fix(codex): read Priority traces on Linux

[A-l-an]

Problem

On Linux, CodexBarCore links the existing CSQLite3 module, but the native Codex Priority trace reader was compiled only under canImport(SQLite3). The resolver consequently returned an empty, apparently validated result even when the host had readable Priority/Fast evidence. Supported Priority usage could then receive Standard API-equivalent prices. This also affects a Linux host serving the existing SSH cost-summary command.

With two synthetic gpt-5.4 sessions (110 tokens each, one Priority) and fixed local prices, the unpatched production resolver/scanner tests fail and the native Linux CLI reports $0.00050 rather than $0.00075. This is a synthetic reproduction, not a claim about any user's historical bill.

Change

• Use SQLite3 on macOS or the existing CSQLite3 dependency on Linux throughout the native trace reader, memo, and persisted cursor paths.
• Preserve native history and checkpoints across the generated parser-fingerprint update.
• Add portable production-path regression tests for live/historical evidence, cursor restoration, corrupt/missing traces, warm repricing, and scanner → snapshot → existing host summary.

SQL, pricing formulas, SSH transport, JSON schema, and CLI options are unchanged. This is independent of the UI/combined-scan proposal in #3687.

Validation

• Linux x86_64, Swift 6.3.3, isolated Debian 12 container: the same five production-path tests compile and fail on baseline ec12a024, then all five pass with this patch. Full swift test --jobs 2 --parallel: 660 tests / 86 suites passed.
• Actual Linux CLI, offline, dedicated test users and synthetic histories only: both native JSON and --summary-only report 220 tokens / $0.00050 on the baseline and 220 tokens / $0.00075 after the fix. A normal refresh of the baseline cache (without --refresh) preserves its database identity, token snapshots, accumulators, and file checkpoints while correcting the Priority price. Removing the trace afterward retains the validated $0.00075 estimate. Coverage and provenance remain unchanged. The snapshot regression separately asserts 110 Standard and 110 Priority tokens; the wire schema is not expanded.
• macOS, Swift 6.3.2: focused Priority/store regression 134 tests / 4 suites passed; make test 118/118 groups passed on the first attempt, no retries or timeouts; make check and git diff --check passed.
• Musl limitation: attempted the current CI static SDK/SQLite release-build path with Swift 6.3.3. The 2-CPU / 4-GiB test container OOM-killed the compiler (signal 9, cgroup oom_kill=1) while building Core. A musl build/runtime pass is not claimed; it still needs validation on the CI runner.

The Linux tested source-file hashes match this commit. No installed app/CLI or private session history was used.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 21, 2026, 4:02 AM ET / 08:02 UTC.

ClawSweeper review

What this changes

Enable Linux to read existing Codex Priority/Fast trace evidence and apply the correct cost estimates while preserving cached history, with regression tests and documentation.

Merge readiness

✅ Ready for maintainer review

Keep open: this fixes a source-confirmed Linux pricing defect still present on main and in v0.63.0. The focused patch and reported CLI/cache-upgrade results support landing; no blocking correctness or security finding was identified.

Priority: P2
Reviewed head: 0368b075e95cefe93185e905c42e66165130063c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrow repair with relevant runtime observations, upgrade coverage, and focused regression tests.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The supplied Linux production CLI results exercise the changed trace reader through native JSON and host-summary output, showing corrected pricing, baseline-cache preservation, and retained pricing after trace removal; musl success remains unclaimed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The supplied Linux production CLI results exercise the changed trace reader through native JSON and host-summary output, showing corrected pricing, baseline-cache preservation, and retained pricing after trace removal; musl success remains unclaimed.
Evidence reviewed	8 items	Introduced change: The pinned introduction changes seven files: SQLite import guards, parser fingerprint compatibility, focused tests, and documentation. It does not change SSH transport, pricing formulas, dependencies, or output schemas. Current-main defect: Main still compiles the trace resolver only when SQLite3 is importable; its alternative returns empty turns with validationPending false. Package.swift supplies CSQLite3 on Linux, so the proposed change repairs the existing platform mismatch. Latest-release check: The supplied latest release, v0.63.0, also contains the SQLite3-only guards and empty successful fallback; it does not already supply this fix.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar combines local Codex session usage with SQLite trace evidence to distinguish Standard from Priority pricing. Its cached cost snapshots feed native reports and the existing CLI host-summary output.

flowchart LR
  A[Local session history] --> C[Usage scanner]
  B[SQLite Priority traces] --> D[Platform SQLite reader]
  D --> C
  E[Existing history cache] --> C
  C --> F[Priced cost snapshot]
  F --> G[CLI and host summaries]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +11/-8; tests +217/-0	Production growth is limited to platform support and cache compatibility, with five focused Linux regression tests.

Technical review

Best possible solution:

Use the existing platform SQLite dependency for the shared Priority reader while preserving native history through the established cache-adoption path.

Do we have a high-confidence way to reproduce the issue?

Yes: current main's SQLite3-only guard excludes the existing Linux CSQLite3 dependency and returns empty Priority evidence. The contributor also reports a matching baseline CLI failure; this review did not execute it.

Is this the best way to solve the issue?

Yes: extending the established reader's import guards avoids a second implementation, and compatible cache adoption preserves existing history while ordinary refresh corrects pricing.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6f59667e12c2.

Labels

Label changes:

• add P2: Linux can understate Priority cost estimates, with a bounded fix to existing local accounting.
• add proof: sufficient: Contributor real behavior proof is sufficient. The supplied Linux production CLI results exercise the changed trace reader through native JSON and host-summary output, showing corrected pricing, baseline-cache preservation, and retained pricing after trace removal; musl success remains unclaimed.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The supplied Linux production CLI results exercise the changed trace reader through native JSON and host-summary output, showing corrected pricing, baseline-cache preservation, and retained pricing after trace removal; musl success remains unclaimed.

Label justifications:

• P2: Linux can understate Priority cost estimates, with a bounded fix to existing local accounting.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The supplied Linux production CLI results exercise the changed trace reader through native JSON and host-summary output, showing corrected pricing, baseline-cache preservation, and retained pricing after trace removal; musl success remains unclaimed.
• proof: sufficient: Contributor real behavior proof is sufficient. The supplied Linux production CLI results exercise the changed trace reader through native JSON and host-summary output, showing corrected pricing, baseline-cache preservation, and retained pricing after trace removal; musl success remains unclaimed.

Evidence

What I checked:

• Introduced change: The pinned introduction changes seven files: SQLite import guards, parser fingerprint compatibility, focused tests, and documentation. It does not change SSH transport, pricing formulas, dependencies, or output schemas. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CodexPriority.swift:7, 0368b075e95c)
• Current-main defect: Main still compiles the trace resolver only when SQLite3 is importable; its alternative returns empty turns with validationPending false. Package.swift supplies CSQLite3 on Linux, so the proposed change repairs the existing platform mismatch. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CodexPriority.swift:325, 6f59667e12c2)
• Latest-release check: The supplied latest release, v0.63.0, also contains the SQLite3-only guards and empty successful fallback; it does not already supply this fix. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CodexPriority.swift:325, f3e718c897d5)
• Cache compatibility and repricing: The preceding parser hash is added to the existing compatible-adoption path. That path updates metadata without rebuilding native rows; existing scanner logic detects changed Priority evidence and refreshes pricing. The extended store regression checks retained snapshots, accumulators, discovery state, and resumable file checkpoints. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageStore.swift:83, 0368b075e95c)
• Real CLI and upgrade observations: The captured PR body reports actual offline Linux CLI runs in an isolated Debian 12 environment: native JSON and --summary-only retain 220 tokens while costs change from $0.00050 to $0.00075. Refreshing the baseline cache preserves database identity and accounting checkpoints; subsequent trace removal retains the validated price. These are contributor-reported production CLI observations with synthetic histories, not a reviewer-executed reproduction. The live body read matched the supplied body and pinned head. (0368b075e95c)
• Validation scope: Five added tests exercise live/historical SQLite reads, cursor restoration, missing/corrupt traces, snapshot summaries, and warm repricing. The contributor reports 660 Linux tests, 118 macOS test groups, and formatting checks passing. The musl attempt ended in a container OOM and is explicitly not claimed as passing. Read-only review independently confirmed the generated parser hash and a clean diff check; builds and tests were not run. (TestsLinux/CodexPrioritySQLiteTests.swift:10, 0368b075e95c)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.