[P1 CRITICAL] Restore Codex OPENAI_API_KEY - Blocking All Codex Agents

[github-actions]

Critical Issue

Component: Codex Agent Family
Status: P1 CRITICAL - Authentication failure
Impact: All Codex-powered workflows unable to execute
Severity: P1 - Urgent restoration required

Problem

The OPENAI_API_KEY credential required for Codex agents is missing or invalid, blocking the entire Codex agent family from functioning.

Evidence

• Listed as P1 HIGH in shared-alerts.md
• Codex agents flagged as "under-creation" with auth blocker
• Pattern classification shows systemic authentication failure

Impact

• Scope: All workflows using engine: codex
• Severity: Complete service outage for Codex capabilities
• Duration: Unknown - requires immediate investigation

Recommended Actions

Immediate (< 24 hours)

1. Audit secrets configuration:

   • Verify OPENAI_API_KEY exists in repository secrets
   • Check for typos or formatting issues in secret name
   • Validate key has not expired or been revoked

2. Test restoration:

   • Run a simple Codex workflow to verify auth works
   • Monitor for authentication errors in logs

3. Add health checks:

   • Implement pre-flight auth validation for Codex workflows
   • Fail fast with clear error message if key is missing
   • Alert on authentication failures

Short-term (< 1 week)

4. Prevent recurrence:

   • Document key rotation procedures
   • Add monitoring for credential expiration
   • Implement automated alerts for auth failures

5. Review other engines:

   • Audit credentials for Claude, Copilot, and other engines
   • Ensure all required secrets are configured

Success Criteria

• OPENAI_API_KEY restored and validated
• At least one Codex workflow successfully completes
• Health checks implemented
• Documentation updated

References

• Shared Alerts: /tmp/gh-aw/repo-memory/default/shared-alerts.md
• Agent Performance Latest: /tmp/gh-aw/repo-memory/default/agent-performance-latest.md

---

Generated by Agent Performance Analyzer - Meta-Orchestrator

Generated by ⚡ Agent Performance Analyzer - Meta-Orchestrator · ● 1.9M · ◷

• expires on May 23, 2026, 1:54 PM UTC

[lpcox]

Root Cause & Fix

This is a duplicate of #32446. The Codex agent fails because gh-aw's lock compiler uses --exclude-env OPENAI_API_KEY without enabling the api-proxy sidecar that provides placeholder injection.

AWF already handles this when apiProxy.enabled: true is set. The fix is in the gh-aw lock compiler — it should generate a config like:

{
  "apiProxy": {
    "enabled": true
  },
  "network": {
    "allowDomains": ["api.openai.com"]
  }
}

Piped to AWF:

echo '{"apiProxy":{"enabled":true},"network":{"allowDomains":["api.openai.com"]}}' | \
  awf --config - -- codex exec "..."

When apiProxy.enabled is true and OPENAI_API_KEY is in the host environment, AWF will:

1. Strip the real key from the agent container
2. Inject OPENAI_API_KEY=sk-placeholder-for-api-proxy so Codex's auth check passes
3. Set OPENAI_BASE_URL=http://172.30.0.30:10000 (the sidecar)
4. The sidecar injects the real key before forwarding upstream

No manual --exclude-env needed — credential isolation is automatic.

See: docs/awf-config-spec.md §5 CLI Mapping and src/services/api-proxy-service.ts lines 250-261