[Windows][Desktop 26.915.4065.0] Runtime updater redownloads a 495 MB archive hourly on two independent PCs

Component

ChatGPT Desktop for Windows / Codex primary runtime updater

Summary

ChatGPT Desktop repeatedly downloads the same Codex primary runtime archive from persistent.oaistatic.com. The complete archive is then rejected with errorCategory=checksum_mismatch, and the scheduled updater downloads the same archive again approximately every hour.

The expected SHA-256 and the received SHA-256 are unchanged across every attempt, so the failure appears deterministic rather than like random transfer corruption.

The same behavior has been independently observed on two separate Windows PCs in different physical locations and on independent networks: a Windows 10 PC at work and a Windows 11 PC at home. This makes a transient fault isolated to one Windows version, installation, disk, machine, or local network unlikely.

Manual downloads on Windows and on a separate US Linux server both produce the same SHA-256 served to the app. The HTTP Content-Length also differs from the size selected by the updater, which strongly indicates that the updater metadata and the published CDN object do not match.

Steps to reproduce

1. Launch ChatGPT Desktop 26.915.4065.0 on Windows x64.
2. Leave the application running with Codex enabled.
3. Observe a complete runtime archive download from persistent.oaistatic.com.
4. The installation fails during verify_checksum.
5. Leave the application running. A scheduled update downloads the complete archive again about one hour later.

Expected behavior

• The manifest and archive agree, and the runtime installs successfully after one download.
• If a checksum mismatch occurs, the client does not repeatedly download the same known-bad 495 MB object unless the manifest or artifact changes.
• The existing healthy runtime remains usable without repeated high-bandwidth retries.

Actual behavior

• The full archive is downloaded.
• SHA-256 validation fails with the same expected and actual hashes on every attempt.
• Runtime 26.905.11957 remains installed and is reported healthy.
• The scheduled updater downloads the same archive again approximately hourly.

Environment

• Primary evidence PC: Windows 10 Pro 22H2, build 19045.6466, x64, at work
• Second affected PC: Windows 11, x64, at home
• ChatGPT Desktop package version: 26.915.4065.0
• Package: OpenAI.Codex_26.915.4065.0_x64__2p2nqsd0c76g0
• Existing healthy primary runtime: 26.905.11957
• Runtime selected for update: 26.915.20218, win32-x64, tar.gz
• Reproducibility: observed across Windows 10 and Windows 11 on independent home and office networks. Detailed logs and traffic measurements below are from the Windows 10 PC.

Runtime artifact

• URL: https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
• Size in the updater-selected runtimeInstallConfig: 495,161,818 bytes
• HTTP Content-Length currently served by the CDN: 495,163,216 bytes
• Size difference: 1,398 bytes
• SHA-256 in the updater-selected runtimeInstallConfig: 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3
• SHA-256 of the object actually served: 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368
• HTTP metadata: Last-Modified: Wed, 16 Sep 2026 20:59:52 GMT, ETag: 0x8DF143574704677, cf-cache-status: HIT

The expected hash is not inferred from the failed download. Before downloading, the app log records the selected configuration as runtimeInstallConfig.latest.platforms.windows-x86_64.digest=062660..., with hash=sha256 and size=495161818. The updater later compares the downloaded object against that configured digest.

Independent manual verification

The same public URL was downloaded manually on Windows:

certutil.exe -hashfile .\codex-primary-runtime-win32-x64-26.915.20218.tar.gz sha256
5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368

It was also downloaded independently on a Linux server:

sha256sum codex-primary-runtime-win32-x64-26.915.20218.tar.gz
5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368  codex-primary-runtime-win32-x64-26.915.20218.tar.gz

Both independent downloads match the hash observed by ChatGPT Desktop and disagree with the digest selected by the updater.

Timeline and traffic impact

Local times on 2026-09-20:

• 11:54:50 — startup-triggered download started; failed at 11:55:21.
• 12:24:14 — scheduled download started; failed at 12:24:42.
• 13:24:15 — scheduled download started; failed at 13:24:41.
• 14:24:16 — scheduled download started; failed at 14:24:43.

The traffic observer started after the first attempt and captured the last three complete downloads:

• 12:24 attempt: 496,474,624 downloaded bytes.
• 13:24 attempt: 496,480,994 downloaded bytes.
• 14:24 attempt: 496,475,464 downloaded bytes.
• Captured total for persistent.oaistatic.com: 1,489,452,328 downloaded bytes (1,420.45 MiB), including small manifest/check connections.

At the observed hourly retry rate, leaving the app running could consume roughly 11.9 GB per day.

Sanitized installer log excerpt

The timestamps in this excerpt are UTC. User paths, stack traces, call IDs, bundle operation IDs, and unrelated events have been removed.

2026-09-20T01:14:12.297Z info  primary_runtime_dependencies_diagnose_finished bundleVersion=26.905.11957 installed=true problemCount=0

2026-09-20T03:54:50.076Z info  Codex runtime config selected release=latest bundleVersion=26.915.20218 windows-x86_64.hash=sha256 windows-x86_64.digest=06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3 windows-x86_64.size=495161818

2026-09-20T03:54:50.544Z info  primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=startup_missing
2026-09-20T03:54:50.545Z info  Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T03:55:21.122Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=30577 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."

2026-09-20T04:24:14.122Z info  primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=scheduled_update
2026-09-20T04:24:14.123Z info  Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T04:24:42.387Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=28265 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."

2026-09-20T05:24:15.124Z info  primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=scheduled_update
2026-09-20T05:24:15.125Z info  Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T05:24:41.400Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=26275 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."

2026-09-20T06:24:16.094Z info  primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=scheduled_update
2026-09-20T06:24:16.095Z info  Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T06:24:43.599Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=27504 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."

Additional notes

• I can provide the complete app log privately if needed, but it may contain sensitive local information.
• The screenshots show an earlier traffic snapshot; the sanitized CSV includes the later 14:24 retry.

Codex-runtime-download-loop-feedback.zip

No source file or test is named; start by tracing the primary runtime updater from the logged scheduled_update trigger through verify_checksum, using the recorded URL, manifest digest, and artifact mismatch to reproduce it. Done means a deterministic checksum failure does not redownload the unchanged object hourly, while the existing healthy runtime remains usable.