fix: decide the Codex session value for the doctor engine-floor test

[orveth]

main does not compile. cargo test -p maxplayer fails at crates/maxplayer/src/doctor.rs:2796 with error[E0063]: missing field codex_chatgpt in initializer of SandboxConfig. This adds the field, with its reasoning, and nothing else.

Why main is red

a2b9403f ("feat: read Codex ChatGPT sessions on the host") added codex_chatgpt to SandboxConfig. That struct has two longhand initializers in the workspace that do not use ..Default::default(). The commit updated one and missed the other, because they live in different crates:

• crates/maxplayer-core/tests/sandbox_netns_live.rs — updated in the commit itself, a +1/−0 change setting codex_chatgpt: None.
• crates/maxplayer/src/doctor.rs — not in the commit at all. Its four files are codex_subscription.rs, home.rs, lib.rs, and sandbox_netns_live.rs; a filter for doctor over that commit's file list returns empty while the others return patches.

So this is an incomplete enumeration of literals, not an open question.

One field is enough, and that is measured rather than assumed. A repo-wide classification at c2bb4cae finds exactly two longhand SandboxConfig literals — every other construction site uses ..Default::default() or a struct-update base:

LONGHAND  has-field       crates/maxplayer-core/tests/sandbox_netns_live.rs:524
LONGHAND  MISSING-FIELD   crates/maxplayer/src/doctor.rs:2796

This matters because the compiler stops at the first failing crate, so a longhand literal in a crate that never got built would stay invisible behind this one. There is none. (Bound: that is a text classifier over the SandboxConfig { literal form in *.rs at one commit, not the compiler — a macro-generated or builder-constructed initializer would not match it.)

⚠ And a trap for anyone re-checking that scope the same way: classifying a block as safe because it contains ..Default::default() false-clears this exact literal. The tripwire comment three lines up contains that string verbatim — "Written out rather than ..Default::default() so that adding another sandbox field breaks this test" — so a text probe reads the mention of the construct as the construct and scores the one longhand literal as shorthand. It fails in the reassuring direction. Strip comments before classifying, and keep doctor.rs:2796 as a positive control that must come back LONGHAND.

Why None, and why the comment goes in with it

The literal is written longhand deliberately. Its own note, three lines above the change:

This check is about the engine floor, not egress… Written out rather than ..Default::default() so that adding another sandbox field breaks this test and makes someone decide what it should be here.

The same tripwire already fired once in this literal and was answered in place, for file_credentials:

Decision for this test, per the note above: none. It asserts the engine-version floor, and a file-sourced credential is a containment concern that would only add a second reason for the check to move.

codex_chatgpt is that same class. It is Option<CodexChatgptConfig> under [sandbox.*], naming a host auth.json that the per-job proxy reads so a contained run can use a host ChatGPT session; the field's own doc states that absent means existing auth behaviour is unchanged. The prior rationale covers it without extension, so this change copies that answer's form as well as its value and records the reasoning beside the field.

That is deliberate. This test's only assertion is that build_checks runs a check named "sandbox engine floor" — no field value in the literal is observable by it. The tripwire is therefore a prompt, not a check: it cannot distinguish "someone decided" from "someone made it compile," because both produce the identical green and the identical bytes. The inline note is the only artifact that survives to tell them apart, and it is what let the precedent answer this question from the file rather than from a person. The next sandbox field will fire this again; it compounds if each answer writes its reasoning down and merely repeats if one is typed bare.

Evidence

Red before, on unmodified main. A detached checkout of c2bb4cae with no PR involved: cargo test -p maxplayer --locked --no-run → rc=101, E0063 at doctor.rs:2796. Independently corroborated by PR #907, whose two failing rows — Build & test (acp) and Build & test (default features) — both report the same error at doctor.rs:2796:36, a file outside that PR's diff.

Green after. cargo test -p maxplayer --locked --no-run on this branch, run under nix develop so the toolchain is the flake's: rc=0, finished in 4m22s, emitting four test executables (maxplayer, cli_e2e, mcp_daemon, seller_declared_output). Zero E0063, zero could not compile. The rc is read from inside the log rather than from the wrapper's exit status.

⚠ Worth stating because it nearly fooled me: my first attempt to reproduce the red returned exactly the rc=101 I predicted — but for the wrong reason. It died on linker 'cc' not found in dependency build scripts and never compiled maxplayer at all. An expected failure arriving for an unexpected reason is the most convincing false confirmation available, because it agrees with the hypothesis and nothing prompts you to read further. That is why the red-before evidence above is cited from three sources that did reach the compiler, and not from my own first run.

The change is 3 added lines in 1 file: one field and its two-line note.

Scope and one caveat stated plainly

This fixes the compile only. It makes no claim about runtime containment behaviour, and it changes no shipped default — codex_chatgpt is #[serde(default)] and absent already meant None.

⚠ The sibling literal cited above as precedent lives in a test that is #[ignore]d and gated #![cfg(all(acp, wallet))], and has never been executed. So "the author wrote None" is authorial intent and is solid; "None was observed to contain" is not established by it. That distinction does not affect this change — the test touched here never launches a container and cannot observe the field — but it should not be carried elsewhere as if the value had been exercised.

Unblocks #900, #890 and #907, all of which are red or held on this one line.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mobee	Ready	Preview	Aug 25, 2026 7:26pm