refactor(app): consolidate handwritten application runtime

[jbeckwith-oai]

Change

Finish relocating handwritten application policy out of pkg/custom. Command assembly, feature request/output policy, error presentation, and their tests now live in internal/app; shared request/output implementations retain their existing packages.

cmd/openai passes the generated command tree to app.Run, removing the application's dependency on generated commands. pkg/custom/runtime.go is a 59-line adapter for the current generated bridge only, to be removed when Castiron updates its imports. No external Go import compatibility is retained.

Moved implementations are byte-for-byte identical apart from package declarations. All 257 moved test entrypoints are retained. Update native/WSL package selectors, release-please's version-file path, and documentation/demo references. Generated sources, dependency manifests, generation provenance, and the zero-budget policy are unchanged.

Validation

• All-package compilation, Windows amd64 and ARM64 app/executable compilation.
• Full app tests and app race tests; command-feature/help suites, except the unchanged batch /dev/fd case below. Existing known local image shell-setup failures were excluded from the broad feature run.
• Executable deterministic output/stream, finite-list error, admin credentials/mTLS, help, image upload/generation and ordering contracts passed.
• All 55 WSL pilot controls passed; both relocated request and existing app inventories passed the strict actual-output validator.
• Basic code review and whitespace checks passed.

Local limitations: TestBatchOutputDirectoryRepeatedFailuresCloseDescriptors fails at os.ReadDir("/dev/fd") with bad file descriptor, including outside the sandbox; this unchanged package does not depend on app/custom. Vet reports the same four unkeyed-literal warnings in the moved tests as before migration. Native Windows/macOS/WSL behavior remains covered by hosted CI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T02:41:16.183624Z	4df68c4	PR opened
🔒 Security Review	✅ Completed 2026-10-20T02:42:44.302479Z	4df68c4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Castiron custom code

Evaluated main: 4a159a67b74818d51d16c97f48e17d7cda7e432a.

Trusted main policy: 4a159a67b74818d51d16c97f48e17d7cda7e432a.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared 4a159a67b748 → 4df68c49f29b. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 39360019319 --repo openai/openai-cli \
  --name castiron-custom-code-39360019319-1 --dir /tmp/castiron-custom-code-39360019319-1
git apply --stat /tmp/castiron-custom-code-39360019319-1/custom-code.patch
cat /tmp/castiron-custom-code-39360019319-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 4a159a67b74818d51d16c97f48e17d7cda7e432a 4df68c49f29b9e229da5a3352e534a742f50e2b0
python3 scripts/castiron/custom_code_report.py report \
  --base 4a159a67b74818d51d16c97f48e17d7cda7e432a \
  --head 4df68c49f29b9e229da5a3352e534a742f50e2b0 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-4df68c49f29b
cat /tmp/castiron-custom-code-4df68c49f29b/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch