rdmbair13m5-changelog-20260830-2213-codex-remote-helper-repair

Repaired the Codex remote SSH code-mode helper without changing project data, restoring the existing RTTy planning task's ability to negotiate the helper and create a shell.

Scope

• Host: rdmbair13m5.
• Source coordination task: 01a05576-551e-7502-af54-bd854b1e56aa on rdmsm4x.
• Affected task: RTTy planning task 01a020b0-ff22-7133-b86f-78cf35287bd9.
• No repository, task database, auth store, credential, cookie, approval, enrollment, GUI app-server, or unrelated process was changed.

Exact state changed

• Restarted the standalone SSH Codex app-server from PID 2349, which logged repeated code-mode negotiation timeouts, to PID 25907 executing /opt/homebrew/Caskroom/codex/0.151.0/bin/codex.
• Atomically refreshed the inode of /opt/homebrew/Caskroom/codex/0.151.0/bin/codex-code-mode-host while preserving identical executable bytes, signature, mode, and quarantine metadata.
• Recreated /Users/richh/Documents/Codex/2026-08-20/rtty-product-planning as the task's exact empty recorded working-directory container. It is not a project root and no repository was initialized.
• Added rollback evidence under /Users/richh/.agent-coordination/remote-helper-repair/20260830/rdmbair13m5/.

Commands and diagnostics

• Verified host identity with scutil, arch, and the host Ed25519 fingerprint; expected fingerprint prefix E+262mKu matched.
• Verified Homebrew prefix /opt/homebrew, Codex 0.151.0, helper path, file type, SHA-256, Developer ID signature, dynamic dependencies, extended attributes, current PIDs, children, executable mappings, and app-server logs.
• Compared the Apple-silicon helper byte-for-byte with the working rdmsm4x helper; hashes matched.
• Used sample on a bounded test process and temporary same-directory copies to isolate the stall to the original helper inode. All temporary diagnostic files were removed.
• Preserved the old log, sent TERM only to the verified idle standalone app-server and MCP children, removed only its stale control socket, and relaunched explicit Homebrew Codex 0.151.0.
• Used an atomic verified copy/move sequence for the helper inode refresh; the exact original inode was retained for rollback evidence.

Verification

• Helper SHA-256 before and after: f5c96dc8cca0f760f525076c1f9f4efad31355c0fe18efb56e76df7e40592376, matching the working rdmsm4x Apple-silicon helper.
• codesign --verify --strict passed before and after; signer remained Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2).
• Quarantine metadata was restored/preserved exactly after the rejected diagnostic hypothesis.
• Original helper path now returns its --help output successfully.
• Final probe through the original RTTy task reported: helper negotiation succeeded, shell creation succeeded, exit code 0, codex-cli 0.151.0, Homebrew prefix /opt/homebrew, helper path /opt/homebrew/Caskroom/codex/0.151.0/bin/codex-code-mode-host, and the restored task directory empty.
• The original RTTy task is active again, reconstructing its read-only product-planning decision ledger before asking the next questions.

Backup and undo

• Pre-restart log: /Users/richh/.agent-coordination/remote-helper-repair/20260830/rdmbair13m5/app-server-before-restart.log.
• Original helper inode: /Users/richh/.agent-coordination/remote-helper-repair/20260830/rdmbair13m5/codex-code-mode-host.original-inode.
• Original quarantine value: /Users/richh/.agent-coordination/remote-helper-repair/20260830/rdmbair13m5/codex-code-mode-host.quarantine.hex.
• A clean future Homebrew Codex reinstall/upgrade should supersede the preserved original inode. Moving the original inode back would also restore the observed loader stall and is only a last-resort forensic rollback.
• The empty task container may be removed only after the task is relocated or archived and no longer records that path; it contains no project data at verification time.

Outstanding owner actions

• Rich should answer the next RTTy planning questions in the existing task; implementation remains explicitly out of scope there.
• Recheck the helper after the next Codex cask upgrade; if the in-place upgrade recreates the loader stall, prefer a clean Homebrew reinstall and retain this evidence.
• Apple Notes entry is pending: the SSH session could not enter the logged-in Aqua audit session (Operation not permitted). This Markdown file is present both in the canonical rdmsm4x archive and the host's secondary archive; a GUI-side helper must add the exact title to Notes folder rdmbair13m5.