Remove the OpenAI 272K context guard with an ownership-safe v0.1.4 migration #109

Outcome and scheduling

• Release target: v0.2, the next CodexHub release after v0.1.4.
• Priority: after the shortest-path GLM-5.2 execution work in Adapt GLM-5.2 apply_patch function calls to the Codex freeform tool contract #105 and Restore bundled provider/model capabilities when installed runtime config predates them #108. Do not dispatch this Issue until both blockers are resolved and their integration hotset is released.
• Remove the OpenAI 272K/240K Context Guard from normal product behavior while safely retiring state already written by v0.1.4.

Evidence and surface boundary

CodexHub v0.1.4 introduced this feature in b2fc2904 and shipped it in v0.1.4. It can persist model_context_window = 272000, model_auto_compact_token_limit = 240000, an ownership state file, the Gateway settings/catalog clamp, and generated configuration for bound Gateway clients.

The maintainer supplied a 2026-07-12 screenshot of a verified OpenAI employee reply stating that users should not apply this override for GPT-5.6 Sol in Codex, that the default context threshold is tuned, and that the claimed Codex-side >270K surcharge does not apply. No permalink was supplied, so treat it as supporting first-party evidence rather than the only public source.

The official Codex configuration reference explicitly says that leaving model_auto_compact_token_limit unset uses model defaults; it defines model_context_window as an override but does not explicitly document its unset resolution. Removing the context-window override is therefore a bounded product decision based on the staff instruction and official model metadata, not a verbatim documentation guarantee.

This scope is Official Codex subscription only. The GPT-5.6 Sol API model page still says API prompts with more than 272K input tokens are priced at 2x input and 1.5x output for the full request. Do not remove or misstate API/third-party Provider context or pricing semantics.

Why deletion alone is unsafe

Removing only the toggle and active clamp would strand invisible v0.1.4 state in the live Codex config.toml, runtime-owner overlay backup, context-guard-state.json, settings.json: openai_context_guard_enabled, generated Gateway metadata, and configurations previously generated for CodexHub-bound clients. Users who enabled the guard would continue to compact early after the control disappeared.

Required design

Remove the active product feature

In v0.2 remove the Provider-page control and copy; public Tauri/web-bridge commands and frontend types; the normal Settings/runtime flag; Gateway/Rust and Python catalog clamp branches; and normal client-sync behavior that propagates the artificial 272K metadata.

Do not remove generic model context_window metadata, Provider context configuration, or legitimate 272K values by text search.

Retain a narrow versioned upgrade migrator

Ship an idempotent legacy migrator such as remove_openai_context_guard_v1 before Gateway/catalog/client initialization. Keep it available for the supported direct-upgrade window because users may jump from v0.1.4 across multiple releases. The active feature is removed even while this compatibility restorer remains.

Migration contract:

1. A valid v0.1.4 ownership state is the primary proof that CodexHub owns the override.
2. For each managed key/target, restore the recorded prior value only while the current value still exactly equals 272000 or 240000; delete it only when the recorded prior value was absent.
3. Preserve any key changed by the user after enablement.
4. If state is missing, malformed, or cannot be correlated to the current runtime owner, disable/ignore the Gateway clamp but do not guess or delete Codex config—even if values equal 272K/240K. Show one actionable migration warning.
5. A leftover state file with a false/missing settings flag is an interrupted migration candidate; apply only the same ownership/exact-value checks.
6. Modify live config and the matching owner backup atomically, preserving comments, newline style, and unrelated TOML. Keep recovery state until primary cleanup is durable; fail closed without logging paths or config content.
7. Clear/ignore the legacy Gateway flag before rebuilding official metadata. Use current official subscription metadata; do not invent a 1.05M fallback.
8. Re-sync only clients still marked bound/managed by CodexHub. Never scan/rewrite unbound or user-authored entries. With auto-sync disabled, report pending manual sync. Record applied/skipped/failed per client and retry idempotently.
9. Show the existing required Codex/client restart or refresh feedback; never silently restart user applications.

Acceptance criteria

• Fresh installs expose no Context Guard control, persist no legacy flag/state, and write neither override.
• A v0.1.4 fixture with valid ownership state and absent prior values removes only the still-managed keys from live config and matching backup.
• A fixture with recorded custom prior values restores them without changing unrelated TOML, comments, or newline style.
• User-changed keys are preserved; only keys still equal to the managed value are restored.
• Missing/corrupt/owner-mismatched state never causes automatic deletion; Gateway no longer clamps and the user receives an actionable non-secret warning.
• Interrupted migration, stale-state-with-flag-false, Stable/Beta owner switching, write failure, and a second startup are deterministic and idempotent.
• Official Gateway/Codex subscription models are no longer clamped to 272K; external/API Provider behavior remains unchanged.
• Bound clients are regenerated from unclamped metadata with per-client retry; unbound/user-authored entries remain unchanged.
• UI, command, Settings/runtime, Python catalog, and Rust Gateway activation paths are gone; only the scoped legacy migrator remains.
• Release notes distinguish Official Codex subscription behavior from OpenAI API >272K pricing.
• Focused Python/Rust/frontend migration tests, full relevant suites, UI contract/build, and python scripts/report_quality_gates.py complete successfully.

Expected hotset

• src-python/config_overlay.py, official catalog handling in src-python/codex_proxy.py
• src-tauri/src/config.rs, gateway.rs, main.rs, proxy.rs, web_bridge.rs
• Provider UI, settings/Tauri/types/i18n, UI-contract tests
• temporary-CODEX_HOME v0.1.4 upgrade fixtures and bound-client synchronization

This overlaps the #105/#108 integration surface and must be serialized after it.

Non-goals

• Choosing a new fixed context/compact threshold.
• Changing OpenAI API billing or long-context behavior.
• Removing generic context metadata or third-party Provider controls.
• Rewriting unbound clients, unknown configuration files, or user-authored values.