Add Codex subscription provider with isolated runtime and safe recovery

[ethanplusai]

Summary

Add an optional Codex subscription provider so Harvey can use a file-based ChatGPT login for model usage. Claude remains the default. Setup, training, the heartbeat, CLI status, dashboard and usage accounting support the selected provider; there is no silent model/provider or API-billing fallback.

The adapter runs Codex in an isolated temporary environment with no model-visible tools, MCP servers, hooks or instructions. It attests routes and configuration before introducing an access-token-only login copy, never copies the refresh token, and leaves the native login unchanged. Unsupported versions, unsafe configuration, incompatible models and unusable credentials fail closed. Timeouts include queueing and process startup; teardown removes private files and process groups.

Provider failures pause work with visible health status and recovery. Usage-limit pauses survive restarts. Reply drafting now finishes before conversation state is committed, avoiding lost or duplicated replies after a provider outage. Across both providers, native mailbox reads and reply handling precede queued sends; failed or timed-out reply processing holds sends until recovery. This fixes the prior race between stop-on-reply cancellation and outbox delivery.

Validation completed before opening this PR

The initial feature sources matched the final locally validated snapshot. Follow-up commit a16e640 fixes dashboard UTF-8 decoding and adds four regression cases; the complete remote CI matrix passes on this commit.

Environment	Full suite	Real CLI security suite	Installed-wheel suite
macOS, Python 3.12	424 passed, 19 opt-in skips	18 passed	1 passed
ARM64 Linux, Python 3.11	424 passed, 19 opt-in skips	18 passed	1 passed
x86-64 Linux, Python 3.11, CPU emulation	424 passed, 19 opt-in skips	18 passed	1 passed

The 19 skips are the 18 real-CLI tests and one packaging test, each executed separately above. Linux suites used purpose-built containers without external networking or credentials. Real-CLI security tests use Codex 0.159.3 against localhost mocks. Wheel build/install and CLI smoke checks also passed on both Linux architectures. git diff --check passed.

Additional live synthetic acceptance:

• Actual Codex heartbeat on macOS and ARM64 Linux: approval required, exactly one captured delivery after approval across repeated cycles, no duplicate inbound messages, correct usage accounting. Same heartbeat scenario passed with Claude on macOS.
• 11/11 Handler/Writer/Trainer/injection checks passed with each provider on macOS; 11/11 passed with Codex on ARM64 Linux. Live subscription quota retrieval succeeded.
• Native Codex login bytes, inode, modification time and permissions remained unchanged.
• Independently reproduced regression cases now pass: draft failure leaves the reply pending; rejected model plus approved outbox sends nothing; mailbox read failure sends nothing. Automated tests also cover recovery, processing failures and timeouts, migration from a pre-provider database, credential isolation, hostile routes, cleanup and accounting.

No real emails were sent. Live model checks used disposable synthetic state and a capturing-only mail transport. No production deployment or live SMTP delivery was tested.

The new GitHub Actions matrix covers Python 3.11/3.12 on Linux, macOS and Windows. Codex integration steps run only on Linux/macOS; Windows runs the remaining suite and unsupported-platform guards. Remote CI now passes all six jobs on commit a16e640: Python 3.11 and 3.12 on Linux, macOS and Windows. See the successful CI run. Results in the table above record the original local validation.

Supported scope and limitations

• Supported initial release: macOS and Linux, Codex CLI 0.159.3 exactly, explicit brain.model: gpt-5.5, and a file-based ChatGPT login in ~/.codex/auth.json or $CODEX_HOME/auth.json, using the documented checkout installation.
• Windows Codex is explicitly unsupported and rejected before login access or process launch. Claude remains available on Windows; native Windows validation was not performed locally.
• Keyring login storage, other CLI versions and unverified models are outside this release scope. Code-mode models exposing tools are refused. There is no automatic substitution.
• Harvey does not refresh the native login. Use Codex or codex login to renew it roughly every eight days; expiry or renewal due pauses Harvey safely.
• The shipped Docker image does not contain Node/Codex and is not supported for this provider. Linux validation used separate purpose-built test images.
• Standalone wheels still omit repository prompts/skills (pre-existing packaging limitation). Installed-wheel provider/CLI/assets checks passed with fallback prompts; the supported installation is from a checkout.
• x86-64 Linux validation ran under CPU emulation; live-account Linux inference was ARM64 only.
• Isolation adds startup overhead: two app-server starts per inference and a full non-inference preflight each heartbeat.

Existing Instantly delivery-failure semantics are unchanged: a failure after storing a handled reply does not automatically retry that answer. This PR does not claim to fix that pre-existing delivery limitation.

Windows dashboard regression fix

The initial Windows CI run exposed a pre-existing bug: dashboard assets were read with the host default encoding, causing CP1252 decoding to fail on UTF-8 CSS. HTML and text assets now explicitly use UTF-8. Four regression cases simulate a CP1252 default for HTML, CSS, JavaScript and SVG and assert exact response text and bytes. All four failed before the fix and passed afterward; all 21 dashboard tests passed locally. Both native Windows CI jobs now pass, along with all Linux/macOS jobs. Codex itself remains unsupported on Windows.