Expose headless managed-client config materialization for isolated runners

Outcome

Expose a candidate-built, headless managed-client configuration seam for isolated qualification runs. The CLI must invoke the same production materialization code used by CodexHub so test runners consume production-selected endpoints, protocol formats, model selectors, ownership, and serialization instead of maintaining a second implementation.

Corrected production architecture

OpenCode, ZCode, Pi, and OMP already use native Rust preview/apply adapters in src-tauri/src/gateway.rs.
Codex Desktop and Codex CLI share the Codex config.toml produced by the existing production src-tauri/src/config.rs path, which invokes the existing src-python/config_overlay.py serializer. Do not port or duplicate that serializer in Rust.
Existing adapters currently write and return; post-apply readback is new production behavior owned by this Issue, not pre-existing behavior.
Existing public GUI/Web Bridge apply entrypoints and the new CLI must delegate to one production apply-and-readback seam. A CLI-only verifier is not sufficient.

Design and scope

Add a machine-readable candidate CLI surface for managed-client preview, materialization/apply, and readback under an explicitly supplied fresh isolated root.
For OpenCode, ZCode, Pi, and OMP, add explicit-path/settings/provider variants around the existing Rust serializers and apply functions while leaving current host-discovering public entrypoints compatible.
For Codex, construct isolated ConfigPaths and invoke the existing config::switch_mode_with_paths_takeover production path and Python overlay. This is configuration materialization, not Python Gateway transport; config_overlay.py itself is not reimplemented.
Load settings, providers, catalog, target paths, and backups only from candidate-owned inputs beneath the supplied root using existing production parsers. Do not accept runner-supplied endpoint/protocol/selector overrides and do not call current-user discovery.
Add common post-apply readback that reopens the produced files, validates ownership and complete round-trip parity against production preview, and returns sanitized selector/model/route metadata. Wire existing production apply entrypoints through the same verification.
Resolve managed selectors, canonical Gateway models, endpoint roots, and Responses/Chat format from production settings/providers/catalog state. Never hardcode a Volc Chat path or infer a route from the E2E matrix.
Reject missing/non-fresh roots, path escape, reparse/junction/symlink targets, hard-linked inputs or outputs, stale ownership, partial/malformed output, or fallback to host configuration.
Emit bounded JSON containing only client ID, managed selector, canonical model, route/protocol classification, relative target names, apply/readback status, and approved hashes. Never emit credentials, authorization values, usernames, absolute paths, prompts, outputs, or request/session/runtime IDs.
Keep the real-client runner and its fixtures out of this prerequisite; Add pinned real-client E2E qualification foundation for Gateway candidates #190 consumes the merged seam.

Acceptance criteria

One candidate-built CLI exercises production preview/apply/readback for Codex, OpenCode, ZCode, Pi, and OMP under fresh isolated roots.
Codex uses config.rs -> existing config_overlay.py; the four native clients use their existing gateway.rs serializers. No second client-config generator is introduced.
Existing production GUI/Web Bridge apply entrypoints and the CLI use the same post-apply readback verifier and fail closed on missing, contradictory, stale-owner, partial, malformed, linked, or non-round-tripping output.
Generated files are byte/semantic equivalent to current production adapters for identical settings, providers, models, and roots.
Structured output reports the actual managed selector, canonical Gateway model, and endpoint/protocol family without secret values or absolute paths.
Volc route format is selected by production configuration; the CLI exposes no endpoint/protocol override and hardcodes no client route.
Reads, writes, catalogs, settings, providers, and backups cannot escape the isolated root and never discover or alter host client configuration.
Table-driven Rust tests cover all clients, Official Luna and Volc GLM-5.2, Responses/Chat selection, opaque secret preservation, path rejection, production-entrypoint/CLI parity, and every readback failure class.
Targeted Rust tests, full Rust test/clippy, full pytest, diff check, report-only quality gates, exact-SHA Actions, and a strict heavy Reviewer pass.

Boundaries

No Python Gateway transport, SSE, retry, or tool-loop changes.
No changes to the real-client runner, credentials/login handling, or live E2E evidence in this Issue.
No fallback to Sol, Kimi, Ollama, or another provider.
Squash to dev only; never merge or publish main automatically.

Expected hotset

src-tauri/src/cli.rs
src-tauri/src/gateway.rs
src-tauri/src/config.rs
Focused Rust tests adjacent to those production seams

Verification

Push-Location src-tauri
cargo test --locked gateway_client
cargo test --locked cli
cargo test --locked config
cargo test --locked
cargo clippy --locked --all-targets -- -D warnings
Pop-Location
python -m pytest -q
git diff --check
python scripts/report_quality_gates.py

The quality-gate command is report-only.

{
  "contract": {
    "acceptance": [
      "One candidate-built CLI exercises production preview, apply/materialization, and readback for Codex, OpenCode, ZCode, Pi, and OMP under fresh isolated roots.",
      "Codex delegates through src-tauri/src/config.rs to the existing src-python/config_overlay.py serializer; OpenCode, ZCode, Pi, and OMP delegate to their existing src-tauri/src/gateway.rs serializers, with no second client-config generator.",
      "Existing production GUI/Web Bridge apply entrypoints and the CLI use the same new post-apply readback verifier and fail closed on missing, contradictory, stale-owner, partial, malformed, linked, or non-round-tripping output.",
      "Generated files are byte- or semantic-equivalent to current production adapters for identical settings, providers, models, and roots.",
      "Structured output reports the actual managed selector, canonical Gateway model, and selected endpoint/protocol family without exposing secret values or absolute paths.",
      "Volc route format is selected by production configuration; the CLI accepts no endpoint, protocol, or selector override and hardcodes no client route.",
      "All settings, providers, catalogs, target paths, and backups remain below the supplied fresh isolated root and no operation discovers or alters host client configuration.",
      "Table-driven Rust tests cover all clients, Official Luna and Volc GLM-5.2, Responses/Chat selection, opaque secret preservation, path rejection, production-entrypoint and CLI parity, and every readback failure class.",
      "Targeted Rust tests, cargo test, clippy, full pytest, diff check, report-only quality gates, exact-SHA Actions, and a strict heavy Reviewer pass."
    ],
    "change_claims": {
      "paths": [
        "src-tauri/src/cli.rs",
        "src-tauri/src/config.rs",
        "src-tauri/src/gateway.rs"
      ],
      "resources": [
        "managed-client-config-contract"
      ]
    },
    "dependencies": {
      "dispatch_after": [],
      "merge_after": []
    },
    "design": [
      "Add a candidate-built machine-readable CLI for managed-client preview, materialization/apply, and readback under an explicitly supplied fresh isolated root.",
      "For OpenCode, ZCode, Pi, and OMP, add explicit-path/settings/provider variants around the existing Rust gateway adapters while preserving current host-discovering public entrypoint compatibility.",
      "For Codex, construct isolated ConfigPaths and invoke the existing config::switch_mode_with_paths_takeover production path and existing config_overlay.py serializer; do not port or duplicate Codex TOML generation.",
      "Load settings, providers, catalogs, targets, and backups only from candidate-owned inputs below the supplied root through existing production parsers; expose no runner-controlled endpoint, protocol, or selector override.",
      "Add a common fail-closed post-apply readback verifier as new production behavior and make both existing GUI/Web Bridge apply entrypoints and the CLI delegate to it.",
      "Resolve managed selectors, canonical Gateway models, endpoint roots, and Responses/Chat format from production state; reject path escape, reparse or link targets, stale ownership, partial output, and host discovery.",
      "Emit bounded sanitized metadata and hashes only; keep Python Gateway transport and the real-client runner out of this prerequisite, and let Issue #190 consume the merged seam."
    ],
    "difficulty": "heavy",
    "done_when": [
      "cargo test --locked gateway_client, cargo test --locked cli, and cargo test --locked config in src-tauri",
      "cargo test --locked and cargo clippy --locked --all-targets -- -D warnings in src-tauri",
      "python -m pytest -q",
      "git diff --check",
      "python scripts/report_quality_gates.py (report-only)",
      "GitHub Actions and strict heavy review pass on the same candidate SHA"
    ],
    "priority": "P1",
    "risk": "strict",
    "sha256": "9858039d8002c5852425c15ae05001f9652a1b5036130ecc8fa8067954e68caf",
    "unresolved_decisions": []
  },
  "dispatch": {
    "accepted_at": "2026-07-21T11:54:42Z",
    "attempt": 1,
    "base_sha": "cc9df197a709fb4c7548021819ecb8fa716ed664",
    "branch": "work/issue-194",
    "candidate_sha": "7833a2597500fc07d74cd5af34438f2fbf565a1d",
    "claimed_at": "2026-07-21T04:31:55.609257Z",
    "contract_sha256": "9858039d8002c5852425c15ae05001f9652a1b5036130ecc8fa8067954e68caf",
    "creator_agent_id": "fc91861e-6478-4d4e-8019-d7d0cff5c451",
    "generation": 1,
    "id": "dispatch-issue-194-a1",
    "integrating_at": "2026-07-21T11:59:40.082029Z",
    "last_lifecycle_action_id": "resume-dispatch-issue-194-a1-g2",
    "lifecycle_generation": 2,
    "merged_at": "2026-07-21T11:59:47Z",
    "parked": false,
    "pr_number": 195,
    "recovery_prompt_sent": true,
    "resumed_at": "2026-07-21T05:22:45.981190Z",
    "status": "merged",
    "worker_agent_id": "7c7fb123-9558-4efa-81f9-1415006254ca",
    "workspace_id": "wks_1af97d84d7cfccc6"
  }
}

test(gateway): harden isolated managed-client config coverage (#194)

fix(gateway): resolve isolated managed-client strict-review findings (#…

Expose isolated managed-client config CLI seam (#194) (#195)

Delivered by merged PR #195.

Navigation Menu

Repository navigation

Expose headless managed-client config materialization for isolated runners #194

Outcome

Corrected production architecture

Design and scope

Acceptance criteria

Boundaries

Expected hotset

Verification

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Expose headless managed-client config materialization for isolated runners #194

Description

Outcome

Corrected production architecture

Design and scope

Acceptance criteria

Boundaries

Expected hotset

Verification

Activity

NOirBRight commented on Jul 21, 2026

NOirBRight commented on Jul 21, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions