Handle Codex reset credits omitted after redemption

[endless7]

Summary

• follow up on Fix Codex quota refresh after manual reset #2710 for the provider shape observed after a real manual reset
• accept a consumed reset credit when the provider omits its row and the aggregate available count decreases
• require both the initial and confirmation inventories to independently corroborate consumption
• retain support for explicit redeeming/redeemed rows and all existing account, timestamp, boundary, and two-sample safeguards

Why a follow-up is needed

#2710 was merged with support for a stable credit row transitioning from available to redeemed. A redacted provider trace recovered after that merge showed a different post-redemption representation: the successful inventory omitted the consumed row entirely and returned availableCount: 0.

The merged implementation therefore remains conservative for the observed real response and may continue preserving the stale pre-reset snapshot.

Real provider behavior (redacted)

Observed on CodexBar 0.47.0 with a signed-in Codex OAuth account. Account identity, tokens, and reset-credit IDs are omitted.

Captured at (UTC)	Weekly used	Reset boundary (UTC)
2026-08-06 08:59:18	98%	2026-08-10 01:00:26
2026-08-06 09:28:18	99%	2026-08-10 01:00:26
2026-08-06 09:33:18	0%	2026-08-13 09:33:18

The successful reset-credit inventory persisted with the post-redemption observation was:

{"availableCount":0,"credits":[]}

A later read-only live OAuth fetch returned the same successful empty inventory. This shows that the consumed credit is omitted in the observed provider response instead of being retained as a redeemed row.

After-fix real-provider smoke (redacted)

On 2026-08-07, I built and launched the exact PR head c07f9d43 as CodexBar 0.48.0 (build 112) with ./Scripts/compile_and_run.sh. The release bundle remained running, and its packaged CodexBarCLI then completed a read-only live OAuth provider fetch without error:

{
  "source": "oauth",
  "updatedAt": "2026-08-07T08:39:40Z",
  "weekly": {
    "usedPercent": 41,
    "windowMinutes": 10080,
    "resetsAt": "2026-08-13T09:29:11Z"
  },
  "resetCredits": {
    "availableCount": 0,
    "credits": []
  }
}

Account identity, tokens, and credit IDs are omitted. This confirms that an after-fix bundle starts successfully and that its real Codex OAuth provider path still accepts the currently observed successful empty reset-credit inventory.

This smoke run does not claim a second live redemption: by the time the fixed bundle was available, weekly usage had advanced to 41% and the account had no reset credit remaining, so an available -> omitted transition could not be triggered again. The exact 99% -> 0% omission decision path is therefore still validated by the focused production-code replay below.

Safeguards

The omission path is accepted only when:

• a stable credit ID was previously available;
• reset-credit inventory timestamps are finite and monotonic;
• both independent low-usage samples either report that same credit as redeeming/redeemed, or omit it while reporting a lower aggregate available count;
• an omitted credit is still unexpired at each inventory timestamp, preventing natural expiry from being treated as consumption;
• the existing weekly reset-boundary and two-sample equivalence checks also pass.

A single missing inventory does not bypass the early-reset guard.

Validation

• focused CodexWeeklyResetConfirmationTests: 19/19 passed
• fresh ./Scripts/compile_and_run.sh bundle at c07f9d43: CodexBar 0.48.0 (112) launched and remained running
• packaged release CodexBarCLI live OAuth fetch: succeeded with weekly usage 41% and reset-credit inventory availableCount: 0, credits: []
• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make check: SwiftFormat 0/1806, SwiftLint 0 violations/1805, all repository gates passed
• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make test: 824 selections across 69 groups, 69 first-pass successes, 0 failures, 0 retries, 0 timeouts
• git diff --check origin/main..HEAD

The account has no reset credit remaining, so the after-fix validation replays the exact redacted 99% -> 0% timing/boundary shape through the production decision code; it is not presented as a second live redemption.

No UI changes; screenshots are not applicable.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 424b798c0e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 7, 2026, 2:59 PM ET / 18:59 UTC.

ClawSweeper review

What this changes

This PR lets CodexBar refresh quota after a manual reset when two later reset-credit inventories omit the formerly available credit and both report a lower available-credit count.

Merge readiness

⛔ Blocked until stronger real behavior proof is added - 4 items remain

Keep open for an explicit proof-sufficiency decision: the focused change appears correct and bounded, but the exact-head live smoke did not exercise the new two-sample omission path through quota publication.

Priority: P2
Reviewed head: c07f9d434206121b9b53b4f204e6f8133e0ed726
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and well-covered, but the changed real-provider outcome has not been observed after the fix.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The exact-head live OAuth smoke proves an empty inventory is accepted, but it does not show the new two-sample omission decision publishing refreshed quota; add redacted decision-path evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The exact-head live OAuth smoke proves an empty inventory is accepted, but it does not show the new two-sample omission decision publishing refreshed quota; add redacted decision-path evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Current main only recognizes retained redeemed rows: The current early-reset exception accepts a prior available credit only when the confirmation inventory still contains that ID with status redeemed; an omitted row cannot pass this guard. The production boundary publishes only an admitted confirmation: The usage store obtains a second provider snapshot, checks matching Codex identity, and returns the confirmation only when the confirmation decision publishes it. Existing shipped behavior is narrower: Current main's unreleased changelog records the prior merged manual-reset support as a redeemed-credit exception, consistent with the source guard and the supplied provider trace showing an omitted-row variant.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar polls Codex OAuth usage and reset-credit inventory to update the menu-bar quota display. Its confirmation layer compares prior, initial, and confirmation snapshots before accepting an early weekly reset.

flowchart LR
A[Codex OAuth usage] --> C[Usage snapshots]
B[Reset-credit inventory] --> C
C --> D[Early-reset confirmation]
D --> E{Two samples corroborate consumption?}
E -->|Yes| F[Publish refreshed quota]
E -->|No| G[Preserve prior quota]

Loading

Decision needed

Question	Recommendation
Is the supplied real provider trace, production-code replay, and exact-head OAuth smoke sufficient to merge without a second live available-to-omitted redemption trace?	Require decision-path proof: Keep the PR open until a redacted live trace or production-boundary transcript shows the exact omission path publishing refreshed quota.

Why: Only a maintainer can waive the external-PR real-behavior gate when the one-time provider event cannot presently be repeated safely.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The exact-head live OAuth smoke proves an empty inventory is accepted, but it does not show the new two-sample omission decision publishing refreshed quota; add redacted decision-path evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The PR changes an early-reset safety exception; if the provider's aggregate-count semantics differ from the supplied trace, a user could see quota refreshed from an incorrectly accepted reset.
• Resolve merge risk (P1) - The exact-head live OAuth smoke accepts an empty inventory but does not demonstrate the changed two-sample branch publishing refreshed quota.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production versus test delta	production +35/-9, tests +123/-2	The small confirmation-rule change is accompanied by focused coverage for omission and expiry cases.

Merge-risk options

Maintainer options:

1. Capture omission-path publication (recommended)
   Before merge, add redacted live or production-boundary evidence that the two omitted inventories cause the refreshed weekly snapshot to be published.
2. Accept the bounded compatibility risk
   A maintainer may merge using the existing provider trace and replay evidence if a second safe redemption cannot be obtained.

Technical review

Best possible solution:

Land after a redacted production-boundary trace proves the available-to-omitted transition publishes the refreshed quota, or after an explicit maintainer decision accepts the supplied trace, replay, and smoke as sufficient proof.

Do we have a high-confidence way to reproduce the issue?

Yes in source: current main only accepts a retained redeemed credit, while the supplied real provider shape omits it; constructing those three snapshots reaches the guarded confirmation path. The reported focused replay was not independently run in this read-only review.

Is this the best way to solve the issue?

Yes for the code path: requiring two monotonic inventories, a lower count, an unexpired prior credit, and the existing boundary checks is a narrow way to recognize the observed provider representation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 22b24b885693.

Labels

Label justifications:

• P2: This is a bounded Codex quota-refresh correctness fix with limited user impact.
• merge-risk: 🚨 compatibility: The PR broadens the condition under which existing users' early weekly-reset observations replace the cached quota state.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The exact-head live OAuth smoke proves an empty inventory is accepted, but it does not show the new two-sample omission decision publishing refreshed quota; add redacted decision-path evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current main only recognizes retained redeemed rows: The current early-reset exception accepts a prior available credit only when the confirmation inventory still contains that ID with status redeemed; an omitted row cannot pass this guard. (Sources/CodexBar/Providers/Codex/CodexWeeklyResetConfirmation.swift:146, 5bd587850611)
• The production boundary publishes only an admitted confirmation: The usage store obtains a second provider snapshot, checks matching Codex identity, and returns the confirmation only when the confirmation decision publishes it. (Sources/CodexBar/Providers/Codex/UsageStore+CodexWeeklyResetConfirmation.swift:74, 22b24b885693)
• Existing shipped behavior is narrower: Current main's unreleased changelog records the prior merged manual-reset support as a redeemed-credit exception, consistent with the source guard and the supplied provider trace showing an omitted-row variant. (CHANGELOG.md:40, 22b24b885693)
• Feature-history provenance: History shows the confirmation subsystem was established in the weekly-reset confirmation work; the preceding merged manual-reset change is commit 5014285, authored by JiaJian. (Sources/CodexBar/Providers/Codex/CodexWeeklyResetConfirmation.swift:146, 5014285fa781)
• Real-provider evidence is partial: The PR body supplies a redacted real 99%-to-0% omitted-inventory trace and an exact-head live OAuth smoke with an empty inventory, but the smoke does not show the changed confirmation decision publishing refreshed quota. (c07f9d434206)

Likely related people:

• Peter Steinberger: Current confirmation code and its focused tests trace through recent weekly-reset work authored by Peter Steinberger. (role: recent area contributor; confidence: high; commits: b2b9c535e513, 6f84c4e9425b, 5bd587850611; files: Sources/CodexBar/Providers/Codex/CodexWeeklyResetConfirmation.swift, Tests/CodexBarTests/CodexWeeklyResetConfirmationTests.swift)
• JiaJian: Commit 5014285 is the merged manual-reset refresh change this PR extends with the provider's omitted-row representation. (role: introduced adjacent manual-reset behavior; confidence: high; commits: 5014285fa781; files: Sources/CodexBar/Providers/Codex/CodexWeeklyResetConfirmation.swift)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide a redacted runtime trace or production-boundary transcript showing the available-to-omitted transition publishes refreshed quota.
• If another safe redemption is unavailable, obtain an explicit maintainer proof-sufficiency decision; update the PR body to trigger re-review or ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (9 earlier review cycles; latest 8 shown)

• reviewed 2026-08-07T08:01:53.987Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T08:05:38.597Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T08:43:56.404Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T09:25:22.382Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T10:59:36.537Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T12:06:34.668Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T13:53:29.200Z sha c07f9d4 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-07T17:08:29.473Z sha c07f9d4 :: needs real behavior proof before merge. :: none

[endless7]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Failed
• Detail: Durable publication exhausted its retry budget and was retained for operator dead-letter recovery.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31165557737
• Updated: 2026-08-07T09:22:12.133Z

[endless7]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: c07f9d4342

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[endless7]

Proof follow-up for maintainer judgment:

I built and launched the exact PR head c07f9d43 as CodexBar 0.48.0 (112), then ran the release bundle's packaged CLI against the real signed-in OAuth account. The redacted output is now in the PR body: the live provider fetch succeeded and returned weekly usage 41% plus the same successful empty reset-credit inventory (availableCount: 0, credits: []).

This is an after-fix real-provider smoke run, but it cannot reproduce the one-time available -> omitted transition: the credit has already been consumed and the account has no reset credit remaining. I do not want to manufacture or overstate a second redemption. The original real 99% -> 0% trace is replayed through the production decision code, including both independent empty inventories, and all 19 focused confirmation tests pass. CI is green, and the latest GitHub Codex review found no major issues.

Please use maintainer judgment on whether this combined evidence is sufficient, or whether the PR should remain open until another safe live redemption becomes available.

[steipete]

Landed. Verification before merge (Codex-gathered evidence, maintainer-reviewed):

• Full interaction matrix verified: present-available → exemption refused (one-available-one-omitted explicitly test-rejected); present-redeemed → the unchanged Fix Codex quota refresh after manual reset #2710 path; absent-after-previously-available → fires exactly once (both omitted inventories must show a lower count while the prior credit is unexpired); absent-always → guard fails. Self-limitation preserved by ownership: the admitted confirmation becomes the newer baseline without an available credit, so the omission branch cannot re-fire.
• Deliberate tightening noted and accepted: initial-available + confirmation-redeemed alone no longer suffices — both samples must corroborate consumption; Fix Codex quota refresh after manual reset #2710's pinned regression (initial .redeeming) is unchanged.
• 403 tests across 26 suites green including all 19 weekly-reset tests; make check clean; CI green. The supplied real omitted-row trace plus deterministic replay accepted as live proof for this narrow branch.

Thanks @endless7 — two clean landings in one week on this subsystem.