Admit codex-cli 0.147.0 after repeating the pin's policy checks (#272)

st2's controlled Codex launch refused the installed 0.147.0, taking native
delivery out of service on any machine that ran `codex update`.

The schema comparison 0.146.0 -> 0.147.0 is complete: no definition was
removed, no `ServerRequest` arm was added or renamed, and every message
envelope st2 parses is byte-identical after canonicalization. The raw diff
is noise because 0.147.0 emits object keys in sorted order.

Live evidence reached a submitted `turn/start` against the real binary: the
delivered prompt rendered in the remote TUI, which then failed on the
account's usage limit, with a reset estimated at 2026-08-20. Everything
gated behind a completed model turn is therefore unproven on 0.147.0. The
constant's doc comment names that gap rather than asserting a check that did
not finish.

The existing gate test asserted 0.147.0 was rejected. It now derives its
admitted cases from the constant, and pins rejection of an older unadmitted
release and of the 0.148.0 alpha.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: schickling

src/codex_app_server.rs

@@ -35,7 +35,18 @@ use crate::{ding, message, run, status};
 /// Every admitted version has a delivery-critical schema comparison and live remote-TUI evidence.
 /// A later version stays rejected until both checks are repeated; semantic-version proximity is
 /// not compatibility evidence for this experimental provider surface.
-pub const SUPPORTED_CODEX_CLI_VERSIONS: &[&str] = &["codex-cli 0.145.0", "codex-cli 0.146.0"];
+///
+/// `codex-cli 0.147.0` is admitted on a completed schema comparison against 0.146.0 and on live
+/// evidence that reached a submitted `turn/start` against the real binary. Its live evidence stops
+/// short of a completed model turn: the account was over its usage limit when the check ran. The
+/// `turn/start` response body, `turn/started`, `turn/completed`, the typed `item/completed`
+/// receipt, `turn/steer`, and the `thread/resume` subscription path are therefore unproven on this
+/// version. See #267.
+pub const SUPPORTED_CODEX_CLI_VERSIONS: &[&str] = &[
+    "codex-cli 0.145.0",
+    "codex-cli 0.146.0",
+    "codex-cli 0.147.0",
+];
 const RUNTIME_SCHEMA: &str = "st2.codex-runtime.v1";
 const BINDING_SCHEMA: &str = "st2.codex-thread-binding.v1";
 const CONTROL_STATE_SCHEMA: &str = "st2.codex-control-state.v1";
@@ -2436,24 +2447,33 @@ mod tests {
             fs::set_permissions(&path, fs::Permissions::from_mode(0o755)).unwrap();
             path
         };
-        for (name, version) in [
-            ("codex-0145", "codex-cli 0.145.0"),
-            ("codex-0146", "codex-cli 0.146.0"),
-        ] {
-            ensure_supported_version(write_version(name, version).to_str().unwrap()).unwrap();
+        for (index, version) in SUPPORTED_CODEX_CLI_VERSIONS.iter().enumerate() {
+            ensure_supported_version(
+                write_version(&format!("codex-admitted-{index}"), version)
+                    .to_str()
+                    .unwrap(),
+            )
+            .unwrap();
+        }
+        // An unadmitted release stays rejected until both policy checks are repeated for it, and
+        // an alpha cannot carry live evidence at all.
+        for (index, unadmitted) in ["codex-cli 0.144.0", "codex-cli 0.148.0-alpha.21"]
+            .into_iter()
+            .enumerate()
+        {
+            let error = ensure_supported_version(
+                write_version(&format!("codex-unadmitted-{index}"), unadmitted)
+                    .to_str()
+                    .unwrap(),
+            )
+            .unwrap_err();
+            assert!(error.to_string().contains(unadmitted));
+            assert!(
+                error
+                    .to_string()
+                    .contains(&SUPPORTED_CODEX_CLI_VERSIONS.join(", "))
+            );
         }
-        let error = ensure_supported_version(
-            write_version("codex-0147", "codex-cli 0.147.0")
-                .to_str()
-                .unwrap(),
-        )
-        .unwrap_err();
-        assert!(error.to_string().contains("codex-cli 0.147.0"));
-        assert!(
-            error
-                .to_string()
-                .contains("codex-cli 0.145.0, codex-cli 0.146.0")
-        );
     }
 
     #[test]