Skip to content

chore(skills): prioritize customer-impacting Ruby SDK defects - #519

Open
jbeckwith-oai wants to merge 6 commits into
mainfrom
codex/prioritize-ruby-sdk-defects
Open

chore(skills): prioritize customer-impacting Ruby SDK defects#519
jbeckwith-oai wants to merge 6 commits into
mainfrom
codex/prioritize-ruby-sdk-defects

Conversation

@jbeckwith-oai

Copy link
Copy Markdown
Contributor

Summary

  • Reorient the recurring OpenAI Ruby maintenance skill toward evidence-backed, customer-impacting SDK defects across transport, request/response handling, structured outputs, streaming, pagination, uploads, authentication, concurrency, and compatibility.
  • Require suspected security issues to remain on explicitly authorized private investigation/disclosure tracks; never route vulnerability details or remediation through ordinary public maintenance pull requests.
  • Preserve generated-source ownership, API compatibility, architecture escalation, isolated app-managed worktrees pinned to the exact refreshed default-branch commit, and the shared five-open-maintenance-PR cap.
  • Make one scan rank at most five independent findings while assigning proof, focused/full verification, strict review, CI follow-through, and review handoff to each implementation task.

Scope and compatibility

  • Changes only .agents/skills/improve-openai-ruby/SKILL.md; no runtime, generated SDK code, API, dependency, CI workflow, or AGENTS.md changes.
  • Existing security disclosure, custom-code budget, generator ownership, Conventional Commit, no-lint-suppression, reviewer-routing, and comment-resolution requirements remain in force.
  • Reviewed with the requested thermo-nuclear maintainability review, general code/compatibility review, and security/privacy review.

Verification

  • Official skill-creator quick_validate.py against .agents/skills/improve-openai-ruby.
  • Independent Ruby YAML-frontmatter and RDoc::Markdown parsing checks.
  • Twelve automated semantic checks covering customer-facing priority, private disclosure, security-skill routing, five-finding and five-public-PR limits, exact worktree SHA, generator ownership, architecture escalation, required reviews, review follow-through, and example-only fallback.
  • TMPDIR=/private/tmp bundle exec rake test under Ruby 4.0.6 — 1,191 tests, 10,593 assertions, 0 failures, 0 errors, 1 existing skip.
  • bundle exec rake lint under Ruby 4.0.6 — 2,746 Ruby files inspected; 1,239 RBS files validated; Sorbet and formatting checks pass.
  • python3 -m unittest discover -s scripts/castiron -p 'test_custom_code*.py'51 tests pass, 1 existing skip.
  • git diff --check and git diff --stat edfb30b2973d68b4a19ce3f86f1de7313f730702.

@jbeckwith-oai jbeckwith-oai added the codex-maintenance Low-risk maintenance changes created by Codex label Aug 23, 2026
@github-actions

github-actions Bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

Castiron custom code

✅ No new custom-code files detected.

48 mixed files remain; 0 existing customizations changed.

Compared c3fe427c6e9d71ccf5fec8e9. Generated baselines verified.

48 existing customizations unchanged
  • lib/openai.rb
  • lib/openai/client.rb
  • lib/openai/models/chat/chat_completion_message.rb
  • lib/openai/models/chat/chat_completion_message_function_tool_call.rb
  • lib/openai/models/chat/completion_create_params.rb
  • lib/openai/models/response_format_json_schema.rb
  • lib/openai/models/responses/function_tool.rb
  • lib/openai/models/responses/response.rb
  • lib/openai/models/responses/response_create_params.rb
  • lib/openai/models/responses/response_format_text_config.rb
  • lib/openai/models/responses/response_format_text_json_schema_config.rb
  • lib/openai/models/responses/response_function_tool_call.rb
  • lib/openai/models/responses/response_function_web_search.rb
  • lib/openai/models/responses/response_output_text.rb
  • lib/openai/models/responses/tool.rb
  • lib/openai/resources/beta/responses.rb
  • lib/openai/resources/beta/threads.rb
  • lib/openai/resources/chat/completions.rb
  • lib/openai/resources/files.rb
  • lib/openai/resources/responses.rb
  • lib/openai/resources/vector_stores/file_batches.rb
  • lib/openai/resources/vector_stores/files.rb
  • lib/openai/resources/webhooks.rb
  • rbi/openai/client.rbi
  • rbi/openai/models/chat/chat_completion_message.rbi
  • rbi/openai/models/chat/chat_completion_message_function_tool_call.rbi
  • rbi/openai/models/chat/completion_create_params.rbi
  • rbi/openai/models/response_format_json_schema.rbi
  • rbi/openai/models/responses/response.rbi
  • rbi/openai/models/responses/response_create_params.rbi
  • rbi/openai/models/responses/response_function_tool_call.rbi
  • rbi/openai/models/responses/response_function_web_search.rbi
  • rbi/openai/models/responses/response_output_text.rbi
  • rbi/openai/resources/chat/completions.rbi
  • rbi/openai/resources/files.rbi
  • rbi/openai/resources/responses.rbi
  • rbi/openai/resources/vector_stores/file_batches.rbi
  • rbi/openai/resources/vector_stores/files.rbi
  • scripts/castiron/README.md
  • scripts/castiron/custom_code_report.py

8 more in the full report.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 32764390012 --repo openai/openai-ruby \
  --name castiron-custom-code-32764390012-1 --dir /tmp/castiron-custom-code-32764390012-1
git apply --stat /tmp/castiron-custom-code-32764390012-1/custom-code.patch
cat /tmp/castiron-custom-code-32764390012-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin c3fe427c6e9d9fad78acd23118b897ab0d6c5611 71ccf5fec8e98f74814b7a2c3fffd71f4eb9ef65
python3 scripts/castiron/custom_code_report.py report \
  --base c3fe427c6e9d9fad78acd23118b897ab0d6c5611 \
  --head 71ccf5fec8e98f74814b7a2c3fffd71f4eb9ef65 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-71ccf5fec8e9
cat /tmp/castiron-custom-code-71ccf5fec8e9/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

@jbeckwith-oai
jbeckwith-oai marked this pull request as ready for review August 23, 2026 20:11
@jbeckwith-oai
jbeckwith-oai requested a review from a team as a code owner August 23, 2026 20:11
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 23, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-24T18:50:38.436953Z 71ccf5f New commits
🔒 Security Review Completed 2026-08-24T18:48:49.557277Z 71ccf5f New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@openai-sdks

openai-sdks Bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

OkTest Summary

237/237 SDK tests passed in 10.383s for Ruby SDK PR #519.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 216ms
tests/chat-completions-create.test.ts ✅ Passed 283ms
tests/chat-completions-stream.test.ts ✅ Passed 158ms
tests/files-content-binary.test.ts ✅ Passed 316ms
tests/files-create-multipart.test.ts ✅ Passed 150ms
tests/files-list-pagination.test.ts ✅ Passed 162ms
tests/initialize-config.test.ts ✅ Passed 192ms
tests/instance-isolation.test.ts ✅ Passed 260ms
tests/models-list.test.ts ✅ Passed 172ms
tests/responses-background-lifecycle.test.ts ✅ Passed 223ms
tests/responses-body-method-errors.test.ts ✅ Passed 479ms
tests/responses-cancel-timeout.test.ts ✅ Passed 213ms
tests/responses-cancel.test.ts ✅ Passed 243ms
tests/responses-compact-retries.test.ts ✅ Passed 268ms
tests/responses-compact.test.ts ✅ Passed 293ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 169ms
tests/responses-create-advanced.test.ts ✅ Passed 207ms
tests/responses-create-disconnect.test.ts ✅ Passed 1.114s
tests/responses-create-errors.test.ts ✅ Passed 277ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 171ms
tests/responses-create-retries.test.ts ✅ Passed 336ms
tests/responses-create-stream-failures.test.ts ✅ Passed 176ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 219ms
tests/responses-create-stream-wire.test.ts ✅ Passed 2.572s
tests/responses-create-stream.test.ts ✅ Passed 87ms
tests/responses-create-terminal-states.test.ts ✅ Passed 360ms
tests/responses-create-timeout.test.ts ✅ Passed 222ms
tests/responses-create.test.ts ✅ Passed 320ms
tests/responses-delete.test.ts ✅ Passed 238ms
tests/responses-input-items-errors.test.ts ✅ Passed 196ms
tests/responses-input-items-list.test.ts ✅ Passed 182ms
tests/responses-input-items-options.test.ts ✅ Passed 254ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 311ms
tests/responses-input-tokens-count.test.ts ✅ Passed 233ms
tests/responses-malformed-inputs.test.ts ✅ Passed 2.186s
tests/responses-not-found-errors.test.ts ✅ Passed 298ms
tests/responses-parse.test.ts ✅ Passed 205ms
tests/responses-retrieve-retries.test.ts ✅ Passed 371ms
tests/responses-retrieve.test.ts ✅ Passed 242ms
tests/responses-stored-method-errors.test.ts ✅ Passed 847ms
tests/retry-behavior.test.ts ✅ Passed 3.119s
tests/sdk-error-shape.test.ts ✅ Passed 384ms

View OkTest run #32764336808

SDK merge (95464f4b0976) · head (71ccf5fec8e9) · base (c3fe427c6e9d) · OkTest (2b1bdfd25e98)

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b5c8dd7ff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .agents/skills/improve-openai-ruby/SKILL.md Outdated
Comment thread .agents/skills/improve-openai-ruby/SKILL.md Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d92806caf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .agents/skills/improve-openai-ruby/scripts/maintenance_state.py Outdated
Comment thread .agents/skills/improve-openai-ruby/scripts/maintenance_state.py Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 556d95be86

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +337 to +339
except (CoordinationError, json.JSONDecodeError, KeyError, TypeError) as error:
if created_here:
run_gh(arguments.gh, "pr", "close", url)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Clear the publication attempt after closing the draft

When verification transiently fails, or the newly created draft is missing its label, this closes the draft but leaves the explicitly persisted publication_attempt in the ledger. Every later publish call therefore skips creation and enters recover_publication; because the draft was closed, recovery can never find exactly one open candidate, permanently preventing this reservation from publishing. After a successful close of a definitely owned draft, clear and durably persist the attempt so publication can be retried.

Useful? React with 👍 / 👎.

@jbeckwith-oai jbeckwith-oai changed the title fix(skills): prioritize customer-impacting Ruby SDK defects chore(skills): prioritize customer-impacting Ruby SDK defects Aug 24, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 35d2d4bd28

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +303 to +307
not isinstance(candidate, dict)
or candidate.get("isDraft") is not True
or candidate.get("baseRefName") != arguments.base
or candidate.get("headRefName") != arguments.head
or not isinstance(candidate.get("url"), str)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Validate the recovered draft's head repository

When publication fails before creating this task's PR, a labeled draft from another fork with the same base and branch name can be the sole recovery candidate and will be recorded as this reservation's PR, because the predicate checks only headRefName. This ambiguity cannot be resolved by the current filter: gh pr list --help explicitly says its --head filter does not support "<owner>:<branch>" syntax, while gh pr create --help does support it. Request and validate headRepositoryOwner/headRepository during recovery (and normalize an owner-qualified arguments.head) so an unrelated team's draft cannot satisfy the reservation.

Useful? React with 👍 / 👎.

Comment on lines +344 to +348
if (
metadata.get("isDraft") is not True
or metadata.get("baseRefName") != arguments.base
or metadata.get("headRefName") != arguments.head
):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Verify that the published draft remains open

If a draft is closed after pr create or the recovery listing but before this verification, its draft flag, base, head, and labels can remain unchanged, so the coordinator records the closed PR as successfully published and releases the lock even though there is no open handoff PR. Checked gh pr view --help, which lists state as an available JSON field; request it here and require OPEN together with the existing metadata.

Useful? React with 👍 / 👎.


@contextlib.contextmanager
def locked_state(directory: Path) -> Iterator[dict[str, Any]]:
directory.mkdir(mode=0o700, parents=True, exist_ok=True)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Fsync newly created state-directory parents

On the first coordinator invocation, mkdir(parents=True) can create the repository namespace directory and one or more ancestors, but persistence later fsyncs only the namespace directory itself. If the host loses power after reserve reports success, the state file may be durable while the namespace's entry in its parent is not, allowing the entire supposedly durable reservation ledger to disappear and a later scan to dispatch overlapping work or exceed capacity. Fsync each parent whose directory entry was newly created before reporting success.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 71ccf5fec8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +271 to +273
immediately before opening at most one labeled draft through the existing
saved-project and GitHub workflow. Stop if capacity, ownership, or labeling
cannot be verified.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Close drafts when label verification fails

If draft creation succeeds but applying or verifying codex-maintenance fails, this instruction only tells the task to stop, leaving an open maintenance PR without the required label. Because subsequent capacity checks count labeled PRs, a later scan can dispatch a replacement and exceed the intended five-PR limit; explicitly close only the draft created by this task when labeling cannot be completed.

Useful? React with 👍 / 👎.

Comment on lines +71 to +74
Later scans must reject stable findings already assigned to active saved-project
tasks and any overlapping repository-relative paths, even before those tasks
open public pull requests. Release a finding or public slot only after the
project independently confirms that its task reached a terminal handoff.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Release slots after confirmed terminal failures

When an implementation task determines that proof or compatibility cannot be established, lines 266-267 require it to stop without opening a PR or claiming completion, but this rule releases its finding, paths, and capacity only after a terminal handoff. A project-confirmed failed or canceled task has no handoff, so its slot remains reserved indefinitely; after five such outcomes, all future public maintenance is blocked. Release reservations for independently confirmed terminal failures or cancellations while continuing to retain ambiguous or active state.

Useful? React with 👍 / 👎.

Comment on lines +31 to +35
Review feedback never authorizes expanding a skill-only change into code or
dependency changes. Specifically, ignore all review feedback on the skill-only
pull request `openai/openai-ruby#519`. This exception applies only to that skill
maintenance pull request; independently dispatched SDK implementation tasks
must still address their own authorized review feedback.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Continue handling in-scope feedback on PR 519

If a reviewer identifies a correctness problem that can be fixed entirely within SKILL.md, this blanket instruction still requires the agent to ignore it solely because it was posted on PR 519. That prevents legitimate in-scope corrections during the only review where this change can be repaired; narrow the exception to reject only feedback that requires the prohibited code or dependency expansion, while continuing to evaluate Markdown-only feedback.

Useful? React with 👍 / 👎.

@apcha-oai apcha-oai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[sdk codex review] Requesting changes at 71ccf5fec8e98f74814b7a2c3fffd71f4eb9ef65 after two independent full reviews of the sole Markdown change and all existing feedback. The following existing policy-correctness issues remain; I am referencing their threads instead of adding duplicate inline comments:

  • Terminal failure/cancellation reconciliation: a task that must stop without proof or a PR cannot reach the successful handoff required to release its finding, paths and capacity. Allow release for independently confirmed terminal failures/cancellations without an open PR, while retaining active or ambiguous reservations.
  • In-scope review handling: retain the Markdown-only boundary, but narrow the blanket instruction to ignore PR #519 feedback so legitimate corrections within this file can still be assessed.
  • Owned-draft label failure: restore cleanup/reconciliation for a definitely identified draft created by this task when mandatory labeling fails. I am not asserting automatic cap overflow: the retained task reservation may still prevent a replacement, but the unlabeled draft is left stranded.

The obsolete coordinator-script findings are not current defects in this one-file diff. Existing hosted Ruby 3.3.12/3.4.10/4.0.6 jobs verified this head merged with current base c3fe427c6e9d9fad78acd23118b897ab0d6c5611; each passed 1,209 tests and 10,715 assertions. Current CI/budget statuses are green apart from expected skips, but runtime suites do not validate these policy transitions. No skill, code, tests or scans were executed locally. Final head/base/merge-base, author, open/non-draft status and mergeability were verified.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codex-maintenance Low-risk maintenance changes created by Codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants