Summary
codex_credential_isolation_required errors have been recurring since 2026-07-16 (Sentry: LOOPOVER-28/2A/2C/29) on a self-host install that was previously working. The credential-isolation guard itself (assertCodexCredentialIsolation in src/selfhost/ai.ts) is correct, intentional security hardening — it's not a bug. The problem is upstream of it: 59b16a05c (#5652, the GITTENSORY_→LOOPOVER_ env var rebrand) removed dual-read support for GITTENSORY_ENABLE_UNSAFE_CODEX_REVIEWER and hardcoded a strict LOOPOVER_ENABLE_UNSAFE_CODEX_REVIEWER === "1" check. An operator whose .env still uses the legacy name silently reverts to fully-disabled, with no signal distinguishing that from "never configured at all."
This is compounded by src/services/ai-review.ts's isStructuralProviderConfigError — the per-provider circuit breaker that gives a deterministic config error an hour-long cooldown instead of the default 60s one. Its regex (/^codex_(?:auth_not_configured|no_auth):/) doesn't match codex_credential_isolation_required, so this failure mode retries every 60s instead of backing off — the exact flood pattern that circuit breaker was built to prevent (see its own doc comment citing LOOPOVER-K/8, 2094 + 544 events).
Area
GitHub App
Expected behavior
- An operator still on the legacy env var name gets a specific, actionable error telling them to rename it — not the same generic message as never having configured it at all.
- A deterministic
codex_credential_isolation_required failure gets the hour-long structural cooldown, not the 60s generic one.
Actual behavior
- Both cases (never configured vs. legacy var name) throw the identical generic
codex_credential_isolation_required message.
- The circuit breaker treats this as a transient failure and retries every 60s.
Validation
Confirmed via git log -S dualPrefixEnvFlag and git show 59b16a05c that the legacy var name was deliberately retired repo-wide (not a bug in itself), and by reading isStructuralProviderConfigError's regex against the actual thrown error string.
Summary
codex_credential_isolation_requirederrors have been recurring since 2026-07-16 (Sentry: LOOPOVER-28/2A/2C/29) on a self-host install that was previously working. The credential-isolation guard itself (assertCodexCredentialIsolationinsrc/selfhost/ai.ts) is correct, intentional security hardening — it's not a bug. The problem is upstream of it:59b16a05c(#5652, the GITTENSORY_→LOOPOVER_ env var rebrand) removed dual-read support forGITTENSORY_ENABLE_UNSAFE_CODEX_REVIEWERand hardcoded a strictLOOPOVER_ENABLE_UNSAFE_CODEX_REVIEWER === "1"check. An operator whose.envstill uses the legacy name silently reverts to fully-disabled, with no signal distinguishing that from "never configured at all."This is compounded by
src/services/ai-review.ts'sisStructuralProviderConfigError— the per-provider circuit breaker that gives a deterministic config error an hour-long cooldown instead of the default 60s one. Its regex (/^codex_(?:auth_not_configured|no_auth):/) doesn't matchcodex_credential_isolation_required, so this failure mode retries every 60s instead of backing off — the exact flood pattern that circuit breaker was built to prevent (see its own doc comment citing LOOPOVER-K/8, 2094 + 544 events).Area
GitHub App
Expected behavior
codex_credential_isolation_requiredfailure gets the hour-long structural cooldown, not the 60s generic one.Actual behavior
codex_credential_isolation_requiredmessage.Validation
Confirmed via
git log -S dualPrefixEnvFlagandgit show 59b16a05cthat the legacy var name was deliberately retired repo-wide (not a bug in itself), and by readingisStructuralProviderConfigError's regex against the actual thrown error string.