fix(codex): let an unknown account plan cost a label, not the provider

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

planType was a closed literal on a required field, and CodexProvider reads
account/read with a bare yield*. So one plan Codex named before Pylon knew it
failed the entire probe — status: "error", auth: {status: "unknown"}, zero
models, zero skills — rather than costing a single label.

Codex auto-updates ahead of Pylon, so this recurred on every release that added a
plan. #128 patched six of them a day ago; the next release would have done it
again.

What changes

The PlanType override becomes an open string, so the generated schema emits
Schema.String, and codexAccountAuthLabel gains a real default branch. An
unrecognised plan now decodes with the rest of the account intact and shows the
generic ChatGPT Subscription label. Upstream models the same tolerance in
Rust with #[serde(other)] Unknown.

Exhaustiveness disappeared with the literal union, so the label table test is
what pins the mappings now. Its comment says so rather than claiming a
satisfies never that no longer exists, and the schema test flips from asserting
rejection to asserting acceptance — which is exactly the decision its previous
comment anticipated.

Verification

• vp test run CodexProvider.test.ts schema.test.ts ProviderRegistry.test.ts — 72 passed
• vp run -F t3 typecheck, vp lint — clean
• Mutation probe: replacing the new default with return undefined fails the
  fallback test (expected undefined to equal 'ChatGPT Subscription')
• New coverage both sides of the boundary: the schema accepts
  plan_from_the_future and the full account response containing it, and the
  provider maps it to the generic label

Scope note

Only the five PlanType declarations in schema.gen.ts are edited by hand.
Running the generator rewrites the whole file with ~38k lines of unrelated churn,
because the committed output predates a dependency change that now emits
.annotate({ identifier: … }). That staleness is recorded in
.agents/upstream-review.md and is not this PR's to fix.

Partially addresses #146. The two silent-failure enums it also describes —
CodexErrorInfo (misalignmentPolicyViolation) and
HookEventName/HookHandlerType — are untouched here: those decode failures are
swallowed at client.ts:156 rather than failing a probe, and CodexErrorInfo is
a union of object shapes rather than a flat enum, so it needs a different fix.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−47 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 71a06e0 · PR result: 2a88ac9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.