0.1.8 Beta2 prerequisite: Honor Codex visibility and keep internal reviewer models out of managed catalogs #273

This was generated by AI during triage.

Parent

#318 (part of #248)

Problem

CodexHub does not yet enforce the official Codex visibility contract across native-cache ingestion and every managed catalog. The current path can exclude some internal records incidentally by slug shape, but not through a durable visibility/internal-model policy.

The July 31 upstream incident exposed an internal codex-auto-review record as a second list-visible GPT-5.6-Terra. Direct Official remains upstream-owned. Connected/managed mode must never re-export hidden or internal reviewer identities even when upstream metadata is malformed.

Required behavior

• Represent visibility as a typed catalog property.
• Export only explicitly user-listable entries.
• Exclude internal reviewer identities, including codex-auto-review, even when mislabeled list-visible.
• Treat unknown visibility conservatively and emit only bounded diagnostics.
• Preserve the native official cache and Direct Official ownership boundary.
• Apply one policy to every CodexHub-generated or combined catalog.

Acceptance criteria

• visibility=hide never enters a managed catalog or enabled-model list.
• codex-auto-review never enters the managed picker, including the malformed duplicate-Terra fixture.
• The legitimate gpt-5.6-terra remains visible exactly once.
• Unknown visibility fails closed with a bounded diagnostic.
• Disconnect/Restore Official does not edit the native official model cache.
• Tests cover hidden, malformed duplicate, unknown, and combined-catalog cases.
• Regeneration uses the shared Toast lifecycle to state the exact Desktop restart requirement.