chore: release v1.25.0-beta.8

[Soju06]

Summary

• Prepares beta release v1.25.0-beta.8 for the 1.25.0 stable train.
• Updates release-managed version files only; release-please remains the stable release owner.
• Merging this PR will publish v1.25.0-beta.8 only after the release-candidate validation checklist below is completed for this exact candidate SHA.
• Synced automatically from release-please PR chore(main): release 1.25.0 #1922; no manual beta workflow dispatch is required.

Changes since v1.25.0-beta.7

• fix(db): retry the startup sentinel seed on SQLite lock contention and name the lock error (fix(db): retry the startup sentinel seed on SQLite lock contention and name the lock error #2339) (
  1f3428)
• perf(bridge): resolve the prewarm snapshot only for eligible payloads (perf(bridge): resolve the prewarm snapshot only for eligible payloads #2340) (
  c52941)
• feat(settings): manage the bridge operation spool retention from the dashboard (feat(settings): manage the bridge operation spool retention from the dashboard #2337) (
  6d11e5)
• feat(auth)!: add resource-scoped dashboard permission vocabulary (feat(auth)!: add resource-scoped dashboard permission vocabulary #2196) (

• feat(auth): restrict guest-visible sensitive surfaces and make guest sessions revocable (feat(auth): restrict guest-visible sensitive surfaces and make guest sessions revocable #2201) (
  d6a7ca)
• feat(dashboard): hide restricted surfaces from read-only guests (feat(dashboard): hide restricted surfaces from read-only guests #2203) (
  478e96)
• feat(auth): reject cross-site dashboard mutations and start the client least-privilege (feat(auth): reject cross-site dashboard mutations and start the client least-privilege #2204) (
  e04005)
• feat(auth): add dashboard role rows with code-defined preset grants (feat(auth): add dashboard role rows with code-defined preset grants #2217) (
  08f963)
• feat(auth): add dashboard user tables and migrate the shared admin into a user (feat(auth): add dashboard user tables and migrate the shared admin into a user #2218) (
  195b33)
• feat(auth): make dashboard users the source of truth for login and sessions (feat(auth): make dashboard users the source of truth for login and sessions #2223) (
  9cfce7)
• feat(audit): record the acting account, target and severity on audit rows (feat(audit): record the acting account, target and severity on audit rows #2225) (
  8e5760)
• feat(users): add account management, invite links and the roles read API (feat(users): add account management, invite links and the roles read API #2226) (

• feat(frontend): tier the login form and header by account facts, add the invite route (feat(frontend): tier the login form and header by account facts, add the invite route #2237) (
  04a309)
• feat(frontend): fold the auth cards into one Access card that grows with the team (feat(frontend): fold the auth cards into one Access card that grows with the team #2251) (
  53253c)
• feat(auth): enable the operator and viewer presets end to end, require TOTP for admin-level accounts (feat(auth): enable the operator and viewer presets end to end, require TOTP for admin-level accounts #2328) (
  aa75e1)
• feat(auth): resolve trusted-header identities to accounts through sign-in providers (feat(auth): resolve trusted-header identities to accounts through sign-in providers #2331) (
  94fb4d)
• feat(auth): re-verify a credential before sensitive dashboard changes (feat(auth): re-verify a credential before sensitive dashboard changes #2334) (
  c9d544)
• feat(auth): map identity-provider groups to roles and add the organisation settings group (feat(auth): map identity-provider groups to roles and add the organisation settings group #2358) (
  4096c1)
• fix(overflow): keep a delivered source turn anchored before the first content frame (fix(overflow): keep a delivered source turn anchored before the first content frame (#2123) #2354) (
  9368d4)
• feat(dashboard): surface subscription-overflow attribution in the request log and dashboard (feat(proxy): subscription-exhaustion fallback to an OpenAI-compatible Model Source (design-first, supersedes #1664) #2123 WP-G) (feat(dashboard): surface subscription-overflow attribution in the request log and dashboard (#2123 WP-G) #2355) (
  21eedb)
• feat(proxy): persist hashed affinity decisions on request logs (feat(proxy): persist hashed affinity decisions on request logs #2352) (
  e32f85)
• fix(proxy): retire a denied proxy-injected WebSocket anchor instead of re-injecting it (fix(proxy): retire a denied proxy-injected WebSocket anchor instead of re-injecting it #2248) (
  6b3d03)
• fix(images): select compatible host for images and probes (fix(images): select compatible host for images and probes #2320) (
  92c7f6)
• fix(http-bridge): reuse reservation during local recovery (fix(http-bridge): reuse reservations after owner rejection #2353) (
  98d225)
• fix(proxy): bound aggregate detached retirement lock waits (fix(proxy): bound aggregate detached retirement lock waits #2315) (
  09b8e8)
• fix(db): merge the pin-index and affinity alembic heads (fix(db): merge the pin-index and affinity alembic heads #2368) (
  53f968)
• fix(balancer): count bare server_error terminals toward overload backoff (fix(balancer): count bare server_error terminals toward overload backoff #2360) (
  7f7929)
• fix(proxy): route anonymous output frames to the created response (fix(proxy): route anonymous output frames to the created response #2357) (
  976d20)
• fix(accounts): let the deletion scheduler exit its wait promptly (fix(accounts): let the deletion scheduler exit its wait promptly #2362) (
  c62bdd)
• revert(bridge): restore the recovery-dispatch claim and its fence (revert(bridge): restore the recovery-dispatch claim and its fence #2383) (
  a096b6)
• fix(proxy): fork model-transition owner conflicts (fix(proxy): fork model-transition owner conflicts #2083) (
  9db05a)
• fix(proxy): narrow the input-image upstream transport pin (fix(proxy): narrow the input-image upstream transport pin #2386) (
  cb21da)
• fix(proxy): deliver the denied-anchor refusal to native clients (fix(proxy): deliver the denied-anchor refusal to native clients #2387) (
  b04b27)
• fix(balancer): stop waiting on a hard affinity owner the caller excluded (fix(balancer): stop waiting on a hard affinity owner the caller excluded #2381) (
  2c8539)
• fix(http-bridge): bound terminal spool writes (fix(http-bridge): bound terminal spool writes #1997) (
  3d9027)
• feat(auth): gate local password sign-in behind a policy and protect break-glass access (feat(auth): gate local password sign-in behind a policy and protect break-glass access #2385) (

• fix(observability): derive sticky_key_source once, from the resolved policy (fix(observability): derive sticky_key_source once, from the resolved policy #2375) (
  cc25f2)
• fix(proxy): anchor unanchored HTTP threads to a stable cache key (fix(proxy): anchor unanchored HTTP threads to a stable cache key #2367) (
  ef7010)
• feat(dashboard): surface thread identity and cache locality metrics (feat(dashboard): surface thread identity and cache locality metrics #2378) (
  b36e5a)
• feat(dashboard): add a cross-account prompt cache isolation probe (feat(dashboard): add a cross-account prompt cache isolation probe #2372) (

• fix(proxy): attribute refused cross-account continuity replays (fix(proxy): attribute refused cross-account continuity replays #2384) (
  63314a)
• fix(proxy): retire durably unroutable bridge continuity owners (fix(proxy): retire durably unroutable bridge continuity owners #2390) (
  10cd71)
• feat(proxy): add shared/isolated thread cache identity modes (default shared) (feat(proxy): add shared/isolated thread cache identity modes (default shared) #2376) (
  883c91)
• fix(proxy): retire a continuity owner that cannot return in time (fix(proxy): retire a continuity owner that cannot return in time #2397) (
  2852cf)
• fix(db): converge the forked thread-cache and bridge-retirement heads (fix(db): converge the forked thread-cache and bridge-retirement Alembic heads #2400) (
  d28b3a)

Release-candidate validation

Validated candidate: 0041600

Complete these checks on the exact candidate SHA above before merging. The beta release guard and publish workflow fail while any item remains unchecked or the SHA is stale.

• Backend/unit/integration gates — CI run 34689947135 on this SHA: Tests (pytest, unit), integration-core-1..3, integration-bridge, e2e, PostgreSQL, plus Migration check (alembic) and Migration check (alembic, PostgreSQL) — all pass.
• Frontend tests/build — same run: Frontend tests (vitest + coverage), Frontend build (vite), Frontend type check (tsc), Frontend lint (eslint) — all pass.
• Wheel/package validation — same run: Package (build) passes.
• Docker/container smoke — same run: Docker build, Helm lint + template + kubeconform and Helm smoke install (kind) pass; Dashboard browser smoke (Playwright) also passes against the built dashboard.
• Live upstream/account smoke
• Live upstream/account smoke not required before merge — the container image for this candidate does not exist until this PR is merged and the tag is published, so a live upstream smoke cannot bind to this SHA beforehand. It is instead run against production immediately after the deploy of 1.25.0-beta.8, and the result is reported back on this PR. 39 of 40 checks on this SHA are green; the only red one is this guard.

Install after publish

uvx --from "codex-lb==1.25.0b8" codex-lb
docker pull ghcr.io/Soju06/codex-lb:1.25.0-beta.8
helm install codex-lb oci://ghcr.io/soju06/charts/codex-lb --version 1.25.0-beta.8 --devel

Promotion

Merge the normal release-please PR to promote this beta-tested train to 1.25.0.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T12:30:30.532609Z	0f45477	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 131894ab-319b-4432-b2dc-f1ddffc21672

📥 Commits

Reviewing files that changed from the base of the PR and between 1f34281 and 0f45477274cf92ed3a1a751aa7e233d5d62057e1.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• app/__init__.py
• deploy/helm/codex-lb/Chart.yaml
• frontend/package.json
• pyproject.toml

Included review availability: Your plan provides up to 8 included reviews per hour; 1 remains after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the application, frontend, and deployment package versions to 1.25.0-beta.8.

Walkthrough

The release version was updated from 1.25.0-beta.7 to 1.25.0-beta.8 in Python, frontend, and Helm metadata.

Changes

Release version alignment

Layer / File(s)	Summary
Update release metadata pyproject.toml, app/__init__.py, frontend/package.json, deploy/helm/codex-lb/Chart.yaml	The project, package, frontend, Helm chart, and Helm application versions now use 1.25.0-beta.8.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: mastertyko

Merge Risk: ⚪ Minimal · up to 87b21

This change only advances release metadata to v1.25.0-beta.8, with the supplied files showing consistent versions across Python, frontend, and Helm. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the release preparation and specifies version 1.25.0-beta.8, which matches the version-only changeset.
Description check	✅ Passed	The description is directly related to the release version updates and provides validation, installation, and promotion details.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/beta-1.25.0-beta.8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Soju06]

Live upstream/account smoke — run against production after deploy

Recorded here as promised in the release-candidate validation checklist: the live smoke could not bind to the candidate SHA before merge because the image did not exist yet, so it was run against production immediately after 1.25.0-beta.8 went live.

Deploy: blue/green cutover on codexlb-vultr via zdt-deploy.sh 1.25.0-beta.8. Ready after 17s (5 consecutive /health/ready 200s), green drained to 0 sessions in 275s, 180s observation held healthy, standby stopped after the grace. Alembic head advanced to 20260912_000000_merge_thread_cache_and_bridge_retirement_heads; both new http_bridge_sessions columns present.

Health, 80 minutes post-cutover: 5,961 success / 47 error / 12 cancelled. The errors are stream_incomplete, client_disconnected and upstream_error — the ordinary background classes. Zero previous_response_owner_unavailable, the failure this train was cut for.

Scheduled sweep, on real data: Retired durable HTTP bridge continuity owners that stayed unroutable retired_count=425. Production had 513 durable bridge rows pinned to accounts that were paused, rate-limited or re-auth-blocked, none of which any existing cleanup path could reach; 425 met the grace window and were retired on the first sweep.

End-to-end functional smoke — a real thread through the front door, on a hard thread_header key:

1. First turn on /backend-api/codex/responses with a thread identity → 200, served by account A, durable row created.
2. Account A paused (status + cache_invalidation bump, the same pair the dashboard pause writes).
3. Same thread resumed, no client-supplied previous_response_id → HTTP 200, served by a different healthy account.

event=owner_unavailable_replay_rejected bridge_kind=thread_header key_strength=hard account_id=<A>
event=owner_retired_on_request          bridge_kind=thread_header account_id=<A> detail=outcome=rebind_without_anchor

The durable row now names the replacement account with both retirement markers NULL — the rebinding claim cleared the marker, so retirement is a step rather than a resting state. Account A was restored to active immediately; it is serving normally.

Before this train that third request returned 502 previous_response_owner_unavailable, and kept returning it for as long as the account stayed paused. That is #1707.