fix(proxy-responses): restart verified v1 goals after stale anchors - #48

Summary

Fix native Codex /v1/responses Goal restart after a proxy-injected stale previous_response_id. A verified, self-contained Goal restart now rotates HTTP turn-state and performs the safe fresh replay path; an unsafe stale-anchor continuation terminates once instead of repeatedly local-rebinding and reinjecting the same stale anchor.

Source sidechat: 01a045d1-ecf5-7840-b404-4c9b6098216d
Recovered from: a347912b8334af52133bfc4436381fb78afb8888

Type of change

• fix: — bug fix
• This PR includes / updates an OpenSpec change
• This PR touches a codex-faithful path and preserves upstream-equivalent behavior
• Breaking change

Linked issue: GitHub Issues are disabled for chekdata/codex-lb; this PR tracks the internal stale-anchor incident directly.

Change directory: openspec/changes/recover-v1-goal-restart-from-stale-durable-anchor/

Changes

• Add strict verification for native Codex Goal restart headers and self-contained account-neutral replay eligibility.
• Force verified Goal restart requests onto a new HTTP turn-state while preserving the existing durable bridge/session and stale-anchor evidence.
• Carry the verified restart marker through streaming/session creation.
• End proxy-injected stale-anchor streams once when no safe fresh replay is available, preventing repeated injection of the same stale previous_response_id.
• Keep ordinary turn-state fallback behavior unchanged.
• Add integration/unit coverage and OpenSpec proposal/design/spec/tasks documentation.
• No schema, migration, setting, sticky configuration, continuity configuration, durable-session cleanup, or production database change.

Test plan

Passed locally:

uv run pytest -q tests/integration/test_http_responses_bridge.py
151 passed in 123.28s

uv run pytest -q tests/unit/test_proxy_http_bridge.py tests/unit/test_proxy_api_websocket_auth.py
710 passed in 16.55s

uv run pytest -q tests/integration/test_http_responses_bridge.py::test_v1_responses_verified_goal_restart_rotates_turn_state_and_preserves_stale_bridge tests/integration/test_http_responses_bridge.py::test_v1_responses_http_bridge_terminates_after_upstream_previous_response_not_found tests/integration/test_http_responses_bridge.py::test_v1_responses_http_bridge_stream_terminates_proxy_injected_stale_anchor_once
3 passed in 2.46s

uv run ruff check <6 changed files>
All checks passed
uv run ruff format --check <6 changed files>
6 files already formatted
uv run ty check
All checks passed
uv run python scripts/check_proxy_architecture.py
proxy architecture checks passed
git diff --check
passed

npx --yes @fission-ai/openspec@latest validate recover-v1-goal-restart-from-stale-durable-anchor --strict
Change 'recover-v1-goal-restart-from-stale-durable-anchor' is valid

Known blockers / gaps

• The project-required PostgreSQL durable-session integration was attempted against postgresql+asyncpg://codex_lb:codex_lb@127.0.0.1:5432/codex_lb, but the local environment has no PostgreSQL listener (ConnectionRefusedError: [Errno 61]); pg_isready, psql, postgres, initdb, pg_ctl, and Docker are unavailable. SQLite was not used as a substitute.
• Full-repository npx --yes @fission-ai/openspec@latest validate --specs --strict currently reports 35 passed, 22 failed due to pre-existing unrelated specs (including account-auth, account-routing, and release-automation); the target responses-api-compat spec and this change validate successfully.
• CI, review, merge to main, image/GitOps deployment, and production Goal probe are not complete in this PR. Production probing is intentionally not run.

Merge/deploy status

This PR is opened from fix/v1-goal-restart-stale-anchor at commit 6e2750a98c3335a8979c7cfdc3a1fb6f622eaf41. It has not entered origin/main, has not been deployed, and has not changed production state.