Codex reviews fail with TLS errors on macOS 14.1.1; laptop fix needs verification

Protected Codex reviews repeatedly timed out on the laptop while ordinary Codex worked. Later diagnostics exposed a TLS/certificate failure. A public CA bundle fix has been implemented and works on the development desktop, but the affected laptop has not yet been confirmed working after that fix. Keep this issue open until that retest succeeds.

Affected environment

• macOS 14.1.1, Darwin 23.1.0, arm64
• Node v24.18.0
• Codex CLI 0.154.0
• Authentication source: an isolated copy of saved Codex auth.json
• Model: Codex default; Margin intentionally does not inherit user configuration
• Ordinary Codex works on the laptop

Reproduction

From the Margin repository with the Markdown demo prepared:

npm run margin -- review draft.md \
  --root .demo/markdown \
  --provider codex \
  --brief "Focus on argument and pacing. Preserve my voice."

Expected: a completed, validated review appears in VS Code, with the source unchanged.

Observed before the CA bundle fix: early runs reached Margin's 120-second timeout. On commit 7af245a, warning-level diagnostics showed a model-catalog connection problem, then a local session/turn, followed by retries and a TLS/certificate failure:

[margin +3s] Codex reported a connection problem or retry. Reported while fetching the model catalog; this alone does not establish that the review request failed.
[margin +6s] Codex created a local session; service connection is not yet confirmed.
[margin +7s] Codex reported a connection problem or retry.
[margin +7s] Codex reported a TLS or certificate failure.

No completed laptop review was confirmed. Prepared snapshots/requests were retained for manual import. No draft edits were reported.

Evidence and interpretation

The laptop's margin doctor --json report reached both hosts using Node HTTPS, both outside and inside Seatbelt: chatgpt.com returned HTTP 403 and api.openai.com returned HTTP 421. No recognized omitted environment overrides were detected. These unauthenticated probe responses establish Node HTTPS reachability only; they do not validate Codex's Rust TLS implementation, authentication, WebSockets, or model access.

The development desktop uses macOS 26.6.2 and Node 22.22.0. The OS/runtime difference is relevant context, but it has not been established as the root cause. Missing trust roots inside the protected runtime are a working hypothesis supported by the TLS diagnostic, not a verified laptop root-cause analysis.

Implemented changes

• 7f8079f: bounded connection diagnostics, paired Node HTTPS probes, version reporting, and more specific error classes.
• 7af245a: disable and verify Codex's unbounded connection retries; surface warning-level diagnostics and identify the credential source without exposing its contents.
• abd9b6b: validate Node's bundled public CA roots, copy them into the private runtime directory, and pass the file through Codex's supported CODEX_CA_CERTIFICATE setting. Both Node doctor probes use the same explicit bundle.

Certificate/hostname verification, the read-only sandbox, source-access restrictions, integration isolation, and the 120-second outer deadline remain enabled. No keychain export, inherited custom CA file, TLS bypass, or expanded source permissions were introduced.

Verification so far

• 49 offline tests passed, including actual Seatbelt/loopback TLS checks that accept a selected CA and reject an untrusted issuer and wrong hostname.
• With the CA bundle, the development desktop's protected Node HTTPS probes pass; an earlier protected Node certificate failure there is eliminated.
• A separate real Codex review on the desktop completed in 18 seconds and imported four comments with draft bytes and Git version context unchanged.
• The user subsequently confirmed that the desktop editor workflow works.
• The affected macOS 14.1.1 laptop has not been retested successfully after abd9b6b in the reported evidence.

Acceptance criteria

• Update and build the latest code on the affected laptop; verify the TLS trust: ... public CA certificates bundled with Node startup line.
• Complete a protected Codex review there and inspect its editorial letter and source comments.
• Repeat from a fresh runtime to check that success does not depend on cached state.
• Confirm source bytes, Git HEAD/index, and the existing authentication file are unchanged by the reviewing workflow.
• Record the tested macOS/Node/Codex versions and update docs/testing.md with the laptop result.
• If TLS still fails, capture the safe diagnostic class and investigate certificate discovery/transport without weakening TLS verification or sandbox protections.

Do not close this issue solely because desktop tests pass. Do not attach credentials, authentication files, raw private logs, or full draft snapshots.

Update and build the latest code on the affected macOS 14.1.1 laptop, then run the documented protected Codex review command and verify the bundled-CA startup line. Repeat from a fresh runtime, inspect the review and source comments, and confirm source bytes, Git state, and authentication files are unchanged. Record the environment and result in docs/testing.md; if TLS still fails, preserve the existing protections while capturing the safe diagnostic class.