Chores:
• Added a faster Cargo profiling build profile and disabled empty doctest targets to speed up Rust development loops.
• Hardened dependency and CI hygiene with fully qualified GitHub Action pins, a Dependabot cooldown, and a cargo-shear upgrade.
• Simplified internal surfaces by removing unused device-key APIs, extra skills roots, the remote thread-store implementation, and string-keyed MCP tool maps.
• Added configurable OpenTelemetry trace metadata and richer review/feedback analytics for better debugging and triage.
Chores:
• Linux releases now build, publish, bundle, and verify a standalone bwrap fallback for npm and DotSlash installs.
• Vendored Bubblewrap was updated to 0.11.2, including upstream security changes around setuid support.
• Windows Bazel CI now uses faster cross-compilation for tests, clippy, and release-build checks, and Bazel now runs sharded Rust integration tests.
• App-server and protocol internals were split and slimmed down, including transport extraction, protocol module decomposition, thread/message history moves, and tool-handler cleanup.
• 1 more...
Docs:
• Updated the bundled OpenAI Docs skill for GPT-5.5, gpt-image-2, and clearer upgrade guidance.
• Clarified contributor-facing docs, including the PR template, Rust async trait guidance, and README wording.
• Added a checked-in codex-core public API listing and a ThreadManager sample crate.
Chores:
• Published codex-app-server release artifacts, stopped publishing GNU Linux binaries, and increased release workflow timeouts.
• Added Codex-pinned versioning for the Python app-server SDK package.
• Deprecated --full-auto while steering users toward explicit permission profiles and trust flows.
• Stabilized CI and release plumbing with Bazel setup migration, release smoke-test pinning, and updated workflow pins/timeouts.