[clubanderson]

Part of #8419

Automated pin bump: codex 0.167.0 -> 0.168.0 in src/Dockerfile and src/Dockerfile.contributor.

Provenance

Every value below was resolved by src/scripts/cli-pin-bump.sh in run https://github.com/hivecommons/hive/actions/runs/43371821632; digests are computed from the downloaded artifacts and cross-checked against the vendor-published digest where one exists (never copied from a page).

VERSION=0.168.0

Smoke (before this PR was opened)

src/Dockerfile built for linux/amd64 with the new pin; inside the image:

$ codex --version
codex-cli 0.168.0

Model lists (not automated)

::warning::claudePinnedCLIModels has no 'version pinned in src/Dockerfile (X' comment to check
::warning::codex static list comment says 0.166.0 but src/Dockerfile pins 0.168.0
2 model-list drift finding(s) against the CLI pins; also review static/index.html and src/pkg/tokens/pricing.go by hand.

• Allowlists and static fallbacks in src/pkg/dashboard/cli_models*.go match the new pin's model set, and their "matches CLI version" comments name it
• static/index.html model options updated
• src/pkg/tokens/pricing.go has prices for any new model

The docker workflow on this PR builds both images for linux/amd64 and linux/arm64 (every hash-verified layer runs sha256sum -c / sha512sum -c), and the backend smoke's pinned lane picks the new CLI up on its next run. See src/docs/cli-pins.md.

Opened by .github/workflows/cli-pin-bump.yml.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hanthor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Open PR overlap check

✅ Resolved: no conflicting open PRs or same-file overlaps remain against v5.

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• test (rest 3/4)

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

stage 080-awaiting-merge-admission → 071-needs-author: required-check-failing:coverage

Evidence bundle `#18062a8f016e` sha256:279d6f3ccf45b13c0b1cf586f314f43897d17f2605b9cb11c1460f26608b796d — download from the dashboard or `hivectl review evidence #18062`.

[hivecommons-hive]

The diff is correct; the red is a time-bombed test on v5, not this PR.

The change is the two ARG CODEX_VERSION=0.167.0 → 0.168.0 lines (src/Dockerfile:327, src/Dockerfile.contributor:265); the docker (hive) / docker (contributor) / docker (hub) jobs that actually consume the ARG are green on both arches. Nothing in pkg/github is touched.

Why test (rest 3/4) → test → coverage are red (same on #18063, #18064, #18065, and on every hourly "v2 Tests" run of v5@88f6c9c since 2026-11-13 03:31Z):

• TestReopenedClaimPersistsAcrossLoad (src/pkg/github/prclaims_reopen_test.go:235) fails deterministically, 3/3 retries, with reloaded = {Repo: Issue:0 …}, false at line 254.
• Fixture reopenTestMerged = 2026-10-14 01:46:50 UTC (prclaims_reopen_test.go:18); the claim is MergedPR: true (line 25) so Settled() is true (prclaims.go:316-321).
• settledClaimRetention = 30 * 24 * time.Hour (prclaims.go:92) — so settledRetained() (prclaims.go:368-374) flipped to false at 2026-11-13 01:46:50 UTC.
• The test reloads via LoadClaimLedger (line 245), which uses the wall clock (loadClaimLedgerAt(path, logger, nil), prclaims.go:1242-1252). The load loop at prclaims.go:1273-1277 hits c.Settled() && !settledRetained(c, now) → continue, dropping the claim, so LookupAny returns ok=false.

The sibling tests in that file pin the clock with ledger.SetClock(...); this is the only one going through the wall-clock loader. One-line fix: call loadClaimLedgerAt(path, testLogger(), func() time.Time { return reopenTestReopened }) instead of LoadClaimLedger. No production code change needed.

I tried to file this as an issue but the reviewer tier may not create issues; @clubanderson, this needs a fix on v5 before any of the four pin bumps can go green. I have not changed anything.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

test (rest 3/4) is red on the v5 baseline itself (pkg/github.TestReopenedClaimPersistsAcrossLoad, a fixture-date time bomb), not caused by this PR — tracked as shared incident #18067, fix in #18066. Deferring this PR until the baseline is green; it needs no change of its own for that check.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The hive's GitHub App lacks actions: write, so it cannot rerun shared ci for head 0f6e6cbfd83a. A repository maintainer with Actions write can re-run failed jobs at https://github.com/hivecommons/hive/actions/runs/43372505053 . Alternatively, the App owner can request Actions read and write for this recovery installation and its owner must accept the update. This is a CI recovery permission block, not a source-code failure or merge approval. Hive retries after its bounded permission cooldown; no alternate credential is selected. Hive will resume automatically once the step is done; this label and note clear themselves.

[hivecommons-hive]

Needs a decision, not a merge:

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

a8f016e

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head a8f016e5e8ca) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • src/Dockerfile
  • src/Dockerfile.contributor

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Decision needed: @clubanderson should confirm the codex 0.168.0 pin lands as-is, or first update the model lists the bump warned about.

Routing, not objecting. The diff is exactly what the body says: ARG CODEX_VERSION 0.167.0 -> 0.168.0 in src/Dockerfile:327 and src/Dockerfile.contributor:265, and the two values agree (the smoke test asserts this). Image manifests are a trust surface, since this changes code run in every agent image, so I am leaving the sign-off to a person.

One open item from the PR's own provenance block: it warns that the codex static-list comment still says 0.166.0, and the three manual checklist items (cli_models*.go, static/index.html, src/pkg/tokens/pricing.go) are unchecked. I did not verify whether 0.168.0 adds or removes models, so I can't say whether that follow-up is needed or can wait.

I have not approved or closed anything.

— hive: agent=reviewer backend=claude model=claude-sonnet-5-5 claude=2.1.322