Codex resolved any unknown slug (incl. enso*) to the 272k unknown-model
fallback, silently capping Hanzo's flagship and triggering auto-compaction
at ~245k instead of ~900k. Add an explicit `enso` entry (context_window +
max_context_window = 1,000,000); longest-prefix match covers enso-1m/-ultra.
Verified: enso resolves to cw=1000000, auto_compact@900000.
Add a new `codex-reward-signals` crate and wire it into the TUI so the
Hanzo router gets production training feedback. Signals are content-free:
a response id, an enum, and (for ratings) a small integer — never any
prompt/response/file/code text.
Signals emitted:
- rating (1..3) on exit via a one-shot prompt; 0/Esc/Enter => dismiss
- regenerate on backtrack/re-run of a turn
- abandon on Ctrl+C interrupt mid-generation
The client POSTs {gateway_base}/v1/feedback with the same bearer token the
model client uses, fire-and-forget and silent on any failure. The exit
rating uses a bounded (<=1500ms) synchronous send since a detached task
would be killed on process exit. Gated to the Hanzo gateway; opt out via
HANZO_FEEDBACK=0|false|off or config `reward_signals = false`.
Response ids (previously discarded from ResponseEvent::Completed) are now
threaded through SamplingRequestResult -> turn state -> TurnCompleteEvent
-> app-server Turn.response_id -> ChatWidget.last_request_id.
Bumps hanzo-node to 0.6.53.
Co-authored-by: hanzo-dev <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Adversarial review fixes for the cloud-agent runner:
- Path traversal (CONFIRMED): `encode_segment` left `.`/`..` unescaped, so
`dev agent run ..` collapsed `/v1/agents/../run` to `/v1/run` via URL
normalization, sending the bearer to an unintended endpoint. Reject names
client-side against the server grammar (`validate_name`) before building any
URL; `encode_segment` stays as defense-in-depth. New `AgentsError::InvalidName`.
- Bearer-token exfiltration (CONFIRMED): CODEX_AGENTS_BASE_URL fed the live
hanzo.id JWT to any host. Restrict it to HTTPS hanzo.ai/*.hanzo.ai (plus
loopback for testing) via `validate_base_url`, mirroring
`validate_api_key_remote_host`. Closes userinfo/suffix-spoof bypasses.
- Unbounded response body (CONFIRMED): `.text()` had no cap. Read the body in
chunks with a 16 MiB ceiling; over-cap responses error instead of OOMing.
- --json exit code (CONFIRMED): a recorded error run exited 0 under --json.
Now prints the JSON record and still exits non-zero, matching the
human-readable path.
- 502-masquerade (REFUTED): required `id`/`status`/`model` already prevent
arbitrary JSON from decoding into an all-default Run; added a regression test.
Tests: agents-client 14/14, cli agent_cmd 3/3. `cargo clippy -D warnings`
clean for both crates. /v1 only, no dep changes.
Add `dev agent {list,run,show}` over the canonical `/v1/agents` registry
(cloud/clients/agents), reusing the signed-in hanzo.id session for auth.
- New crate `agents-client` mirrors `cloud-tasks-client`: wire types
(Agent/AgentDetail/Run matching the server contract), an `AgentsBackend`
trait, and a reqwest `HttpClient` that targets `{base}/v1/agents…`,
injects the bearer JWT via `codex_api::SharedAuthProvider`, and quotes
server errors honestly. A recorded error run (HTTP 502 with a Run body)
is surfaced as the Run, not swallowed as a bare status.
- New `cli/src/agent_cmd.rs` module wires the subcommand like the existing
`cloud` command: resolves base URL (default https://api.hanzo.ai,
override CODEX_AGENTS_BASE_URL) + AuthManager from the loaded Config,
fails secure when not signed in. `list`/`run`/`show`, each with `--json`;
`run` reads the prompt from an arg or stdin.
- Cloud-agent invocation is additive and orthogonal to the local
config-defined subprocess agents; no shared state.
Tests: 8 wiremock unit tests (list/get/run happy + recorded-error 502 +
503 server error + bearer header + path encoding). `cargo build`, `cargo
clippy -D warnings`, and `cargo test` are clean for the touched crates.
Bumps @hanzo/dev 0.6.91 -> 0.6.92 (patch) so a release can publish.
`dev login --device-auth` (default provider hanzo) now speaks standard
OAuth 2.0 Device Authorization Grant against Hanzo IAM, so headless/CLI
login works on hanzo.id / lux.id / zoolabs.id. Previously --device-auth
always used OpenAI's proprietary /api/accounts/deviceauth + PKCE scheme
(ignoring --provider), which Hanzo IAM does not serve — the genesis of
the "expected value at line 1 column 1" failure.
- oidc_device_auth.rs: brand-agnostic RFC 8628 flow. POST {issuer}/oauth/
device, then poll {issuer}/oauth/token with grant_type=device_code,
handling authorization_pending / slow_down (interval backoff) /
access_denied / expired_token. Both interval AND expires_in are clamped
(a hostile issuer can't overflow Instant+Duration or pin the poll).
Prefers verification_uri_complete. Persists via the same token store
the browser flow uses. Pure classify_poll() is unit-tested (8 tests).
- device-auth routes by provider: hanzo (default) -> RFC 8628; openai ->
the existing OpenAI device scheme (untouched); claude -> guidance.
- HANZO_CLIENT_ID hanzo-dev -> hanzo-app (hanzo-dev returns Invalid
client_id live; hanzo-app is the canonical <org>-app client). issuer/
client overridable via the experimental flags for lux-app/zoo-app.
Verified: cargo check (login+cli), clippy clean, 8 unit tests pass.
Fixes every test failure caused by the codex->dev rename + hanzo-default-provider
overlay, and the clearly-stale ones:
- cargo_bin(codex)->dev (29), help/usage assertions, doctest, doctor snapshot
- RUST_MIN_STACK=8MiB so cargo test matches nextest's main-thread stack
- exec harness DRY mock_server_config_overrides + resume (provider pin)
- cli_stream (5) provider-pin, guardian (3) HANZO_PROVIDER_ID
- tui status snapshots (20): the legit 'Model provider: Hanzo' line
- code_mode (1): the intended truncation warning
Verified via nextest: the fixed clusters are green. Remaining local failures are
provably env-bound to this WSL box (cwd/HOME/git-context/webrtc/network + exec
partial-stdout capture, ACTUAL_LEN=11980 vs 50000) and pass in CI's clean runner.
[skip ci]: the verifying fleet release is a deliberate workflow_dispatch.
truncate_code_mode_result intentionally prepends 'Warning: truncated output
(original token count: N)' (confirmed by the passing unit test
truncated_text_output_starts_with_warning); the printf-based integration
expectation predated it. The 5 python3-based code_mode tests fail only on this
box due to partial exec stdout capture (ACTUAL_LEN=11980 vs 50000 — the
documented skip_if_wine_exec class); they pass in CI's full-capture Linux.
- integration_creates_and_checks_session_file runs a SECOND (resume) command
that also set openai_base_url without a provider; pin model_provider=openai.
- status snapshots: several tests have multiple assert_snapshot! calls; insta
panics on the first, hiding later ones. Updated the chained snapshots (only the
legit 'Model provider: Hanzo' line; git diff verified no other drift).
The fork defaults to the hanzo provider, which breaks upstream tests that assume
openai. Fix the consolidation-adjacent + stale clusters:
- cli_stream (5): pin model_provider=openai in the 4 command builders that set
openai_base_url but no provider (PAT/ChatGPT + openai_base_url-routing tests
need the openai provider; the passing builders already pin a provider).
- guardian (3): the review records the configured provider id; expectation
OPENAI_PROVIDER_ID -> HANZO_PROVIDER_ID (the fork default).
- tui status snapshots (16): accept the legit new 'Model provider: Hanzo' line
the status card now renders. (Env-dependent project-name/paste-hint snapshots
left untouched.)
Verified via nextest: guardian 3/3 + cli_stream pass. Pre-existing code_mode
truncation-policy drift + env-bound-to-this-box failures are NOT addressed here.
codex's large async futures overflow cargo test's 2 MiB spawned-thread stacks
(SIGABRT in startup tests). nextest (.config/nextest.toml, used by CI) runs each
test in its own process on the 8 MiB main thread, so they pass there. Set
RUST_MIN_STACK=8 MiB for cargo-launched test processes to match. Additive:
nextest, the Windows /STACK link-arg, and the directly-executed shipped binary
are all unaffected.
After the bin rename (codex->dev) and the hanzo default provider, upstream tests broke:
- 29 cargo_bin("codex") -> cargo_bin("dev") (integration tests spawned a
non-existent `codex` binary).
- exec integration tests (28) reached the real api.hanzo.ai because the mock
harness only overrode openai_base_url while the default provider is hanzo.
Fix: ONE DRY helper mock_server_config_overrides() (sets openai_base_url AND
pins the openai provider), consumed by cmd_with_server AND the resume test
(which had duplicated the override inline — the actual cause of its failure).
- doctor insta snapshot prefix codex__ -> dev__ (snapshot name tracks the bin
crate name).
- core feedback_tags doctest: bind the example vars so it compiles.
- main.rs plugin-marketplace help assertions codex -> dev (bin_name is dev).
Full workspace: 4552 passed. The remaining agent-graph-store failures are sqlite
pool-acquire saturation under full-workspace parallelism (30s timeout exceeded
when 100+ test binaries hit /tmp sqlite at once); they pass in isolation. CI
bounds this with nextest.
Brings the develop-vs-ship split to an end. release.yml now builds & ships the
live codex-rs workspace (musl via prebuilt rusty_v8 artifacts), the frozen
hanzo-dev fork + 4 other parallel trees are deleted, the code-version crate is
ported so `dev --version` is real, and the binary is branded `dev`/Hanzo Dev.
[skip ci] is intentional: the first codex-rs-based fleet release (which builds
all platforms AND publishes @hanzo/dev to npm) is a deliberate ship decision,
triggered via workflow_dispatch — not auto-fired by this integration merge.
hanzo-dev was a 53-day-frozen diverged fork that release.yml shipped only
because codex-rs's v8 dep was believed to block musl. It doesn't — the prebuilt
rusty_v8 musl artifacts already exist (rust-release.yml uses them). So collapse
to the single canonical tree.
- Delete hanzo-dev/ (1416 paths). codex-rs has zero deps on it; its 'unique'
crates (zap/sse/backoff) aren't needed (codex-rs has its own upstream impls);
zt/zap zero-trust was feature-gated OFF in release builds so it never shipped
(external ~/work/hanzozt SDKs + docs unaffected; design notes kept in LLM.md).
- Repoint every remaining hanzo-dev build/path ref to codex-rs: workflows
(preview-build, issue-code, issue-comment), scripts (ci-tests.sh,
generate-homebrew-formula.sh, pre-release.sh, build-fast.sh, hanzo.sh,
hanzo-cli), code-sign actions, dependabot.yaml, merge-policy.json, docs.
- Port the dev-fast cargo profile into codex-rs/Cargo.toml (build-fast.sh /
pre-release.sh / release.yml preflight all use it).
- Delete obsolete hanzo-dev-only tooling (check-codex-path-deps.sh,
upstream-merge/diff-crates.sh) + repoint their callers.
- package.json/build-fast.sh build only --bin dev (codex-rs has no
dev-tui/dev-exec split bins).
Verified locally: codex-rs builds `dev` (Hanzo Dev header, CODE_VERSION-aware);
zero dangling source refs (only npm package names + Homebrew formula name kept).
codex-rs had no way to consume the CODE_VERSION the release CI injects, so
`dev --version` printed `codex-cli 0.0.0`. Port hanzo-dev's proven code-version
crate (build.rs reads CODE_VERSION env → rustc-env → option_env! const) as
codex-rs/code-version (package codex-version), wire codex-cli to it, and set clap
name/bin_name/usage/help to `dev` + header to `Hanzo Dev`.
Verified: CODE_VERSION=1.2.3 build → `dev --version` = `dev 1.2.3`; default → `dev 0.0.0`.
This is the only thing codex-rs needed from hanzo-dev before hanzo-dev is removed.
release.yml built the frozen hanzo-dev workspace because codex-rs's v8/code-mode
dep blocked musl static linking. But the musl rusty_v8 prebuilt artifacts already
exist and rust-release.yml already consumes them — so this was CI plumbing, not a
real blocker. Wire the same 'Configure musl rusty_v8 artifact overrides' step into
the @hanzo/dev release build and point every step (preflight build+test, binary
build, toolchain read, rust-cache, prefetch, smoke, package, timings) at codex-rs.
Releases now ship the live tree (codex-rs) instead of a 53-day-frozen snapshot.
The musl+v8 link needs one fleet CI run to validate end-to-end.
Removes the unambiguously-dead parallel trees (code-rs, codex-rs/tui2,
standalone-hanzo-dev, published-hanzo-dev) and 996 force-committed target/
build artifacts. codex-rs (canonical) and hanzo-dev (release) untouched.
target/ already gitignored so it won't recur.
One engine everywhere — hanzo-node can serve the same hanzo-server-core
(/v1/responses + /v1/messages + /v1/chat/completions) in-process alongside
gRPC. Default-off so the no-features build is unchanged.
Make hanzo-node natively serve the canonical Hanzo inference engine (OpenAI /
Anthropic / Responses HTTP API) in-process, alongside the existing gRPC server,
behind a new default-off `engine` Cargo feature. Purely additive: with the
feature off the node builds and behaves exactly as before.
- Cargo.toml: optional path-deps on hanzo-server-core (default-features=false)
and hanzo-engine; `engine` feature gating them; cuda/cudnn/metal/rocm/vulkan/
accelerate/mkl/nccl/flash-attn[-v3] features each forwarding to the matching
engine + server-core features (mirrors hanzo-server/Cargo.toml). default = [].
- .cargo/config.toml: rustflags target-cpu=native (engine's candle fork needs it).
- lib.rs: add EngineConfig (enabled/cpu/engine_api_addr default 0.0.0.0:36900, +
cfg-gated ModelSelected) to NodeConfig; cfg-gated hanzo_state on HanzoNode built
in new() via HanzoForServerBuilder; start() runs gRPC + axum engine API
concurrently (spawn + tokio::join!) when state is present, else unchanged.
All engine code is #[cfg(feature = "engine")]; errors map to crate::Error,
no unwrap/expect.
- bin: --engine-port/HANZO_ENGINE_ADDR, --model/HANZO_ENGINE_MODEL, --engine-cpu;
logs the engine URL on startup.
Validation (CPU box, GPU-blocked, no weights):
- cargo check -p hanzo-node (no features): pass, 0 warnings.
- cargo check -p hanzo-node --features engine: pass; warnings only from upstream
hanzo-engine/hanzo-server-core, none from hanzo-node.
GPU feature graphs (cuda/rocm/metal/...) resolve via cargo metadata but are not
compiled here (no GPU toolchains).
Removes four redundant, unreferenced trees verified as not wired into any
Cargo workspace, CI workflow, justfile, bazel build, or build-fast.sh.
Workspaces still resolve after removal (cargo metadata --no-deps --locked
exit 0 for both: codex-rs = 127 members, hanzo-dev = 47 members).
Removed (1878 files, ~175 MB reclaimed):
- published-hanzo-dev/ single-crate dead copy (pkg "dev"); 1000 files,
~166 MB (a committed build target/ dir). 0 refs.
- standalone-hanzo-dev/ single-crate dead copy (pkg "dev"); 3 files, ~28 KB.
0 refs.
- code-rs/ stale partial checkout: 80 files, ~2.6 MB, NO
Cargo.toml anywhere (not a buildable workspace),
no .git. Not a path-dep/member of anything.
- codex-rs/tui2/ prototype crate "codex-tui2"; 795 files, ~6.1 MB.
NOT in codex-rs/Cargo.toml [workspace] members and
nothing depends on codex-tui2/codex_tui2.
Verified-but-KEPT (NOT deleted):
- hanzo-dev/core/*_prompt.md duplicates: although byte-identical to the
codex-rs/core copies, hanzo-dev/core/src/model_family.rs embeds all 6
via include_str!("../<file>.md") at compile time, so deleting them would
break the hanzo-dev build. Left in place per the verify-then-delete rule.
Out of scope / untouched: codex-rs and hanzo-dev source crates, login,
providers, and the unrelated in-progress hanzo-node/rust/ engine changes.
hanzo-desktop's embedded_engine serves an OpenAI-compatible API on
localhost:36900 (/v1/chat/completions,/v1/embeddings,/v1/models). Point the
`node` provider there by default so `dev -c model_provider=node` taps the
desktop's running node out of the box; HANZO_NODE_URL overrides for remote
Hanzo/Lux/Zoo nodes. Standalone `hanzo serve` (:1234) remains `hanzo-local`.
Co-authored-by: Hanzo Dev <[email protected]>
Migrate every release.yml job from GitHub-hosted runners (ubuntu-latest/macos-14/
windows-latest) to the self-hosted Hanzo fleet labels ([self-hosted, linux|macos|
windows, amd64|arm64]; topology in hanzoai/universe infra/runners). Build payload
unchanged (frozen hanzo-dev) — this restores the publish pipe off GitHub billing
first; codex-rs cutover ships separately via the @next dist-tag.
Co-authored-by: Hanzo Dev <[email protected]>
`dev -c model_provider=node` targets a local node (localhost:1234) or any node
via HANZO_NODE_URL (e.g. a Lux or Zoo node). Same OpenAI-compatible serve API.
Co-authored-by: Hanzo Dev <[email protected]>
hanzo engine (`hanzo serve`) / hanzo-node expose an OpenAI-compatible API on
http://localhost:1234/v1 (and Anthropic /v1/messages with Claude Code harness
support). Add a built-in 'hanzo-local' provider pointing there so `dev` can use
local Hanzo inference natively: `dev -c model_provider=hanzo-local`.
Cloud default stays 'hanzo' (api.hanzo.ai).
Co-authored-by: Hanzo Dev <[email protected]>
The device-code flow hit OpenAI-shaped endpoints (/api/accounts/deviceauth/*)
that hanzo.id (Casdoor) does not serve. Fix: hanzo login now uses the browser
PKCE flow with issuer https://hanzo.id/v1/iam, so authorize/token resolve to
https://hanzo.id/v1/iam/oauth/{authorize,token} (verified vs hanzo.id OIDC
discovery). Verified the emitted authorize URL is correct.
Co-authored-by: Hanzo Dev <[email protected]>
linux-sandbox/build.rs compiles bubblewrap from codex-rs/vendor/bubblewrap on
Linux. Vendor it in-tree (LGPL-2.0+) so local and CI release builds are
self-contained (CI already installs libcap-dev + node22). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Old main (broken merge, does not build) is retained in history via this merge's
second parent and on backup/broken-merge-main-20260616. This tree is the working,
tested pre-merge baseline + Hanzo overlay (api.hanzo.ai default, auth fixes,
schema/bin-name test fixes). Upstream-latest re-port tracked separately.
- Add built-in 'hanzo' model provider (api.hanzo.ai/v1, Responses wire API,
HTTP transport) and make it the default model_provider_id. Auth flows through
the auth layer (Hanzo IAM OAuth from `dev login`, or HANZO_API_KEY/CODEX_API_KEY),
mirroring the OpenAI provider so managed-auth tests keep working.
- Live-verified: `dev exec` now targets api.hanzo.ai/v1/responses (was api.openai.com).
- Fix token refresh: persist_tokens no longer aborts when a refresh response
omits a parseable id_token; keeps existing claims, applies new access/refresh.
- core lib: 1631 passed / 0 failed.
Co-authored-by: Hanzo Dev <[email protected]>
- Regenerated schema fixtures to include Hanzo/Claude/OpenAI LoginAccount auth
params (json + typescript) so schema_fixtures tests pass.
- Updated 10 test files: cargo_bin("codex") -> cargo_bin("dev") to match the
renamed binary, fixing all CLI integration tests that shell out.
Co-authored-by: Hanzo Dev <[email protected]>
Working pre-merge baseline build of the dev CLI. hanzo.id-default login
(--provider hanzo|openai|claude, --with-api-key) intact. Build setup on
Linux: vendor bubblewrap into codex-rs/vendor + libcap-dev (see memory).
Co-authored-by: Hanzo Dev <[email protected]>
@zap-proto/zap moved from the old MCP-misnamed Cap'n Proto package to
the native ZAP wire runtime, and rejoined the 1.x line at 1.1.0. The
new canonical surface has a single root export (builder, client/
ZapClient, envelope, pipeline, view, wire) and NO ./protocol, ./transport,
or ./rpc subpaths — and no Client/Server/BatchClient/MessageType symbols.
The wrapper's prior src (protocol/transport/rpc/client/server/types/error
re-exporting those now-nonexistent symbols and subpaths) no longer
compiles against it. Collapse the wrapper to its honest shape: a single
`export * from "@zap-proto/zap"` root re-export. ZapClient flows through
natively, so the old `Client as ZapClient` alias is dropped (it aliased
a symbol the canonical package no longer exports; ZapClient is now the
canonical name).
- dep: @zap-proto/zap ^1.0.0 -> ^1.1.0
- version: 1.0.0 -> 1.1.0 (minor; matches the underlying line, no major break)
- build: single-entry tsup (drop the dead multi-entry subpath build)
- exports: drop ./protocol ./transport ./rpc (canonical has no such subpaths)
- repository.directory: correct to hanzo-dev/zap/sdk/typescript
- test: --passWithNoTests (pure re-export; nothing of its own to test)
Reverts violations of the durable rule that current-state docs belong
in LLM.md and history belongs in git log. Removed files were session
handoffs, agent-style "complete success" / "1000%" reports, dated
audit dumps, and stub NOTES.
## Why
Codex Review now supports repository-specific review rules in AGENTS.md.
Adding the review prompts there makes the guidance available as
repository review rules next to the code it governs while keeping the
existing local review skills intact.
## What changed
- Added a `## Code Review Rules` section to `AGENTS.md` with the
existing review prompts for model context, breaking changes, test
authoring, and change size.
- Preserved the existing `.codex/skills/code-review*` skill files.
## Verification
- `git diff --check origin/main...HEAD`
## Why
The root formatting entrypoints could drift: `just fmt` did not format
the Justfile itself, and the CI-facing check recipe only checked Python
scripts instead of matching everything formatted by `just fmt`.
## What changed
- Add a shared cross-platform Python formatter driver used by both `just
fmt` and `just fmt-check`.
- Run Justfile, Rust, Python SDK, and internal-script formatter groups
concurrently while buffering each formatter group's output until it
finishes.
- Log formatter starts immediately, then print each formatter group's
labeled output when it completes.
- Keep the SDK lint-fix and Ruff formatting passes ordered, with source
comments explaining their distinct roles and the check-mode equivalents.
- Run Ruff through shared `uv run --no-sync --with ruff` overlays so
formatting works on clean glibc Linux checkouts without installing the
platform-specific SDK runtime wheel.
- Show `fmt-check` help text in `just -l` and simplify CI to call the
shared driver through `just fmt-check`.
- Pin the general CI workflow to `[email protected].0` so its formatter agrees
with the checked-in Justfile.
- Add regression coverage for the thin Just recipes and the driver's
formatter graph.
## Validation
- `just fmt`
- `just fmt-check`
- `python3 -m pytest
sdk/python/tests/test_artifact_workflow_and_binaries.py -k 'root_fmt or
root_format' -q`
- `pnpm run format`
- `git diff --check`
- `just -l | rg -n '^ fmt|fmt-check'`
- `uvx --from uv==0.7.22 uv run --frozen --project sdk/python --no-sync
--with ruff ruff check --diff sdk/python`
## Why
Remote control enrollment authorizes a desktop server, but app-server v2
did not expose the follow-up pairing operation needed to mint a
short-lived controller pairing artifact from that enrolled server.
Clients need a narrow RPC that starts pairing without exposing the
backend `serverId` or conflating pairing with websocket connection
state.
Issue: N/A; internal remote-control pairing API change.
## What Changed
Added experimental app-server v2 `remoteControl/pairing/start` with
`manualCode` input and `pairingCode`, nullable `manualPairingCode`,
`environmentId`, and Unix-seconds `expiresAt` output. The method
serializes under its own `global("remote-control-pairing")` scope and is
documented in `app-server/README.md`.
Extended the remote-control transport with private `/server/pair`
request/response types and normalized `pair_url` handling. Pairing uses
the current enrolled server bearer, refreshes that bearer when needed,
keeps backend `server_id` private, validates returned `server_id` and
`environment_id` against the current enrollment, and preserves backend
status/header/body context for failures and malformed responses.
Wired the request through `RemoteControlRequestProcessor` and
`MessageProcessor`, mapping unavailable/disabled pairing to
`invalid_request` and backend failures to internal errors.
## Verification
- `just test -p codex-app-server-transport`
- `just test -p codex-app-server
remote_control_pairing_start_returns_pairing_artifacts`
## Summary
- Moves the existing `codex-cloud-requirements` crate to
`codex-cloud-config`.
- Updates workspace dependencies and imports to the new crate name.
- Intentionally keeps runtime behavior unchanged: this still fetches the
legacy cloud requirements endpoint.
## Details
This PR exists to make the lineage obvious before the bundle migration.
GitHub should show the old `codex-rs/cloud-requirements/src/lib.rs`
implementation as moved to `codex-rs/cloud-config/src/lib.rs`, rather
than as unrelated new code.
The follow-up PR adapts this moved crate to the new config bundle API
and switches runtime consumers over.
zeekay
