 = stream_digest(source)
+            metadata_key = f"{PREFIX}/releases/{version}/{RELEASE_METADATA_NAME}"
+            put_object(
+                endpoint,
+                metadata_key,
+                metadata_path,
+                metadata_sha256,
+                extra_args=["--no-overwrite"],
+            )
+            verify_remote(
+                endpoint,
+                metadata_key,
+                metadata_size,
+                metadata_sha256,
+            )
+            print(
+                f"published and verified s3://{BUCKET}/{metadata_key} "
+                f"size={metadata_size} sha256={metadata_sha256}",
+                file=sys.stderr,
+            )
+            if args.prerelease == "false":
+                publish_installers(endpoint, args.tag, assets)
+            channels = []
+            if args.make_latest == "true":
+                channels.append("latest")
+            if args.prerelease == "true":
+                channels.append("prerelease")
+            for channel in channels:
+                channel_key = f"{PREFIX}/channels/{channel}"
+                put_object(
+                    endpoint,
+                    channel_key,
+                    metadata_path,
+                    metadata_sha256,
+                    extra_args=["--content-type", "application/json"],
+                )
+                verify_remote(
+                    endpoint,
+                    channel_key,
+                    metadata_size,
+                    metadata_sha256,
+                )
+                print(
+                    f"published and verified s3://{BUCKET}/{channel_key} "
+                    f"size={metadata_size} sha256={metadata_sha256}",
+                    file=sys.stderr,
+                )
+
+        print(
+            json.dumps(
+                {
+                    "assetCount": len(published),
+                    "assets": published,
+                    "releaseMetadata": {
+                        "key": metadata_key,
+                        "sha256": metadata_sha256,
+                        "size": metadata_size,
+                    },
+                    "releasePrefix": f"{PREFIX}/releases/{version}/",
+                    "stage": args.stage,
+                    "tag": args.tag,
+                    "version": version,
+                },
+                sort_keys=True,
+            )
+        )
+        return 0
+    except PublishError as error:
+        print(f"publish failed: {error}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/resolve_python_cli_release.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Bind downstream Python publication to a published stable CLI release."""
+
+import argparse
+import itertools
+import json
+import re
+import subprocess
+from pathlib import Path
+
+
+def github_api(path: str):
+    return json.loads(subprocess.check_output(["gh", "api", path], text=True))
+
+
+def github_items(path: str, key: str | None = None):
+    separator = "&" if "?" in path else "?"
+    for page in itertools.count(1):
+        response = github_api(f"{path}{separator}per_page=100&page={page}")
+        items = response[key] if key else response
+        yield from items
+        if len(items) < 100:
+            return
+
+
+def resolve_release(
+    repository: str, run_id: str, *, run: dict | None = None
+) -> dict[str, str] | None:
+    if repository != "openai/codex" or not re.fullmatch(r"[1-9][0-9]*", run_id):
+        raise ValueError("Expected an openai/codex Rust release run ID")
+    prefix = f"repos/{repository}"
+    if run is None:
+        run = github_api(f"{prefix}/actions/runs/{run_id}")
+    if (
+        str(run["id"]) != run_id
+        or run["path"] != ".github/workflows/rust-release.yml"
+        or run["event"] != "push"
+        or run["status"] != "completed"
+        or run["head_repository"]["full_name"] != repository
+    ):
+        raise ValueError("Python publication requires a completed Rust release run")
+    tag = run["head_branch"]
+    if not isinstance(tag, str) or not tag.startswith("rust-v"):
+        raise ValueError("The Rust release run must identify a release tag")
+    match = re.fullmatch(r"rust-v([0-9]+\.[0-9]+\.[0-9]+)", tag)
+    if match is None:
+        return None  # CLI prereleases do not publish the Python SDK.
+    revision = run["head_sha"]
+    if not re.fullmatch(r"[0-9a-f]{40}", revision):
+        raise ValueError("The Rust release run must identify an exact commit")
+
+    # A partial rerun of an unrelated publisher may not contain the release job.
+    # Inspect all attempts and use the last release job that actually ran.
+    release_job = max(
+        (
+            job
+            for job in github_items(
+                f"{prefix}/actions/runs/{run_id}/jobs?filter=all", "jobs"
+            )
+            if job["name"] == "release" and job["conclusion"] != "skipped"
+        ),
+        key=lambda job: (job["run_attempt"], job["id"]),
+        default=None,
+    )
+    if release_job is None or release_job["conclusion"] != "success":
+        raise ValueError("Python publication requires a successful release job")
+
+    target = github_api(f"{prefix}/git/ref/tags/{tag}")["object"]
+    for _ in range(8):
+        if target["type"] != "tag":
+            break
+        target = github_api(f"{prefix}/git/tags/{target['sha']}")["object"]
+    if target.get("type") != "commit" or target.get("sha") != revision:
+        raise ValueError("The release tag no longer matches the successful CLI run")
+    release = github_api(f"{prefix}/releases/tags/{tag}")
+    if release["draft"] or release["prerelease"] or release["tag_name"] != tag:
+        raise ValueError("The CLI release must be published and stable")
+
+    # The runtime builder downloads these six wheels and builds the two musl
+    # wheels from the release's package archives.
+    required_assets = {
+        f"openai_codex_cli_bin-{match[1]}-py3-none-{platform}.whl"
+        for platform in (
+            "macosx_10_9_x86_64",
+            "macosx_11_0_arm64",
+            "manylinux_2_17_aarch64",
+            "manylinux_2_17_x86_64",
+            "win_amd64",
+            "win_arm64",
+        )
+    } | {
+        f"codex-package-{arch}-unknown-linux-musl.tar.gz"
+        for arch in ("aarch64", "x86_64")
+    }
+    available_assets = {
+        asset["name"]
+        for asset in github_items(f"{prefix}/releases/{release['id']}/assets")
+        if asset["state"] == "uploaded" and asset["size"] > 0
+    }
+    if missing := required_assets - available_assets:
+        raise ValueError(f"The CLI release is missing Python inputs: {sorted(missing)}")
+    return {"source_sha": revision, "release_tag": tag, "version": match[1]}
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("run_id")
+    parser.add_argument("--repository", required=True)
+    parser.add_argument("--event-path", type=Path)
+    parser.add_argument("--github-output", type=Path, required=True)
+    args = parser.parse_args(argv)
+    event = json.loads(args.event_path.read_text()) if args.event_path else {}
+    release = resolve_release(
+        args.repository, args.run_id, run=event.get("workflow_run")
+    )
+    with args.github_output.open("a") as output:
+        print(f"publish={str(release is not None).lower()}", file=output)
+        for name, value in (release or {}).items():
+            print(f"{name}={value}", file=output)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/run-argument-comment-lint-bazel.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bazel_lint_args=("$@")
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  # Some Rust top-level targets are still intentionally incompatible with the
+  # local Windows exec platform. Skip those explicit targets so the native
+  # lint aspect can run across the compatible crate graph instead of failing the
+  # whole build after analysis.
+  bazel_lint_args+=("--skip_incompatible_explicit_targets")
+fi
+
+read_query_labels() {
+  local query="$1"
+  local query_stdout
+  local query_stderr
+  query_stdout="$(mktemp)"
+  query_stderr="$(mktemp)"
+
+  if ! ./.github/scripts/run-bazel-query-ci.sh \
+    --keep_going \
+    --output=label \
+    -- "$query" >"$query_stdout" 2>"$query_stderr"; then
+    cat "$query_stderr" >&2
+    rm -f "$query_stdout" "$query_stderr"
+    exit 1
+  fi
+
+  cat "$query_stdout"
+  rm -f "$query_stdout" "$query_stderr"
+}
+
+final_build_targets=(//codex-rs/...)
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  # Bazel's local Windows platform currently lacks a default test toolchain for
+  # `rust_test`, so target the concrete Rust crate rules directly. The lint
+  # aspect still walks their crate graph, which preserves incremental reuse for
+  # non-test code while avoiding non-Rust wrapper targets such as platform_data.
+  final_build_targets=()
+  while IFS= read -r label; do
+    [[ -n "$label" ]] || continue
+    final_build_targets+=("$label")
+  done < <(read_query_labels 'kind("rust_(library|binary|proc_macro) rule", //codex-rs/...)')
+
+  if [[ ${#final_build_targets[@]} -eq 0 ]]; then
+    echo "Failed to discover Windows Bazel lint targets." >&2
+    exit 1
+  fi
+fi
+
+./.github/scripts/run-bazel-ci.sh \
+  -- \
+  build \
+  "${bazel_lint_args[@]}" \
+  -- \
+  "${final_build_targets[@]}"

.github/scripts/run-bazel-ci.sh

@@ -0,0 +1,420 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+print_failed_bazel_test_logs=0
+print_failed_bazel_action_summary=0
+remote_download_toplevel=0
+windows_msvc_host_platform=0
+windows_cross_compile=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --print-failed-test-logs)
+      print_failed_bazel_test_logs=1
+      shift
+      ;;
+    --print-failed-action-summary)
+      print_failed_bazel_action_summary=1
+      shift
+      ;;
+    --remote-download-toplevel)
+      remote_download_toplevel=1
+      shift
+      ;;
+    --windows-msvc-host-platform)
+      windows_msvc_host_platform=1
+      shift
+      ;;
+    --windows-cross-compile)
+      windows_cross_compile=1
+      shift
+      ;;
+    --)
+      shift
+      break
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ $# -eq 0 ]]; then
+  echo "Usage: $0 [--print-failed-test-logs] [--print-failed-action-summary] [--remote-download-toplevel] [--windows-msvc-host-platform] [--windows-cross-compile] -- <bazel args> -- <targets>" >&2
+  exit 1
+fi
+
+bazel_startup_args=()
+if [[ -n "${BAZEL_HOST_JVM_ARG:-}" ]]; then
+  bazel_startup_args+=("--host_jvm_args=${BAZEL_HOST_JVM_ARG}")
+fi
+if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
+  bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
+fi
+
+run_bazel() {
+  if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+    MSYS2_ARG_CONV_EXCL='*' "$(dirname "${BASH_SOURCE[0]}")/run_bazel_with_buildbuddy.py" "$@"
+    return
+  fi
+
+  "$(dirname "${BASH_SOURCE[0]}")/run_bazel_with_buildbuddy.py" "$@"
+}
+
+run_bazel_with_startup_args() {
+  if (( ${#bazel_startup_args[@]} > 0 )); then
+    run_bazel "${bazel_startup_args[@]}" "$@"
+    return
+  fi
+
+  run_bazel "$@"
+}
+
+ci_config=ci-linux
+case "${RUNNER_OS:-}" in
+  macOS)
+    ci_config=ci-macos
+    ;;
+  Windows)
+    if [[ $windows_cross_compile -eq 1 ]]; then
+      ci_config=ci-windows-cross
+    else
+      ci_config=ci-windows
+    fi
+    ;;
+esac
+
+print_bazel_test_log_tails() {
+  local console_log="$1"
+  local testlogs_dir
+
+  local -a bazel_info_args=(info)
+  if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+    # `bazel info` needs the same CI config as the failed test invocation so
+    # platform-specific output roots match. On Windows, omitting `ci-windows`
+    # would point at `local_windows-fastbuild` even when the test ran with the
+    # MSVC host platform under `local_windows_msvc-fastbuild`.
+    bazel_info_args+=("--config=${ci_config}")
+  fi
+
+  # Only pass flags that affect Bazel's output-root selection or repository
+  # lookup. Test/build-only flags such as execution logs or remote download
+  # mode can make `bazel info` fail, which would hide the real test log path.
+  for arg in "${post_config_bazel_args[@]}"; do
+    case "$arg" in
+      --host_platform=* | --repo_contents_cache=* | --repository_cache=*)
+        bazel_info_args+=("$arg")
+        ;;
+    esac
+  done
+
+  testlogs_dir="$(run_bazel_with_startup_args \
+    --noexperimental_remote_repo_contents_cache \
+    "${bazel_info_args[@]}" \
+    bazel-testlogs 2>/dev/null || echo bazel-testlogs)"
+
+  local failed_targets=()
+  while IFS= read -r target; do
+    failed_targets+=("$target")
+  done < <(
+    grep -E '^(FAIL: //|ERROR: .* Testing //)' "$console_log" \
+      | sed -E 's#^FAIL: (//[^ ]+).*#\1#; s#^ERROR: .* Testing (//[^ ]+) failed:.*#\1#' \
+      | sort -u
+  )
+
+  if [[ ${#failed_targets[@]} -eq 0 ]]; then
+    echo "No failed Bazel test targets were found in console output."
+    return
+  fi
+
+  for target in "${failed_targets[@]}"; do
+    local rel_path="${target#//}"
+    rel_path="${rel_path/://}"
+    local test_log="${testlogs_dir}/${rel_path}/test.log"
+    local reported_test_log
+    reported_test_log="$(grep -F "FAIL: ${target} " "$console_log" | sed -nE 's#.* \(see (.*[\\/]test\.log)\).*#\1#p' | head -n 1 || true)"
+    if [[ -n "$reported_test_log" ]]; then
+      reported_test_log="${reported_test_log//\\//}"
+      test_log="$reported_test_log"
+    fi
+
+    echo "::group::Bazel test log tail for ${target}"
+    if [[ -f "$test_log" ]]; then
+      tail -n 200 "$test_log"
+    else
+      echo "Missing test log: $test_log"
+    fi
+    echo "::endgroup::"
+  done
+}
+
+print_bazel_action_failure_summary() {
+  local console_log="$1"
+  local escaped_summary
+  local summary
+
+  summary="$(
+    awk '
+      function clean(line) {
+        gsub(sprintf("%c", 27) "\\[[0-9;]*m", "", line)
+        sub(/^.*\t[^\t]*\t[0-9TZ:._-]+ /, "", line)
+        return line
+      }
+
+      function is_diagnostic(line) {
+        return line ~ /^(error(\[[^]]+\])?:|warning:|note:|help:)/ ||
+          line ~ /^[[:space:]]+-->/ ||
+          line ~ /^[[:space:]]*[0-9]+[[:space:]]+\|/ ||
+          line ~ /^[[:space:]]*\|/ ||
+          line ~ /^[[:space:]]+= (note|help):/ ||
+          line ~ /^[[:space:]]*\^[[:space:]^~-]*$/ ||
+          line ~ /^For more information/ ||
+          line ~ /^error: aborting/
+      }
+
+      {
+        line = clean($0)
+      }
+
+      line ~ /^ERROR: .* failed:/ {
+        if (printed) {
+          print ""
+        }
+        print line
+        in_failure = 1
+        seen_diagnostic = 0
+        printed = 1
+        next
+      }
+
+      in_failure && is_diagnostic(line) {
+        print line
+        seen_diagnostic = 1
+        next
+      }
+
+      in_failure && seen_diagnostic && line == "" {
+        print ""
+        next
+      }
+
+      in_failure && seen_diagnostic {
+        in_failure = 0
+        seen_diagnostic = 0
+        next
+      }
+    ' "$console_log"
+  )"
+
+  if [[ -z "$summary" ]]; then
+    summary="$(grep -E '^ERROR: |^FAILED: ' "$console_log" | tail -n 50 || true)"
+  fi
+
+  if [[ -z "$summary" ]]; then
+    echo "No Bazel action failures were found in the captured console output."
+    return
+  fi
+
+  if [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
+    escaped_summary="$(
+      printf '%s' "$summary" \
+        | awk 'BEGIN { ORS = "" } {
+            gsub(/%/, "%25")
+            gsub(/\r/, "%0D")
+            print sep $0
+            sep = "%0A"
+          }'
+    )"
+    echo "::error title=Bazel failed action diagnostics::${escaped_summary}"
+  fi
+
+  echo
+  echo "Bazel failed action diagnostics:"
+  echo "--------------------------------"
+  printf '%s\n' "$summary"
+  echo "--------------------------------"
+}
+
+bazel_args=()
+bazel_targets=()
+found_target_separator=0
+for arg in "$@"; do
+  if [[ "$arg" == "--" && $found_target_separator -eq 0 ]]; then
+    found_target_separator=1
+    continue
+  fi
+
+  if [[ $found_target_separator -eq 0 ]]; then
+    bazel_args+=("$arg")
+  else
+    bazel_targets+=("$arg")
+  fi
+done
+
+if [[ ${#bazel_args[@]} -eq 0 || ${#bazel_targets[@]} -eq 0 ]]; then
+  echo "Expected Bazel args and targets separated by --" >&2
+  exit 1
+fi
+
+if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -z "${BUILDBUDDY_API_KEY:-}" ]]; then
+  # Windows cross-compilation depends on authenticated RBE. Preserve the local
+  # Windows build shape when credentials are unavailable.
+  ci_config=ci-windows
+  windows_msvc_host_platform=1
+fi
+
+post_config_bazel_args=()
+if [[ "${RUNNER_OS:-}" == "Windows" && $windows_msvc_host_platform -eq 1 ]]; then
+  has_host_platform_override=0
+  for arg in "${bazel_args[@]}"; do
+    if [[ "$arg" == --host_platform=* ]]; then
+      has_host_platform_override=1
+      break
+    fi
+  done
+
+  if [[ $has_host_platform_override -eq 0 ]]; then
+    # Use the MSVC Windows platform for jobs that need helper binaries like
+    # Rust test wrappers and V8 generators to resolve a compatible toolchain.
+    # Callers that need a different Windows target platform should pass an
+    # explicit `--platforms=...` flag.
+    post_config_bazel_args+=("--host_platform=//:local_windows_msvc")
+  fi
+fi
+
+if [[ $remote_download_toplevel -eq 1 ]]; then
+  # Override the CI config's remote_download_minimal setting when callers need
+  # the built artifact to exist on disk after the command completes.
+  post_config_bazel_args+=(--remote_download_toplevel)
+fi
+
+if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+  # `--enable_platform_specific_config` expands `common:windows` on Windows
+  # hosts after ordinary rc configs, which can override `ci-windows-cross`'s
+  # RBE host platform. Repeat the host platform on the command line so V8 and
+  # other genrules execute on Linux RBE workers instead of Git Bash locally.
+  #
+  # Bazel also derives the default genrule shell from the client host. Without
+  # an explicit shell executable, remote Linux actions can be asked to run
+  # `C:\Program Files\Git\usr\bin\bash.exe`.
+  post_config_bazel_args+=(--host_platform=//:rbe --shell_executable=/bin/bash)
+fi
+
+if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -z "${BUILDBUDDY_API_KEY:-}" ]]; then
+  # The Windows cross-compile config depends on authenticated remote
+  # execution. When credentials are unavailable, keep the local build shape
+  # and its lower concurrency cap.
+  post_config_bazel_args+=(--jobs=8)
+fi
+
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  # Windows self-hosted runners can run multiple Bazel jobs concurrently. Give
+  # each job its own repo contents cache so they do not fight over the shared
+  # path configured in `ci-windows`.
+  post_config_bazel_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  post_config_bazel_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+
+if [[ -n "${CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR:-}" ]]; then
+  post_config_bazel_args+=(
+    "--execution_log_compact_file=${CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR}/execution-log-${bazel_args[0]}-${GITHUB_JOB:-local}-$$.zst"
+  )
+fi
+
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  pass_windows_build_env=1
+  if [[ $windows_cross_compile -eq 1 && -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+    # Remote build actions execute on Linux RBE workers. Passing the Windows
+    # runner's build environment there makes Bazel genrules try to execute
+    # C:\Program Files\Git\usr\bin\bash.exe on Linux.
+    pass_windows_build_env=0
+  fi
+
+  if [[ $pass_windows_build_env -eq 1 ]]; then
+    windows_action_env_vars=(
+      INCLUDE
+      LIB
+      LIBPATH
+      UCRTVersion
+      UniversalCRTSdkDir
+      VCINSTALLDIR
+      VCToolsInstallDir
+      WindowsLibPath
+      WindowsSdkBinPath
+      WindowsSdkDir
+      WindowsSDKLibVersion
+      WindowsSDKVersion
+    )
+
+    for env_var in "${windows_action_env_vars[@]}"; do
+      if [[ -n "${!env_var:-}" ]]; then
+        post_config_bazel_args+=("--action_env=${env_var}" "--host_action_env=${env_var}")
+      fi
+    done
+  fi
+
+  if [[ -z "${CODEX_BAZEL_WINDOWS_PATH:-}" ]]; then
+    echo "CODEX_BAZEL_WINDOWS_PATH must be set for Windows Bazel CI." >&2
+    exit 1
+  fi
+
+  if [[ $pass_windows_build_env -eq 1 ]]; then
+    post_config_bazel_args+=(
+      "--action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+      "--host_action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+    )
+  elif [[ $windows_cross_compile -eq 1 ]]; then
+    # Remote build actions run on Linux RBE workers. Give their shell snippets
+    # a Linux PATH while preserving CODEX_BAZEL_WINDOWS_PATH below for local
+    # Windows test execution.
+    post_config_bazel_args+=(
+      "--action_env=PATH=/usr/bin:/bin"
+      "--host_action_env=PATH=/usr/bin:/bin"
+    )
+  fi
+  post_config_bazel_args+=("--test_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}")
+fi
+
+bazel_console_log="$(mktemp)"
+trap 'rm -f "$bazel_console_log"' EXIT
+
+bazel_run_args=(
+  "${bazel_args[@]}"
+)
+if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+  echo "BuildBuddy API key is available; using remote Bazel configuration."
+  bazel_run_args+=("--config=${ci_config}")
+else
+  echo "BuildBuddy API key is not available; using local Bazel configuration."
+fi
+if (( ${#post_config_bazel_args[@]} > 0 )); then
+  bazel_run_args+=("${post_config_bazel_args[@]}")
+fi
+set +e
+# Work around Bazel 9 remote repo contents cache / overlay materialization
+# failures seen in CI (for example "is not a symlink" or permission errors
+# while materializing external repos such as rules_perl). This only disables
+# the startup-level repo contents cache; keyed runs still use BuildBuddy.
+run_bazel_with_startup_args \
+  --noexperimental_remote_repo_contents_cache \
+  "${bazel_run_args[@]}" \
+  -- \
+  "${bazel_targets[@]}" \
+  2>&1 | tee "$bazel_console_log"
+bazel_status=${PIPESTATUS[0]}
+set -e
+
+if [[ ${bazel_status:-0} -ne 0 ]]; then
+  if [[ $print_failed_bazel_action_summary -eq 1 ]]; then
+    print_bazel_action_failure_summary "$bazel_console_log"
+  fi
+  if [[ $print_failed_bazel_test_logs -eq 1 ]]; then
+    print_bazel_test_log_tails "$bazel_console_log"
+  fi
+  exit "$bazel_status"
+fi

.github/scripts/run-bazel-query-ci.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Run target-discovery queries with the same startup settings as the main
+# build/test invocation so they can reuse the same Bazel server. Queries only
+# enumerate labels, so they intentionally do not select a CI build/test config
+# or remote execution.
+
+if [[ $# -lt 2 || "${@: -2:1}" != "--" ]]; then
+  echo "Usage: $0 [<bazel query args>...] -- <query expression>" >&2
+  exit 1
+fi
+
+query_args=("${@:1:$#-2}")
+query_expression="${@: -1}"
+
+run_bazel() {
+  if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+    MSYS2_ARG_CONV_EXCL='*' "$(dirname "${BASH_SOURCE[0]}")/run_bazel_with_buildbuddy.py" "$@"
+    return
+  fi
+
+  "$(dirname "${BASH_SOURCE[0]}")/run_bazel_with_buildbuddy.py" "$@"
+}
+
+bazel_query_args=(query)
+
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  bazel_query_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  bazel_query_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+
+if (( ${#query_args[@]} > 0 )); then
+  bazel_query_args+=("${query_args[@]}")
+fi
+bazel_query_args+=("$query_expression")
+
+run_bazel "${bazel_query_args[@]}"

.github/scripts/run_bazel_with_buildbuddy.py

@@ -0,0 +1,217 @@
+#!/usr/bin/env python3
+
+import json
+import os
+import subprocess
+import sys
+from collections.abc import Mapping
+from collections.abc import Sequence
+from pathlib import Path
+
+
+OPENAI_REPOSITORY = "openai/codex"
+# Remote configurations select cache/BES/download endpoints. Their -rbe forms
+# also select the matching remote executor endpoint.
+GENERIC_REMOTE_CONFIG = "buildbuddy-generic"
+OPENAI_REMOTE_CONFIG = "buildbuddy-openai"
+# These CI configurations require remote build execution. The wrapper supplies
+# an RBE configuration, which also includes the common `remote` settings.
+REMOTE_EXECUTION_CONFIGS = {
+    "--config=ci-linux",
+    "--config=ci-macos",
+    "--config=ci-v8",
+    "--config=ci-windows-cross",
+}
+# Honor either explicit setting so the wrapper never overrides the caller's
+# choice when it supplies the CI default below.
+REMOTE_REPO_CONTENTS_CACHE_STARTUP_OPTIONS = {
+    "--experimental_remote_repo_contents_cache",
+    "--noexperimental_remote_repo_contents_cache",
+}
+
+
+def startup_args(args: Sequence[str], env: Mapping[str, str]) -> list[str]:
+    """Return shared startup options that are missing from a Bazel invocation.
+
+    Bazel startup options must precede the command, and changing them restarts
+    the server and discards its analysis cache. GitHub Actions invokes Bazel
+    through several helpers, so normalize their startup options here while
+    preserving any explicit choice made by the caller.
+    """
+    command_idx = next(
+        (idx for idx, arg in enumerate(args) if not arg.startswith("-")),
+        len(args),
+    )
+    configured_startup_args = args[:command_idx]
+    injected_args = []
+
+    output_user_root = env.get("BAZEL_OUTPUT_USER_ROOT")
+    if output_user_root and not any(
+        arg.startswith("--output_user_root=") for arg in configured_startup_args
+    ):
+        injected_args.append(f"--output_user_root={output_user_root}")
+
+    if env.get("GITHUB_ACTIONS") == "true" and not any(
+        arg in REMOTE_REPO_CONTENTS_CACHE_STARTUP_OPTIONS
+        for arg in configured_startup_args
+    ):
+        # Work around Bazel 9 overlay materialization failures seen in CI. This
+        # disables only the startup-level repo contents cache; keyed runs still
+        # use BuildBuddy.
+        injected_args.append("--noexperimental_remote_repo_contents_cache")
+
+    return injected_args
+
+
+# Only authenticated workflow runs executing trusted upstream code may use the
+# OpenAI BuildBuddy host. A pull request event without proof that its head is
+# in the upstream repository fails closed to the generic host.
+def is_trusted_upstream_run(env: Mapping[str, str]) -> bool:
+    # `GITHUB_REPOSITORY` is easy to set locally. Requiring GitHub's workflow
+    # marker prevents a local command from opting itself into the OpenAI host.
+    if (
+        env.get("GITHUB_ACTIONS") != "true"
+        or env.get("GITHUB_REPOSITORY") != OPENAI_REPOSITORY
+    ):
+        return False
+    # Non-PR workflow runs in `openai/codex` execute upstream refs, so they are
+    # trusted. Fork code reaches these workflows only through pull requests.
+    if env.get("GITHUB_EVENT_NAME") != "pull_request":
+        return True
+
+    event_path = env.get("GITHUB_EVENT_PATH")
+    if not event_path:
+        return False
+    try:
+        event = json.loads(Path(event_path).read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return False
+
+    try:
+        return event["pull_request"]["head"]["repo"]["fork"] is False
+    except (KeyError, TypeError):
+        return False
+
+
+def uses_openai_host(env: Mapping[str, str]) -> bool:
+    return bool(env.get("BUILDBUDDY_API_KEY")) and is_trusted_upstream_run(env)
+
+
+def uses_remote_execution(args: Sequence[str]) -> bool:
+    try:
+        separator_idx = args.index("--")
+    except ValueError:
+        separator_idx = len(args)
+    return any(arg in REMOTE_EXECUTION_CONFIGS for arg in args[:separator_idx])
+
+
+def remote_config(args: Sequence[str], env: Mapping[str, str]) -> str | None:
+    if not env.get("BUILDBUDDY_API_KEY"):
+        return None
+
+    config = OPENAI_REMOTE_CONFIG if uses_openai_host(env) else GENERIC_REMOTE_CONFIG
+    if uses_remote_execution(args):
+        config += "-rbe"
+    return config
+
+
+def bazel_args_without_remote_execution(args: Sequence[str]) -> list[str]:
+    # Remote CI configs require BuildBuddy credentials. Removing them preserves
+    # the local fallback used for fork pull requests.
+    try:
+        separator_idx = args.index("--")
+    except ValueError:
+        separator_idx = len(args)
+    return [
+        *(arg for arg in args[:separator_idx] if arg not in REMOTE_EXECUTION_CONFIGS),
+        *args[separator_idx:],
+    ]
+
+
+def bazel_args_with_remote_config(
+    args: Sequence[str], env: Mapping[str, str]
+) -> list[str]:
+    command_idx = next(
+        (idx for idx, arg in enumerate(args) if not arg.startswith("-")),
+        None,
+    )
+    if command_idx is None:
+        raise ValueError("expected a Bazel command")
+
+    config = remote_config(args, env)
+    if config is None:
+        configured_args = bazel_args_without_remote_execution(args)
+    else:
+        # `remote_config()` returns a configuration only when this key is present.
+        api_key = env["BUILDBUDDY_API_KEY"]
+        remote_args = [
+            f"--config={config}",
+            f"--remote_header=x-buildbuddy-api-key={api_key}",
+        ]
+
+        # Insert immediately after the Bazel command. This keeps wrapper-added
+        # options out of positional payloads and lets later CI configs override
+        # shared RBE defaults such as the Windows cross-compilation exec platforms.
+        configured_args = [
+            *args[: command_idx + 1],
+            *remote_args,
+            *args[command_idx + 1 :],
+        ]
+
+    try:
+        separator_idx = configured_args.index("--")
+    except ValueError:
+        separator_idx = len(configured_args)
+
+    cache_args = [
+        f"{option_prefix}{env[env_name]}"
+        for env_name, option_prefix in (
+            ("BAZEL_REPO_CONTENTS_CACHE", "--repo_contents_cache="),
+            ("BAZEL_REPOSITORY_CACHE", "--repository_cache="),
+        )
+        if env.get(env_name)
+        and not any(
+            arg.startswith(option_prefix) for arg in configured_args[:separator_idx]
+        )
+    ]
+    return [
+        *configured_args[:separator_idx],
+        *cache_args,
+        *configured_args[separator_idx:],
+    ]
+
+
+def bazel_command(*args: str, env: Mapping[str, str] | None = None) -> list[str]:
+    env = os.environ if env is None else env
+    bazel = env.get("CODEX_BAZEL_BIN", "bazel")
+    return [bazel, *startup_args(args, env), *bazel_args_with_remote_config(args, env)]
+
+
+def main() -> None:
+    config = remote_config(sys.argv[1:], os.environ)
+    if config is None:
+        print(
+            "BuildBuddy key unavailable; using local Bazel configuration.",
+            file=sys.stderr,
+        )
+    else:
+        host_description = (
+            "OpenAI tenant" if uses_openai_host(os.environ) else "generic"
+        )
+        print(
+            f"Using {host_description} BuildBuddy configuration: {config}.",
+            file=sys.stderr,
+        )
+
+    command = bazel_command(*sys.argv[1:])
+    if os.name == "nt":
+        # Windows CRT exec can split arguments containing spaces and lose the
+        # eventual child exit status. Wait for Bazel and propagate its status.
+        result = subprocess.run(command, check=False)
+        raise SystemExit(result.returncode)
+
+    os.execvp(command[0], command)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/rusty_v8_bazel.py

@@ -0,0 +1,411 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import hashlib
+import re
+import shutil
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+from run_bazel_with_buildbuddy import bazel_command
+from rusty_v8_module_bazel import (
+    RustyV8ChecksumError,
+    check_module_bazel,
+    rusty_v8_http_file_versions,
+    update_module_bazel,
+)
+
+
+ROOT = Path(__file__).resolve().parents[2]
+MODULE_BAZEL = ROOT / "MODULE.bazel"
+RUSTY_V8_CHECKSUMS_DIR = ROOT / "third_party" / "v8"
+RELEASE_ARTIFACT_PROFILE = "release"
+SANDBOX_ARTIFACT_PROFILE = "ptrcomp_sandbox_release"
+ARTIFACT_BAZEL_CONFIGS = ["rusty-v8-upstream-libcxx"]
+
+
+def bazel_execroot() -> Path:
+    output = subprocess.check_output(
+        bazel_command("info", "execution_root"),
+        cwd=ROOT,
+        text=True,
+    )
+    return Path(output.strip())
+
+
+def bazel_output_base() -> Path:
+    output = subprocess.check_output(
+        bazel_command("info", "output_base"),
+        cwd=ROOT,
+        text=True,
+    )
+    return Path(output.strip())
+
+
+def bazel_output_path(path: str) -> Path:
+    if path.startswith("external/"):
+        return bazel_output_base() / path
+    return bazel_execroot() / path
+
+
+def bazel_output_files(
+    platform: str,
+    labels: list[str],
+    compilation_mode: str = "fastbuild",
+    bazel_configs: list[str] | None = None,
+) -> list[Path]:
+    expression = "set(" + " ".join(labels) + ")"
+    bazel_configs = bazel_configs or []
+    output = subprocess.check_output(
+        bazel_command(
+            "cquery",
+            "-c",
+            compilation_mode,
+            f"--platforms=@llvm//platforms:{platform}",
+            *[f"--config={config}" for config in bazel_configs],
+            "--output=files",
+            expression,
+        ),
+        cwd=ROOT,
+        text=True,
+    )
+    return [
+        bazel_output_path(line.strip()) for line in output.splitlines() if line.strip()
+    ]
+
+
+def bazel_build(
+    platform: str,
+    labels: list[str],
+    compilation_mode: str = "fastbuild",
+    bazel_configs: list[str] | None = None,
+    download_toplevel: bool = False,
+) -> None:
+    bazel_configs = bazel_configs or []
+    download_args = ["--remote_download_toplevel"] if download_toplevel else []
+    subprocess.run(
+        bazel_command(
+            "build",
+            "-c",
+            compilation_mode,
+            f"--platforms=@llvm//platforms:{platform}",
+            *[f"--config={config}" for config in bazel_configs],
+            *download_args,
+            *labels,
+        ),
+        cwd=ROOT,
+        check=True,
+    )
+
+
+def ensure_bazel_output_files(
+    platform: str,
+    labels: list[str],
+    compilation_mode: str = "fastbuild",
+    bazel_configs: list[str] | None = None,
+) -> list[Path]:
+    # Bazel output paths can be reused across config flips, so existence alone
+    # does not prove the files match the requested flags.
+    bazel_build(
+        platform,
+        labels,
+        compilation_mode,
+        bazel_configs,
+        download_toplevel=True,
+    )
+    outputs = bazel_output_files(platform, labels, compilation_mode, bazel_configs)
+    missing = [str(path) for path in outputs if not path.exists()]
+    if missing:
+        raise SystemExit(f"missing built outputs for {labels}: {missing}")
+    return outputs
+
+
+def artifact_bazel_configs(bazel_configs: list[str] | None = None) -> list[str]:
+    configured = list(ARTIFACT_BAZEL_CONFIGS)
+    for config in bazel_configs or []:
+        if config not in configured:
+            configured.append(config)
+    return configured
+
+
+def release_pair_label(target: str, sandbox: bool = False) -> str:
+    target_suffix = target.replace("-", "_")
+    pair_kind = "sandbox_release_pair" if sandbox else "release_pair"
+    return f"//third_party/v8:rusty_v8_{pair_kind}_{target_suffix}"
+
+
+def resolved_v8_crate_version() -> str:
+    cargo_lock = tomllib.loads((ROOT / "codex-rs" / "Cargo.lock").read_text())
+    versions = sorted(
+        {
+            package["version"]
+            for package in cargo_lock["package"]
+            if package["name"] == "v8"
+        }
+    )
+    if len(versions) == 1:
+        return versions[0]
+    if len(versions) > 1:
+        raise SystemExit(f"expected exactly one resolved v8 version, found: {versions}")
+
+    module_bazel = (ROOT / "MODULE.bazel").read_text()
+    matches = sorted(
+        set(
+            re.findall(
+                r"https://static\.crates\.io/crates/v8/v8-([0-9]+\.[0-9]+\.[0-9]+)\.crate",
+                module_bazel,
+            )
+        )
+    )
+    if len(matches) != 1:
+        raise SystemExit(
+            "expected exactly one pinned v8 crate version in MODULE.bazel, "
+            f"found: {matches}"
+        )
+    return matches[0]
+
+
+def rusty_v8_checksum_manifest_path(version: str) -> Path:
+    return RUSTY_V8_CHECKSUMS_DIR / f"rusty_v8_{version.replace('.', '_')}.sha256"
+
+
+def command_version(version: str | None) -> str:
+    if version is not None:
+        return version
+
+    manifest_versions = rusty_v8_http_file_versions(MODULE_BAZEL.read_text())
+    if len(manifest_versions) == 1:
+        return manifest_versions[0]
+    if len(manifest_versions) > 1:
+        raise SystemExit(
+            "expected at most one rusty_v8 http_file version in MODULE.bazel, "
+            f"found: {manifest_versions}; pass --version explicitly"
+        )
+
+    return resolved_v8_crate_version()
+
+
+def command_manifest_path(manifest: Path | None, version: str) -> Path:
+    if manifest is None:
+        return rusty_v8_checksum_manifest_path(version)
+    if manifest.is_absolute():
+        return manifest
+    return ROOT / manifest
+
+
+def staged_archive_name(target: str, source_path: Path, artifact_profile: str) -> str:
+    if target.endswith("-pc-windows-msvc"):
+        return f"rusty_v8_{artifact_profile}_{target}.lib.gz"
+    return f"librusty_v8_{artifact_profile}_{target}.a.gz"
+
+
+def staged_binding_name(target: str, artifact_profile: str) -> str:
+    return f"src_binding_{artifact_profile}_{target}.rs"
+
+
+def staged_checksums_name(target: str, artifact_profile: str) -> str:
+    return f"rusty_v8_{artifact_profile}_{target}.sha256"
+
+
+def stage_artifacts(
+    target: str,
+    lib_path: Path,
+    binding_path: Path,
+    output_dir: Path,
+    sandbox: bool,
+) -> None:
+    missing_paths = [
+        str(path) for path in [lib_path, binding_path] if not path.exists()
+    ]
+    if missing_paths:
+        raise SystemExit(f"missing release outputs for {target}: {missing_paths}")
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+    artifact_profile = SANDBOX_ARTIFACT_PROFILE if sandbox else RELEASE_ARTIFACT_PROFILE
+    staged_library = output_dir / staged_archive_name(
+        target, lib_path, artifact_profile
+    )
+    staged_binding = output_dir / staged_binding_name(target, artifact_profile)
+
+    with lib_path.open("rb") as src, staged_library.open("wb") as dst:
+        with gzip.GzipFile(
+            filename="",
+            mode="wb",
+            fileobj=dst,
+            compresslevel=6,
+            mtime=0,
+        ) as gz:
+            shutil.copyfileobj(src, gz)
+
+    shutil.copyfile(binding_path, staged_binding)
+
+    staged_checksums = output_dir / staged_checksums_name(target, artifact_profile)
+    with staged_checksums.open("w", encoding="utf-8", newline="\n") as checksums:
+        for path in [staged_library, staged_binding]:
+            digest = hashlib.sha256()
+            with path.open("rb") as artifact:
+                for chunk in iter(lambda: artifact.read(1024 * 1024), b""):
+                    digest.update(chunk)
+            checksums.write(f"{digest.hexdigest()}  {path.name}\n")
+
+    print(staged_library)
+    print(staged_binding)
+    print(staged_checksums)
+
+
+def upstream_release_pair_paths(
+    target: str,
+    target_dir: Path,
+) -> tuple[Path, Path]:
+    lib_name = (
+        "rusty_v8.lib" if target.endswith("-pc-windows-msvc") else "librusty_v8.a"
+    )
+    gn_out = target_dir / target / "release" / "gn_out"
+    return gn_out / "obj" / lib_name, gn_out / "src_binding.rs"
+
+
+def stage_upstream_release_pair(
+    target: str,
+    output_dir: Path,
+    target_dir: Path,
+    sandbox: bool = False,
+) -> None:
+    lib_path, binding_path = upstream_release_pair_paths(
+        target,
+        target_dir,
+    )
+    stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
+
+
+def stage_release_pair(
+    platform: str,
+    target: str,
+    output_dir: Path,
+    compilation_mode: str = "fastbuild",
+    bazel_configs: list[str] | None = None,
+    sandbox: bool = False,
+) -> None:
+    bazel_configs = artifact_bazel_configs(bazel_configs)
+    outputs = ensure_bazel_output_files(
+        platform,
+        [release_pair_label(target, sandbox)],
+        compilation_mode,
+        bazel_configs,
+    )
+
+    try:
+        lib_path = next(path for path in outputs if path.suffix in {".a", ".lib"})
+    except StopIteration as exc:
+        raise SystemExit(f"missing static library output for {target}") from exc
+
+    try:
+        binding_path = next(path for path in outputs if path.suffix == ".rs")
+    except StopIteration as exc:
+        raise SystemExit(f"missing Rust binding output for {target}") from exc
+
+    stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    stage_release_pair_parser = subparsers.add_parser("stage-release-pair")
+    stage_release_pair_parser.add_argument("--platform", required=True)
+    stage_release_pair_parser.add_argument("--target", required=True)
+    stage_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_release_pair_parser.add_argument("--sandbox", action="store_true")
+    stage_release_pair_parser.add_argument(
+        "--bazel-config",
+        action="append",
+        default=[],
+        dest="bazel_configs",
+    )
+    stage_release_pair_parser.add_argument(
+        "--compilation-mode",
+        default="fastbuild",
+        choices=["fastbuild", "opt", "dbg"],
+    )
+
+    stage_upstream_release_pair_parser = subparsers.add_parser(
+        "stage-upstream-release-pair"
+    )
+    stage_upstream_release_pair_parser.add_argument(
+        "--target-dir", type=Path, required=True
+    )
+    stage_upstream_release_pair_parser.add_argument("--target", required=True)
+    stage_upstream_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_upstream_release_pair_parser.add_argument("--sandbox", action="store_true")
+
+    subparsers.add_parser("resolved-v8-crate-version")
+
+    check_module_bazel_parser = subparsers.add_parser("check-module-bazel")
+    check_module_bazel_parser.add_argument("--version")
+    check_module_bazel_parser.add_argument("--manifest", type=Path)
+    check_module_bazel_parser.add_argument(
+        "--module-bazel",
+        type=Path,
+        default=MODULE_BAZEL,
+    )
+
+    update_module_bazel_parser = subparsers.add_parser("update-module-bazel")
+    update_module_bazel_parser.add_argument("--version")
+    update_module_bazel_parser.add_argument("--manifest", type=Path)
+    update_module_bazel_parser.add_argument(
+        "--module-bazel",
+        type=Path,
+        default=MODULE_BAZEL,
+    )
+
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    if args.command == "stage-release-pair":
+        stage_release_pair(
+            platform=args.platform,
+            target=args.target,
+            output_dir=Path(args.output_dir),
+            compilation_mode=args.compilation_mode,
+            bazel_configs=args.bazel_configs,
+            sandbox=args.sandbox,
+        )
+        return 0
+    if args.command == "stage-upstream-release-pair":
+        stage_upstream_release_pair(
+            target=args.target,
+            output_dir=Path(args.output_dir),
+            target_dir=args.target_dir,
+            sandbox=args.sandbox,
+        )
+        return 0
+    if args.command == "resolved-v8-crate-version":
+        print(resolved_v8_crate_version())
+        return 0
+    if args.command == "check-module-bazel":
+        version = command_version(args.version)
+        manifest_path = command_manifest_path(args.manifest, version)
+        try:
+            check_module_bazel(args.module_bazel, manifest_path, version)
+        except RustyV8ChecksumError as exc:
+            raise SystemExit(str(exc)) from exc
+        return 0
+    if args.command == "update-module-bazel":
+        version = command_version(args.version)
+        manifest_path = command_manifest_path(args.manifest, version)
+        try:
+            update_module_bazel(args.module_bazel, manifest_path, version)
+        except RustyV8ChecksumError as exc:
+            raise SystemExit(str(exc)) from exc
+        return 0
+    raise SystemExit(f"unsupported command: {args.command}")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/scripts/rusty_v8_module_bazel.py

@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+
+SHA256_RE = re.compile(r"[0-9a-f]{64}")
+HTTP_FILE_BLOCK_RE = re.compile(r"(?ms)^http_file\(\n.*?^\)\n?")
+HTTP_FILE_VERSION_RE = re.compile(r"^rusty_v8_([0-9]+)_([0-9]+)_([0-9]+)_")
+
+
+class RustyV8ChecksumError(ValueError):
+    pass
+
+
+@dataclass(frozen=True)
+class RustyV8HttpFile:
+    start: int
+    end: int
+    block: str
+    name: str
+    downloaded_file_path: str
+    sha256: str | None
+
+
+def parse_checksum_manifest(path: Path) -> dict[str, str]:
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except FileNotFoundError as exc:
+        raise RustyV8ChecksumError(f"missing checksum manifest: {path}") from exc
+
+    checksums: dict[str, str] = {}
+    for line_number, line in enumerate(lines, 1):
+        if not line.strip():
+            continue
+        parts = line.split()
+        if len(parts) != 2:
+            raise RustyV8ChecksumError(
+                f"{path}:{line_number}: expected '<sha256>  <filename>'"
+            )
+        checksum, filename = parts
+        if not SHA256_RE.fullmatch(checksum):
+            raise RustyV8ChecksumError(
+                f"{path}:{line_number}: invalid SHA-256 digest for {filename}"
+            )
+        if not filename or filename in {".", ".."} or "/" in filename:
+            raise RustyV8ChecksumError(
+                f"{path}:{line_number}: expected a bare artifact filename"
+            )
+        if filename in checksums:
+            raise RustyV8ChecksumError(
+                f"{path}:{line_number}: duplicate checksum for {filename}"
+            )
+        checksums[filename] = checksum
+
+    if not checksums:
+        raise RustyV8ChecksumError(f"empty checksum manifest: {path}")
+    return checksums
+
+
+def string_field(block: str, field: str) -> str | None:
+    # Matches one-line string fields inside http_file blocks, e.g. `sha256 = "...",`.
+    match = re.search(rf'^\s*{re.escape(field)}\s*=\s*"([^"]+)",\s*$', block, re.M)
+    if match:
+        return match.group(1)
+    return None
+
+
+def rusty_v8_http_files(module_bazel: str, version: str) -> list[RustyV8HttpFile]:
+    version_slug = version.replace(".", "_")
+    name_prefix = f"rusty_v8_{version_slug}_"
+    entries = []
+    for match in HTTP_FILE_BLOCK_RE.finditer(module_bazel):
+        block = match.group(0)
+        name = string_field(block, "name")
+        if not name or not name.startswith(name_prefix):
+            continue
+        downloaded_file_path = string_field(block, "downloaded_file_path")
+        if not downloaded_file_path:
+            raise RustyV8ChecksumError(
+                f"MODULE.bazel {name} is missing downloaded_file_path"
+            )
+        entries.append(
+            RustyV8HttpFile(
+                start=match.start(),
+                end=match.end(),
+                block=block,
+                name=name,
+                downloaded_file_path=downloaded_file_path,
+                sha256=string_field(block, "sha256"),
+            )
+        )
+    return entries
+
+
+def rusty_v8_http_file_versions(module_bazel: str) -> list[str]:
+    versions = set()
+    for match in HTTP_FILE_BLOCK_RE.finditer(module_bazel):
+        name = string_field(match.group(0), "name")
+        if not name:
+            continue
+        version_match = HTTP_FILE_VERSION_RE.match(name)
+        if version_match:
+            versions.add(".".join(version_match.groups()))
+    return sorted(versions)
+
+
+def module_entry_set_errors(
+    entries: list[RustyV8HttpFile],
+    checksums: dict[str, str],
+    version: str,
+) -> list[str]:
+    errors = []
+    if not entries:
+        errors.append(f"MODULE.bazel has no rusty_v8 http_file entries for {version}")
+        return errors
+
+    module_files: dict[str, RustyV8HttpFile] = {}
+    duplicate_files = set()
+    for entry in entries:
+        if entry.downloaded_file_path in module_files:
+            duplicate_files.add(entry.downloaded_file_path)
+        module_files[entry.downloaded_file_path] = entry
+
+    for filename in sorted(duplicate_files):
+        errors.append(f"MODULE.bazel has duplicate http_file entries for {filename}")
+
+    for filename in sorted(set(module_files) - set(checksums)):
+        entry = module_files[filename]
+        errors.append(f"MODULE.bazel {entry.name} has no checksum in the manifest")
+
+    for filename in sorted(set(checksums) - set(module_files)):
+        errors.append(f"manifest has {filename}, but MODULE.bazel has no http_file")
+
+    return errors
+
+
+def module_checksum_errors(
+    entries: list[RustyV8HttpFile],
+    checksums: dict[str, str],
+) -> list[str]:
+    errors = []
+    for entry in entries:
+        expected = checksums.get(entry.downloaded_file_path)
+        if expected is None:
+            continue
+        if entry.sha256 is None:
+            errors.append(f"MODULE.bazel {entry.name} is missing sha256")
+        elif entry.sha256 != expected:
+            errors.append(
+                f"MODULE.bazel {entry.name} has sha256 {entry.sha256}, "
+                f"expected {expected}"
+            )
+    return errors
+
+
+def raise_checksum_errors(message: str, errors: list[str]) -> None:
+    if errors:
+        formatted_errors = "\n".join(f"- {error}" for error in errors)
+        raise RustyV8ChecksumError(f"{message}:\n{formatted_errors}")
+
+
+def check_module_bazel_text(
+    module_bazel: str,
+    checksums: dict[str, str],
+    version: str,
+) -> None:
+    entries = rusty_v8_http_files(module_bazel, version)
+    errors = [
+        *module_entry_set_errors(entries, checksums, version),
+        *module_checksum_errors(entries, checksums),
+    ]
+    raise_checksum_errors("rusty_v8 MODULE.bazel checksum drift", errors)
+
+
+def block_with_sha256(block: str, checksum: str) -> str:
+    sha256_line_re = re.compile(r'(?m)^(\s*)sha256\s*=\s*"[0-9a-f]+",\s*$')
+    if sha256_line_re.search(block):
+        return sha256_line_re.sub(
+            lambda match: f'{match.group(1)}sha256 = "{checksum}",',
+            block,
+            count=1,
+        )
+
+    downloaded_file_path_match = re.search(
+        r'(?m)^(\s*)downloaded_file_path\s*=\s*"[^"]+",\n',
+        block,
+    )
+    if not downloaded_file_path_match:
+        raise RustyV8ChecksumError("http_file block is missing downloaded_file_path")
+    insert_at = downloaded_file_path_match.end()
+    indent = downloaded_file_path_match.group(1)
+    return f'{block[:insert_at]}{indent}sha256 = "{checksum}",\n{block[insert_at:]}'
+
+
+def update_module_bazel_text(
+    module_bazel: str,
+    checksums: dict[str, str],
+    version: str,
+) -> str:
+    entries = rusty_v8_http_files(module_bazel, version)
+    errors = module_entry_set_errors(entries, checksums, version)
+    raise_checksum_errors("cannot update rusty_v8 MODULE.bazel checksums", errors)
+
+    updated = []
+    previous_end = 0
+    for entry in entries:
+        updated.append(module_bazel[previous_end : entry.start])
+        updated.append(
+            block_with_sha256(entry.block, checksums[entry.downloaded_file_path])
+        )
+        previous_end = entry.end
+    updated.append(module_bazel[previous_end:])
+    return "".join(updated)
+
+
+def check_module_bazel(
+    module_bazel_path: Path,
+    manifest_path: Path,
+    version: str,
+) -> None:
+    checksums = parse_checksum_manifest(manifest_path)
+    module_bazel = module_bazel_path.read_text(encoding="utf-8")
+    check_module_bazel_text(module_bazel, checksums, version)
+    print(f"{module_bazel_path} rusty_v8 {version} checksums match {manifest_path}")
+
+
+def update_module_bazel(
+    module_bazel_path: Path,
+    manifest_path: Path,
+    version: str,
+) -> None:
+    checksums = parse_checksum_manifest(manifest_path)
+    module_bazel = module_bazel_path.read_text(encoding="utf-8")
+    updated_module_bazel = update_module_bazel_text(module_bazel, checksums, version)
+    if updated_module_bazel == module_bazel:
+        print(f"{module_bazel_path} rusty_v8 {version} checksums are already current")
+        return
+    module_bazel_path.write_text(updated_module_bazel, encoding="utf-8")
+    print(f"updated {module_bazel_path} rusty_v8 {version} checksums")

.github/scripts/setup-dev-drive.ps1

@@ -0,0 +1,63 @@
+# Configure a fast drive for Windows CI jobs.
+#
+# GitHub-hosted Windows runners do not always expose a secondary D: volume. When
+# they do not, create a Dev Drive VHD. CI depends on this path for its
+# build directories where CI spends significant time doing I/O, so fail the
+# job if no real Dev Drive is available.
+
+function Test-DevDrive {
+    param([string]$Drive)
+
+    & fsutil devdrv query $Drive *> $null
+    return $LASTEXITCODE -eq 0
+}
+
+function Invoke-BestEffort {
+    param([scriptblock]$Script, [string]$Description)
+
+    try {
+        & $Script
+    } catch {
+        Write-Warning "$Description failed: $($_.Exception.Message)"
+    }
+}
+
+if ((Test-Path "D:\") -and (Test-DevDrive "D:")) {
+    Write-Output "Using existing Dev Drive at D:"
+    $Drive = "D:"
+} else {
+    if (Test-Path "D:\") {
+        Write-Output "Existing D: volume is not a Dev Drive; provisioning a new Dev Drive VHD."
+    }
+
+    try {
+        $VhdPath = Join-Path $env:RUNNER_TEMP "codex-dev-drive.vhdx"
+        $SizeBytes = 64GB
+
+        if (Test-Path $VhdPath) {
+            Remove-Item -Path $VhdPath -Force
+        }
+
+        New-VHD -Path $VhdPath -SizeBytes $SizeBytes -Dynamic -ErrorAction Stop | Out-Null
+        $Mounted = Mount-VHD -Path $VhdPath -Passthru -ErrorAction Stop
+        $Disk = $Mounted | Get-Disk -ErrorAction Stop
+        $Disk | Initialize-Disk -PartitionStyle GPT -ErrorAction Stop
+        $Partition = $Disk | New-Partition -AssignDriveLetter -UseMaximumSize -ErrorAction Stop
+        $Volume = $Partition | Format-Volume -FileSystem ReFS -NewFileSystemLabel "CodexDevDrive" -DevDrive -Confirm:$false -Force -ErrorAction Stop
+
+        $Drive = "$($Volume.DriveLetter):"
+
+        if (-not (Test-DevDrive $Drive)) {
+            throw "Provisioned volume at $Drive did not pass Dev Drive verification."
+        }
+
+        Invoke-BestEffort { fsutil devdrv trust $Drive } "Trusting Dev Drive $Drive"
+        Invoke-BestEffort { fsutil devdrv enable /disallowAv } "Disabling AV filter attachment for Dev Drives"
+
+        Write-Output "Using Dev Drive at $Drive"
+    } catch {
+        throw "Failed to create Dev Drive: $($_.Exception.Message)"
+    }
+}
+
+"CI_BUILD_ROOT=$Drive" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

.github/scripts/setup-voice-windows.ps1

@@ -0,0 +1,96 @@
+# CI-only prerequisites. Never install these tools into a Codex package.
+param(
+    [Parameter(Mandatory = $true)][string]$Target,
+    [Parameter(Mandatory = $true)][string]$SnapshotArchive
+)
+
+$ErrorActionPreference = "Stop"
+$PkgHashes = @{
+    "x86_64-pc-windows-msvc" = @("x64", "5604cf25ef38bb6a09520cff25ae9f0ecd8c2443053b15e40df4ad1eae0e4405")
+    "aarch64-pc-windows-msvc" = @("arm64", "d5752ce2ac2296c8abb91fb12c12e75ee99ba8a18b52ce5febf325847b6f062b")
+}
+if (-not $PkgHashes.ContainsKey($Target)) { throw "Unsupported target: $Target" }
+$Root = Join-Path $env:RUNNER_TEMP "voice-windows-build-tools"
+$Evidence = Join-Path $Root "evidence"
+$Cygwin = Join-Path $Root "cygwin"
+$Cache = Join-Path $Root "cache"
+New-Item -ItemType Directory -Path $Root, $Evidence | Out-Null
+$ManifestPath = Join-Path $PSScriptRoot "voice-cygwin-snapshot.json"
+$Manifest = Get-Content -Raw $ManifestPath | ConvertFrom-Json
+$SnapshotTool = Join-Path $PSScriptRoot "voice-cygwin-inputs.py"
+& python $SnapshotTool extract --archive $SnapshotArchive --directory (Join-Path $Cache $Manifest.cacheDirectory)
+if ($LASTEXITCODE -ne 0) { throw "Cygwin snapshot could not be verified and extracted" }
+Copy-Item $ManifestPath (Join-Path $Evidence "cygwin-snapshot.json")
+
+# Official https://cygwin.com/setup/sha512.sum and pkgconf release asset digests.
+# The complete package closure is pinned separately in cygwin-snapshot.json.
+$Inputs = @(
+    @{
+        url = "https://cygwin.com/setup/setup-2.937.x86_64.exe"
+        file = "setup.exe"
+        algorithm = "SHA512"
+        digest = "6acea47c59781c9e7f544a18d53935d59df6e44d5d52ac95ee165671b8e388820455eebf30ccc7d254b00c3d0eb694269a0f8dc84b17944c1f355dac9c5aafcc"
+    },
+    @{
+        url = "https://github.com/pkgconf/pkgconf/releases/download/pkgconf-3.0.6/pkgconf-$($PkgHashes[$Target][0])-3.0.6.msi"
+        file = "pkgconf.msi"
+        algorithm = "SHA256"
+        digest = $PkgHashes[$Target][1]
+    }
+)
+foreach ($InputFile in $Inputs) {
+    $Destination = Join-Path $Root $InputFile.file
+    Invoke-WebRequest -Uri $InputFile.url -OutFile $Destination
+    $Actual = (Get-FileHash -Path $Destination -Algorithm $InputFile.algorithm).Hash.ToLowerInvariant()
+    if ($Actual -ne $InputFile.digest) { throw "Build input digest mismatch: $($InputFile.file)" }
+}
+$Inputs | ConvertTo-Json | Set-Content (Join-Path $Evidence "bootstrap-inputs.json")
+$Packages = $Manifest.requestedPackages -join ","
+# Only setup.xz + setup.xz.sig are present: local mode still verifies that
+# signature. Never substitute an unsigned setup.ini or enable a network fallback.
+$Setup = Start-Process -FilePath (Join-Path $Root "setup.exe") -Wait -PassThru -ArgumentList @(
+    "--quiet-mode", "--no-admin", "--no-shortcuts", "--only-site",
+    "--local-install", "--no-version-check",
+    "--root", "`"$Cygwin`"", "--local-package-dir", "`"$Cache`"",
+    "--packages", $Packages
+)
+if ($Setup.ExitCode -ne 0) { throw "Cygwin setup failed: $($Setup.ExitCode)" }
+Copy-Item (Join-Path $Cygwin "var/log/setup.log*") $Evidence
+Copy-Item (Join-Path $Cygwin "etc/setup/installed.db") $Evidence
+& (Join-Path $Cygwin "bin/cygcheck.exe") -cd | Set-Content (Join-Path $Evidence "packages.txt")
+if ($LASTEXITCODE -ne 0) { throw "Cannot inventory Cygwin packages" }
+& python $SnapshotTool check-installed --inventory (Join-Path $Evidence "packages.txt")
+if ($LASTEXITCODE -ne 0) { throw "Installed Cygwin package set differs from the snapshot" }
+Get-ChildItem $Cache -File -Recurse | ForEach-Object {
+    @{ file = [IO.Path]::GetRelativePath($Cache, $_.FullName); bytes = $_.Length;
+       sha512 = (Get-FileHash $_.FullName -Algorithm SHA512).Hash.ToLowerInvariant() }
+} | ConvertTo-Json | Set-Content (Join-Path $Evidence "package-cache.json")
+
+# Administrative extraction uses TARGETDIR, not a normal MSI installation:
+# no product registration or system PATH modification. Fail rather than fall
+# back to an ambient executable or ordinary installer if the payload is absent.
+$Image = Join-Path $Root "pkgconf-image"
+$Extract = Start-Process msiexec.exe -Wait -PassThru -ArgumentList @(
+    "/a", "`"$(Join-Path $Root 'pkgconf.msi')`"", "/qn", "/norestart",
+    "TARGETDIR=`"$Image`"", "/L*v", "`"$(Join-Path $Evidence 'pkgconf-extract.log')`""
+)
+if ($Extract.ExitCode -ne 0) { throw "pkgconf extraction failed: $($Extract.ExitCode)" }
+$Candidates = @(Get-ChildItem $Image -Filter pkgconf.exe -File -Recurse)
+if ($Candidates.Count -ne 1) { throw "Expected exactly one native pkgconf executable" }
+# Bazel shell-quotes execpaths containing spaces; Cargo executes PKG_CONFIG
+# directly. Keep the executable and its support files at a space-free execpath.
+$Native = Join-Path $Image "native"
+if (Test-Path $Native) { throw "Native pkgconf destination must be fresh" }
+Move-Item -LiteralPath $Candidates[0].Directory.FullName -Destination $Native
+$PkgConfig = Join-Path $Native "pkgconf.exe"
+$Version = & $PkgConfig --version
+if ($LASTEXITCODE -ne 0 -or $Version -ne "3.0.6") { throw "Unexpected native pkgconf version" }
+@{ target = $Target; cygwin_root = $Cygwin; pkg_config = $PkgConfig;
+   pkgconf_version = $Version; requested_packages = $Packages } |
+    ConvertTo-Json | Set-Content (Join-Path $Evidence "tools.json")
+# Declare complete installed support trees only after snapshot and tool checks.
+& python (Join-Path $PSScriptRoot "voice_windows_tools.py") --root $Root --target $Target --pkg-config $PkgConfig
+if ($LASTEXITCODE -ne 0) { throw "Cannot declare Windows Bazel tool inputs" }
+"VOICE_WINDOWS_BAZEL_REPOSITORY=$Root" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
+"VOICE_CYGWIN_ROOT=$Cygwin" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
+"VOICE_PKG_CONFIG=$PkgConfig" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append

.github/scripts/test_macos_signing_entitlements.py

@@ -0,0 +1,37 @@
+import plistlib
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+SIGNING_DIR = ROOT / ".github" / "scripts" / "macos-signing"
+ALLOW_JIT = "com.apple.security.cs.allow-jit"
+ALLOW_UNSIGNED_EXECUTABLE_MEMORY = (
+    "com.apple.security.cs.allow-unsigned-executable-memory"
+)
+
+
+class MacosSigningEntitlementsTest(unittest.TestCase):
+    def load(self, binary: str) -> dict[str, bool]:
+        path = SIGNING_DIR / f"{binary}.entitlements.plist"
+        with path.open("rb") as file:
+            return plistlib.load(file)
+
+    def test_v8_binaries_allow_unsigned_executable_memory(self) -> None:
+        expected = {
+            ALLOW_JIT: True,
+            ALLOW_UNSIGNED_EXECUTABLE_MEMORY: True,
+        }
+        for binary in ["codex", "codex-app-server", "codex-code-mode-host"]:
+            with self.subTest(binary=binary):
+                self.assertEqual(self.load(binary), expected)
+
+    def test_responses_proxy_keeps_existing_entitlements(self) -> None:
+        self.assertEqual(
+            self.load("codex-responses-api-proxy"),
+            {ALLOW_JIT: True},
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_resolve_python_cli_release.py

@@ -0,0 +1,250 @@
+import copy
+import json
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+import resolve_python_cli_release as resolver
+
+
+class ResolvePythonCliReleaseTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.revision = "a" * 40
+        self.run = {
+            "id": 123,
+            "path": ".github/workflows/rust-release.yml",
+            "event": "push",
+            "status": "completed",
+            "conclusion": "success",
+            "head_repository": {"full_name": "openai/codex"},
+            "head_branch": "rust-v1.2.3",
+            "head_sha": self.revision,
+        }
+        self.job = {
+            "id": 456,
+            "run_attempt": 1,
+            "name": "release",
+            "conclusion": "success",
+        }
+        self.commit = {"type": "commit", "sha": self.revision}
+        self.release = {
+            "id": 789,
+            "draft": False,
+            "prerelease": False,
+            "tag_name": "rust-v1.2.3",
+        }
+        self.assets = [
+            {"name": name, "state": "uploaded", "size": 100}
+            for name in [
+                "openai_codex_cli_bin-1.2.3-py3-none-macosx_10_9_x86_64.whl",
+                "openai_codex_cli_bin-1.2.3-py3-none-macosx_11_0_arm64.whl",
+                "openai_codex_cli_bin-1.2.3-py3-none-manylinux_2_17_aarch64.whl",
+                "openai_codex_cli_bin-1.2.3-py3-none-manylinux_2_17_x86_64.whl",
+                "openai_codex_cli_bin-1.2.3-py3-none-win_amd64.whl",
+                "openai_codex_cli_bin-1.2.3-py3-none-win_arm64.whl",
+                "codex-package-aarch64-unknown-linux-musl.tar.gz",
+                "codex-package-x86_64-unknown-linux-musl.tar.gz",
+            ]
+        ]
+        self.expected = {
+            "source_sha": self.revision,
+            "release_tag": "rust-v1.2.3",
+            "version": "1.2.3",
+        }
+
+    def responses(self) -> list:
+        return copy.deepcopy(
+            [
+                self.run,
+                {"jobs": [self.job]},
+                {"object": self.commit},
+                self.release,
+                self.assets,
+            ]
+        )
+
+    def test_resolves_lightweight_and_annotated_tags_to_the_run_revision(self) -> None:
+        for annotated in (False, True):
+            with self.subTest(annotated=annotated):
+                responses = self.responses()
+                if annotated:
+                    responses.insert(2, {"object": {"type": "tag", "sha": "b" * 40}})
+                with patch.object(resolver, "github_api", side_effect=responses):
+                    self.assertEqual(
+                        resolver.resolve_release("openai/codex", "123"), self.expected
+                    )
+
+    def test_skips_cli_prereleases_before_reading_jobs_or_assets(self) -> None:
+        for suffix in ("-alpha", "-alpha.1", "-alpha.1.2", "-beta", "-beta.1"):
+            with self.subTest(suffix=suffix):
+                run = {**self.run, "head_branch": f"rust-v1.2.3{suffix}"}
+                with patch.object(resolver, "github_api", return_value=run) as api:
+                    self.assertIsNone(resolver.resolve_release("openai/codex", "123"))
+                api.assert_called_once_with("repos/openai/codex/actions/runs/123")
+
+    def test_rejects_unrelated_or_incomplete_runs(self) -> None:
+        for field, value in (
+            ("id", 999),
+            ("path", ".github/workflows/sdk.yml"),
+            ("event", "pull_request"),
+            ("status", "in_progress"),
+            ("head_branch", "main"),
+            ("head_sha", "main"),
+            ("head_repository", {"full_name": "other/codex"}),
+        ):
+            with self.subTest(field=field, value=value):
+                with patch.object(
+                    resolver, "github_api", return_value={**self.run, field: value}
+                ):
+                    with self.assertRaises(ValueError):
+                        resolver.resolve_release("openai/codex", "123")
+
+    def test_accepts_failed_ancillary_publisher_and_its_partial_rerun(self) -> None:
+        for overall in ("failure", "cancelled"):
+            with self.subTest(overall=overall):
+                responses = self.responses()
+                responses[0]["conclusion"] = overall
+                responses[1]["jobs"].extend(
+                    [
+                        {
+                            "id": 999,
+                            "run_attempt": 2,
+                            "name": "publish-winget",
+                            "conclusion": "failure",
+                        },
+                        {
+                            **self.job,
+                            "id": 998,
+                            "run_attempt": 2,
+                            "conclusion": "skipped",
+                        },
+                    ]
+                )
+                with patch.object(resolver, "github_api", side_effect=responses):
+                    self.assertEqual(
+                        resolver.resolve_release("openai/codex", "123"), self.expected
+                    )
+
+    def test_requires_success_from_latest_executed_release_job(self) -> None:
+        for jobs in (
+            [],
+            [{**self.job, "conclusion": "skipped"}],
+            [{**self.job, "conclusion": "failure"}],
+            [{**self.job, "conclusion": "cancelled"}],
+            [
+                {**self.job, "id": 999, "run_attempt": 2, "conclusion": "failure"},
+                self.job,
+            ],
+        ):
+            with self.subTest(jobs=jobs):
+                with patch.object(
+                    resolver, "github_api", side_effect=[self.run, {"jobs": jobs}]
+                ):
+                    with self.assertRaisesRegex(ValueError, "successful release job"):
+                        resolver.resolve_release("openai/codex", "123")
+
+    def test_reads_all_pages_of_jobs_and_assets(self) -> None:
+        responses = self.responses()
+        responses.insert(1, {"jobs": [{**self.job, "name": "other"}] * 100})
+        responses.insert(-1, [{"name": "other", "state": "uploaded", "size": 1}] * 100)
+        with patch.object(resolver, "github_api", side_effect=responses) as api:
+            self.assertEqual(
+                resolver.resolve_release("openai/codex", "123"), self.expected
+            )
+        api.assert_any_call(
+            "repos/openai/codex/actions/runs/123/jobs?filter=all&per_page=100&page=2"
+        )
+        api.assert_any_call(
+            "repos/openai/codex/releases/789/assets?per_page=100&page=2"
+        )
+
+    def test_rejects_a_moved_tag(self) -> None:
+        responses = self.responses()
+        responses[2] = {"object": {"type": "commit", "sha": "b" * 40}}
+        with patch.object(resolver, "github_api", side_effect=responses):
+            with self.assertRaisesRegex(ValueError, "no longer matches"):
+                resolver.resolve_release("openai/codex", "123")
+
+    def test_bounds_annotated_tag_resolution(self) -> None:
+        tag = {"object": {"type": "tag", "sha": "b" * 40}}
+        with patch.object(
+            resolver,
+            "github_api",
+            side_effect=[self.run, {"jobs": [self.job]}, *([tag] * 9)],
+        ) as api:
+            with self.assertRaisesRegex(ValueError, "no longer matches"):
+                resolver.resolve_release("openai/codex", "123")
+        self.assertEqual(api.call_count, 11)
+
+    def test_requires_a_published_stable_release_for_the_tag(self) -> None:
+        for field, value in (
+            ("draft", True),
+            ("prerelease", True),
+            ("tag_name", "rust-v9.9.9"),
+        ):
+            responses = self.responses()
+            responses[3][field] = value
+            with self.subTest(field=field):
+                with patch.object(resolver, "github_api", side_effect=responses):
+                    with self.assertRaisesRegex(ValueError, "published and stable"):
+                        resolver.resolve_release("openai/codex", "123")
+
+    def test_requires_all_runtime_inputs_to_be_uploaded_and_nonempty(self) -> None:
+        for assets in (
+            self.assets[:-1],
+            [*self.assets[:-1], {**self.assets[-1], "size": 0}],
+            [*self.assets[:-1], {**self.assets[-1], "state": "new"}],
+        ):
+            with self.subTest(assets=assets):
+                responses = self.responses()
+                responses[-1] = assets
+                with patch.object(resolver, "github_api", side_effect=responses):
+                    with self.assertRaisesRegex(ValueError, "missing Python inputs"):
+                        resolver.resolve_release("openai/codex", "123")
+
+    def test_rejects_invalid_inputs_before_github_access(self) -> None:
+        with patch.object(resolver, "github_api") as api:
+            for repository, run_id in (
+                ("other/codex", "123"),
+                ("openai/codex", "../123"),
+            ):
+                with self.assertRaises(ValueError):
+                    resolver.resolve_release(repository, run_id)
+            api.assert_not_called()
+
+    def test_event_and_manual_retry_emit_the_same_revision_and_version(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "output"
+            event = Path(directory) / "event.json"
+            for automatic in (True, False):
+                output.write_text("")
+                event.write_text(
+                    json.dumps({"workflow_run": self.run} if automatic else {})
+                )
+                responses = self.responses()[1:] if automatic else self.responses()
+                with patch.object(resolver, "github_api", side_effect=responses) as api:
+                    resolver.main(
+                        [
+                            "123",
+                            "--repository",
+                            "openai/codex",
+                            "--event-path",
+                            str(event),
+                            "--github-output",
+                            str(output),
+                        ]
+                    )
+                self.assertEqual(
+                    output.read_text(),
+                    f"publish=true\nsource_sha={self.revision}\nrelease_tag=rust-v1.2.3\nversion=1.2.3\n",
+                )
+                if automatic:
+                    self.assertNotIn(
+                        unittest.mock.call("repos/openai/codex/actions/runs/123"),
+                        api.call_args_list,
+                    )
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_run_bazel_with_buildbuddy.py

@@ -0,0 +1,290 @@
+#!/usr/bin/env python3
+
+import json
+import os
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+import run_bazel_with_buildbuddy
+
+
+class RunBazelWithBuildBuddyTest(unittest.TestCase):
+    def github_env(
+        self,
+        temp_dir: str,
+        *,
+        repository: str = "openai/codex",
+        fork: bool = False,
+        event_name: str = "pull_request",
+    ) -> dict[str, str]:
+        event_path = Path(temp_dir) / "event.json"
+        event_path.write_text(
+            json.dumps({"pull_request": {"head": {"repo": {"fork": fork}}}}),
+            encoding="utf-8",
+        )
+        return {
+            "BUILDBUDDY_API_KEY": "token",
+            "GITHUB_ACTIONS": "true",
+            "GITHUB_EVENT_NAME": event_name,
+            "GITHUB_EVENT_PATH": str(event_path),
+            "GITHUB_REPOSITORY": repository,
+        }
+
+    def test_keyless_invocation_drops_remote_ci_configuration(self) -> None:
+        self.assertIsNone(
+            run_bazel_with_buildbuddy.remote_config(
+                ["build", "--config=ci-linux", "//codex-rs/cli:codex"],
+                {},
+            )
+        )
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_args_with_remote_config(
+                ["build", "--config=ci-linux", "--", "//codex-rs/cli:codex"],
+                {},
+            ),
+            ["build", "--", "//codex-rs/cli:codex"],
+        )
+
+    def test_program_arguments_after_separator_do_not_select_or_lose_rbe(self) -> None:
+        args = ["run", "//codex-rs/cli:codex", "--", "--config=remote"]
+
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_args_with_remote_config(args, {}),
+            args,
+        )
+        self.assertEqual(
+            run_bazel_with_buildbuddy.remote_config(
+                args, {"BUILDBUDDY_API_KEY": "fork-token"}
+            ),
+            "buildbuddy-generic",
+        )
+
+    def test_upstream_push_selects_openai_rbe_before_target_separator(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            env = self.github_env(temp_dir, event_name="push")
+
+            self.assertEqual(
+                run_bazel_with_buildbuddy.bazel_args_with_remote_config(
+                    ["build", "--config=ci-linux", "--", "//codex-rs/cli:codex"],
+                    env,
+                ),
+                [
+                    "build",
+                    "--config=buildbuddy-openai-rbe",
+                    "--remote_header=x-buildbuddy-api-key=token",
+                    "--config=ci-linux",
+                    "--",
+                    "//codex-rs/cli:codex",
+                ],
+            )
+
+    def test_windows_cross_ci_configuration_follows_remote_configuration(self) -> None:
+        env = {"BUILDBUDDY_API_KEY": "fork-token"}
+
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_args_with_remote_config(
+                ["build", "--config=ci-windows-cross", "//codex-rs/cli:codex"],
+                env,
+            ),
+            [
+                "build",
+                "--config=buildbuddy-generic-rbe",
+                "--remote_header=x-buildbuddy-api-key=fork-token",
+                "--config=ci-windows-cross",
+                "//codex-rs/cli:codex",
+            ],
+        )
+
+    def test_query_remote_configuration_is_inserted_before_expression(self) -> None:
+        expression = 'kind("rust_library rule", //codex-rs/...)'
+        env = {"BUILDBUDDY_API_KEY": "fork-token"}
+
+        for command in ("query", "cquery", "aquery"):
+            with self.subTest(command=command):
+                self.assertEqual(
+                    run_bazel_with_buildbuddy.bazel_args_with_remote_config(
+                        [
+                            command,
+                            "--config=ci-windows-cross",
+                            "--output=label",
+                            expression,
+                        ],
+                        env,
+                    ),
+                    [
+                        command,
+                        "--config=buildbuddy-generic-rbe",
+                        "--remote_header=x-buildbuddy-api-key=fork-token",
+                        "--config=ci-windows-cross",
+                        "--output=label",
+                        expression,
+                    ],
+                )
+
+    def test_same_repository_pull_request_selects_openai_host(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            self.assertEqual(
+                run_bazel_with_buildbuddy.remote_config(
+                    ["build", "--config=ci-v8"], self.github_env(temp_dir)
+                ),
+                "buildbuddy-openai-rbe",
+            )
+
+    def test_fork_pull_request_cannot_select_openai_host(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            env = self.github_env(temp_dir, fork=True)
+
+            self.assertEqual(
+                run_bazel_with_buildbuddy.remote_config(
+                    ["build", "--config=ci-v8"], env
+                ),
+                "buildbuddy-generic-rbe",
+            )
+
+    def test_run_in_fork_repository_cannot_select_openai_host(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            env = self.github_env(temp_dir, repository="contributor/codex")
+
+            self.assertEqual(
+                run_bazel_with_buildbuddy.remote_config(
+                    ["build", "--config=ci-v8"], env
+                ),
+                "buildbuddy-generic-rbe",
+            )
+
+    def test_pull_request_without_readable_event_payload_fails_closed(self) -> None:
+        for event_path in (None, "missing-event.json"):
+            env = {
+                "BUILDBUDDY_API_KEY": "token",
+                "GITHUB_ACTIONS": "true",
+                "GITHUB_EVENT_NAME": "pull_request",
+                "GITHUB_REPOSITORY": "openai/codex",
+            }
+            if event_path is not None:
+                env["GITHUB_EVENT_PATH"] = event_path
+
+            with self.subTest(event_path=event_path):
+                self.assertEqual(
+                    run_bazel_with_buildbuddy.remote_config(["build"], env),
+                    "buildbuddy-generic",
+                )
+
+    def test_bazel_command_uses_configured_binary_locally(self) -> None:
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_command(
+                "info",
+                "execution_root",
+                env={"CODEX_BAZEL_BIN": "fake-bazel"},
+            ),
+            ["fake-bazel", "info", "execution_root"],
+        )
+
+    def test_bazel_command_normalizes_github_actions_startup_options(self) -> None:
+        env = {
+            "BAZEL_OUTPUT_USER_ROOT": "/tmp/bazel-output",
+            "GITHUB_ACTIONS": "true",
+        }
+
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_command("build", "//codex-rs/...", env=env),
+            [
+                "bazel",
+                "--output_user_root=/tmp/bazel-output",
+                "--noexperimental_remote_repo_contents_cache",
+                "build",
+                "//codex-rs/...",
+            ],
+        )
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_command(
+                "--experimental_remote_repo_contents_cache",
+                "build",
+                "//codex-rs/...",
+                env=env,
+            ),
+            [
+                "bazel",
+                "--output_user_root=/tmp/bazel-output",
+                "--experimental_remote_repo_contents_cache",
+                "build",
+                "//codex-rs/...",
+            ],
+        )
+
+    def test_bazel_command_uses_configured_local_caches(self) -> None:
+        env = {
+            "BAZEL_REPO_CONTENTS_CACHE": "/tmp/bazel-repo-contents",
+            "BAZEL_REPOSITORY_CACHE": "/tmp/bazel-repository",
+        }
+
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_command(
+                "build",
+                "--config=local",
+                "//codex-rs/...",
+                env=env,
+            ),
+            [
+                "bazel",
+                "build",
+                "--config=local",
+                "//codex-rs/...",
+                "--repo_contents_cache=/tmp/bazel-repo-contents",
+                "--repository_cache=/tmp/bazel-repository",
+            ],
+        )
+
+    def test_bazel_command_adds_local_caches_before_separator(self) -> None:
+        self.assertEqual(
+            run_bazel_with_buildbuddy.bazel_command(
+                "build",
+                "//codex-rs/...",
+                "--",
+                "--program-arg",
+                env={"BAZEL_REPOSITORY_CACHE": "/tmp/bazel-repository"},
+            ),
+            [
+                "bazel",
+                "build",
+                "//codex-rs/...",
+                "--repository_cache=/tmp/bazel-repository",
+                "--",
+                "--program-arg",
+            ],
+        )
+
+    def test_main_preserves_spaced_argument_and_child_exit_status(self) -> None:
+        spaced_arg = (
+            r"--test_env=PATH=C:\Program Files\PowerShell\7;C:\Program Files\Git\bin"
+        )
+        child_code = (
+            f"import sys; sys.exit(37 if sys.argv[1] == {spaced_arg!r} else 91)"
+        )
+        env = os.environ.copy()
+        env["CODEX_BAZEL_BIN"] = sys.executable
+        env.pop("BAZEL_OUTPUT_USER_ROOT", None)
+        env.pop("BUILDBUDDY_API_KEY", None)
+        env.pop("GITHUB_ACTIONS", None)
+
+        result = subprocess.run(
+            [
+                sys.executable,
+                str(Path(run_bazel_with_buildbuddy.__file__)),
+                "-c",
+                child_code,
+                spaced_arg,
+            ],
+            env=env,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+
+        self.assertEqual(result.returncode, 37, result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_rusty_v8_bazel.py

@@ -0,0 +1,439 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import textwrap
+import unittest
+from os import environ
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from unittest.mock import patch
+
+import rusty_v8_bazel
+import rusty_v8_module_bazel
+
+
+class RustyV8BazelTest(unittest.TestCase):
+    def test_consumer_selectors_track_resolved_crate_version(self) -> None:
+        build_bazel = (
+            rusty_v8_bazel.ROOT / "third_party" / "v8" / "BUILD.bazel"
+        ).read_text()
+        version_suffix = rusty_v8_bazel.resolved_v8_crate_version().replace(".", "_")
+
+        for selector in [
+            "aarch64_apple_darwin_bazel",
+            "aarch64_pc_windows_gnullvm",
+            "aarch64_pc_windows_msvc",
+            "aarch64_unknown_linux_gnu_bazel",
+            "aarch64_unknown_linux_musl_release_base",
+            "x86_64_apple_darwin_bazel",
+            "x86_64_pc_windows_gnullvm",
+            "x86_64_pc_windows_msvc",
+            "x86_64_unknown_linux_gnu_bazel",
+            "x86_64_unknown_linux_musl_release",
+        ]:
+            self.assertIn(
+                f":v8_{version_suffix}_{selector}",
+                build_bazel,
+            )
+
+        for selector in [
+            "aarch64_apple_darwin",
+            "aarch64_pc_windows_gnullvm",
+            "aarch64_pc_windows_msvc",
+            "aarch64_unknown_linux_gnu",
+            "aarch64_unknown_linux_musl",
+            "x86_64_apple_darwin",
+            "x86_64_pc_windows_gnullvm",
+            "x86_64_pc_windows_msvc",
+            "x86_64_unknown_linux_gnu",
+            "x86_64_unknown_linux_musl",
+        ]:
+            self.assertIn(
+                f":src_binding_release_{selector}_{version_suffix}_release",
+                build_bazel,
+            )
+
+    def test_command_version_tracks_remaining_http_file_assets(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            module_bazel = Path(temp_dir) / "MODULE.bazel"
+            module_bazel.write_text(
+                textwrap.dedent(
+                    """\
+                    http_file(
+                        name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                        downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                        urls = ["https://example.test/archive.gz"],
+                    )
+                    """
+                )
+            )
+
+            with patch.object(rusty_v8_bazel, "MODULE_BAZEL", module_bazel):
+                self.assertEqual("146.4.0", rusty_v8_bazel.command_version(None))
+
+    def test_artifact_bazel_configs_always_enable_upstream_libcxx(self) -> None:
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx"],
+            rusty_v8_bazel.artifact_bazel_configs(),
+        )
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx", "v8-release-compat"],
+            rusty_v8_bazel.artifact_bazel_configs(["v8-release-compat"]),
+        )
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx", "v8-release-compat"],
+            rusty_v8_bazel.artifact_bazel_configs(
+                ["rusty-v8-upstream-libcxx", "v8-release-compat"]
+            ),
+        )
+
+    def test_bazel_commands_use_shared_buildbuddy_remote_config_library(self) -> None:
+        with patch.dict(environ, {}, clear=True):
+            self.assertEqual(
+                [
+                    "bazel",
+                    "build",
+                    "//third_party/v8:release",
+                ],
+                rusty_v8_bazel.bazel_command(
+                    "build",
+                    "--config=ci-v8",
+                    "//third_party/v8:release",
+                ),
+            )
+        with patch.dict(environ, {"BUILDBUDDY_API_KEY": "token"}, clear=True):
+            self.assertEqual(
+                [
+                    "bazel",
+                    "build",
+                    "--config=buildbuddy-generic-rbe",
+                    "--remote_header=x-buildbuddy-api-key=token",
+                    "--config=ci-v8",
+                    "//third_party/v8:release",
+                ],
+                rusty_v8_bazel.bazel_command(
+                    "build",
+                    "--config=ci-v8",
+                    "//third_party/v8:release",
+                ),
+            )
+
+    def test_release_pair_labels_and_staged_names_distinguish_sandbox_artifacts(
+        self,
+    ) -> None:
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl",
+            rusty_v8_bazel.release_pair_label("x86_64-unknown-linux-musl"),
+        )
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
+            rusty_v8_bazel.release_pair_label(
+                "x86_64-unknown-linux-musl", sandbox=True
+            ),
+        )
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_apple_darwin",
+            rusty_v8_bazel.release_pair_label("x86_64-apple-darwin", sandbox=True),
+        )
+        self.assertEqual(
+            "librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
+            rusty_v8_bazel.staged_archive_name(
+                "x86_64-unknown-linux-musl",
+                Path("libv8.a"),
+                rusty_v8_bazel.RELEASE_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
+            rusty_v8_bazel.staged_archive_name(
+                "x86_64-pc-windows-msvc",
+                Path("v8.a"),
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs",
+            rusty_v8_bazel.staged_binding_name(
+                "x86_64-unknown-linux-musl",
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "rusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.sha256",
+            rusty_v8_bazel.staged_checksums_name(
+                "x86_64-unknown-linux-musl",
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+
+    def test_stage_artifacts(self) -> None:
+        with TemporaryDirectory() as source_dir, TemporaryDirectory() as output_dir:
+            source_root = Path(source_dir)
+            archive = source_root / "librusty_v8.a"
+            binding = source_root / "src_binding.rs"
+            archive.write_bytes(b"archive")
+            binding.write_text("binding")
+
+            rusty_v8_bazel.stage_artifacts(
+                "aarch64-apple-darwin",
+                archive,
+                binding,
+                Path(output_dir),
+                sandbox=True,
+            )
+
+            self.assertEqual(
+                {
+                    "librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz",
+                    "src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs",
+                    "rusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.sha256",
+                },
+                {path.name for path in Path(output_dir).iterdir()},
+            )
+            checksums = (
+                Path(output_dir)
+                / "rusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.sha256"
+            ).read_bytes()
+            self.assertNotIn(b"\r", checksums)
+
+    def test_upstream_release_pair_paths(self) -> None:
+        self.assertEqual(
+            (
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-apple-darwin/release/gn_out/obj/"
+                    "librusty_v8.a"
+                ),
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-apple-darwin/release/gn_out/"
+                    "src_binding.rs"
+                ),
+            ),
+            rusty_v8_bazel.upstream_release_pair_paths(
+                "x86_64-apple-darwin",
+                Path("/tmp/rusty_v8/target"),
+            ),
+        )
+        self.assertEqual(
+            (
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-pc-windows-msvc/release/gn_out/"
+                    "obj/rusty_v8.lib"
+                ),
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-pc-windows-msvc/release/gn_out/"
+                    "src_binding.rs"
+                ),
+            ),
+            rusty_v8_bazel.upstream_release_pair_paths(
+                "x86_64-pc-windows-msvc",
+                Path("/tmp/rusty_v8/target"),
+            ),
+        )
+
+    def test_stage_upstream_release_pair(self) -> None:
+        with (
+            TemporaryDirectory() as target_dir,
+            TemporaryDirectory() as output_dir,
+        ):
+            gn_out = Path(target_dir) / "x86_64-pc-windows-msvc" / "release" / "gn_out"
+            (gn_out / "obj").mkdir(parents=True)
+            (gn_out / "obj" / "rusty_v8.lib").write_bytes(b"archive")
+            (gn_out / "src_binding.rs").write_text("binding")
+
+            rusty_v8_bazel.stage_upstream_release_pair(
+                "x86_64-pc-windows-msvc",
+                Path(output_dir),
+                Path(target_dir),
+                sandbox=True,
+            )
+
+            self.assertEqual(
+                {
+                    "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
+                    "src_binding_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.rs",
+                    "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.sha256",
+                },
+                {path.name for path in Path(output_dir).iterdir()},
+            )
+
+    def test_ensure_bazel_output_files_rebuilds_existing_outputs(self) -> None:
+        with TemporaryDirectory() as output_dir:
+            output = Path(output_dir) / "libv8.a"
+            output.write_bytes(b"archive")
+
+            with (
+                patch.object(rusty_v8_bazel, "bazel_build") as bazel_build,
+                patch.object(
+                    rusty_v8_bazel,
+                    "bazel_output_files",
+                    return_value=[output],
+                ) as bazel_output_files,
+            ):
+                self.assertEqual(
+                    [output],
+                    rusty_v8_bazel.ensure_bazel_output_files(
+                        "macos_arm64",
+                        ["//third_party/v8:pair"],
+                        "opt",
+                        ["rusty-v8-upstream-libcxx"],
+                    ),
+                )
+
+            bazel_build.assert_called_once_with(
+                "macos_arm64",
+                ["//third_party/v8:pair"],
+                "opt",
+                ["rusty-v8-upstream-libcxx"],
+                download_toplevel=True,
+            )
+            bazel_output_files.assert_called_once_with(
+                "macos_arm64",
+                ["//third_party/v8:pair"],
+                "opt",
+                ["rusty-v8-upstream-libcxx"],
+            )
+
+    def test_update_module_bazel_replaces_and_inserts_sha256(self) -> None:
+        module_bazel = textwrap.dedent(
+            """\
+            http_file(
+                name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                sha256 = "0000000000000000000000000000000000000000000000000000000000000000",
+                urls = [
+                    "https://example.test/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                ],
+            )
+
+            http_file(
+                name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding",
+                downloaded_file_path = "src_binding_release_x86_64-unknown-linux-musl.rs",
+                urls = [
+                    "https://example.test/src_binding_release_x86_64-unknown-linux-musl.rs",
+                ],
+            )
+
+            http_file(
+                name = "rusty_v8_145_0_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                sha256 = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+                urls = [
+                    "https://example.test/old.gz",
+                ],
+            )
+            """
+        )
+        checksums = {
+            "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz": (
+                "1111111111111111111111111111111111111111111111111111111111111111"
+            ),
+            "src_binding_release_x86_64-unknown-linux-musl.rs": (
+                "2222222222222222222222222222222222222222222222222222222222222222"
+            ),
+        }
+
+        updated = rusty_v8_module_bazel.update_module_bazel_text(
+            module_bazel,
+            checksums,
+            "146.4.0",
+        )
+
+        self.assertEqual(
+            textwrap.dedent(
+                """\
+                http_file(
+                    name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                    sha256 = "1111111111111111111111111111111111111111111111111111111111111111",
+                    urls = [
+                        "https://example.test/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                    ],
+                )
+
+                http_file(
+                    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding",
+                    downloaded_file_path = "src_binding_release_x86_64-unknown-linux-musl.rs",
+                    sha256 = "2222222222222222222222222222222222222222222222222222222222222222",
+                    urls = [
+                        "https://example.test/src_binding_release_x86_64-unknown-linux-musl.rs",
+                    ],
+                )
+
+                http_file(
+                    name = "rusty_v8_145_0_0_x86_64_unknown_linux_gnu_archive",
+                    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                    sha256 = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+                    urls = [
+                        "https://example.test/old.gz",
+                    ],
+                )
+                """
+            ),
+            updated,
+        )
+        rusty_v8_module_bazel.check_module_bazel_text(updated, checksums, "146.4.0")
+
+    def test_check_module_bazel_rejects_manifest_drift(self) -> None:
+        module_bazel = textwrap.dedent(
+            """\
+            http_file(
+                name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                sha256 = "1111111111111111111111111111111111111111111111111111111111111111",
+                urls = [
+                    "https://example.test/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                ],
+            )
+            """
+        )
+        checksums = {
+            "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz": (
+                "1111111111111111111111111111111111111111111111111111111111111111"
+            ),
+            "orphan.gz": (
+                "2222222222222222222222222222222222222222222222222222222222222222"
+            ),
+        }
+
+        with self.assertRaisesRegex(
+            rusty_v8_module_bazel.RustyV8ChecksumError,
+            "manifest has orphan.gz",
+        ):
+            rusty_v8_module_bazel.check_module_bazel_text(
+                module_bazel,
+                checksums,
+                "146.4.0",
+            )
+
+    def test_rusty_v8_http_file_versions(self) -> None:
+        module_bazel = textwrap.dedent(
+            """\
+            http_file(
+                name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "archive.gz",
+                urls = ["https://example.test/archive.gz"],
+            )
+
+            http_file(
+                name = "rusty_v8_147_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "new-archive.gz",
+                urls = ["https://example.test/new-archive.gz"],
+            )
+
+            http_file(
+                name = "unrelated_archive",
+                downloaded_file_path = "other.gz",
+                urls = ["https://example.test/other.gz"],
+            )
+            """
+        )
+
+        self.assertEqual(
+            ["146.4.0", "147.4.0"],
+            rusty_v8_module_bazel.rusty_v8_http_file_versions(module_bazel),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_v8_canary_changes.py

@@ -0,0 +1,111 @@
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from v8_canary_changes import changed_files
+from v8_canary_changes import canary_required
+from v8_canary_changes import merge_base
+from v8_canary_changes import resolved_v8_version
+from v8_canary_changes import windows_source_required
+
+
+class V8CanaryChangesTest(unittest.TestCase):
+    def test_resolved_v8_version(self) -> None:
+        cargo_lock = b"""\
+[[package]]
+name = "other"
+version = "1.0.0"
+
+[[package]]
+name = "v8"
+version = "149.2.0"
+"""
+
+        self.assertEqual(resolved_v8_version(cargo_lock), "149.2.0")
+
+    def test_unrelated_cargo_manifest_change_does_not_require_source_build(
+        self,
+    ) -> None:
+        self.assertFalse(
+            windows_source_required(
+                {"codex-rs/Cargo.toml"},
+                "149.2.0",
+                "149.2.0",
+            )
+        )
+
+    def test_v8_version_change_requires_source_build(self) -> None:
+        self.assertTrue(windows_source_required(set(), "149.2.0", "150.0.0"))
+
+    def test_module_helper_change_requires_source_build(self) -> None:
+        self.assertTrue(
+            windows_source_required(
+                {".github/scripts/rusty_v8_module_bazel.py"},
+                "149.2.0",
+                "149.2.0",
+            )
+        )
+
+    def test_shared_ci_setup_changes_require_canary_and_source_build(self) -> None:
+        for path in (
+            ".github/actions/setup-ci/action.yml",
+            ".github/scripts/setup-dev-drive.ps1",
+        ):
+            with self.subTest(path=path):
+                changed_files = {path}
+                self.assertTrue(canary_required(changed_files, "149.2.0", "149.2.0"))
+                self.assertTrue(
+                    windows_source_required(changed_files, "149.2.0", "149.2.0")
+                )
+
+    def test_manual_dispatch_requires_source_build(self) -> None:
+        self.assertTrue(
+            windows_source_required(
+                set(),
+                "149.2.0",
+                "149.2.0",
+                force=True,
+            )
+        )
+
+    def test_changed_files_excludes_changes_made_only_on_base_branch(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            self.run_git(root, "init", "--initial-branch=main")
+            self.run_git(root, "config", "user.name", "Test User")
+            self.run_git(root, "config", "user.email", "test@example.com")
+
+            self.write_and_commit(root, "initial", "initial.txt")
+            common = self.run_git(root, "rev-parse", "HEAD")
+            self.run_git(root, "switch", "-c", "feature")
+            self.run_git(root, "switch", "main")
+            self.write_and_commit(root, "base-only", "base-only.txt")
+            base = self.run_git(root, "rev-parse", "HEAD")
+
+            self.run_git(root, "switch", "feature")
+            self.write_and_commit(root, "feature-only", "feature-only.txt")
+            head = self.run_git(root, "rev-parse", "HEAD")
+
+            self.assertEqual(
+                changed_files(base, head, root=root),
+                {"feature-only.txt"},
+            )
+            self.assertEqual(merge_base(base, head, root=root), common)
+
+    def write_and_commit(self, root: Path, contents: str, path: str) -> None:
+        (root / path).write_text(contents)
+        self.run_git(root, "add", path)
+        self.run_git(root, "commit", "-m", contents)
+
+    def run_git(self, root: Path, *args: str) -> str:
+        return subprocess.check_output(
+            ["git", *args],
+            cwd=root,
+            stderr=subprocess.PIPE,
+            text=True,
+        ).strip()
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_verify_pypi_release.py

@@ -0,0 +1,96 @@
+import http.client
+import io
+import json
+import unittest
+import urllib.error
+from unittest.mock import MagicMock, patch
+
+from verify_pypi_release import verify_release
+
+
+class VerifyPyPIReleaseTest(unittest.TestCase):
+    def test_waits_for_complete_release_after_registry_error(self) -> None:
+        wheel = "openai_codex-1.2.3-py3-none-any.whl"
+        sdist = "openai_codex-1.2.3.tar.gz"
+        reset_response = MagicMock()
+        reset_response.__enter__.return_value.read.side_effect = ConnectionResetError(
+            "connection reset while reading response"
+        )
+        responses = [
+            urllib.error.URLError("registry unavailable"),
+            TimeoutError("registry timed out"),
+            http.client.IncompleteRead(b"{", 20),
+            reset_response,
+            io.StringIO('{"urls":'),
+            *[
+                io.StringIO(json.dumps(data))
+                for data in (
+                    None,
+                    [],
+                    {},
+                    {"urls": None},
+                    {"urls": {}},
+                    {"urls": [None]},
+                    {"urls": [{}]},
+                    {"urls": [{"filename": 42}]},
+                )
+            ],
+            io.StringIO(json.dumps({"urls": [{"filename": wheel}]})),
+            io.StringIO(
+                json.dumps({"urls": [{"filename": wheel}, {"filename": sdist}]})
+            ),
+        ]
+        with (
+            patch(
+                "verify_pypi_release.urllib.request.urlopen", side_effect=responses
+            ) as urlopen,
+            patch("verify_pypi_release.time.sleep") as sleep,
+        ):
+            verify_release("openai-codex", "1.2.3")
+
+        self.assertEqual(urlopen.call_count, 15)
+        self.assertEqual(sleep.call_count, 14)
+        urlopen.assert_called_with(
+            "https://pypi.org/pypi/openai-codex/1.2.3/json", timeout=30
+        )
+
+    def test_uses_canonical_version_for_lookup_and_artifact_names(self) -> None:
+        data = {
+            "urls": [
+                {"filename": name}
+                for name in (
+                    "openai_codex-1.2.3b1-py3-none-any.whl",
+                    "openai_codex-1.2.3b1.tar.gz",
+                )
+            ]
+        }
+        with (
+            patch(
+                "verify_pypi_release.urllib.request.urlopen",
+                return_value=io.StringIO(json.dumps(data)),
+            ) as urlopen,
+            patch("verify_pypi_release.time.sleep") as sleep,
+        ):
+            verify_release("openai-codex", "1.2.3b01")
+        urlopen.assert_called_once_with(
+            "https://pypi.org/pypi/openai-codex/1.2.3b1/json", timeout=30
+        )
+        sleep.assert_not_called()
+
+    def test_fails_after_bounded_retries_when_runtime_wheels_are_missing(self) -> None:
+        with (
+            patch(
+                "verify_pypi_release.urllib.request.urlopen",
+                side_effect=lambda *args, **kwargs: io.StringIO('{"urls": []}'),
+            ) as urlopen,
+            patch("verify_pypi_release.time.sleep") as sleep,
+            self.assertRaisesRegex(SystemExit, "did not become available on PyPI"),
+        ):
+            verify_release("openai-codex-cli-bin", "1.2.3a4.post5")
+
+        self.assertEqual(urlopen.call_count, 30)
+        self.assertEqual(sleep.call_count, 29)
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_voice_cygwin_inputs.py

@@ -0,0 +1,83 @@
+"""Offline checks for the public Windows build-input bootstrap."""
+
+import hashlib
+import importlib.util
+import io
+from pathlib import Path
+import tarfile
+import tempfile
+import unittest
+
+
+SCRIPT = Path(__file__).with_name("voice-cygwin-inputs.py")
+SPEC = importlib.util.spec_from_file_location("voice_cygwin_inputs", SCRIPT)
+inputs = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(inputs)
+
+
+class VoiceCygwinInputsTests(unittest.TestCase):
+    def test_input_paths_cannot_escape_the_local_cache(self):
+        manifest = {
+            "metadata": [
+                {"file": "x86_64/setup.xz"},
+                {"file": "x86_64/setup.xz.sig"},
+            ],
+            "packages": [{"file": "../outside.tar.xz"}],
+        }
+        with self.assertRaisesRegex(ValueError, "unsafe Cygwin input"):
+            inputs.records(manifest)
+
+    def test_extract_verifies_archive_and_every_input_before_offline_installation(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            payloads = {
+                "x86_64/setup.xz": b"metadata",
+                "x86_64/setup.xz.sig": b"signature",
+                "x86_64/release/bash/bash.tar.xz": b"package",
+            }
+            records = [
+                {
+                    "file": name,
+                    "bytes": len(data),
+                    "sha512": hashlib.sha512(data).hexdigest(),
+                }
+                for name, data in payloads.items()
+            ]
+            archive = root / "inputs.tar.gz"
+
+            def write_archive(contents):
+                with tarfile.open(archive, "w:gz") as bundle:
+                    for name, data in contents.items():
+                        info = tarfile.TarInfo(name)
+                        info.size = len(data)
+                        bundle.addfile(info, io.BytesIO(data))
+                return {
+                    "bytes": archive.stat().st_size,
+                    "sha256": hashlib.sha256(archive.read_bytes()).hexdigest(),
+                }
+
+            manifest = {
+                "metadata": records[:2],
+                "packages": records[2:],
+                "archive": write_archive(payloads),
+            }
+            destination = root / "cache"
+            inputs.extract(manifest, archive, destination)
+            self.assertEqual(
+                {
+                    record["file"]: (destination / record["file"]).read_bytes()
+                    for record in records
+                },
+                payloads,
+            )
+
+            (destination / records[2]["file"]).unlink()
+            payloads[records[2]["file"]] = b"wrong"
+            manifest["archive"] = write_archive(payloads)
+            with self.assertRaisesRegex(ValueError, "Cygwin input mismatch"):
+                inputs.extract(manifest, archive, root / "rejected")
+            self.assertFalse((root / "rejected").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/v8_canary_changes.py

@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+
+"""Decide which V8 canary work is needed for a commit range.
+
+The workflow deliberately has no trigger-level path filters because it is both
+directly triggered for pull requests and called by postmerge-ci. Keeping the
+patterns here gives those entrypoints one source of truth; unrelated events
+still run metadata but skip the expensive build matrices.
+"""
+
+import argparse
+import subprocess
+import tomllib
+from fnmatch import fnmatchcase
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+# These patterns replace the old pull_request/push path filters. Include parent
+# workflow changes because they can alter whether the canary is invoked.
+CANARY_PATH_PATTERNS = {
+    ".bazelrc",
+    ".github/actions/setup-bazel-ci/**",
+    ".github/actions/setup-ci/**",
+    ".github/scripts/run_bazel_with_buildbuddy.py",
+    ".github/scripts/rusty_v8_bazel.py",
+    ".github/scripts/rusty_v8_module_bazel.py",
+    ".github/scripts/setup-dev-drive.ps1",
+    ".github/scripts/v8_canary_changes.py",
+    ".github/workflows/postmerge-ci.yml",
+    ".github/workflows/rusty-v8-release.yml",
+    ".github/workflows/v8-canary.yml",
+    "MODULE.bazel",
+    "MODULE.bazel.lock",
+    "codex-rs/Cargo.toml",
+    "patches/BUILD.bazel",
+    "patches/llvm_*.patch",
+    "patches/rules_cc_*.patch",
+    "patches/v8_*.patch",
+    "third_party/v8/**",
+}
+# Windows source builds are a narrower, more expensive subset of the canary.
+# A V8 version change also requires them even when no path below changed.
+WINDOWS_SOURCE_BUILD_PATHS = {
+    ".github/actions/setup-ci/**",
+    ".github/scripts/rusty_v8_bazel.py",
+    ".github/scripts/rusty_v8_module_bazel.py",
+    ".github/scripts/setup-dev-drive.ps1",
+    ".github/scripts/v8_canary_changes.py",
+    ".github/workflows/rusty-v8-release.yml",
+    ".github/workflows/v8-canary.yml",
+}
+
+
+def matching_canary_paths(changed_files: set[str]) -> set[str]:
+    """Return changed paths that require the general V8 build matrix."""
+    return {
+        path
+        for path in changed_files
+        if any(fnmatchcase(path, pattern) for pattern in CANARY_PATH_PATTERNS)
+    }
+
+
+def canary_required(
+    changed_files: set[str],
+    base_v8_version: str,
+    head_v8_version: str,
+    *,
+    force: bool = False,
+) -> bool:
+    """Return whether the general V8 build matrix should run."""
+    return (
+        force
+        or base_v8_version != head_v8_version
+        or bool(matching_canary_paths(changed_files))
+    )
+
+
+def matching_windows_source_paths(changed_files: set[str]) -> set[str]:
+    """Return changed paths that require Windows rusty_v8 source builds."""
+    return {
+        path
+        for path in changed_files
+        if any(fnmatchcase(path, pattern) for pattern in WINDOWS_SOURCE_BUILD_PATHS)
+    }
+
+
+def resolved_v8_version(cargo_lock: bytes) -> str:
+    versions = sorted(
+        {
+            package["version"]
+            for package in tomllib.loads(cargo_lock.decode())["package"]
+            if package["name"] == "v8"
+        }
+    )
+    if len(versions) != 1:
+        raise ValueError(f"expected exactly one resolved v8 version, found: {versions}")
+    return versions[0]
+
+
+def windows_source_required(
+    changed_files: set[str],
+    base_v8_version: str,
+    head_v8_version: str,
+    *,
+    force: bool = False,
+) -> bool:
+    """Return whether Windows must rebuild rusty_v8 from source."""
+    return (
+        force
+        or base_v8_version != head_v8_version
+        or bool(matching_windows_source_paths(changed_files))
+    )
+
+
+def git_output(*args: str, root: Path = ROOT) -> bytes:
+    return subprocess.check_output(["git", *args], cwd=root)
+
+
+def v8_version_at_revision(revision: str, *, root: Path = ROOT) -> str:
+    return resolved_v8_version(
+        git_output("show", f"{revision}:codex-rs/Cargo.lock", root=root)
+    )
+
+
+def merge_base(base: str, head: str, *, root: Path = ROOT) -> str:
+    return git_output("merge-base", base, head, root=root).decode().strip()
+
+
+def changed_files(base: str, head: str, *, root: Path = ROOT) -> set[str]:
+    # Three-dot diff gives PRs merge-base semantics while remaining equivalent
+    # to before/after for ordinary linear pushes to main.
+    output = git_output(
+        "diff",
+        "--name-only",
+        "--no-renames",
+        f"{base}...{head}",
+        root=root,
+    )
+    return set(output.decode().splitlines())
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--base")
+    parser.add_argument("--head")
+    parser.add_argument("--force", action="store_true")
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+    if args.force:
+        # workflow_dispatch has no comparison range, and callers use it as a
+        # manual retry path, so it intentionally runs every variant.
+        canary = True
+        canary_reason = "manual workflow dispatch"
+        windows_source = True
+        windows_source_reason = "manual workflow dispatch"
+    elif not args.base or not args.head:
+        raise SystemExit("--base and --head are required unless --force is set")
+    else:
+        files = changed_files(args.base, args.head)
+        base_version = v8_version_at_revision(merge_base(args.base, args.head))
+        head_version = v8_version_at_revision(args.head)
+
+        matched_canary_paths = sorted(matching_canary_paths(files))
+        canary = canary_required(files, base_version, head_version)
+        windows_source = windows_source_required(files, base_version, head_version)
+        if base_version != head_version:
+            canary_reason = f"v8 version changed from {base_version} to {head_version}"
+            windows_source_reason = canary_reason
+        else:
+            canary_reason = (
+                ", ".join(matched_canary_paths)
+                if matched_canary_paths
+                else "no relevant changes"
+            )
+            matched_windows_paths = sorted(matching_windows_source_paths(files))
+            windows_source_reason = (
+                ", ".join(matched_windows_paths)
+                if matched_windows_paths
+                else "no relevant changes"
+            )
+
+    print(f"canary_required={str(canary).lower()}")
+    print(f"canary_reason={canary_reason}")
+    print(f"windows_source_required={str(windows_source).lower()}")
+    print(f"windows_source_reason={windows_source_reason}")
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/verify-zsh-manifest.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+manifest="${1:?missing zsh manifest path}"
+expected_sha256="${2:?missing expected zsh manifest SHA-256}"
+
+if command -v sha256sum >/dev/null 2>&1; then
+  printf '%s  %s\n' "$expected_sha256" "$manifest" | sha256sum --check -
+else
+  printf '%s  %s\n' "$expected_sha256" "$manifest" | shasum -a 256 --check -
+fi

.github/scripts/verify_bazel_clippy_lints.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+import tomllib
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+DEFAULT_CARGO_TOML = ROOT / "codex-rs" / "Cargo.toml"
+DEFAULT_BAZELRC = ROOT / ".bazelrc"
+BAZEL_CLIPPY_FLAG_PREFIX = "build:clippy --@rules_rust//rust/settings:clippy_flag="
+BAZEL_SPECIAL_FLAGS = {"-Dwarnings"}
+VALID_LEVELS = {"allow", "warn", "deny", "forbid"}
+LONG_FLAG_RE = re.compile(
+    r"^--(?P<level>allow|warn|deny|forbid)=clippy::(?P<lint>[a-z0-9_]+)$"
+)
+SHORT_FLAG_RE = re.compile(r"^-(?P<level>[AWDF])clippy::(?P<lint>[a-z0-9_]+)$")
+SHORT_LEVEL_NAMES = {
+    "A": "allow",
+    "W": "warn",
+    "D": "deny",
+    "F": "forbid",
+}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description=(
+            "Verify that Bazel clippy flags in .bazelrc stay in sync with "
+            "codex-rs/Cargo.toml [workspace.lints.clippy]."
+        )
+    )
+    parser.add_argument(
+        "--cargo-toml",
+        type=Path,
+        default=DEFAULT_CARGO_TOML,
+        help="Path to the workspace Cargo.toml to inspect.",
+    )
+    parser.add_argument(
+        "--bazelrc",
+        type=Path,
+        default=DEFAULT_BAZELRC,
+        help="Path to the .bazelrc file to inspect.",
+    )
+    args = parser.parse_args()
+
+    cargo_toml = args.cargo_toml.resolve()
+    bazelrc = args.bazelrc.resolve()
+
+    cargo_lints = load_workspace_clippy_lints(cargo_toml)
+    bazel_lints = load_bazel_clippy_lints(bazelrc)
+
+    missing = sorted(cargo_lints.keys() - bazel_lints.keys())
+    extra = sorted(bazel_lints.keys() - cargo_lints.keys())
+    mismatched = sorted(
+        lint
+        for lint in cargo_lints.keys() & bazel_lints.keys()
+        if cargo_lints[lint] != bazel_lints[lint]
+    )
+
+    if missing or extra or mismatched:
+        print_sync_error(
+            cargo_toml=cargo_toml,
+            bazelrc=bazelrc,
+            cargo_lints=cargo_lints,
+            bazel_lints=bazel_lints,
+            missing=missing,
+            extra=extra,
+            mismatched=mismatched,
+        )
+        return 1
+
+    print(
+        "Bazel clippy flags in "
+        f"{display_path(bazelrc)} match "
+        f"{display_path(cargo_toml)} [workspace.lints.clippy]."
+    )
+    return 0
+
+
+def load_workspace_clippy_lints(cargo_toml: Path) -> dict[str, str]:
+    workspace = tomllib.loads(cargo_toml.read_text())["workspace"]
+    clippy_lints = workspace["lints"]["clippy"]
+    parsed: dict[str, str] = {}
+    for lint, level in clippy_lints.items():
+        if not isinstance(level, str):
+            raise SystemExit(
+                f"expected string lint level for clippy::{lint} in {cargo_toml}, got {level!r}"
+            )
+        normalized = level.strip().lower()
+        if normalized not in VALID_LEVELS:
+            raise SystemExit(
+                f"unsupported lint level {level!r} for clippy::{lint} in {cargo_toml}"
+            )
+        parsed[lint] = normalized
+    return parsed
+
+
+def load_bazel_clippy_lints(bazelrc: Path) -> dict[str, str]:
+    parsed: dict[str, str] = {}
+    line_numbers: dict[str, int] = {}
+
+    for lineno, line in enumerate(bazelrc.read_text().splitlines(), start=1):
+        if not line.startswith(BAZEL_CLIPPY_FLAG_PREFIX):
+            continue
+
+        flag = line.removeprefix(BAZEL_CLIPPY_FLAG_PREFIX).strip()
+        if flag in BAZEL_SPECIAL_FLAGS:
+            continue
+
+        parsed_flag = parse_bazel_lint_flag(flag)
+        if parsed_flag is None:
+            continue
+
+        lint, level = parsed_flag
+        if lint in parsed:
+            raise SystemExit(
+                f"duplicate Bazel clippy entry for clippy::{lint} at "
+                f"{bazelrc}:{line_numbers[lint]} and {bazelrc}:{lineno}"
+            )
+        parsed[lint] = level
+        line_numbers[lint] = lineno
+
+    return parsed
+
+
+def parse_bazel_lint_flag(flag: str) -> tuple[str, str] | None:
+    long_match = LONG_FLAG_RE.match(flag)
+    if long_match:
+        return long_match["lint"], long_match["level"]
+
+    short_match = SHORT_FLAG_RE.match(flag)
+    if short_match:
+        return short_match["lint"], SHORT_LEVEL_NAMES[short_match["level"]]
+
+    return None
+
+
+def print_sync_error(
+    *,
+    cargo_toml: Path,
+    bazelrc: Path,
+    cargo_lints: dict[str, str],
+    bazel_lints: dict[str, str],
+    missing: list[str],
+    extra: list[str],
+    mismatched: list[str],
+) -> None:
+    cargo_toml_display = display_path(cargo_toml)
+    bazelrc_display = display_path(bazelrc)
+    example_manifest = find_workspace_lints_example_manifest()
+
+    print(
+        "ERROR: Bazel clippy flags are out of sync with Cargo workspace clippy lints.",
+        file=sys.stderr,
+    )
+    print(file=sys.stderr)
+    print(
+        f"Cargo defines the source of truth in {cargo_toml_display} "
+        "[workspace.lints.clippy].",
+        file=sys.stderr,
+    )
+    if example_manifest is not None:
+        print(
+            "Cargo applies those lint levels to member crates that opt into "
+            f"`[lints] workspace = true`, for example {example_manifest}.",
+            file=sys.stderr,
+        )
+    print(
+        "Bazel clippy does not ingest Cargo lint levels automatically, and "
+        "`clippy.toml` can configure lint behavior but cannot set allow/warn/deny/forbid.",
+        file=sys.stderr,
+    )
+    print(
+        f"Update {bazelrc_display} so its `build:clippy` "
+        "`clippy_flag` entries match Cargo.",
+        file=sys.stderr,
+    )
+
+    if missing:
+        print(file=sys.stderr)
+        print("Missing Bazel entries:", file=sys.stderr)
+        for lint in missing:
+            print(f"  {render_bazelrc_line(lint, cargo_lints[lint])}", file=sys.stderr)
+
+    if mismatched:
+        print(file=sys.stderr)
+        print("Mismatched lint levels:", file=sys.stderr)
+        for lint in mismatched:
+            cargo_level = cargo_lints[lint]
+            bazel_level = bazel_lints[lint]
+            print(
+                f"  clippy::{lint}: Cargo has {cargo_level}, Bazel has {bazel_level}",
+                file=sys.stderr,
+            )
+            print(
+                f"    expected: {render_bazelrc_line(lint, cargo_level)}",
+                file=sys.stderr,
+            )
+
+    if extra:
+        print(file=sys.stderr)
+        print("Extra Bazel entries with no Cargo counterpart:", file=sys.stderr)
+        for lint in extra:
+            print(f"  {render_bazelrc_line(lint, bazel_lints[lint])}", file=sys.stderr)
+
+
+def render_bazelrc_line(lint: str, level: str) -> str:
+    return f"{BAZEL_CLIPPY_FLAG_PREFIX}--{level}=clippy::{lint}"
+
+
+def display_path(path: Path) -> str:
+    try:
+        return str(path.relative_to(ROOT))
+    except ValueError:
+        return str(path)
+
+
+def find_workspace_lints_example_manifest() -> str | None:
+    for cargo_toml in sorted((ROOT / "codex-rs").glob("**/Cargo.toml")):
+        if cargo_toml == DEFAULT_CARGO_TOML:
+            continue
+        data = tomllib.loads(cargo_toml.read_text())
+        if data.get("lints", {}).get("workspace") is True:
+            return str(cargo_toml.relative_to(ROOT))
+    return None
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/scripts/verify_cargo_workspace_manifests.py

@@ -0,0 +1,395 @@
+#!/usr/bin/env python3
+
+"""Verify that codex-rs Cargo manifests follow workspace manifest policy.
+
+Checks:
+- Crates inherit `[workspace.package]` metadata.
+- Crates opt into `[lints] workspace = true`.
+- Crate names follow the codex-rs directory naming conventions.
+- Workspace manifests do not introduce workspace crate feature toggles.
+"""
+
+from __future__ import annotations
+
+import sys
+import tomllib
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+CARGO_RS_ROOT = ROOT / "codex-rs"
+WORKSPACE_PACKAGE_FIELDS = ("version", "edition", "license")
+TOP_LEVEL_NAME_EXCEPTIONS = {
+    "windows-sandbox-rs": "codex-windows-sandbox",
+}
+UTILITY_NAME_EXCEPTIONS = {
+    "path-utils": "codex-utils-path",
+}
+MANIFEST_FEATURE_EXCEPTIONS = {
+    "codex-rs/code-mode/Cargo.toml": {"sandbox": ("v8/v8_enable_sandbox",)},
+    "codex-rs/v8-poc/Cargo.toml": {"sandbox": ("v8/v8_enable_sandbox",)},
+}
+OPTIONAL_DEPENDENCY_EXCEPTIONS = set()
+INTERNAL_DEPENDENCY_FEATURE_EXCEPTIONS = {}
+
+
+def main() -> int:
+    internal_package_names = workspace_package_names()
+    used_manifest_feature_exceptions: set[str] = set()
+    used_optional_dependency_exceptions: set[tuple[str, str, str]] = set()
+    used_internal_dependency_feature_exceptions: set[tuple[str, str, str]] = set()
+    failures_by_path: dict[str, list[str]] = {}
+
+    for path in manifests_to_verify():
+        if errors := manifest_errors(
+            path,
+            internal_package_names,
+            used_manifest_feature_exceptions,
+            used_optional_dependency_exceptions,
+            used_internal_dependency_feature_exceptions,
+        ):
+            failures_by_path[manifest_key(path)] = errors
+
+    add_unused_exception_errors(
+        failures_by_path,
+        used_manifest_feature_exceptions,
+        used_optional_dependency_exceptions,
+        used_internal_dependency_feature_exceptions,
+    )
+
+    if not failures_by_path:
+        return 0
+
+    print(
+        "Cargo manifests under codex-rs must inherit workspace package metadata, "
+        "opt into workspace lints, and avoid introducing new workspace crate "
+        "features."
+    )
+    print(
+        "Workspace crate features are disallowed because our Bazel build setup "
+        "does not honor them today, which can let issues hidden behind feature "
+        "gates go unnoticed, and because they add extra crate build "
+        "permutations we want to avoid."
+    )
+    print(
+        "Cargo only applies `codex-rs/Cargo.toml` `[workspace.lints.clippy]` "
+        "entries to a crate when that crate declares:"
+    )
+    print()
+    print("[lints]")
+    print("workspace = true")
+    print()
+    print(
+        "Without that opt-in, `cargo clippy` can miss violations that Bazel clippy "
+        "catches."
+    )
+    print()
+    print(
+        "Package-name checks apply to `codex-rs/<crate>/Cargo.toml` and "
+        "`codex-rs/utils/<crate>/Cargo.toml`."
+    )
+    print(
+        "Workspace crate features are forbidden; add a targeted exception here "
+        "only if there is a deliberate temporary migration in flight."
+    )
+    print()
+    for path in sorted(failures_by_path):
+        errors = failures_by_path[path]
+        print(f"{path}:")
+        for error in errors:
+            print(f"  - {error}")
+
+    return 1
+
+
+def manifest_errors(
+    path: Path,
+    internal_package_names: set[str],
+    used_manifest_feature_exceptions: set[str],
+    used_optional_dependency_exceptions: set[tuple[str, str, str]],
+    used_internal_dependency_feature_exceptions: set[tuple[str, str, str]],
+) -> list[str]:
+    manifest = load_manifest(path)
+    package = manifest.get("package")
+    if not isinstance(package, dict) and path != CARGO_RS_ROOT / "Cargo.toml":
+        return []
+
+    errors = []
+    if isinstance(package, dict):
+        for field in WORKSPACE_PACKAGE_FIELDS:
+            if not is_workspace_reference(package.get(field)):
+                errors.append(f"set `{field}.workspace = true` in `[package]`")
+
+        lints = manifest.get("lints")
+        if not (isinstance(lints, dict) and lints.get("workspace") is True):
+            errors.append("add `[lints]` with `workspace = true`")
+
+        expected_name = expected_package_name(path)
+        if expected_name is not None:
+            actual_name = package.get("name")
+            if actual_name != expected_name:
+                errors.append(
+                    f"set `[package].name` to `{expected_name}` (found `{actual_name}`)"
+                )
+
+    path_key = manifest_key(path)
+    features = manifest.get("features")
+    if features is not None:
+        normalized_features = normalize_feature_mapping(features)
+        expected_features = MANIFEST_FEATURE_EXCEPTIONS.get(path_key)
+        if expected_features is None:
+            errors.append(
+                "remove `[features]`; new workspace crate features are not allowed"
+            )
+        else:
+            used_manifest_feature_exceptions.add(path_key)
+            if normalized_features != expected_features:
+                errors.append(
+                    "limit `[features]` to the existing exception list while "
+                    "workspace crate features are being removed "
+                    f"(expected {render_feature_mapping(expected_features)})"
+                )
+
+    for section_name, dependencies in dependency_sections(manifest):
+        for dependency_name, dependency in dependencies.items():
+            if not isinstance(dependency, dict):
+                continue
+
+            if dependency.get("optional") is True:
+                exception_key = (path_key, section_name, dependency_name)
+                if exception_key in OPTIONAL_DEPENDENCY_EXCEPTIONS:
+                    used_optional_dependency_exceptions.add(exception_key)
+                else:
+                    errors.append(
+                        "remove `optional = true` from "
+                        f"`{dependency_entry_label(section_name, dependency_name)}`; "
+                        "new optional dependencies are not allowed because they "
+                        "create crate features"
+                    )
+
+            if not is_internal_dependency(
+                path, dependency_name, dependency, internal_package_names
+            ):
+                continue
+
+            dependency_features = dependency.get("features")
+            if dependency_features is not None:
+                normalized_dependency_features = normalize_string_list(
+                    dependency_features
+                )
+                exception_key = (path_key, section_name, dependency_name)
+                expected_dependency_features = (
+                    INTERNAL_DEPENDENCY_FEATURE_EXCEPTIONS.get(exception_key)
+                )
+                if expected_dependency_features is None:
+                    errors.append(
+                        "remove `features = [...]` from workspace dependency "
+                        f"`{dependency_entry_label(section_name, dependency_name)}`; "
+                        "new workspace crate feature activations are not allowed"
+                    )
+                else:
+                    used_internal_dependency_feature_exceptions.add(exception_key)
+                    if normalized_dependency_features != expected_dependency_features:
+                        errors.append(
+                            "limit workspace dependency features on "
+                            f"`{dependency_entry_label(section_name, dependency_name)}` "
+                            "to the existing exception list while workspace crate "
+                            "features are being removed "
+                            f"(expected {render_string_list(expected_dependency_features)})"
+                        )
+
+            if dependency.get("default-features") is False:
+                errors.append(
+                    "remove `default-features = false` from workspace dependency "
+                    f"`{dependency_entry_label(section_name, dependency_name)}`; "
+                    "new workspace crate feature toggles are not allowed"
+                )
+
+    return errors
+
+
+def expected_package_name(path: Path) -> str | None:
+    parts = path.relative_to(CARGO_RS_ROOT).parts
+    if len(parts) == 2 and parts[1] == "Cargo.toml":
+        directory = parts[0]
+        return TOP_LEVEL_NAME_EXCEPTIONS.get(
+            directory,
+            directory if directory.startswith("codex-") else f"codex-{directory}",
+        )
+    if len(parts) == 3 and parts[0] == "utils" and parts[2] == "Cargo.toml":
+        directory = parts[1]
+        return UTILITY_NAME_EXCEPTIONS.get(directory, f"codex-utils-{directory}")
+    return None
+
+
+def is_workspace_reference(value: object) -> bool:
+    return isinstance(value, dict) and value.get("workspace") is True
+
+
+def manifest_key(path: Path) -> str:
+    return str(path.relative_to(ROOT))
+
+
+def normalize_feature_mapping(value: object) -> dict[str, tuple[str, ...]] | None:
+    if not isinstance(value, dict):
+        return None
+
+    normalized = {}
+    for key, features in value.items():
+        if not isinstance(key, str):
+            return None
+        normalized_features = normalize_string_list(features)
+        if normalized_features is None:
+            return None
+        normalized[key] = normalized_features
+    return normalized
+
+
+def normalize_string_list(value: object) -> tuple[str, ...] | None:
+    if not isinstance(value, list) or not all(isinstance(item, str) for item in value):
+        return None
+    return tuple(value)
+
+
+def render_feature_mapping(features: dict[str, tuple[str, ...]]) -> str:
+    entries = [
+        f"{name} = {render_string_list(items)}" for name, items in features.items()
+    ]
+    return ", ".join(entries)
+
+
+def render_string_list(items: tuple[str, ...]) -> str:
+    return "[" + ", ".join(f'"{item}"' for item in items) + "]"
+
+
+def dependency_sections(manifest: dict) -> list[tuple[str, dict]]:
+    sections = []
+    for section_name in ("dependencies", "dev-dependencies", "build-dependencies"):
+        dependencies = manifest.get(section_name)
+        if isinstance(dependencies, dict):
+            sections.append((section_name, dependencies))
+
+    workspace = manifest.get("workspace")
+    if isinstance(workspace, dict):
+        workspace_dependencies = workspace.get("dependencies")
+        if isinstance(workspace_dependencies, dict):
+            sections.append(("workspace.dependencies", workspace_dependencies))
+
+    target = manifest.get("target")
+    if not isinstance(target, dict):
+        return sections
+
+    for target_name, tables in target.items():
+        if not isinstance(tables, dict):
+            continue
+        for section_name in ("dependencies", "dev-dependencies", "build-dependencies"):
+            dependencies = tables.get(section_name)
+            if isinstance(dependencies, dict):
+                sections.append((f"target.{target_name}.{section_name}", dependencies))
+
+    return sections
+
+
+def dependency_entry_label(section_name: str, dependency_name: str) -> str:
+    return f"[{section_name}].{dependency_name}"
+
+
+def is_internal_dependency(
+    manifest_path: Path,
+    dependency_name: str,
+    dependency: dict,
+    internal_package_names: set[str],
+) -> bool:
+    package_name = dependency.get("package", dependency_name)
+    if isinstance(package_name, str) and package_name in internal_package_names:
+        return True
+
+    dependency_path = dependency.get("path")
+    if not isinstance(dependency_path, str):
+        return False
+
+    resolved_dependency_path = (manifest_path.parent / dependency_path).resolve()
+    try:
+        resolved_dependency_path.relative_to(CARGO_RS_ROOT)
+    except ValueError:
+        return False
+    return True
+
+
+def add_unused_exception_errors(
+    failures_by_path: dict[str, list[str]],
+    used_manifest_feature_exceptions: set[str],
+    used_optional_dependency_exceptions: set[tuple[str, str, str]],
+    used_internal_dependency_feature_exceptions: set[tuple[str, str, str]],
+) -> None:
+    for path_key in sorted(
+        set(MANIFEST_FEATURE_EXCEPTIONS) - used_manifest_feature_exceptions
+    ):
+        add_failure(
+            failures_by_path,
+            path_key,
+            "remove the stale `[features]` exception from "
+            "`MANIFEST_FEATURE_EXCEPTIONS`",
+        )
+
+    for path_key, section_name, dependency_name in sorted(
+        OPTIONAL_DEPENDENCY_EXCEPTIONS - used_optional_dependency_exceptions
+    ):
+        add_failure(
+            failures_by_path,
+            path_key,
+            "remove the stale optional-dependency exception for "
+            f"`{dependency_entry_label(section_name, dependency_name)}` from "
+            "`OPTIONAL_DEPENDENCY_EXCEPTIONS`",
+        )
+
+    for path_key, section_name, dependency_name in sorted(
+        set(INTERNAL_DEPENDENCY_FEATURE_EXCEPTIONS)
+        - used_internal_dependency_feature_exceptions
+    ):
+        add_failure(
+            failures_by_path,
+            path_key,
+            "remove the stale internal dependency feature exception for "
+            f"`{dependency_entry_label(section_name, dependency_name)}` from "
+            "`INTERNAL_DEPENDENCY_FEATURE_EXCEPTIONS`",
+        )
+
+
+def add_failure(
+    failures_by_path: dict[str, list[str]], path_key: str, error: str
+) -> None:
+    failures_by_path.setdefault(path_key, []).append(error)
+
+
+def workspace_package_names() -> set[str]:
+    package_names = set()
+    for path in cargo_manifests():
+        manifest = load_manifest(path)
+        package = manifest.get("package")
+        if not isinstance(package, dict):
+            continue
+        package_name = package.get("name")
+        if isinstance(package_name, str):
+            package_names.add(package_name)
+    return package_names
+
+
+def load_manifest(path: Path) -> dict:
+    return tomllib.loads(path.read_text())
+
+
+def cargo_manifests() -> list[Path]:
+    return sorted(
+        path
+        for path in CARGO_RS_ROOT.rglob("Cargo.toml")
+        if path != CARGO_RS_ROOT / "Cargo.toml"
+    )
+
+
+def manifests_to_verify() -> list[Path]:
+    return [CARGO_RS_ROOT / "Cargo.toml", *cargo_manifests()]
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/scripts/verify_pypi_release.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Wait for every Python release artifact to become visible on PyPI."""
+
+import argparse
+import http.client
+import json
+import time
+import urllib.request
+
+from packaging.version import Version
+
+RUNTIME_PLATFORM_TAGS = {
+    "macosx_10_9_x86_64",
+    "macosx_11_0_arm64",
+    "manylinux_2_17_aarch64",
+    "manylinux_2_17_x86_64",
+    "musllinux_1_1_aarch64",
+    "musllinux_1_1_x86_64",
+    "win_amd64",
+    "win_arm64",
+}
+
+
+def verify_release(package: str, version: str) -> None:
+    version = str(Version(version))
+    name = package.replace("-", "_")
+    if package == "openai-codex-cli-bin":
+        expected = {
+            f"{name}-{version}-py3-none-{tag}.whl" for tag in RUNTIME_PLATFORM_TAGS
+        }
+    else:
+        expected = {f"{name}-{version}-py3-none-any.whl", f"{name}-{version}.tar.gz"}
+
+    for attempt in range(30):
+        try:
+            with urllib.request.urlopen(
+                f"https://pypi.org/pypi/{package}/{version}/json", timeout=30
+            ) as response:
+                data = json.load(response)
+                if not isinstance(data, dict) or not isinstance(data.get("urls"), list):
+                    raise ValueError("Expected a PyPI response with a urls list")
+                if any(
+                    not isinstance(file, dict)
+                    or not isinstance(file.get("filename"), str)
+                    for file in data["urls"]
+                ):
+                    raise ValueError("Expected each PyPI file to have a filename")
+                actual = {file["filename"] for file in data["urls"]}
+        except (
+            OSError,
+            http.client.HTTPException,
+            ValueError,
+        ) as error:
+            print(f"Could not read {package} {version} from PyPI: {error}.")
+        else:
+            if actual == expected:
+                print(f"All {package} {version} files are available on PyPI.")
+                return
+            print(f"Missing files: {sorted(expected - actual)}")
+            print(f"Unexpected files: {sorted(actual - expected)}")
+        if attempt < 29:
+            time.sleep(10)
+
+    raise SystemExit(f"{package} {version} files did not become available on PyPI.")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("package", choices=["openai-codex-cli-bin", "openai-codex"])
+    parser.add_argument("version")
+    args = parser.parse_args()
+    verify_release(args.package, args.version)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/verify_tui_core_boundary.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+
+"""Verify codex-tui does not depend on or import codex-core directly."""
+
+from __future__ import annotations
+
+import re
+import sys
+import tomllib
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+TUI_ROOT = ROOT / "codex-rs" / "tui"
+TUI_MANIFEST = TUI_ROOT / "Cargo.toml"
+FORBIDDEN_PACKAGE = "codex-core"
+FORBIDDEN_SOURCE_PATTERNS = (
+    re.compile(r"\bcodex_core::"),
+    re.compile(r"\buse\s+codex_core\b"),
+    re.compile(r"\bextern\s+crate\s+codex_core\b"),
+)
+
+
+def main() -> int:
+    failures = []
+    failures.extend(manifest_failures())
+    failures.extend(source_failures())
+
+    if not failures:
+        return 0
+
+    print("codex-tui must not depend on or import codex-core directly.")
+    print(
+        "Use the app-server protocol/client boundary instead; temporary embedded "
+        "startup gaps belong behind codex_app_server_client::legacy_core."
+    )
+    print()
+    for failure in failures:
+        print(f"- {failure}")
+
+    return 1
+
+
+def manifest_failures() -> list[str]:
+    manifest = tomllib.loads(TUI_MANIFEST.read_text())
+    failures = []
+    for section_name, dependencies in dependency_sections(manifest):
+        if FORBIDDEN_PACKAGE in dependencies:
+            failures.append(
+                f"{relative_path(TUI_MANIFEST)} declares `{FORBIDDEN_PACKAGE}` "
+                f"in `[{section_name}]`"
+            )
+    return failures
+
+
+def dependency_sections(manifest: dict) -> list[tuple[str, dict]]:
+    sections: list[tuple[str, dict]] = []
+    for section_name in ("dependencies", "dev-dependencies", "build-dependencies"):
+        dependencies = manifest.get(section_name)
+        if isinstance(dependencies, dict):
+            sections.append((section_name, dependencies))
+
+    for target_name, target in manifest.get("target", {}).items():
+        if not isinstance(target, dict):
+            continue
+        for section_name in ("dependencies", "dev-dependencies", "build-dependencies"):
+            dependencies = target.get(section_name)
+            if isinstance(dependencies, dict):
+                sections.append((f"target.{target_name}.{section_name}", dependencies))
+
+    return sections
+
+
+def source_failures() -> list[str]:
+    failures = []
+    for path in sorted(TUI_ROOT.glob("**/*.rs")):
+        text = path.read_text()
+        for line_number, line in enumerate(text.splitlines(), start=1):
+            if any(pattern.search(line) for pattern in FORBIDDEN_SOURCE_PATTERNS):
+                failures.append(
+                    f"{relative_path(path)}:{line_number} imports `codex_core`"
+                )
+    return failures
+
+
+def relative_path(path: Path) -> str:
+    return str(path.relative_to(ROOT))
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/scripts/voice-cygwin-inputs.py

@@ -0,0 +1,98 @@
+"""Verify the pinned Cygwin build-input archive before offline installation."""
+
+import argparse
+import hashlib
+import json
+from pathlib import Path, PurePosixPath
+import shutil
+import tarfile
+
+
+def records(manifest):
+    metadata = manifest["metadata"]
+    if {item["file"] for item in metadata} != {
+        "x86_64/setup.xz",
+        "x86_64/setup.xz.sig",
+    }:
+        raise ValueError("signed setup metadata is required")
+    entries = metadata + manifest["packages"]
+    expected = {entry["file"]: entry for entry in entries}
+    if len(expected) != len(entries):
+        raise ValueError("duplicate Cygwin input")
+    for name in expected:
+        path = PurePosixPath(name)
+        if (
+            not path.parts
+            or path.is_absolute()
+            or ".." in path.parts
+            or path.as_posix() != name
+            or "\\" in name
+            or ":" in name
+        ):
+            raise ValueError(f"unsafe Cygwin input: {name}")
+    return expected
+
+
+def extract(manifest, archive, destination):
+    expected = records(manifest)
+    pin = manifest["archive"]
+    with archive.open("rb") as stream:
+        if (
+            archive.stat().st_size != pin["bytes"]
+            or hashlib.file_digest(stream, "sha256").hexdigest() != pin["sha256"]
+        ):
+            raise ValueError("Cygwin archive digest or size mismatch")
+        stream.seek(0)
+        with tarfile.open(fileobj=stream, mode="r:gz") as bundle:
+            members = bundle.getmembers()
+            if len(members) != len(expected) or {m.name for m in members} != set(
+                expected
+            ):
+                raise ValueError("missing, extra, or duplicate Cygwin inputs")
+            for member in members:
+                if not member.isfile() or member.issparse():
+                    raise ValueError(f"non-regular Cygwin input: {member.name}")
+                with bundle.extractfile(member) as source:
+                    if (
+                        member.size != expected[member.name]["bytes"]
+                        or hashlib.file_digest(source, "sha512").hexdigest()
+                        != expected[member.name]["sha512"]
+                    ):
+                        raise ValueError(f"Cygwin input mismatch: {member.name}")
+            destination.mkdir(parents=True)
+            try:
+                bundle.extractall(destination, members=members, filter="data")
+            except BaseException:
+                shutil.rmtree(destination)
+                raise
+
+
+def check_installed(manifest, inventory):
+    installed = sorted(
+        tuple(line.split())
+        for line in inventory.read_text().splitlines()
+        if len(line.split()) == 2 and not line.startswith("Package ")
+    )
+    expected = sorted((item["name"], item["version"]) for item in manifest["packages"])
+    if installed != expected:
+        raise ValueError("installed Cygwin packages differ from reviewed inputs")
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("command", choices=("extract", "check-installed"))
+    parser.add_argument("--archive", type=Path)
+    parser.add_argument("--directory", type=Path)
+    parser.add_argument("--inventory", type=Path)
+    args = parser.parse_args()
+    pinned = json.loads(
+        Path(__file__).with_name("voice-cygwin-snapshot.json").read_text()
+    )
+    if args.command == "extract":
+        if args.archive is None or args.directory is None:
+            parser.error("extract requires --archive and --directory")
+        extract(pinned, args.archive, args.directory)
+    else:
+        if args.inventory is None:
+            parser.error("check-installed requires --inventory")
+        check_installed(pinned, args.inventory)

.github/scripts/voice-cygwin-snapshot.json

@@ -0,0 +1,145 @@
+{
+  "schemaVersion": 1,
+  "sourceMirror": "https://mirrors.kernel.org/sourceware/cygwin/",
+  "cacheDirectory": "https%3a%2f%2fmirrors.kernel.org%2fsourceware%2fcygwin%2f",
+  "requestedPackages": [
+    "bash",
+    "make",
+    "automake1.18",
+    "coreutils",
+    "diffutils",
+    "findutils",
+    "grep",
+    "sed",
+    "gawk"
+  ],
+  "signingFingerprint": "56405CF6FCC81574682A5D561A698DE9E2E56300",
+  "archive": {
+    "tag": "voice-cygwin-108b38cf67cbb731",
+    "name": "cygwin-build-inputs.tar.gz",
+    "bytes": 62276721,
+    "sha256": "108b38cf67cbb731801e5ca8d8412b8f349961e4e71d8e3d5a1768f1a8d15c50"
+  },
+  "metadata": [
+    {
+      "file": "x86_64/setup.xz",
+      "bytes": 3598392,
+      "sha512": "306bffefa1e86178d9c6ff78a8add2e1af3c96f7cd698d62b58d0237a568e1a9f1b30016ed5891f9fe1d1c8a1e58089c3d9cb8989eb7bed758a928f212078e25"
+    },
+    {
+      "file": "x86_64/setup.xz.sig",
+      "bytes": 566,
+      "sha512": "7c466da6446bbef67762ff4038dd4986018ed09432bd6ee6ca9e33150874dbb9d61c7e4b06bd925f932a55fda345401224689bbaddc135d7300651f67ec8160b"
+    }
+  ],
+  "sourceArchive": {
+    "name": "cygwin-build-sources.tar",
+    "bytes": 368824320,
+    "sha256": "13a42ea4e6465f77c32f91e4162f41bcfeab7c0eca47701bb6a8b9aca1eb99f4"
+  },
+  "packages": [
+    {"name": "_autorebase", "version": "001091-1", "file": "noarch/release/_autorebase/_autorebase-001091-1.tar.zst", "bytes": 4696, "sha512": "a9416ce992ca57f3a6208f46517520d21dfac61988ac84cbb5b17b76e053a0845c15368ccb8ca9c483d8935f9e3db81568433c0d08d0265ec5e6916ea30f2831"},
+    {"name": "alternatives", "version": "1.31-1", "file": "x86_64/release/alternatives/alternatives-1.31-1.tar.xz", "bytes": 123748, "sha512": "94adf3376e7fcaf937594be718f54a99f2a2b66367eb2bb294b6fd4a933a9515954a9e9f309ed74cc62fbb353adb053d8500bbaf42994e4355f7180664afa62c"},
+    {"name": "autoconf", "version": "15-3", "file": "noarch/release/autoconf/autoconf-15-3-noarch.tar.zst", "bytes": 2396, "sha512": "edaa6c97c5b50e138acef4b80406bfdd0988da3360cc622be2541593f6e926a4fbe1088ff608ddadfacf275b3924605d54f59e140cc7c79b31f4885e5878ad6f"},
+    {"name": "autoconf2.1", "version": "2.13-12", "file": "noarch/release/autoconf2.1/autoconf2.1-2.13-12.tar.bz2", "bytes": 204911, "sha512": "96f8f592fff4665512c0023d6a7844fdc281ba99dc98dee9e55c37523b3a1279ae8fd31559fa6426edb1da7559a483b3eae99ae7911d50646ec60338ef209c18"},
+    {"name": "autoconf2.5", "version": "2.69-5", "file": "noarch/release/autoconf2.5/autoconf2.5-2.69-5.tar.zst", "bytes": 341597, "sha512": "3739719f29ad3ab1c1045b72ccbfe6c58e3f7696ac063c2ff4e09e11e1a9015f289fa8fc267a62b43cb2f6b682b83d3b4b6450040e733f9f41d086dc4a2f36b9"},
+    {"name": "autoconf2.7", "version": "2.73-1", "file": "noarch/release/autoconf2.7/autoconf2.7-2.73-1-noarch.tar.zst", "bytes": 906344, "sha512": "0493d68a7ea9cd61e403b6b7086b5302bad5bc1cc35715349f59605a795ac7a9f901c444cb387e5f44d1860de3e5d0fcfceee4ee2726d68904cfc5e2db6e90e9"},
+    {"name": "automake1.18", "version": "1.18.1-1", "file": "noarch/release/automake1.18/automake1.18-1.18.1-1-noarch.tar.zst", "bytes": 921189, "sha512": "416ef8041505ecddc23e9e72394ef3a81311c6c378b8b6d348e989584c77924d40aa427b47ab4d3a9a2b83438d13995bb7c6302afb73af3d3af7f2e9061579c0"},
+    {"name": "base-cygwin", "version": "3.8-2", "file": "noarch/release/base-cygwin/base-cygwin-3.8-2.tar.xz", "bytes": 1260, "sha512": "e03949b4ae6b692858e1d29fb764afbda990c07a6b70b0eb7219fc12f28dfba3cf7e757a7570c31e315be79f091b012d6a6ddafdb4b0b8961afe9af9f4977fab"},
+    {"name": "base-files", "version": "4.3-3", "file": "noarch/release/base-files/base-files-4.3-3.tar.zst", "bytes": 46481, "sha512": "dfafbe28fbe89d9b72a2eeb10901712e04de71d9089a85cfd2b8d45ffd739bdd49dadb7b57d098f01b8902456f5b839e9d4a10dbd6a8001573e035fde6797b63"},
+    {"name": "bash", "version": "5.2.21-1", "file": "x86_64/release/bash/bash-5.2.21-1.tar.xz", "bytes": 1650932, "sha512": "c3a5594f1c248dd27a3b5aa10c31fb1651072eae878479d3d8cab09c28354ce4509a2fe230f176ad200a6484a561bc10c2dc9c74c4e9f03164190dac2e683d65"},
+    {"name": "bzip2", "version": "1.0.8-2", "file": "x86_64/release/bzip2/bzip2-1.0.8-2-x86_64.tar.xz", "bytes": 36396, "sha512": "86e4b0b21b64d17b9fb60260a787626125102b0cb786de67893cb1d39a109457637bdb93956c992429f1135f64b07def64dd0116682a6190b635ba12f81395d7"},
+    {"name": "ca-certificates", "version": "2025.2.80_v9.0.304-1", "file": "noarch/release/ca-certificates/ca-certificates-2025.2.80_v9.0.304-1-noarch.tar.zst", "bytes": 902180, "sha512": "49d08f490db12855f8794cd5cfc721940504d36deffdd3b9aea0fc75909e27471f795d48c739630498fd4baeecb76ee0adb5e5c4cecab4db2ea39b03391a02d0"},
+    {"name": "coreutils", "version": "9.0-1", "file": "x86_64/release/coreutils/coreutils-9.0-1.tar.xz", "bytes": 2767296, "sha512": "530f47640d878f5953580f3556c492a93786191abe573322026b70206a46c7f17d05927784db3e7f2c044d1555f35941880316f7288b887eaec770a9eda4c687"},
+    {"name": "crypto-policies", "version": "20190218-1", "file": "noarch/release/crypto-policies/crypto-policies-20190218-1.tar.xz", "bytes": 14032, "sha512": "44d50ff08528df786eeb26ec1d312445ec92d77ecc9f448a3b741f7647e187f11eabdc0b38f8ab8de803e21d2e610f67eb44de7554f3fa83f6e8172e609b0054"},
+    {"name": "cygutils", "version": "1.4.17-4", "file": "x86_64/release/cygutils/cygutils-1.4.17-4-x86_64.tar.xz", "bytes": 90580, "sha512": "a9c63f8ac86e529fa8809c9637bb80651721003160726e2058c361687e5df6377c4cdbea2d023677b23e1d166bbce37d5a412f7d1135baf075ae2631fdeb77b2"},
+    {"name": "cygwin", "version": "3.6.10-1", "file": "x86_64/release/cygwin/cygwin-3.6.10-1-x86_64.tar.xz", "bytes": 1626060, "sha512": "50e5a100f5229eecba279799363a30d599f8c6ad06967eabc4fc8ed9105736576a522539abc250110282cf18da8536d4e408823cc6c0d2abd8692a91d9fd3341"},
+    {"name": "dash", "version": "0.5.12-5", "file": "x86_64/release/dash/dash-0.5.12-5.tar.xz", "bytes": 79612, "sha512": "8891165224ca8531ad7b601309bc1a74f8b68dad24721060fd3db5d12ae504e3c96bbd0217006bbcbe0650d13283f04c1f58412bde54c40f19acb5291dfaced9"},
+    {"name": "diffutils", "version": "3.12-1", "file": "x86_64/release/diffutils/diffutils-3.12-1-x86_64.tar.xz", "bytes": 431400, "sha512": "2a9d8fa0acd5a6108f74afe515f55a2a7cade6fa7f96368e46a6f33cf3b49d270b50dc3cee0320740c8f1729edcbf8dd3824f4b268261fba7aeed0d75a4e943c"},
+    {"name": "editrights", "version": "1.04-1", "file": "x86_64/release/editrights/editrights-1.04-1.tar.xz", "bytes": 7112, "sha512": "aadc188201441ee1ff5710df0e5550c8ca5cb65421d025c5845921510560a2875c317d1f35b6ea8abbb5077172c0de7fc8f2f55ae95dc8d1e59d26c963c93aa7"},
+    {"name": "file", "version": "5.46-1", "file": "x86_64/release/file/file-5.46-1-x86_64.tar.xz", "bytes": 840940, "sha512": "e4b52477d353557d36af625a6a55c97a11ae41053ce17602624210df2a6d2683f46250c2b9f6db5a9f9e5fcccb7b0be4b24705a36d196cee677bf47d90dfee99"},
+    {"name": "findutils", "version": "4.11.0-1", "file": "x86_64/release/findutils/findutils-4.11.0-1-x86_64.tar.xz", "bytes": 768172, "sha512": "cbb1359fd81c55f98da1485f84f11f905a7a3fe9ce1676424e86da4d7f0effa5fc298546bd5c62c9707e8ddf93c31597d6da01e60be0610c50b9b22ef9475814"},
+    {"name": "gawk", "version": "5.4.0-1", "file": "x86_64/release/gawk/gawk-5.4.0-1-x86_64.tar.xz", "bytes": 1496256, "sha512": "3604c99921d0cff387279aec1d3b332e8afcd2746b052304c0511221efdb6ae6d4a3117b36593e44adc43c67b6f6c4c48bccf6b686e2e1a5cac644c89613d829"},
+    {"name": "getent", "version": "2.18.90-5", "file": "x86_64/release/getent/getent-2.18.90-5.tar.xz", "bytes": 17864, "sha512": "b860f3d01f32da7312a0ce118bdaa53e2418c53f0ac5cfd52b3e4267f353fa21ae27fd2649eb9c6bff48b3d10a0a9f7bcaa2d644f770f0f3916f5d969beedd65"},
+    {"name": "gettext-locale-alias", "version": "0.26-1", "file": "x86_64/release/gettext/gettext-locale-alias/gettext-locale-alias-0.26-1-x86_64.tar.xz", "bytes": 1596, "sha512": "289feafbe00598a2451527b64b0187ab62115577ceaa960774b020270e5a8c5bff4038f389a44c7d9eb870f7e2741c7bb2b27be507843cc8c4ae5c33bc74c8f3"},
+    {"name": "grep", "version": "3.12-1", "file": "x86_64/release/grep/grep-3.12-1-x86_64.tar.xz", "bytes": 418788, "sha512": "2ba28b5d93c352bc3f3f0f232e2052e6651b71cc535841f4ff8cedb23e61e9e4c030d7d5516ed9c797074e1a59cbf3a56732ca678cb0e986e86dcbbf25955976"},
+    {"name": "groff", "version": "1.24.1-1", "file": "x86_64/release/groff/groff-1.24.1-1-x86_64.tar.zst", "bytes": 5878965, "sha512": "9e8aaab0e6f464df3fec6b96fed6679673091aaeafaa463ed518081cb156ef7441fb5f9341a251f602334862640ea0b0fc1b158746c08a1e2529cceeb37e9802"},
+    {"name": "gzip", "version": "1.14-1", "file": "x86_64/release/gzip/gzip-1.14-1-x86_64.tar.xz", "bytes": 164124, "sha512": "57995d2e90bf435ffff8f61cd79c4970ad7260e0c407ab52d4dbacb0540a74c7f8fd0d8bd905316eff31525d9b0367284f9f250950f78f179e5260ce59be3a98"},
+    {"name": "hostname", "version": "3.13-1", "file": "x86_64/release/hostname/hostname-3.13-1.tar.bz2", "bytes": 14024, "sha512": "75114326fa4575b8341434658a881feb81a6565e7e0adf8fd100dde87022d3818b5fc3df430bd9b3298d818a1d23f6b6c4bc7ff33efb3ded5f0ea0bf118c1aae"},
+    {"name": "info", "version": "7.3-1", "file": "x86_64/release/texinfo/info/info-7.3-1-x86_64.tar.zst", "bytes": 607040, "sha512": "3af0e7c2edc34a068d88974c6c1b0f529663f4bbce145b5a33f3b7e90671fd908fb4a544e033b98a6906d3244c64a18732104c5f1d323c0ccac8a5134e13f411"},
+    {"name": "ipc-utils", "version": "1.1-1", "file": "x86_64/release/ipc-utils/ipc-utils-1.1-1.tar.xz", "bytes": 11120, "sha512": "374ef40c871d00eb3b4774c383bb85872443a2e8b9abf74b8b9b9b27984598abfb6284716c2d2cd264181e6d012cf7dc8cd04f6bab91f9b083f72e9b51e6226b"},
+    {"name": "less", "version": "704-1", "file": "x86_64/release/less/less-704-1-x86_64.tar.xz", "bytes": 171024, "sha512": "2d1ecf29272e7c1781bb0df5b0f0531b009972edc8d246d63e17edf7d8314109f0a8f38668b371c6f5e1dc1f948d63384eecdca5409eacb927c4f267f89f4bfe"},
+    {"name": "libargp", "version": "20250917-2", "file": "x86_64/release/libargp/libargp-20250917-2-x86_64.tar.xz", "bytes": 19508, "sha512": "a83ef7c1809cae1b10a50e228643a640ea14e1be324429b9f53be9a4c8cee03ddd0efb46b24e159493dfa36569e73b636bc897943d61cdb90511e5e4cbb54257"},
+    {"name": "libattr1", "version": "2.5.2-2", "file": "x86_64/release/attr/libattr1/libattr1-2.5.2-2-x86_64.tar.xz", "bytes": 6160, "sha512": "345b8f84b9c4df2eeea5e211dbaff5e0382aaee788435e1f4cc69f546e1603bbb45e9baec02a37d935674fcd55fb782d924c3a1540d2f829bde4969c96945ce4"},
+    {"name": "libblkid1", "version": "2.40.2-2", "file": "x86_64/release/util-linux/libblkid1/libblkid1-2.40.2-2.tar.xz", "bytes": 120936, "sha512": "d931c47cce5a7caf18799a16ed526e0f0d0f82c0f6d0af952420d50d88f1e0f0ea9d6c07be72f9d0baa06a3299b2db8c3bd3c43d13d94400edc816e7c00da148"},
+    {"name": "libbz2_1", "version": "1.0.8-2", "file": "x86_64/release/bzip2/libbz2_1/libbz2_1-1.0.8-2-x86_64.tar.xz", "bytes": 26884, "sha512": "d15d88e8e0fae69f7c4c3025515e748c273d758a0f470312162cec46c4cf0d340d2ef036e3a4f4d03b5edf4508b4927834ffa0f9aa45585a5f3bc3b3163ff675"},
+    {"name": "libcrypt2", "version": "4.5.2-1", "file": "x86_64/release/libxcrypt/libcrypt2/libcrypt2-4.5.2-1-x86_64.tar.xz", "bytes": 106104, "sha512": "7668d29aaebba8ca94e48e810d92108db72b067b2786cea8dcf4a049c29f20f0aeb8653a6e9524869c69e0b1df9d4d0ac499a052a86f0d44178e8a8167002c97"},
+    {"name": "libdb18.1", "version": "18.1.40-1", "file": "x86_64/release/db/libdb18.1/libdb18.1-18.1.40-1.tar.xz", "bytes": 733872, "sha512": "51955ae95823c54051b5345a7dbe6927521411754dff416ad6af2061bd3c9b2230ca2ea88f9b921b4b09b7654c7dac924b0ae08af708a93604cc193d6a18f4ff"},
+    {"name": "libfdisk1", "version": "2.40.2-2", "file": "x86_64/release/util-linux/libfdisk1/libfdisk1-2.40.2-2.tar.xz", "bytes": 160264, "sha512": "0c8e6854eb72bb8cc51fc33565ee0d36a747e520e98e074a1d2400672a45651807b53be0f5a1c97efa0ce34975063f86953c9465312dcfdaba8104edb1298d62"},
+    {"name": "libffi8", "version": "3.8.0-1", "file": "x86_64/release/libffi/libffi8/libffi8-3.8.0-1-x86_64.tar.xz", "bytes": 196924, "sha512": "935a0567f740a314d70ecd4adc8c4cf5ad37c6fb43f2d26dee882d4fda71f08efb2646bee10cee6e2000f52e25cce87fa29ce07665ba6d22532e0daa76bc887c"},
+    {"name": "libgc1", "version": "8.2.12-1", "file": "x86_64/release/libgc/libgc1/libgc1-8.2.12-1-x86_64.tar.xz", "bytes": 62392, "sha512": "faf226ea2b58949da714e2c50f1aa95738082c3499e2ae4828af5173bdd617248f000bf4868636b31a2b76b3a905057ab307c4f6a0d7112f23422531a97be92d"},
+    {"name": "libgcc1", "version": "14.4.0-1", "file": "x86_64/release/gcc/libgcc1/libgcc1-14.4.0-1-x86_64.tar.zst", "bytes": 59166, "sha512": "5ac8a56e5eee285efcd6dbd05a473e795e181021d7194b8a98dfe2fa201a71f0abe2908e0b4c81490eb5ef472efaeac8e56a61a5f289eee4ad6e90e52a844ff8"},
+    {"name": "libgdbm6", "version": "1.26-1", "file": "x86_64/release/gdbm/libgdbm6/libgdbm6-1.26-1-x86_64.tar.xz", "bytes": 25436, "sha512": "8ed666a5b978b40f8cfc69d270d47cd674a31eb41bac499f783137eedfde6aa02ba4346de3d5dc3184d9af10ec80f57730c7517a88732616f4c6e0ef637d4bce"},
+    {"name": "libgdbm_compat4", "version": "1.26-1", "file": "x86_64/release/gdbm/libgdbm_compat4/libgdbm_compat4-1.26-1-x86_64.tar.xz", "bytes": 3892, "sha512": "fd026dd74c495c1ee67b790269e77e8525ad78d52d4895923443feab55f7bb32dc07b115d490143c7e0277167d9cdbef5dad4707ecc7ca6df13a9f1a5184f8ca"},
+    {"name": "libgmp10", "version": "6.3.0-1", "file": "x86_64/release/gmp/libgmp10/libgmp10-6.3.0-1.tar.zst", "bytes": 254680, "sha512": "947cd56e1945ddf180622b453f17e6655b4ee3e79fcc91238370a8826b88cd07c31d939f1ed7b87d91344d46fee90af2560105267a9207dcca800cba72459191"},
+    {"name": "libguile3.0_1", "version": "3.0.11-1", "file": "x86_64/release/guile3.0/libguile3.0_1/libguile3.0_1-3.0.11-1-x86_64.tar.xz", "bytes": 6969492, "sha512": "a559914ed5d62d0a701e4ce3810276436cf1ce54d579c72fc72c3b4688f2af71ef93f3cdae7089ad7f85107c7ca5c87f2e497cac6f2550b38df1bc6ba7f16230"},
+    {"name": "libiconv2", "version": "1.19-2", "file": "x86_64/release/libiconv/libiconv2/libiconv2-1.19-2-x86_64.tar.xz", "bytes": 555664, "sha512": "a1b23e24e0a495e7163923bcf40a4b933403e0826cfc0d9bde785bc92c909b8c4fb94b1e6b2c0242f4328a723855e72ff3baab9f557ef855b7fe7a7d901b0943"},
+    {"name": "libintl8", "version": "0.22.5-1", "file": "x86_64/release/gettext/libintl8/libintl8-0.22.5-1.tar.xz", "bytes": 43256, "sha512": "370a19af888bc7c9ed95cf8ade0d36d5e7cdb634abdebcba260cad61fa9a4cc05b5e748e315c9709f66861e8756b227d6757d529846591189e19ee2b2d00002d"},
+    {"name": "liblastlog2", "version": "2.40.2-2", "file": "x86_64/release/util-linux/liblastlog2/liblastlog2-2.40.2-2.tar.xz", "bytes": 4908, "sha512": "89350921fe76c9065662dd9d72dd464d2f404f1690e806210cbb828ae8325ea5f3f9909d8eb04c8342b80417a4e1e22c3569241515762ad081ecd58d56927c02"},
+    {"name": "liblz4_1", "version": "1.9.4-1", "file": "x86_64/release/lz4/liblz4_1/liblz4_1-1.9.4-1.tar.xz", "bytes": 53296, "sha512": "70e6b0f3af2c5e04089c955b46c13293ab935ee4683e4690da0cebfffba4ba91614004aede99dd804f54e4def93461159f55d151e7fbb647d1ca97ca29e619cc"},
+    {"name": "liblzma5", "version": "5.8.3-1", "file": "x86_64/release/xz/liblzma5/liblzma5-5.8.3-1-x86_64.tar.zst", "bytes": 87321, "sha512": "7399c6d117f23788a7edb11cf7f5eec77724aad2bf7cf8a437001fc1515941f6ca415f42363981be35361290f43cd60cd04e15bb1b01cffc0fd275f3167037e0"},
+    {"name": "libmpfr6", "version": "4.2.2-1", "file": "x86_64/release/mpfr/libmpfr6/libmpfr6-4.2.2-1.tar.zst", "bytes": 284416, "sha512": "8203dc61bf646041c71f7fece9fe59422ded96ac28dd24826ffb00a9607f274f3226673f9bee441f32b424a7e26c2f178281bd7836db26b0253d37da208d06a8"},
+    {"name": "libncursesw10", "version": "6.5+20240427-1", "file": "x86_64/release/ncurses/libncursesw10/libncursesw10-6.5+20240427-1.tar.xz", "bytes": 393928, "sha512": "08102f7a7083cb5663fecc46d819f2ece4123444a8f94c42300f03f7eebd40395f556c44b22ab58bf57321b44d9b8fb8b19358e535c7500d36e52d48b05dcca8"},
+    {"name": "libp11-kit0", "version": "0.26.5-1", "file": "x86_64/release/p11-kit/libp11-kit0/libp11-kit0-0.26.5-1-x86_64.tar.xz", "bytes": 212700, "sha512": "dd64f129fe71233e26e0845b6711db5cf2eb2e6d2d050f07b6aec0d9dd54d980e87390614744fbf022cf57aa2b3f7edbdc30c548c2f9d480188c22bcde0c2eba"},
+    {"name": "libpcre1", "version": "8.45-1", "file": "x86_64/release/pcre/libpcre1/libpcre1-8.45-1.tar.zst", "bytes": 166711, "sha512": "85c793ed3622a00b811773b94c45376882513e267b9f1d2a3efa0bc42ff86a4e4bebd8362a193d302e66ae9e5c9b93befc1bb1096c0fd397e2cd0f5632c808dd"},
+    {"name": "libpcre2_8_0", "version": "10.47-1", "file": "x86_64/release/pcre2/libpcre2_8_0/libpcre2_8_0-10.47-1-x86_64.tar.zst", "bytes": 237134, "sha512": "a98b38e1591c19404a5794cef488810747d86cc27ce5ee326e706cfa7069cf088d8a64571933f4c1f7a611fd8c232008837271bebe2e81c04a3f6ec571f0009e"},
+    {"name": "libpipeline1", "version": "1.5.8-1", "file": "x86_64/release/libpipeline/libpipeline1/libpipeline1-1.5.8-1-x86_64.tar.xz", "bytes": 24880, "sha512": "1d062ac4909d37fbac3ce66b07ac691df0ae5acbd01f08c5019a5ed897cb2bbef95f9e347c5bc71185ae3317d89383306e46f2c59acae5d28a18fa65f66d4e80"},
+    {"name": "libpopt-common", "version": "1.19-1", "file": "x86_64/release/popt/libpopt-common/libpopt-common-1.19-1.tar.xz", "bytes": 18536, "sha512": "4d69e6d7e196cdb4caad558c5d7543f706a4c6d7053476be861be07672506e378084126f22903deab8113557f757d2a07578f4a790ae316a2ea50ba612148a43"},
+    {"name": "libpopt0", "version": "1.19-1", "file": "x86_64/release/popt/libpopt0/libpopt0-1.19-1.tar.xz", "bytes": 18748, "sha512": "e820a7bac13cdd3bff07673ac54dcb80f342c6a32917035f218ef255bdb707d654ee6a1684242d7ce8439eebf050ade6566f27f5118896fbf8e0171173b5bfee"},
+    {"name": "libreadline7", "version": "8.2-2", "file": "x86_64/release/readline/libreadline7/libreadline7-8.2-2.tar.xz", "bytes": 113340, "sha512": "1d27576cf49b056f35f90ad933e39c5d946bc271ddcd109daa98f95b97123b428256827889ff45ca8a76409cdb1afd0146e99c9b70150b302538356512acfe38"},
+    {"name": "libreadline8", "version": "8.3-1", "file": "x86_64/release/readline/libreadline8/libreadline8-8.3-1-x86_64.tar.xz", "bytes": 120084, "sha512": "64142c5f305b9836c5be9a4271e4163d8b3e739a0451c0d152373eeb3338342f7cf5691e4437b8e6d0a8404c30ea7a21832e342e7a1ca3b5f3e8e3403051b96e"},
+    {"name": "libsmartcols1", "version": "2.40.2-2", "file": "x86_64/release/util-linux/libsmartcols1/libsmartcols1-2.40.2-2.tar.xz", "bytes": 96124, "sha512": "71ded6f02d264343d068b90450d96f4fdeb4087f278b990709aaa814c16123f4ae947714e5f10020260c30a6d78865c2d35d9ffe57a51b038815db52c3274317"},
+    {"name": "libsqlite3_0", "version": "3.49.1-1", "file": "x86_64/release/sqlite3/libsqlite3_0/libsqlite3_0-3.49.1-1.tar.xz", "bytes": 686212, "sha512": "cd81686fe5778a94ab91e4aebdd2a229cb963318ce7b393e0a0299e29ed7648c24135733c1978cbebbb926813d7f994b9e38318ede12c72fe79ad404dbfdeaf2"},
+    {"name": "libssl3", "version": "3.5.7-1", "file": "x86_64/release/openssl/libssl3/libssl3-3.5.7-1-x86_64.tar.zst", "bytes": 2081790, "sha512": "18161f1292404554742ced4beaa10548c7e1bbfb9398ec0b733e632401dfaa49c33336ad4b1e80e2b7bd77c20f00c10196c5804c327e37f641d49da2288837b8"},
+    {"name": "libstdc++6", "version": "14.4.0-1", "file": "x86_64/release/gcc/libstdc++6/libstdc++6-14.4.0-1-x86_64.tar.zst", "bytes": 651767, "sha512": "3d86409193c952618eee7e2dea32bdeb97f22ee800e13cc46f98b5095d4d0b1b31ac4336dc5819abb2d553ad1c2151619e9f6f337dfe921ba80fda1323f6f4e3"},
+    {"name": "libtasn1_6", "version": "4.21.0-1", "file": "x86_64/release/libtasn1/libtasn1_6/libtasn1_6-4.21.0-1-x86_64.tar.xz", "bytes": 32072, "sha512": "d28713b27d5d41408b29caed785e29380da4d8b4ccdc1c479ae13906e6765bedc6d6b9e6c1c22fd2111d678fcf1663187d3de27d7ad2e104cd48c38086189e36"},
+    {"name": "libuchardet0", "version": "0.0.8-1", "file": "x86_64/release/uchardet/libuchardet0/libuchardet0-0.0.8-1.tar.zst", "bytes": 72637, "sha512": "1fad5711590a82a8386c2492286dd9c0ad7cbe086aab249d07ad27277757327a6a67264e9718aef7d30307515462fe67d64f23582f08f0ced85a19cc8e0afe23"},
+    {"name": "libunistring-devel", "version": "1.4.1-1", "file": "x86_64/release/libunistring/libunistring-devel/libunistring-devel-1.4.1-1-x86_64.tar.xz", "bytes": 43332, "sha512": "14e067719e5c0a973950955a05685c18d6fa97df5defa8d0915125ea3af1d01ac921c2a84565a49cc7fb785b15a8be4640ee209f3f0d2e13cb542eb6c75b51f9"},
+    {"name": "libunistring5", "version": "1.4.1-1", "file": "x86_64/release/libunistring/libunistring5/libunistring5-1.4.1-1-x86_64.tar.xz", "bytes": 498220, "sha512": "cbd454f5068bfb9291d440a3b03b0c58437aa0342a199007d5cce6fa006b6b5ea4d3ba10c136fb0257ffb0d0199db73484275c632506e4ec31c81e1746667b80"},
+    {"name": "libuuid1", "version": "2.40.2-2", "file": "x86_64/release/util-linux/libuuid1/libuuid1-2.40.2-2.tar.xz", "bytes": 12532, "sha512": "3ba0c5d5a401c88796077e9f45164532408882f2f5d9f0ab99b2fdf6eb915917250124cde3653a7c53b648866e091aa3baf3304d0b243337f0d4e254a7631f55"},
+    {"name": "libzstd1", "version": "1.5.7-1", "file": "x86_64/release/zstd/libzstd1/libzstd1-1.5.7-1.tar.zst", "bytes": 253786, "sha512": "f89cdaa004487ec8c4796b8f56887c81f6f497873c1495b9cb585ffe6c8d6e6b8ad4b52617d5238075f965f1fe001da287d9a00d121590274b2d87672b415a0f"},
+    {"name": "login", "version": "1.13-1", "file": "x86_64/release/login/login-1.13-1.tar.xz", "bytes": 17264, "sha512": "66acc3255962a27af8d701a8c02846f3b9180b7b1d65d946f6fb27cd24aeedc8e6a9a2601b419e981c94b356ef376a5c565ea31a4a220e5add9d70ae501a11d1"},
+    {"name": "m4", "version": "1.4.21-1", "file": "x86_64/release/m4/m4-1.4.21-1-x86_64.tar.xz", "bytes": 363204, "sha512": "0d86c88d4bbbfc59e136bba3101ca3714139fba2ab7fea2883bc773ca884c3876f8a8f3a2ea8b05c29fd5280c1fb2d686401346f2761160917edf0818a2b232b"},
+    {"name": "make", "version": "4.4.1-2", "file": "x86_64/release/make/make-4.4.1-2.tar.xz", "bytes": 598004, "sha512": "9a89a0f4ceadf5c2d0390029d16274fbed0190d2410ad6beb76e39b7153f38d0d1169ad0abf57c96929e6ab0523a0a76c345868e9ae46f9cd3d708d23f6fa3e6"},
+    {"name": "man-db", "version": "2.13.1-1", "file": "x86_64/release/man-db/man-db-2.13.1-1-x86_64.tar.zst", "bytes": 1301518, "sha512": "a1e8a0d6d5a75465e32be83c13e685a73f084fa41abc5500d9437837a2c9de2f897827d3516c1076fa6cdd07a3d1aaaa4751f3b393fcfe64c370ff8f6b8b7f84"},
+    {"name": "mintty", "version": "3.8.3-1", "file": "x86_64/release/mintty/mintty-3.8.3-1-x86_64.tar.xz", "bytes": 1190356, "sha512": "79068708c81a7bf6abba3ad1cd0550a2c3eb6f6eea21adade8b0d2b77339cd2519716f528159da9f0972f93bb624867e394d782c3e3b0b7e841a8db985395b92"},
+    {"name": "ncurses", "version": "6.5+20240427-1", "file": "x86_64/release/ncurses/ncurses-6.5+20240427-1.tar.xz", "bytes": 111396, "sha512": "e15664bdab3f4d82bac6481deaa66476adbe34404937079983b5165930fa18cec3aa0345b93fbb2c390f8304ef20f041cd47d268552b92d01a51adb6abde0fc5"},
+    {"name": "openssl", "version": "3.5.7-1", "file": "x86_64/release/openssl/openssl-3.5.7-1-x86_64.tar.zst", "bytes": 1392875, "sha512": "c50821b61eec47d58d1624a4a3d5a4013c80a8b48cdc803d81a656e6859079d321b34fa0ff97db4c093735a76b71a68c8a7f12184b2c4f0677014e910d1ba9d3"},
+    {"name": "p11-kit", "version": "0.26.5-1", "file": "x86_64/release/p11-kit/p11-kit-0.26.5-1-x86_64.tar.xz", "bytes": 332724, "sha512": "1f057de789a5553f04649c80e6f78385135b57de7ba078e9dd51f2db60afee37717bb6de9dcf0a330cf72fce1359e08c0186988632b5f858992ebf95739bb840"},
+    {"name": "p11-kit-trust", "version": "0.26.5-1", "file": "x86_64/release/p11-kit/p11-kit-trust/p11-kit-trust-0.26.5-1-x86_64.tar.xz", "bytes": 110096, "sha512": "2f98ae11e42f69fa4626638f7cefe2ba2fed808ae618093c1e6c568f8a8be79e6690b40e39e20df02a8d363c371cca8b8320fea7b288e8561cd299f15cc5b796"},
+    {"name": "perl", "version": "5.44.0-1", "file": "x86_64/release/perl/perl-5.44.0-1-x86_64.tar.zst", "bytes": 5129424, "sha512": "42f80064ff94ea778319a24e011d4a7236944c79d9db22e0ed64a7ca7d9b65bc2df5998130eb64c50aa95c173937776cc42665174c5717e84fe6dca523368f27"},
+    {"name": "perl-Algorithm-Diff", "version": "1.2010-5", "file": "noarch/release/perl-Algorithm-Diff/perl-Algorithm-Diff-1.2010-5-noarch.tar.zst", "bytes": 31580, "sha512": "d840b605043448ceab8ded77313e12653c81fd7db08062a99010fb19b334429c15628b1a0a805f88110e7aae4dcd3f667b515c18870ba873169533663f4374de"},
+    {"name": "perl-Archive-Zip", "version": "1.680.0-1", "file": "noarch/release/perl-Archive-Zip/perl-Archive-Zip-1.680.0-1-noarch.tar.zst", "bytes": 85917, "sha512": "de23da6dac8aa8c8218c141c845723d092f6eaf2f1e67ced96d7b0385206c2e335b150bb7066bd0c7d257125ad1b3fc7691686dc535c56429b4a0f4535b6c73a"},
+    {"name": "perl-Class-Inspector", "version": "1.360.0-1", "file": "noarch/release/perl-Class-Inspector/perl-Class-Inspector-1.360.0-1-noarch.tar.zst", "bytes": 21261, "sha512": "299489c9d0bc86fe8ba625c0ec0530f0e6ecacab3f67b2826760413f6bc58252c6c11f45583063cfcf0944f9127ed2bece9168fd76220e735841f374a57943f5"},
+    {"name": "perl-Devel-Cycle", "version": "1.120.0-1", "file": "noarch/release/perl-Devel-Cycle/perl-Devel-Cycle-1.120.0-1-noarch.tar.zst", "bytes": 8884, "sha512": "308211af5b57106629b168be340fd682e23670fd97cc7c7f80c3bac48223984c1a226148c99cf5d904b09e352f1008f13bd4645897223a162a22af819aa7af11"},
+    {"name": "perl-File-ShareDir", "version": "1.118.0-1", "file": "noarch/release/perl-File-ShareDir/perl-File-ShareDir-1.118.0-1-noarch.tar.zst", "bytes": 19857, "sha512": "7cb0f5fe4c327e9f870fc9c303f5e7e1483d2d2d012dbb5487f4b08f350170b7eb0a345766bd0a809bb4b8fa138788112eed2528b92718e817a5f21a9b82774d"},
+    {"name": "perl-Text-Diff", "version": "1.450.0-1", "file": "noarch/release/perl-Text-Diff/perl-Text-Diff-1.450.0-1-noarch.tar.zst", "bytes": 30982, "sha512": "c19c80564d50d1d8efd44b156013aa5620b79205fd291897b938735c49214c84867a1337dfe9e7857f97e6f924ec919f5a0197df2d3bfeae78e0ec9dc8b9a6ac"},
+    {"name": "perl-Win32-API", "version": "0.840.0-1", "file": "x86_64/release/perl-Win32-API/perl-Win32-API-0.840.0-1-x86_64.tar.zst", "bytes": 84514, "sha512": "758b1881d55942e91365780bede1dca63838995ad6574f9a242c15f613e7e3211a029e9bd3a3bd24d834ca6838e7a85c2812411783423ba23ccf808d094b6890"},
+    {"name": "perl_autorebase", "version": "5.44.0-1", "file": "x86_64/release/perl/perl_autorebase/perl_autorebase-5.44.0-1-x86_64.tar.zst", "bytes": 175, "sha512": "55cd94604cfa3e2491df45e5a3715f32b2dee8298a656ca2da8de2eba4096329c595228a8c950760e9641b2c6097309571350c0ffe1c8d13759eb76ec841a4f8"},
+    {"name": "perl_base", "version": "5.44.0-1", "file": "x86_64/release/perl/perl_base/perl_base-5.44.0-1-x86_64.tar.zst", "bytes": 3772189, "sha512": "3039e7a60c950cd682d8372f948ec83f7ebea27e9b425ab7406ed2eff0bebb80f7622423cf82b9ab07e34deb183bdf1b56fe129c8306bd2cfb04e7cd96beb992"},
+    {"name": "rebase", "version": "4.6.6-1", "file": "x86_64/release/rebase/rebase-4.6.6-1.tar.xz", "bytes": 248832, "sha512": "9f3751c4687b09f3c286cf5c4522a0d976fce2d79ab471ab37560b15f14af84f7d13162b6102c02d0d60784448ff0586e76e9291675af4fa0c9320a3713633da"},
+    {"name": "run", "version": "1.3.4-2", "file": "x86_64/release/run/run-1.3.4-2.tar.xz", "bytes": 34492, "sha512": "7e3156bbddc5f934fde3530879aa5186c9fdccb757ba848fc958e79e96534b336975f2882e413d5c18174628033a422157d25c48f8b5e90f0f1555ff2fa6343f"},
+    {"name": "sed", "version": "4.10-1", "file": "x86_64/release/sed/sed-4.10-1-x86_64.tar.xz", "bytes": 359252, "sha512": "da5475344a1693f90fb560773ccca48eaf13af0e6bbcada9dcea658862bf7f46043b2d7365de0e2e235fb9a874fe784ad83bc29eb2fdbf3207cd8ad5e127b8b9"},
+    {"name": "tar", "version": "1.35-2", "file": "x86_64/release/tar/tar-1.35-2.tar.zst", "bytes": 997616, "sha512": "007c7df12bc27ca14862a925680e2b2ff616a5149262b153889e6f580f3db492f98da49b5f34a8c4234194ee25021b67e9a84c987c96c5d6baa7ee0b3ea02425"},
+    {"name": "terminfo", "version": "6.5+20240427-1", "file": "x86_64/release/ncurses/terminfo/terminfo-6.5+20240427-1.tar.xz", "bytes": 94760, "sha512": "128fb04f188bbf2af3060416193c9879a9cbbf7e5486febf851f35c3d9d00b9d61a0e2bf4be575d2308fd665a224ce5674485dcfd071125c3a8d199a4b88a042"},
+    {"name": "texinfo", "version": "7.3-1", "file": "x86_64/release/texinfo/texinfo-7.3-1-x86_64.tar.zst", "bytes": 1853455, "sha512": "a7a0da042d05bbf2978857fcad1887552db9d77bf745fb8a17e156a2616500cf711adce107610f008ddff5556d02823f148d2bf146bd7eaa8a9466f9300cf2e6"},
+    {"name": "tzcode", "version": "2026c-1", "file": "x86_64/release/tzcode/tzcode-2026c-1-x86_64.tar.xz", "bytes": 185512, "sha512": "85ab0f5d8d7c02e38dbd945c99ee6841774d84c486f857cd8484605068441b2028eea1f42a7e36c8fd6801c454f8f786a16f9caeb422afb30e5fcf324434878b"},
+    {"name": "tzdata", "version": "2026c-1", "file": "noarch/release/tzdata/tzdata-2026c-1-noarch.tar.xz", "bytes": 184092, "sha512": "567adb6da01050a84b3785a1cb518e62a9c838cfe55e8ab33610c6ee64355677486329de5781361d08f03cd355acd64f94c64ec2a2686d48538813cc405b638c"},
+    {"name": "util-linux", "version": "2.40.2-2", "file": "x86_64/release/util-linux/util-linux-2.40.2-2.tar.xz", "bytes": 2053568, "sha512": "4f3473472e32bff586401ec31f1423237c9cb112ae1140cdd8b2797040c5c182632f49f5354eaaa409d2dacba7767d5baa8b8926d7638e2725ad80065b46c10b"},
+    {"name": "vim-minimal", "version": "9.1.1825-1", "file": "x86_64/release/vim/vim-minimal/vim-minimal-9.1.1825-1-x86_64.tar.xz", "bytes": 794064, "sha512": "6a252210e2ef08a7038d6e5bc8e5312e0c25d8328ab0aefd7f292eb79b7a32dd699f15f3f293cfbb83687e87cb3f68a335e969b117f55e6ff99b34ebdfbc8119"},
+    {"name": "which", "version": "2.23-1", "file": "x86_64/release/which/which-2.23-1-x86_64.tar.xz", "bytes": 31108, "sha512": "98dffe802e1137d7b54359314797fd10080e6c261f37668e32e46aa7b1587b4148a1647b4f4a00cd0d23a9e90f153d5c2081d0ffa4ccea657b73aaa31b538d6e"},
+    {"name": "xz", "version": "5.8.3-1", "file": "x86_64/release/xz/xz-5.8.3-1-x86_64.tar.zst", "bytes": 767298, "sha512": "8918389508ade8237226170b6dd02104938ec53b2bb15b310f5005dd64f954dfd67a5391757ba8602afe2a423f901894204771d6ae335402095c074d098daa76"},
+    {"name": "zlib0", "version": "1.3.2-1", "file": "x86_64/release/zlib/zlib0/zlib0-1.3.2-1-x86_64.tar.zst", "bytes": 46254, "sha512": "d79ba6098cadf6bf2f32f35d9cd54729293c64b3c9daabb9d080f52861a19db71544d5710fdbd61ff45e7c2ae4eecb3f2e3b8a1e3bc05695b8cfe01c7639c53a"},
+    {"name": "zstd", "version": "1.5.7-1", "file": "x86_64/release/zstd/zstd-1.5.7-1.tar.zst", "bytes": 394600, "sha512": "5de9a2fdee75345a35592444d467a1b70504f09f3b2ee5aaf8af8a9d9fda1a4e77d37c5c4c4fee9b96995ef78f9708e6c02adea7a70d9f80f1238e507b2bc0fc"}
+  ]
+}

.github/scripts/voice_windows_tools.py

@@ -0,0 +1,80 @@
+"""Expose verified Windows build-tool installations as local Bazel inputs.
+
+This declares the installed support trees; the caller authenticates their
+inputs and verifies the installed package inventory first.
+"""
+
+import argparse
+import itertools
+import json
+from pathlib import Path
+import stat
+
+
+def export_repository(root: Path, target: str, pkg_config: Path):
+    if target not in ("x86_64-pc-windows-msvc", "aarch64-pc-windows-msvc"):
+        raise ValueError("unsupported Windows target")
+    root = root.resolve(strict=True)
+    pkg_config = pkg_config.resolve(strict=True)
+    names = {
+        "shell": "cygwin/bin/bash.exe",
+        "make": "cygwin/bin/make.exe",
+        "cygpath": "cygwin/bin/cygpath.exe",
+        "automake": "cygwin/bin/automake-1.18",
+        "pkg_config": pkg_config.relative_to(root).as_posix(),
+    }
+    if not names["pkg_config"].startswith("pkgconf-image/"):
+        raise ValueError("pkg-config must belong to the extracted image")
+    outputs = ("BUILD.bazel", "MODULE.bazel", "voice-tools.json")
+    if any((root / name).exists() for name in outputs):
+        raise ValueError("Bazel tool repository outputs must be fresh")
+    # A nested package boundary would silently remove files from Bazel's glob.
+    # Reparse points could escape the installation or hide support directories.
+    for directory in ("cygwin", "pkgconf-image"):
+        tree = root / directory
+        if not tree.is_dir():
+            raise ValueError(f"missing tool tree: {directory}")
+        for path in itertools.chain((tree,), tree.rglob("*")):
+            info = path.lstat()
+            if (
+                stat.S_ISLNK(info.st_mode)
+                or getattr(info, "st_file_attributes", 0)
+                & stat.FILE_ATTRIBUTE_REPARSE_POINT
+                or not (stat.S_ISDIR(info.st_mode) or stat.S_ISREG(info.st_mode))
+                or path.name.casefold() in ("build", "build.bazel")
+            ):
+                raise ValueError(f"unsupported tool-tree entry: {path}")
+    if any(not (root / name).is_file() for name in names.values()):
+        raise ValueError("required Windows build tool missing")
+    definitions = [
+        'package(default_visibility = ["//visibility:public"])',
+        'filegroup(name = "cygwin", srcs = glob(["cygwin/**"], allow_empty = False))',
+        'filegroup(name = "pkgconf", srcs = glob(["pkgconf-image/**"], allow_empty = False))',
+        'filegroup(name = "tools", srcs = [":cygwin", ":pkgconf", "voice-tools.json"])',
+    ]
+    definitions.extend(
+        f"filegroup(name = {json.dumps(name)}, srcs = [{json.dumps(path)}])"
+        for name, path in names.items()
+    )
+    metadata = {
+        "schemaVersion": 1,
+        "target": target,
+        "cygwinArchitecture": "x86_64",
+        "tools": names,
+    }
+    for name, contents in (
+        ("BUILD.bazel", "\n".join(definitions) + "\n"),
+        ("MODULE.bazel", 'module(name = "voice_windows_tools")\n'),
+        ("voice-tools.json", json.dumps(metadata, indent=2) + "\n"),
+    ):
+        with (root / name).open("x", encoding="utf-8") as output:
+            output.write(contents)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, required=True)
+    parser.add_argument("--target", required=True)
+    parser.add_argument("--pkg-config", type=Path, required=True)
+    args = parser.parse_args()
+    export_repository(args.root, args.target, args.pkg_config)

.github/scripts/watch_voice_bazel.py

@@ -0,0 +1,79 @@
+"""Capture one bounded diagnostic when the ARM64 voice build goes silent."""
+
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import threading
+import time
+
+
+def diagnose():
+    root = Path(os.environ.get("BAZEL_OUTPUT_BASE", ""))
+    if not root.is_absolute():
+        print("Bazel output base unavailable; skipping diagnostics", flush=True)
+        return
+    for relative in ("command.log", "server/jvm.out"):
+        try:
+            with (root / relative).open("rb") as source:
+                source.seek(max(0, source.seek(0, 2) - 16384))
+                print(
+                    f"Bazel {relative} tail:\n{source.read(16384).decode(errors='replace')}",
+                    flush=True,
+                )
+        except OSError as error:
+            print(f"Cannot read {relative}: {error}", flush=True)
+    try:
+        pid = str(int((root / "server/server.pid.txt").read_text().strip()))
+        jstack = shutil.which("jstack")
+        if not jstack:
+            print("jstack unavailable; log tails retained", flush=True)
+            return
+        result = subprocess.run([jstack, pid], capture_output=True, timeout=20)
+        print(
+            f"jstack exit {result.returncode}:\n{(result.stdout + result.stderr)[-65536:].decode(errors='replace')}",
+            flush=True,
+        )
+    except (OSError, ValueError, subprocess.TimeoutExpired) as error:
+        print(f"Cannot capture JVM stacks: {error}", flush=True)
+
+
+def main():
+    with subprocess.Popen(
+        sys.argv[1:], stdout=subprocess.PIPE, stderr=subprocess.STDOUT
+    ) as process:
+        last_output = time.monotonic()
+
+        def forward():
+            nonlocal last_output
+            for line in process.stdout:
+                last_output = time.monotonic()
+                sys.stdout.buffer.write(line)
+                sys.stdout.buffer.flush()
+
+        reader = threading.Thread(target=forward)
+        reader.start()
+        captured = False
+        while process.poll() is None:
+            if (
+                not captured
+                and os.environ.get("VOICE_ARCH") == "aarch64"
+                and time.monotonic() - last_output >= 600
+            ):
+                captured = True
+                print(
+                    "ARM64 Bazel silent for ten minutes; capturing diagnostics",
+                    flush=True,
+                )
+                diagnose()
+            time.sleep(1)
+        reader.join()
+        if process.returncode and not captured:
+            print("Bazel command failed; capturing diagnostics", flush=True)
+            diagnose()
+        return process.returncode
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/workflows/Dockerfile.bazel

@@ -0,0 +1,20 @@
+FROM ubuntu:24.04
+
+# TODO(mbolin): Published to docker.io/mbolin491/codex-bazel:latest for
+# initial debugging, but we should publish to a more proper location.
+#
+# docker buildx create --use
+# docker buildx build --platform linux/amd64,linux/arm64 -f .github/workflows/Dockerfile.bazel -t mbolin491/codex-bazel:latest --push .
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    curl git python3 ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install dotslash.
+RUN curl -LSfs "https://github.com/facebook/dotslash/releases/download/v0.5.8/dotslash-ubuntu-22.04.$(uname -m).tar.gz" | tar fxz - -C /usr/local/bin
+
+# Ubuntu 24.04 ships with user 'ubuntu' already created with UID 1000.
+USER ubuntu
+
+WORKDIR /workspace

.github/workflows/README.md

@@ -0,0 +1,37 @@
+# Workflow Strategy
+
+The workflows in this directory are split so that pull requests get fast, review-friendly signal while `main` still gets the full cross-platform verification pass.
+
+## Pull Requests
+
+- Required checks run against GitHub's synthetic merge commit, not the pull
+  request head alone. This includes changes already on `main` and catches
+  conflicts before they reach the branch.
+- `bazel.yml` is the main pre-merge verification path for Rust code.
+  It runs Bazel `test` and Bazel `clippy` on the supported Bazel targets,
+  including the generated Rust test binaries needed to lint inline `#[cfg(test)]`
+  code.
+- `rust-ci.yml` keeps the Cargo-native PR checks intentionally small:
+  - `cargo fmt --check`
+  - `cargo shear`
+  - `argument-comment-lint` on Linux, macOS, and Windows
+  - `tools/argument-comment-lint` package tests when the lint or its workflow wiring changes
+
+## Post-Merge On `main`
+
+- `bazel.yml` also runs on pushes to `main`.
+  This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
+- `rust-ci-full.yml` is the full Cargo-native verification workflow.
+  It keeps the heavier checks off the PR path while still validating them after merge:
+  - the full Cargo `clippy` matrix
+  - the full Cargo `nextest` matrix via per-platform archive-backed shards
+  - Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
+  - release-profile Cargo builds
+  - cross-platform `argument-comment-lint`
+  - Linux remote-env tests
+
+## Rule Of Thumb
+
+- If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in `bazel.yml`.
+- Keep `rust-ci.yml` fast enough that it usually does not dominate PR latency.
+- Reserve `rust-ci-full.yml` for heavyweight Cargo-native coverage that Bazel does not replace yet.

.github/workflows/bazel.yml

@@ -0,0 +1,554 @@
+name: Bazel
+
+# Note this workflow was originally derived from:
+# https://github.com/cerisier/toolchains_llvm_bootstrapped/blob/main/.github/workflows/ci.yaml
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  # Cancel previous actions from the same PR or branch except 'main' branch.
+  # See https://docs.github.com/en/actions/using-jobs/using-concurrency and https://docs.github.com/en/actions/learn-github-actions/contexts for more info.
+  group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  test:
+    # PRs use the sharded Windows cross-compiled test jobs below. Post-merge
+    # pushes to main also run the native Windows test job for broader Windows
+    # signal without putting PR latency back on the critical path. When
+    # Code-mode unit tests run on every Bazel target. When authenticated RBE
+    # is available, the Windows-cross shards exercise the source-built V8 path.
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # macOS
+          - os: macos-15-xlarge
+            target: aarch64-apple-darwin
+          - os: macos-15-xlarge
+            target: x86_64-apple-darwin
+
+          # Linux
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-musl
+          # 2026-02-27 Bazel tests have been flaky on arm in CI.
+          # Disable until we can investigate and stabilize them.
+          # - os: ubuntu-24.04-arm
+          #   target: aarch64-unknown-linux-musl
+          # - os: ubuntu-24.04-arm
+          #   target: aarch64-unknown-linux-gnu
+
+    runs-on: ${{ matrix.os }}
+
+    # Configure a human readable name for each job
+    name: Bazel test on ${{ matrix.os }} for ${{ matrix.target }}
+    environment:
+      name: bazel
+      deployment: false
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Prepare Bazel CI
+        id: prepare_bazel
+        uses: ./.github/actions/prepare-bazel-ci
+        with:
+          target: ${{ matrix.target }}
+          cache-scope: bazel-${{ github.job }}
+
+      - name: Check rusty_v8 MODULE.bazel checksums
+        if: matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu'
+        shell: bash
+        run: |
+          python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
+          just test-github-scripts
+
+      - name: Check MODULE.bazel.lock is up to date
+        if: matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu'
+        shell: bash
+        run: ./scripts/check-module-bazel-lock.sh
+
+      - name: bazel test //...
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          bazel_targets=(
+            //...
+            # Keep standalone V8 library targets out of the ordinary Bazel CI
+            # path. V8 consumers under `//codex-rs/...` still participate
+            # transitively through `//...`.
+            -//third_party/v8:all
+            -//codex-rs/v8-poc:v8-poc-unit-tests
+          )
+
+          bazel_wrapper_args=(
+            --print-failed-action-summary
+            --print-failed-test-logs
+          )
+          bazel_test_args=(
+            test
+            --test_tag_filters=-argument-comment-lint
+            --test_verbose_timeout_warnings
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+          )
+          ./.github/scripts/run-bazel-ci.sh \
+            "${bazel_wrapper_args[@]}" \
+            -- \
+            "${bazel_test_args[@]}" \
+            -- \
+            "${bazel_targets[@]}"
+
+      - name: Upload Bazel execution logs
+        if: always() && !cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bazel-execution-logs-test-${{ matrix.target }}
+          path: ${{ runner.temp }}/bazel-execution-logs
+          if-no-files-found: ignore
+
+      # Save the job-scoped Bazel repository cache after cache misses. Keep the
+      # upload non-fatal so cache service issues never fail the job itself.
+      - name: Save bazel repository cache
+        if: always() && !cancelled() && steps.prepare_bazel.outputs.repository-cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ${{ steps.prepare_bazel.outputs.repository-cache-path }}
+          key: ${{ steps.prepare_bazel.outputs.repository-cache-key }}
+
+      - name: Check for a clean worktree
+        if: always() && !cancelled()
+        uses: ./.github/actions/check-clean-worktree
+
+  test-windows-shard:
+    # Split the Windows Bazel test leg across separate Windows hosts. Jobs with
+    # BuildBuddy credentials use Linux RBE for build actions; test execution
+    # remains on a Windows runner.
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard:
+          - 1
+          - 2
+          - 3
+          - 4
+    runs-on:
+      group: ${{ github.event.repository.name }}-runners
+      labels: ${{ github.event.repository.name }}-windows-x64
+    name: Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard ${{ matrix.shard }}/4
+    environment:
+      name: bazel
+      deployment: false
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Test BuildBuddy Bazel wrapper
+        if: matrix.shard == 1
+        shell: pwsh
+        run: python .github/scripts/test_run_bazel_with_buildbuddy.py
+
+      - name: Prepare Bazel CI
+        id: prepare_bazel
+        uses: ./.github/actions/prepare-bazel-ci
+        with:
+          target: x86_64-pc-windows-gnullvm
+          # Reuse the former monolithic Windows test cache for restores. Do
+          # not save it from every shard below; duplicate uploads would sit on
+          # the PR-blocking critical path after the useful test work is done.
+          cache-scope: bazel-test
+
+      - name: bazel test shard
+        env:
+          BAZEL_TEST_SHARD: ${{ matrix.shard }}
+          BAZEL_TEST_SHARD_COUNT: 4
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          bazel_test_query='tests(//...) except tests(//third_party/v8:all) except attr(tags, "manual", tests(//...))'
+          mapfile -t bazel_targets < <(
+            ./.github/scripts/run-bazel-query-ci.sh --output=label -- "${bazel_test_query}" \
+              | LC_ALL=C sort
+          )
+
+          selected_targets=()
+          for bazel_target in "${bazel_targets[@]}"; do
+            target_bucket="$(
+              printf '%s\n' "${bazel_target}" \
+                | cksum \
+                | awk -v shard_count="${BAZEL_TEST_SHARD_COUNT}" '{ print ($1 % shard_count) + 1 }'
+            )"
+            if [[ "${target_bucket}" == "${BAZEL_TEST_SHARD}" ]]; then
+              selected_targets+=("${bazel_target}")
+            fi
+          done
+
+          if [[ ${#selected_targets[@]} -eq 0 ]]; then
+            echo "No Bazel test targets selected for Windows shard ${BAZEL_TEST_SHARD}/${BAZEL_TEST_SHARD_COUNT}." >&2
+            exit 1
+          fi
+
+          echo "Selected ${#selected_targets[@]} of ${#bazel_targets[@]} Bazel test targets for Windows shard ${BAZEL_TEST_SHARD}/${BAZEL_TEST_SHARD_COUNT}."
+
+          bazel_test_args=(
+            test
+            --skip_incompatible_explicit_targets
+            --test_tag_filters=-argument-comment-lint
+            --test_verbose_timeout_warnings
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+            --build_metadata=TAG_windows_test_shard=${BAZEL_TEST_SHARD}
+          )
+
+          ./.github/scripts/run-bazel-ci.sh \
+            --print-failed-action-summary \
+            --print-failed-test-logs \
+            --windows-cross-compile \
+            --remote-download-toplevel \
+            -- \
+            "${bazel_test_args[@]}" \
+            -- \
+            "${selected_targets[@]}"
+
+      - name: Upload Bazel execution logs
+        if: always() && !cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bazel-execution-logs-test-x86_64-pc-windows-gnullvm-shard-${{ matrix.shard }}
+          path: ${{ runner.temp }}/bazel-execution-logs
+          if-no-files-found: ignore
+
+      - name: Check for a clean worktree
+        if: always() && !cancelled()
+        uses: ./.github/actions/check-clean-worktree
+
+  test-windows:
+    # Preserve the existing required-check surface while the real work happens
+    # in the sharded Windows jobs above.
+    if: always()
+    needs: test-windows-shard
+    runs-on: ubuntu-24.04
+    name: Bazel test on windows-latest for x86_64-pc-windows-gnullvm
+
+    steps:
+      - name: Confirm Windows Bazel test shards passed
+        shell: bash
+        run: |
+          if [[ "${{ needs.test-windows-shard.result }}" != "success" ]]; then
+            echo "Windows Bazel test shards finished with result: ${{ needs.test-windows-shard.result }}" >&2
+            exit 1
+          fi
+
+  test-windows-native-main:
+    # Native Windows Bazel tests are slower and frequently approach the
+    # 30-minute PR budget. Run this only for post-merge commits to main and give
+    # it a larger timeout.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    timeout-minutes: 40
+    runs-on:
+      group: ${{ github.event.repository.name }}-runners
+      labels: ${{ github.event.repository.name }}-windows-x64
+    name: Bazel test on windows-latest for x86_64-pc-windows-msvc (native main)
+    environment:
+      name: bazel
+      deployment: false
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Prepare Bazel CI
+        id: prepare_bazel
+        uses: ./.github/actions/prepare-bazel-ci
+        with:
+          target: x86_64-pc-windows-msvc
+          cache-scope: bazel-${{ github.job }}
+
+      - name: bazel test //...
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          bazel_targets=(
+            //...
+            # Keep standalone V8 library targets out of the ordinary Bazel CI
+            # path. V8 consumers under `//codex-rs/...` still participate
+            # transitively through `//...`.
+            -//third_party/v8:all
+            -//codex-rs/v8-poc:v8-poc-unit-tests
+          )
+
+          bazel_test_args=(
+            test
+            --platforms=//:windows_x86_64_msvc
+            --test_tag_filters=-argument-comment-lint
+            --test_verbose_timeout_warnings
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+            --build_metadata=TAG_windows_native_main=true
+          )
+
+          ./.github/scripts/run-bazel-ci.sh \
+            --print-failed-action-summary \
+            --print-failed-test-logs \
+            --windows-msvc-host-platform \
+            -- \
+            "${bazel_test_args[@]}" \
+            -- \
+            "${bazel_targets[@]}"
+
+      - name: Upload Bazel execution logs
+        if: always() && !cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bazel-execution-logs-test-windows-native-x86_64-pc-windows-msvc
+          path: ${{ runner.temp }}/bazel-execution-logs
+          if-no-files-found: ignore
+
+      # Save the job-scoped Bazel repository cache after cache misses. Keep the
+      # upload non-fatal so cache service issues never fail the job itself.
+      - name: Save bazel repository cache
+        if: always() && !cancelled() && steps.prepare_bazel.outputs.repository-cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ${{ steps.prepare_bazel.outputs.repository-cache-path }}
+          key: ${{ steps.prepare_bazel.outputs.repository-cache-key }}
+
+      - name: Check for a clean worktree
+        if: always() && !cancelled()
+        uses: ./.github/actions/check-clean-worktree
+
+  clippy:
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Keep Linux lint coverage on x64 and add the arm64 macOS path that
+          # the Bazel test job already exercises. Add Windows gnullvm as well
+          # so PRs get Bazel-native lint signal on the same Windows toolchain
+          # that the Bazel test job uses.
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - os: macos-15-xlarge
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-gnullvm
+            runs_on:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-windows-x64
+    runs-on: ${{ matrix.runs_on || matrix.os }}
+    name: Bazel clippy on ${{ matrix.os }} for ${{ matrix.target }}
+    environment:
+      name: bazel
+      deployment: false
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Prepare Bazel CI
+        id: prepare_bazel
+        uses: ./.github/actions/prepare-bazel-ci
+        with:
+          target: ${{ matrix.target }}
+          cache-scope: bazel-${{ github.job }}
+
+      - name: bazel build --config=clippy lint targets
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          bazel_clippy_args=(
+            --config=clippy
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+            --build_metadata=TAG_job=clippy
+          )
+          bazel_wrapper_args=()
+          bazel_target_list_args=()
+          if [[ "${RUNNER_OS}" == "Windows" ]]; then
+            # Keep this aligned with the fast Windows Bazel test job: use
+            # Linux RBE for clippy build actions while targeting Windows
+            # gnullvm. Fork/community PRs without the BuildBuddy secret fall
+            # back inside `run-bazel-ci.sh` to the previous local Windows MSVC
+            # host-platform shape.
+            bazel_wrapper_args+=(--windows-cross-compile)
+            bazel_target_list_args+=(--windows-cross-compile)
+            if [[ -z "${BUILDBUDDY_API_KEY:-}" ]]; then
+              # The fork fallback can see incompatible explicit Windows-cross
+              # internal test binaries in the generated target list. Preserve
+              # the old local-fallback behavior there.
+              bazel_clippy_args+=(--skip_incompatible_explicit_targets)
+            fi
+          fi
+
+          bazel_target_lines="$(./scripts/list-bazel-clippy-targets.sh "${bazel_target_list_args[@]}")"
+          bazel_targets=()
+          while IFS= read -r target; do
+            bazel_targets+=("${target}")
+          done <<< "${bazel_target_lines}"
+
+          ./.github/scripts/run-bazel-ci.sh \
+            --print-failed-action-summary \
+            "${bazel_wrapper_args[@]}" \
+            -- \
+            build \
+            "${bazel_clippy_args[@]}" \
+            -- \
+            "${bazel_targets[@]}"
+
+      - name: Upload Bazel execution logs
+        if: always() && !cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bazel-execution-logs-clippy-${{ matrix.target }}
+          path: ${{ runner.temp }}/bazel-execution-logs
+          if-no-files-found: ignore
+
+      # Save the job-scoped Bazel repository cache after cache misses. Keep the
+      # upload non-fatal so cache service issues never fail the job itself.
+      - name: Save bazel repository cache
+        if: always() && !cancelled() && steps.prepare_bazel.outputs.repository-cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ${{ steps.prepare_bazel.outputs.repository-cache-path }}
+          key: ${{ steps.prepare_bazel.outputs.repository-cache-key }}
+
+      - name: Check for a clean worktree
+        if: always() && !cancelled()
+        uses: ./.github/actions/check-clean-worktree
+
+  verify-release-build:
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - os: macos-15-xlarge
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-gnullvm
+            runs_on:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-windows-x64
+    runs-on: ${{ matrix.runs_on || matrix.os }}
+    name: Verify release build on ${{ matrix.os }} for ${{ matrix.target }}
+    environment:
+      name: bazel
+      deployment: false
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Prepare Bazel CI
+        id: prepare_bazel
+        uses: ./.github/actions/prepare-bazel-ci
+        with:
+          target: ${{ matrix.target }}
+          cache-scope: bazel-${{ github.job }}
+
+      - name: bazel build verify-release-build targets
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          # This job exists to compile Rust code behind
+          # `cfg(not(debug_assertions))` so PR CI catches failures that would
+          # otherwise show up only in a release build. We do not need the full
+          # optimizer and debug-info work that normally comes with a release
+          # build to get that signal, so keep Bazel in `fastbuild` and disable
+          # Rust debug assertions explicitly.
+          bazel_wrapper_args=()
+          if [[ "${RUNNER_OS}" == "Windows" ]]; then
+            # This is build-only signal, so use the same Linux-RBE
+            # cross-compile path as the fast Windows test and clippy jobs.
+            # Fork/community PRs without the BuildBuddy secret fall back
+            # inside `run-bazel-ci.sh` to the previous local Windows MSVC
+            # host-platform shape.
+            bazel_wrapper_args+=(--windows-cross-compile)
+          fi
+
+          bazel_build_args=(
+            --compilation_mode=fastbuild
+            --@rules_rust//rust/settings:extra_rustc_flag=-Cdebug-assertions=no
+            --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebug-assertions=no
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+            --build_metadata=TAG_job=verify-release-build
+            --build_metadata=TAG_rust_debug_assertions=off
+          )
+
+          bazel_target_lines="$(bash ./scripts/list-bazel-release-targets.sh)"
+          bazel_targets=()
+          while IFS= read -r target; do
+            bazel_targets+=("${target}")
+          done <<< "${bazel_target_lines}"
+
+          ./.github/scripts/run-bazel-ci.sh \
+            "${bazel_wrapper_args[@]}" \
+            -- \
+            build \
+            "${bazel_build_args[@]}" \
+            -- \
+            "${bazel_targets[@]}"
+
+      - name: Verify Bazel builds bwrap
+        if: runner.os == 'Linux'
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          ./.github/scripts/run-bazel-ci.sh \
+            --remote-download-toplevel \
+            --print-failed-action-summary \
+            -- \
+            build \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            --build_metadata=TAG_job=verify-bwrap \
+            -- \
+            //codex-rs/bwrap:bwrap
+
+      - name: Upload Bazel execution logs
+        if: always() && !cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bazel-execution-logs-verify-release-build-${{ matrix.target }}
+          path: ${{ runner.temp }}/bazel-execution-logs
+          if-no-files-found: ignore
+
+      # Save the job-scoped Bazel repository cache after cache misses. Keep the
+      # upload non-fatal so cache service issues never fail the job itself.
+      - name: Save bazel repository cache
+        if: always() && !cancelled() && steps.prepare_bazel.outputs.repository-cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ${{ steps.prepare_bazel.outputs.repository-cache-path }}
+          key: ${{ steps.prepare_bazel.outputs.repository-cache-key }}
+
+      - name: Check for a clean worktree
+        if: always() && !cancelled()
+        uses: ./.github/actions/check-clean-worktree

.github/workflows/blob-size-policy.yml

@@ -0,0 +1,53 @@
+name: blob-size-policy
+
+on:
+  workflow_call:
+
+jobs:
+  check:
+    name: Blob size policy
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: openai/fence@e6b39c80c51cb2b2a39448ddeff74b3b886c0a63 # pin@v0.10.0
+        with:
+          mode: audit
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Determine comparison range
+        id: range
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # PRs inspect the proposed diff; main pushes inspect only the commit
+          # range that just landed. Both paths feed the same blob-size checker.
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            base='${{ github.event.pull_request.base.sha }}'
+            head='${{ github.event.pull_request.head.sha }}'
+          else
+            base='${{ github.event.before }}'
+            head='${{ github.sha }}'
+          fi
+
+          echo "base=$base" >> "$GITHUB_OUTPUT"
+          echo "head=$head" >> "$GITHUB_OUTPUT"
+
+      - name: Check changed blob sizes
+        env:
+          BASE_SHA: ${{ steps.range.outputs.base }}
+          HEAD_SHA: ${{ steps.range.outputs.head }}
+        run: |
+          python3 scripts/check_blob_size.py \
+            --base "$BASE_SHA" \
+            --head "$HEAD_SHA" \
+            --max-bytes 512000 \
+            --allowlist .github/blob-size-allowlist.txt
+
+      - name: Check for a clean worktree
+        if: always() && !cancelled()
+        uses: ./.github/actions/check-clean-worktree

.github/workflows/blocking-ci.yml

@@ -0,0 +1,72 @@
+name: blocking-ci
+
+# This is the single entrypoint for checks that block a PR merge. It also runs
+# after pushes to main so the same check family stays grouped in the Actions UI.
+on:
+  pull_request: {}
+  push:
+    branches: [main]
+
+jobs:
+  # Keep reusable workflow calls alphabetized. The `required` job below is the
+  # version-controlled list that the main-branch ruleset should require.
+  bazel:
+    name: Bazel
+    uses: ./.github/workflows/bazel.yml
+    secrets: inherit
+
+  blob-size-policy:
+    name: Blob size policy
+    uses: ./.github/workflows/blob-size-policy.yml
+    secrets: inherit
+
+  cargo-deny:
+    name: cargo-deny
+    uses: ./.github/workflows/cargo-deny.yml
+    secrets: inherit
+
+  codespell:
+    name: Codespell
+    uses: ./.github/workflows/codespell.yml
+    secrets: inherit
+
+  repo-checks:
+    name: repo-checks
+    uses: ./.github/workflows/repo-checks.yml
+    secrets: inherit
+
+  rust-ci:
+    name: rust-ci
+    uses: ./.github/workflows/rust-ci.yml
+    secrets: inherit
+
+  sdk:
+    name: sdk
+    uses: ./.github/workflows/sdk.yml
+    secrets: inherit
+
+  required:
+    name: CI required
+    # Without `always()`, GitHub skips this job after a failed dependency and a
+    # required check can appear successful instead of reporting the failure.
+    if: ${{ always() }}
+    needs:
+      - bazel
+      - blob-size-policy
+      - cargo-deny
+      - codespell
+      - repo-checks
+      - rust-ci
+      - sdk
+    runs-on: ubuntu-24.04
+    steps:
+      # Keep the helper on the same combined revision as the child workflows so
+      # the merge gate evaluates the exact candidate they validated.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Require successful dependencies
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: python3 .github/scripts/check_ci_results.py

.github/workflows/cla.yml

@@ -0,0 +1,49 @@
+name: CLA Assistant
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    # Only run the CLA assistant for the canonical openai repo so forks are not blocked
+    # and contributors who signed previously do not receive duplicate CLA notifications.
+    if: ${{ github.repository_owner == 'openai' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        # Run on close only if the PR was merged. This will lock the PR to preserve
+        # the CLA agreement. We don't want to lock PRs that have been closed without
+        # merging because the contributor may want to respond with additional comments.
+        # This action has a "lock-pullrequest-aftermerge" option that can be set to false,
+        # but that would unconditionally skip locking even in cases where the PR was merged.
+        if: |
+          (
+            github.event_name == 'pull_request_target' &&
+            (
+              github.event.action == 'opened' ||
+              github.event.action == 'synchronize' ||
+              (github.event.action == 'closed' && github.event.pull_request.merged == true)
+            )
+          ) ||
+          (
+            github.event_name == 'issue_comment' &&
+            (
+              github.event.comment.body == 'recheck' ||
+              github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
+            )
+          )
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-document: https://github.com/openai/codex/blob/main/docs/CLA.md
+          path-to-signatures: signatures/cla.json
+          branch: cla-signatures
+          allowlist: codex,dependabot,dependabot[bot],github-actions[bot]