adr: Codex subscription support

[moeadham]

high level request for codex subscription support

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rajpratham1]

The proposal raises a useful feature request—supporting ChatGPT/Codex subscription credentials instead of requiring an OpenAI API key—but the document is not sufficient as an ADR and lacks the architectural details needed for review.

What is good
Identifies a genuine usability gap:
QM currently accepts OpenAI API keys.
Users with ChatGPT/Codex subscriptions cannot easily reuse their existing authentication.
References the official OpenAI documentation as motivation.
Demonstrates that the author has implemented a proof of concept in their fork.
Blocking issues

1. This is a feature request, not an Architecture Decision Record

An ADR should explain:

Context
Decision
Alternatives
Consequences

Instead, this document contains:

current limitation
suggested implementation
link to a fork

There is no architectural decision being documented.

2. Missing security analysis

The proposal says users should:

import their valid auth.json

but does not discuss:

where this file is stored,
how it is protected,
whether credentials are encrypted at rest,
whether refresh tokens are persisted,
how logout works,
how credential revocation works.

Since this involves authentication, these are essential considerations.

3. No explanation of integration

The proposal mentions:

small changes are also needed

without describing:

which authentication layer changes,
whether the provider abstraction changes,
whether Codex models become another provider,
whether existing API-key authentication continues to work unchanged.
4. External fork is not a substitute for design

The document points reviewers to a GitHub commit for inspiration, but ADRs should be self-contained. Reviewers should not need to inspect an external implementation to understand the proposed architecture.

Recommendation

Expand this into a proper ADR that includes:

Context: current authentication model and why ChatGPT subscription credentials are unsupported.
Decision: how auth.json will be imported and used.
Security considerations: storage, encryption, revocation, refresh behavior, and user consent.
Alternatives considered: API keys only, browser-based login flow, device flow, manual credential import, etc.
Consequences: compatibility, maintenance burden, and impact on existing users.

[moeadham]

so if I understand correctly, you are asking for ADR's to be human written, but they are reviewed by AI, and the AI Is asking for the ADR to be extremely verbose?