From eed9d9bf225e517e4be07048bb66bec604eb2bb7 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 28 Sep 2026 07:04:05 -0700
Subject: [PATCH] test(qa): observe Codex auth failure lifecycle events

Match the failed-session snapshot on sessions.changed, the native lifecycle
metadata owner. session.message projects transcript changes independently and
does not guarantee the settled run state. Preserve exact run/session matching,
bounded recovery text across chat, agent.wait and history, and the prohibition
on starting an app-server turn after the selected credential is removed.

The stale event predicate was introduced by 876e8cdb240b (#149784). Reproduced
its line-533 failure on main baf2edda0d31 in the AWS lab, then verified the
three-line correction with 5 passing auth, approval and migration E2E cases
and 199 Gateway event-owner tests. Core typecheck, formatting and autoreview
through P2 passed. Auth proof test time: 53.9s; target recovery case: 16.1s
versus 21.0s before the fix, including the obsolete five-second event wait.

The baseline also hit an unrelated usage.status Timeout in the first auth
case. It did not recur in the patched family run; this test-only change does
not claim to repair that timeout. No production or protocol behavior changed.
---
 .../e2e/qa-lab/runtime/codex-auth-product-proof.e2e.test.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/e2e/qa-lab/runtime/codex-auth-product-proof.e2e.test.ts b/test/e2e/qa-lab/runtime/codex-auth-product-proof.e2e.test.ts
index c932db0886e8..2e1865d0cf7f 100644
--- a/test/e2e/qa-lab/runtime/codex-auth-product-proof.e2e.test.ts
+++ b/test/e2e/qa-lab/runtime/codex-auth-product-proof.e2e.test.ts
@@ -521,7 +521,7 @@ describe("Codex auth product proof", () => {
             expect(
               events.find(
                 (event) =>
-                  event.event === "session.message" &&
+                  event.event === "sessions.changed" &&
                   event.payload !== null &&
                   typeof event.payload === "object" &&
                   (event.payload as { sessionKey?: unknown }).sessionKey === sessionKey &&
@@ -555,7 +555,7 @@ describe("Codex auth product proof", () => {
       );
       const lifecycleEvent = events.find(
         (event) =>
-          event.event === "session.message" &&
+          event.event === "sessions.changed" &&
           event.payload !== null &&
           typeof event.payload === "object" &&
           (event.payload as { sessionKey?: unknown }).sessionKey === sessionKey &&
@@ -563,7 +563,7 @@ describe("Codex auth product proof", () => {
           (event.payload as { session?: { status?: unknown } }).session?.status === "failed",
       );
       expectBoundedMissingProfileRecovery(finalEvent?.payload);
-      // Native lifecycle publishes the failed session snapshot before broadcasting chat.error.
+      // Lifecycle metadata belongs to sessions.changed; transcript delivery has independent timing.
       expectBoundedMissingProfileRecovery(
         (lifecycleEvent?.payload as { session?: { lastRunError?: unknown } } | undefined)?.session
           ?.lastRunError,