Admit OpenAI Codex model pair

tools/validate_cto_child.py

@@ -39,6 +39,7 @@ REQUIRED_FILES = [
     ".sot/03-PROTOCOLS/CTO-CASE-PROVIDER-DECISION-PACKET-PRD.md",
     ".sot/03-PROTOCOLS/CTO-CASE-PROVIDER-DECISION-PACKET-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-CASE-PROVIDER-DECISION-RECORD.md",
+    ".sot/03-PROTOCOLS/CTO-CASE-MODEL-PROVIDER-ADMISSION.openai-codex-gpt-5.5.json",
 ]
 
 REQUIRED_BRIEF_PHRASES = [
@@ -420,6 +421,7 @@ REQUIRED_MODEL_PROVIDER_ADMISSION_PRD_PHRASES = [
 REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_IDS = [
     "CTO-WORK-019",
     "CTO-WORK-020",
+    "CTO-WORK-027",
 ]
 
 REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_PHRASES = [
@@ -454,8 +456,29 @@ REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_PHRASES = [
     "`review_trigger`: expiry, date, or condition that forces review.",
     "`evidence_sources`: references to existing admission/build evidence, not copied runtime evidence.",
     "`effect`: `CTO-WORK-020 remains blocked until admitted provider/model and real Stage 2 pass report exist`.",
+    "CTO-WORK-027 - OpenAI Codex Model Admission JSON",
+    "Admission file path is `.sot/03-PROTOCOLS/CTO-CASE-MODEL-PROVIDER-ADMISSION.openai-codex-gpt-5.5.json`.",
+    "Admission JSON has `status`: `admitted`.",
+    "Admission JSON has `provider`: `openai-codex`.",
+    "Admission JSON has `model`: `gpt-5.5`.",
+    "Admission JSON has `credential_source_class`: `hermes-openai-codex-oauth-and-local-vllm-config`.",
+    "Admission JSON has `allowed_network_class`: `codex-oauth-hosted-model-plus-local-vllm-fallback`.",
+    "Admission JSON has `approval_source`: `JP chat approval on 2026-05-31`.",
+    "Admission JSON contains no secret keys or secret values.",
+    "Fallback to `vllm` / `qwen3.6-35b-a3b` remains explicit decision-record context and must be represented in runtime evidence before it may count as a Case provider/model path.",
+    "`CTO-WORK-020` remains blocked until real Case Stage 2 produces a Harness Evidence Interface pass report using this admission file.",
+    "Real Case Stage 2 command must set `CTO_HARNESS_CASE_MODEL_ADMISSION_FILE` to this admission JSON path.",
 ]
 
+REQUIRED_OPENAI_CODEX_ADMISSION_JSON = {
+    "status": "admitted",
+    "provider": "openai-codex",
+    "model": "gpt-5.5",
+    "credential_source_class": "hermes-openai-codex-oauth-and-local-vllm-config",
+    "allowed_network_class": "codex-oauth-hosted-model-plus-local-vllm-fallback",
+    "approval_source": "JP chat approval on 2026-05-31",
+}
+
 REQUIRED_LOCAL_PROVIDER_ROUTE_PRD_PHRASES = [
     "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
     "`CTO-WORK-020` remains blocked until a provider policy decision exists.",
@@ -845,6 +868,30 @@ def main() -> int:
             if phrase not in text:
                 errors.append(f"missing_model_provider_admission_issue_phrase:{phrase}")
 
+    openai_codex_admission = ROOT / ".sot/03-PROTOCOLS/CTO-CASE-MODEL-PROVIDER-ADMISSION.openai-codex-gpt-5.5.json"
+    if openai_codex_admission.is_file():
+        checked.append("openai_codex_admission_json:parse")
+        try:
+            payload = json.loads(openai_codex_admission.read_text(encoding="utf-8"))
+        except json.JSONDecodeError as exc:
+            errors.append(f"openai_codex_admission_invalid_json:{exc}")
+            payload = {}
+        if not isinstance(payload, dict):
+            errors.append("openai_codex_admission_must_be_object")
+            payload = {}
+        for key, expected in REQUIRED_OPENAI_CODEX_ADMISSION_JSON.items():
+            checked.append(f"openai_codex_admission_json:{key}")
+            if payload.get(key) != expected:
+                errors.append(f"openai_codex_admission_mismatch:{key}:expected_{expected}:actual_{payload.get(key)}")
+        for key in ["admission_timestamp", "review_trigger"]:
+            checked.append(f"openai_codex_admission_json:{key}")
+            if not isinstance(payload.get(key), str) or not payload.get(key):
+                errors.append(f"openai_codex_admission_missing:{key}")
+        for key in payload:
+            checked.append(f"openai_codex_admission_json_secret_key:{key}")
+            if key.lower() in {"api_key", "apikey", "access_token", "token", "secret", "password", "credential_value"}:
+                errors.append(f"openai_codex_admission_forbidden_secret_key:{key}")
+
     local_provider_route_prd = ROOT / ".sot/03-PROTOCOLS/CTO-CASE-LOCAL-PROVIDER-ROUTE-PRD.md"
     if local_provider_route_prd.is_file():
         text = local_provider_route_prd.read_text(encoding="utf-8")
@@ -968,6 +1015,7 @@ def main() -> int:
             "CTO-WORK-024": "validated",
             "CTO-WORK-025": "validated",
             "CTO-WORK-026": "validated",
+            "CTO-WORK-027": "validated",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")
@@ -1016,6 +1064,8 @@ def main() -> int:
             errors.append("workboard_missing_provider_decision_packet_issues_source")
         if "CTO-CASE-PROVIDER-DECISION-RECORD.md" not in text:
             errors.append("workboard_missing_provider_decision_record_source")
+        if "CTO-CASE-MODEL-PROVIDER-ADMISSION.openai-codex-gpt-5.5.json" not in text:
+            errors.append("workboard_missing_openai_codex_admission_json_source")
 
     payload = {
         "ok": not errors,