fix(runtime): curate Codex protocol artifact baseline

[lee-to]

Summary

• keep generated TypeScript protocol files committed as clean-clone build inputs
• keep only the two self-contained aggregate JSON Schema files as reviewable golden snapshots
• generate the complete upstream protocol in a temporary directory and synchronize only the curated baseline
• require the installed Codex CLI version to match @openai/codex-sdk
• reject TypeScript drift, aggregate-schema drift, and reintroduced granular schemas
• remove direct generation scripts that could bypass the curated workflow

Why

The per-type and per-method JSON Schema files duplicate definitions already present in the aggregate schemas, are not consumed at runtime, and make Codex protocol updates unnecessarily large. This change removes 271 tracked granular schema files and more than 56,000 duplicated lines while preserving every generated TypeScript build input and both aggregate protocol snapshots.

Safety

• generated TypeScript files remain committed, so clean clones still build without invoking Codex
• the two aggregate JSON Schema snapshots remain committed and semantically unchanged
• full upstream generation still runs during both generate and check workflows
• generation stops before touching committed artifacts when CLI and SDK versions differ
• check mode fails if an unexpected granular schema is committed again
• the generator preserves the generated README and cleans up temporary files on failure

Testing

• npm run ai:validate
• 873 @aif/runtime tests
• runtime coverage: 85.56% statements, 72.73% branches
• Codex protocol drift check against CLI/SDK 0.145.0
• Playwright performance suite: 4/4 passed
• k6 load suite: 3/3 passed

Closes #156

[lee-to]

Code review

Verdict: COMMENT (non-blocking)

This PR narrows the committed Codex App Server baseline to build-required TypeScript plus the two aggregate schemas, while adding temporary generation, CLI/SDK version parity, and focused drift tests. The production risk is low because the runtime contract and generated TypeScript inputs are unchanged. Build, ESLint, Tests, audit, and MCP checks are green. The red ai-review check is unrelated infrastructure: its webhook failed TLS hostname validation for ai-review-runner.cutcode.dev.

Must fix

None.

Should fix

1. Decomposition (soft size limit) — The raw diff is 56,494 lines across 275 files. After excluding the 271 generated granular-schema removals, the substantive diff is still 530 lines across 4 files and covers two separable concerns, which is above the 400-line soft limit. A concrete split would be:
   • PR 1 — version parity: packages/runtime/scripts/generate-codex-app-server-protocol.mjs version discovery/comparison plus the mismatch tests in packages/runtime/src/__tests__/codexAppServerProtocolGenerator.test.ts.
   • PR 2 — curated baseline: the temporary generation/synchronization logic, packages/runtime/package.json, the generated README, the remaining generator tests, and the mechanical generated/schema/**/*.json removals.

Nits

• packages/runtime/scripts/generate-codex-app-server-protocol.mjs:145 and :181 repeat command construction, spawn, and launch-error handling. A small spawnCodex(...) helper would keep the behavior and diagnostics aligned.

Context gates

• Architecture: pass — no package dependency or DB-access boundary changed.
• Rules: pass — no clear SOLID, structured-error, nullable-cast, CSS, migration, or coverage-rule violation.
• Roadmap: warn — the PR closes Reduce committed Codex App Server protocol artifact churn #156, but neither the issue nor .ai-factory/ROADMAP.md links this maintenance work to a milestone.
• CHECKLIST compliance (touched packages: packages/runtime): pass — focused generator tests were added, protocol drift validation is covered, and runtime coverage is reported above 70%; adapter parity and capability/registration items are not applicable because no adapter contract or capability changed.
• Docs sync: pass — the generated protocol README now documents the curated baseline and the version requirement; provider capability docs, TEMPLATE.ts, bootstrap.ts, and Docker dependency sync are not triggered.
• PR size (56,494 raw lines / 275 raw files / 2 concerns; 530 substantive lines / 4 substantive files): warn — generated removals were excluded from the threshold; suggested boundaries are above.
• Risk gating (feature flag): n/a — this changes build-time generation and committed snapshots, not production runtime behavior, an API contract, schema migration, or hot path.

Positive notes

• Generation validates CLI/SDK parity before synchronizing committed artifacts.
• Check mode compares semantic JSON content and rejects reintroduced granular schemas.
• The tests cover curated generation, stale-artifact rejection, TypeScript/schema drift, and version mismatch.