build(deps): update Codex CLI and review provenance

.github/workflows/cluster-batch.yml

@@ -194,7 +194,7 @@ jobs:
       CLOWNFISH_CODEX_TIMEOUT_MS: ${{ vars.CLOWNFISH_CODEX_TIMEOUT_MS || '1800000' }}
       CLOWNFISH_CODEX_REASONING_EFFORT: ${{ vars.CLOWNFISH_CODEX_REASONING_EFFORT || 'medium' }}
       CLOWNFISH_MODEL: ${{ needs.prepare.outputs.model }}
-      CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.125.0' }}
+      CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.156.1' }}
       OPENCLAW_LOCAL_CHECK: "0"
     steps:
       - uses: actions/checkout@v7

.github/workflows/cluster-worker.yml

@@ -286,7 +286,7 @@ jobs:
       CLOWNFISH_REVIEW_TIMEOUT_MS: ${{ vars.CLOWNFISH_REVIEW_TIMEOUT_MS || '600000' }}
       CLOWNFISH_CODEX_REASONING_EFFORT: ${{ vars.CLOWNFISH_CODEX_REASONING_EFFORT || 'medium' }}
       CLOWNFISH_MODEL: ${{ needs.prepare.outputs.model }}
-      CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.125.0' }}
+      CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.156.1' }}
       OPENCLAW_LOCAL_CHECK: "0"
     steps:
       - uses: actions/checkout@v7
@@ -480,7 +480,7 @@ jobs:
       CLOWNFISH_GIT_USER_NAME: ${{ vars.CLOWNFISH_GIT_USER_NAME || 'projectclownfish' }}
       CLOWNFISH_GIT_USER_EMAIL: ${{ vars.CLOWNFISH_GIT_USER_EMAIL || 'projectclownfish@users.noreply.github.com' }}
       CLOWNFISH_APP_ID: ${{ vars.CLOWNFISH_APP_ID }}
-      CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.125.0' }}
+      CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.156.1' }}
       OPENCLAW_LOCAL_CHECK: "0"
       CLOWNFISH_READ_GH_TOKEN: ${{ github.token }}
     steps:

.github/workflows/commit-finding-intake.yml

@@ -41,7 +41,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.125.0' }}
+  CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.156.1' }}
   CLOWNFISH_ALLOWED_OWNER: ${{ vars.CLOWNFISH_ALLOWED_OWNER || 'openclaw' }}
   CLOWNFISH_ALLOW_EXECUTE: ${{ vars.CLOWNFISH_ALLOW_EXECUTE == '1' && '1' || '0' }}
   CLOWNFISH_ALLOW_FIX_PR: ${{ vars.CLOWNFISH_ALLOW_FIX_PR == '1' && '1' || '0' }}

.github/workflows/external-merge-preflight.yml

@@ -64,13 +64,13 @@ jobs:
           path: |
             ~/.npm
             ~/.projectclownfish/codex
-          key: ${{ runner.os }}-node24-codex-${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.125.0' }}-v1
+          key: ${{ runner.os }}-node24-codex-${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.156.1' }}-v1
           restore-keys: |
             ${{ runner.os }}-node24-codex-
 
       - name: Install Codex CLI
         env:
-          CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.125.0' }}
+          CODEX_CLI_VERSION: ${{ vars.CLOWNFISH_CODEX_CLI_VERSION || '0.156.1' }}
         run: |
           set -euo pipefail
           npm config set prefix "$HOME/.projectclownfish/codex"

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Update worker and external-review Codex CLI to 0.156.1, with matching pinned source provenance.
 - Keep nested backlog helpers within outer cancellation and preserve uncertain dispatch ledgers through workflow failures and replay.
 - Remove executor-created temporary workspaces after reporting, including blocked and failed exits, while preserving operator work directories. Thanks @SebTardif (#327).
 - Clean up requeue artifact downloads on success and failure, and terminate stalled downloads with a configurable deadline. Thanks @SebTardif (#320, #322).

README.md

@@ -299,7 +299,7 @@ replies and dispatch workers.
 
 ## Local Run
 
-Requires Node 24.
+Requires Node 24. External merge preflight requires `codex-cli 0.156.1` and verifies its pinned upstream source before accepting review evidence.
 
 ```bash
 # Validate all job files.

scripts/codex-review-dependency.mjs

@@ -1,10 +1,10 @@
 import fs from "node:fs";
 import path from "node:path";
 export const CODEX_REVIEW_DEPENDENCY = {
-  repo: "openclaw/openclaw", version: "codex-cli 0.125.0",
-  url: "https://github.com/openai/codex.git", tag: "rust-v0.125.0",
-  tagObject: "7d8152a5d74226ddaac12f93f7c5ed3f33a60d2a",
-  commit: "637f7dd6d737f3961e6bf32fbb3861c4953269c5",
+  repo: "openclaw/openclaw", version: "codex-cli 0.156.1",
+  url: "https://github.com/openai/codex.git", tag: "rust-v0.156.1",
+  tagObject: "81e8e29b2956dfe9b092c63953a9ed282781e77c",
+  commit: "b412ff32c417f855c2b2d1581b77058eed87c84b",
   files: ["AGENTS.md", "codex-rs/core/src/lib.rs", "codex-rs/protocol/src/protocol.rs", "codex-rs/exec/src/main.rs"],
 };
 const PROVENANCE_PREFIX = "Codex dependency provenance: ";

test/apply-result.test.mjs

@@ -1945,7 +1945,7 @@ test("apply-result rejects an already-merged replay with invalid review policy",
 for (const [name, evidence] of [
   ["missing", ["Codex /review returned clean"]],
   ["tuple-only", [`Codex dependency provenance: ${JSON.stringify(CODEX_REVIEW_PROVENANCE)}`]],
-  ["tampered", [codexReviewProvenanceEvidence(codexCitation).replace("637f7d", "000000")]],
+  ["tampered", [codexReviewProvenanceEvidence(codexCitation).replace(CODEX_REVIEW_PROVENANCE.commit, "0".repeat(40))]],
 ]) {
   test(`apply-result rejects ${name} OpenClaw Codex provenance before mutation`, () => {
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "clownfish-apply-"));

test/preflight-external-pr-merge.test.mjs

@@ -534,9 +534,10 @@ test("external merge preflight binds OpenClaw review to pinned Codex source", ()
   assert.match(prompt, /\.\.\/codex\/codex-rs\/\.\.\.:<line>/);
   assert.equal(Number(fs.readFileSync(fixture.codexVersionCountPath, "utf8")), 1);
   assert.equal(Number(fs.readFileSync(fixture.codexCloneCountPath, "utf8")), 1);
-  assert.match(
-    fs.readFileSync(fixture.gitCommandsPath, "utf8"),
-    /clone --depth 1 --branch rust-v0\.125\.0 --single-branch https:\/\/github\.com\/openai\/codex\.git /,
+  assert.ok(
+    fs.readFileSync(fixture.gitCommandsPath, "utf8").split("\n").some((command) =>
+      command.startsWith(`clone --depth 1 --branch ${codexDependency.tag} --single-branch ${codexDependency.url} `),
+    ),
   );
   assert.deepEqual(JSON.parse(fs.readFileSync(fixture.codexDependencyEnvPath, "utf8")), {
     allowProtocol: "https",
@@ -578,7 +579,7 @@ test("external merge preflight isolates dependency bootstrap from hostile Git co
 });
 
 for (const [name, options, reason] of [
-  ["malformed version", { codexVersion: "Codex 0.125.0" }, /unsupported Codex version/],
+  ["malformed version", { codexVersion: CODEX_REVIEW_DEPENDENCY.version.replace("codex-cli", "Codex") }, /unsupported Codex version/],
   ["mismatched version", { codexVersion: "codex-cli 0.126.0" }, /unsupported Codex version/],
   ["clone failure", { codexCloneFailure: "fixture clone failure" }, /fixture clone failure/],
   ["lightweight tag", { codexTagType: "commit" }, /tag is not annotated/],
@@ -704,7 +705,7 @@ test("OpenClaw Codex provenance accepts only one exact canonical record", () =>
     ["zero line", [`${prefix}${JSON.stringify({ ...parsed, line: 0 })}`], /citation/],
     ["noninteger line", [`${prefix}${JSON.stringify({ ...parsed, line: 1.5 })}`], /citation/],
     ["noncanonical serialization", [`${prefix}${JSON.stringify(parsed, null, 2)}`], /not canonical/],
-    ["tuple mismatch", [canonical.replace("0.125.0", "0.126.0")], /does not match/],
+    ["tuple mismatch", [canonical.replace(CODEX_REVIEW_DEPENDENCY.version, "codex-cli 0.0.0")], /does not match/],
   ]) {
     assert.match(validateCodexReviewProvenance("openclaw/openclaw", evidence), reason, name);
   }
@@ -5717,7 +5718,7 @@ if (args[0] === "clone" && dependencyCommand) {
 if (dependencyCommand) {
   if (args[0] === "remote" && args[1] === "get-url") console.log("https://github.com/openai/codex.git");
   else if (args[0] === "cat-file" && args[1] === "-t") console.log(${JSON.stringify(codexTagType)});
-  else if (args[0] === "rev-parse" && args[1] === "refs/tags/rust-v0.125.0") console.log(${JSON.stringify(codexTagObject)});
+  else if (args[0] === "rev-parse" && args[1] === ${JSON.stringify(`refs/tags/${CODEX_REVIEW_DEPENDENCY.tag}`)}) console.log(${JSON.stringify(codexTagObject)});
   else if (args[0] === "rev-parse") console.log(${JSON.stringify(codexCommitSha)});
   else if (args[0] === "status" && args[1] === "--porcelain") {
     const source = path.join(dependencyDir, "codex-rs", "exec", "src", "main.rs");

test/review-results.test.mjs

@@ -531,7 +531,7 @@ test("review-results accepts a blocked external preflight request for calibrated
 for (const [name, evidence] of [
   ["missing", ["Codex /review returned clean."]],
   ["tuple-only", [`Codex dependency provenance: ${JSON.stringify(CODEX_REVIEW_PROVENANCE)}`]],
-  ["tampered", [codexReviewProvenanceEvidence(codexCitation).replace("0.125.0", "0.126.0")]],
+  ["tampered", [codexReviewProvenanceEvidence(codexCitation).replace(CODEX_REVIEW_PROVENANCE.version, "codex-cli 0.0.0")]],
 ]) {
   test(`review-results rejects ${name} OpenClaw Codex provenance`, () => {
     const head = "7".repeat(40);