Gate updates on enabled feature health

Author: ilysenko

.github/workflows/upstream-build-app.yml

@@ -10,8 +10,6 @@ on:
       - scripts/patch-linux-window-ui.js
       - scripts/patch-linux-window-ui.test.js
       - scripts/patches/**
-      - linux-features/remote-mobile-control/**
-      - linux-features/ui-tweaks/**
       - scripts/ci/validate-patch-report.js
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
@@ -29,8 +27,6 @@ on:
       - scripts/patch-linux-window-ui.js
       - scripts/patch-linux-window-ui.test.js
       - scripts/patches/**
-      - linux-features/remote-mobile-control/**
-      - linux-features/ui-tweaks/**
       - scripts/ci/validate-patch-report.js
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js

AGENTS.md

@@ -121,9 +121,10 @@ Primary human docs: [architecture](docs/architecture.md),
   and the same format-specific command layer as normal installs.
 - Local installs, updater rebuilds, and scheduled CI use the same upstream DMG
   acceptance profile. Build into a sibling candidate and promote it only after
-  an `accepted` or `accepted_with_warnings` verdict; optional drift remains
-  fail-soft and rejected/inconclusive candidates must not replace the working
-  app.
+  an `accepted` or `accepted_with_warnings` verdict. Only user-enabled Linux
+  features participate in local/updater acceptance, and drift in any enabled
+  feature rejects the candidate. Disabled features are not probed. Rejected or
+  inconclusive candidates must not replace the working app.
 
 ## Generated Artifacts
 
@@ -159,7 +160,7 @@ Side-by-side rebuild candidate: `./scripts/rebuild-candidate.sh` or
 
 ## Runtime Expectations
 
-- `python3`, `7z`, `curl`, `unzip`, `tar`, `make`, and `g++` are required for
+- `python3`, `7z`, `curl`, `unzip`, `tar`, `flock`, `make`, and `g++` are required for
   `install.sh`.
 - Native package builders require their format-specific tools: `dpkg-deb`,
   `rpmbuild`, `makepkg`/pacman tooling, or `appimagetool`.
@@ -197,7 +198,9 @@ for broad cross-format confidence.
   when adding or removing shared payload files.
 - Keep new core patch descriptors fail-soft and idempotent unless there is a
   deliberate `required-upstream` CI policy.
-- Keep optional feature patches optional in CI and disabled by default.
+- Keep optional features disabled by default. When a user enables one, its
+  patch drift must block candidate promotion until the user disables it or the
+  feature is repaired for the current DMG.
 - Add tests near the behavior being changed: patcher tests for ASAR needles,
   feature tests for Linux features, Rust tests for updater/MCP backends, and
   package smoke checks for payload/layout changes.

CHANGELOG.md

@@ -10,7 +10,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - A shared upstream DMG acceptance profile now produces the same structured
   decision for local installs, updater rebuilds, and scheduled CI. Scheduled
   rejections create one fingerprinted drift issue and supersede issues for
-  older DMGs without turning optional patch drift into a blocker.
+  older DMGs. Acceptance evaluates only the user's enabled Linux features and
+  preserves the working app if any enabled feature drifts.
 - Nix module configurations can select the opt-in `mcp-helper-reaper`
   feature. Its Rust helper is supplied by a reproducible Nix derivation and is
   not added to the default package closure.

README.md

@@ -309,6 +309,8 @@ make build-app DMG=/path/to/Codex.dmg
 Local builds are transactional: the candidate must pass the same
 [upstream DMG acceptance profile](docs/upstream-dmg-acceptance.md) used by the
 scheduled GitHub workflow before it replaces the working `codex-app/`.
+Only configured Linux Features are checked; drift in an enabled feature keeps
+the current app installed until that feature is disabled or repaired.
 
 Build and install a package:
 

docs/agents/validation-playbook.md

@@ -50,8 +50,10 @@ scripts/ci/validate-patch-report.js codex-app/.codex-linux/patch-report.json
 ```
 
 Local installs and scheduled CI share `scripts/validate-upstream-dmg.js` and
-`scripts/lib/upstream-dmg-release-profile.js`. Exercise decision and issue
-behavior with:
+`scripts/lib/upstream-dmg-release-profile.js`. Acceptance must inspect only the
+features recorded as enabled in the candidate patch report. Add fixtures
+proving enabled feature drift rejects promotion and disabled features are not
+probed. Exercise decision and issue behavior with:
 
 ```bash
 node --test scripts/ci/upstream-dmg-acceptance.test.js

docs/build-and-packaging.md

@@ -78,7 +78,9 @@ next to `Codex.dmg` and refreshes the cached file when that upstream fingerprint
 changes. Every command builds a sibling candidate and runs the shared
 [upstream DMG acceptance profile](upstream-dmg-acceptance.md) before replacing
 `codex-app/`. A rejected or inconclusive candidate leaves the working app
-unchanged. `--fresh` still forces a cache removal before rebuilding, and an
+unchanged. Acceptance checks only configured Linux Features and rejects drift
+in any enabled feature; disable that feature before retrying if necessary.
+`--fresh` still forces a cache removal before rebuilding, and an
 explicit `DMG=/path/to/Codex.dmg` uses that file exactly.
 Native install shortcuts use `--fresh --reuse-dmg`, so they build a clean
 candidate while still reusing the cached DMG when upstream metadata matches.

docs/troubleshooting.md

@@ -22,7 +22,7 @@
 | Renderer crashes in containers with a tiny `/dev/shm` | The launcher keeps `--disable-dev-shm-usage` automatically when `/dev/shm` is missing or below 1 GiB; force it with `CODEX_ELECTRON_DISABLE_DEV_SHM_USAGE=1` |
 | Screen reader does not read the app UI | Renderer accessibility is forced automatically when Orca, brltty, the GNOME screen-reader setting, AT-SPI accessibility state (`org.a11y.Status IsEnabled` or `toolkit-accessibility`, e.g. after `codex-computer-use-linux setup`), or accessibility env markers are detected; force it with `CODEX_FORCE_RENDERER_ACCESSIBILITY=1` |
 | Stale install / cached DMG | `make build-app-fresh` refreshes the cached DMG and builds a clean candidate; the working app remains until acceptance succeeds |
-| `Candidate was not installed (verdict: rejected)` | Open `dist-next/rebuild/upstream-dmg-decision.json` and its referenced patch reports; fix required current-DMG drift before retrying |
+| `Candidate was not installed (verdict: rejected)` | Open `dist-next/rebuild/upstream-dmg-decision.json`. If the blocker is `enabled-feature-drift`, disable the named Linux Feature and retry; otherwise fix required current-DMG drift before retrying |
 | `Candidate was not installed (verdict: inconclusive)` | Check the build/inspect logs and missing report paths in `upstream-dmg-decision.json`; infrastructure failures intentionally preserve the working app |
 | Computer Use plugin invisible in UI | Enable the Computer Use UI opt-in; upstream server/account rollout can still hide some controls |
 | Computer Use `doctor` reports no input backend | Grant `/dev/uinput`, enable XDG RemoteDesktop portal, or start `ydotoold` / `ydotool.service` |

docs/updater.md

@@ -139,6 +139,10 @@ fresh upstream `Codex.dmg`, builds the native package, and installs it. The
 rebuild uses the shared [upstream DMG acceptance profile](upstream-dmg-acceptance.md);
 rejected and inconclusive candidates never replace the working generated app
 or advance to package installation.
+The rebuild evaluates only the Linux Features selected in the user's saved
+configuration. Drift in any selected feature rejects the candidate; disable
+that feature and retry if receiving the upstream update is more important than
+retaining it.
 
 Updater downloads are streamed to unique temporary files and published as
 `Codex-<sha256>.dmg` only after the file and parent directory are synced. The

docs/upstream-dmg-acceptance.md

@@ -10,21 +10,25 @@ is the only component that decides whether the candidate can be promoted.
 | Verdict | Meaning | Local promotion | Scheduled issue |
 |---|---|---:|---:|
 | `accepted` | Build and every required release check passed | yes | close obsolete drift issues |
-| `accepted_with_warnings` | Only optional fail-soft patches drifted | yes | close obsolete drift issues |
-| `rejected` | A required core/feature/integrity contract failed | no | create or update the current fingerprint issue |
+| `accepted_with_warnings` | Only fail-soft core diagnostics drifted | yes | close obsolete drift issues |
+| `rejected` | A required core/integrity check or an enabled Linux Feature drifted | no | create or update the current fingerprint issue |
 | `inconclusive` | Reports are missing or an infrastructure failure prevented a decision | no | no change |
 
-The profile derives required core patches from patch descriptors. Its explicit
-feature probe enables `remote-mobile-control` and `ui-tweaks`; these requirements
-live in the profile rather than in workflow YAML.
+The profile derives required core patches from patch descriptors and reads the
+enabled feature set from the candidate's patch report. It never enables a
+feature for diagnostics. Disabled features are not checked; any patch drift in
+a user-enabled feature rejects the candidate so the working installation keeps
+that feature intact. The user can disable the feature and retry the update.
 
 ## Transactional Local Install
 
-`install.sh` builds into a hidden sibling candidate directory. It then runs the
-feature probe and writes `dist-next/rebuild/upstream-dmg-decision.json`. The
-existing app is moved only after an accepted verdict, immediately before the
-candidate is renamed into place. A failed rename restores the timestamped
-backup.
+`install.sh` builds into a hidden sibling candidate directory. It evaluates the
+candidate patch report and writes
+`dist-next/rebuild/upstream-dmg-decision.json`. The existing app is moved only
+after an accepted verdict, immediately before the candidate is renamed into
+place. A failed rename restores the timestamped backup. Each build evaluates
+reports from its own transaction directory, and a per-target promotion lock
+serializes the short final replacement window.
 
 `--fresh` refreshes the DMG and candidate without deleting the working app
 early. Set `CODEX_KEEP_REJECTED_CANDIDATE=1` to retain a rejected candidate for

flake.nix

@@ -460,6 +460,7 @@ PY
             pkgs.patchelf
             pkgs.python3
             pkgs.unzip
+            pkgs.util-linux
           ];
 
           dontConfigure = true;