feat(codex): add account-qualified catalog entries - #949

sequenceDiagram
  participant Client
  participant ModelDiscovery
  participant CatalogSync
  participant CatalogStore
  participant MultiAgentGuidance
  Client->>ModelDiscovery: Request model listings
  ModelDiscovery->>CatalogSync: Provide provider state and account selectors
  CatalogSync->>CatalogStore: Generate and reconcile account-bound rows
  CatalogStore-->>ModelDiscovery: Return visible catalog entries
  ModelDiscovery-->>Client: Return Codex and OpenAI model listings
  Client->>MultiAgentGuidance: Request guidance with account namespace
  MultiAgentGuidance-->>Client: Return namespace-filtered model guidance

_{Comment @coderabbitai help to get the list of available commands.}

[GD] Verdict: approve-comment

TLDR

• PR: feat(codex): add account-qualified catalog entries #949 — feat(codex): add account-qualified catalog entries
• Head: 3704869c1b on dev (base 7343f0ba = current tip; mergeable: MERGEABLE; not draft)
• Decision: previous blockers are fixed; re-review finds no remaining in-scope correctness bug that should block this layer.
• Usefulness: high — layer 3 of the feat(codex): add account-qualified model namespaces #426 split; catalog/discovery/subagent projection for account selectors is now coherent with the stated contracts.
• Bugs: none blocking on this head. Residual: role-TOML model_fallback de-dup still lowercases whole ids (global chain path is fixed).
• Security: no new confirmed issue on re-check of privacy/selector surfaces; stored ids/emails stay out of discovery.
• Spec / standards: matches PR body and feat(codex): add account-qualified model namespaces #426 layer scope; docs now describe picker rows, dashboard limits, and projected {{model}}.
• Reviews: earlier Wibias blockers (plain /v1/models availability, exact disables, cooled exact-account fallbacks, docs/dashboard claims, ambiguous prompt substitution, case-distinct global fallbacks) are addressed in subsequent commits through 3704869c. Many open Codex threads are stale/outdated against the current head.
• Base / CI: base is current. Required suite mostly green; test 3/4 failed on unrelated runWithImageBridge assertion expect(sse).not.toContain("504") against a successful recovery stream whose payload contains 504 only as an incidental substring (not this PR's files). Treat as separate flake/brittle test, not a PR product regression.
• Owner actions (foreign PR): none required for the prior correctness blockers. Optional: mirror case-sensitive account de-dup into resolveAgentModelFallbackForPrimary if role-TOML fallbacks will list case-distinct selectors. Optional: harden the image-bridge 504 assertion so incidental id/timestamp substrings do not fail CI.
• Bottom line: approve on substance. Not merge-ready only because CI still has one unrelated red leg and open bot threads are noisy; the account-catalog work itself looks ready.

[GD] Verdict: gated

TLDR

• PR: feat(codex): add account-qualified catalog entries #949 — feat(codex): add account-qualified catalog entries
• Head: 0a6f93c5 on dev (base 67128879; current dev tip is ahead/diverged; mergeable: MERGEABLE; draft again)
• Decision: previous code blockers remain fixed; latest commit only docs account-selector precedence. Gate is draft + incomplete CI + base drift, not a new product regression.
• Usefulness: high — layer 3 of feat(codex): add account-qualified model namespaces #426; catalog/discovery/subagent projection is still coherent.
• Bugs: none blocking relative to earlier review. Residual only: role-TOML model_fallback still de-dupes with full-string toLowerCase() (global chain path is fixed).
• Security: no new confirmed issue; selector privacy/disable contracts still hold.
• Spec / standards: latest commit documents selector-before-provider precedence in model-routing docs; app-picker/dashboard boundaries remain accurate.
• Reviews: open Codex threads are largely stale against this head (availability, cooldown, docs, case-distinct global fallbacks already fixed). Exact-account primary skip of subagent fallback remains intentional fail-closed design.
• Base / CI: PR is draft; only lightweight checks visible (enforce-target, label). Head is behind current dev (diverged). Owner must mark ready and refresh from latest dev before merge-ready claims.
• Owner actions (foreign PR): 1) convert draft → ready when finished, 2) update/rebase onto latest dev, 3) wait for full Cross-platform CI, 4) optional: case-sensitive de-dup in resolveAgentModelFallbackForPrimary.
• Bottom line: approve on substance of the account-catalog work; gated for draft/CI/base, not for the earlier correctness blockers.

[GD] Thanks @chrisae9 — merging this.

Why it helps: this completes the account-catalog layer of the #426 split — account-qualified rows are generated per eligible public account selector, surfaced in Codex and OpenAI discovery without leaking stored ids/aliases/emails, and honored end-to-end by routing, disabledModels, exact-account cooldowns, and subagent fallback including case-distinct selector chains. Bare native routing and raw /v1/models availability stay intact, and the routing guides are updated across all five languages.

Ship it.