From 6d6275e35c5dc725233ac6471a826ae385052df8 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sun, 6 Sep 2026 19:31:01 -0700
Subject: [PATCH] ci(codex): run private-home auth regression suite

---
 .github/workflows/ci.yml | 6 ++++++
 CHANGELOG.md             | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8015d9eb..b403edf4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,6 +49,12 @@ jobs:
           timeout 60s env -i HOME="$test_home" PATH="$PATH" node --test skills/npm/scripts/*.test.mjs </dev/null
           timeout 30s env -i HOME="$test_home" PATH="$PATH" /bin/bash skills/npm/scripts/npm-auth.test.sh </dev/null
 
+      - name: Test Codex context and private-home auth preflight (offline, synthetic)
+        run: |
+          test_home="$(mktemp -d)"
+          trap 'rm -rf "$test_home"' EXIT
+          timeout 60s env -i HOME="$test_home" PATH="$PATH" ruby skills/codex-huge-context/scripts/preflight.test.rb </dev/null
+
       - name: Test macOS release credential boundaries (synthetic)
         run: |
           /bin/bash skills/release-mac-app/scripts/mac-release.test.sh
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 318b9a18..fe5db97a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ summary: Timeline of guardrail helper changes mirrored from Sweetistics and rela
 
 ## Unreleased
 
+- Run the Codex direct-route preflight regression suite in CI with a clean environment and temporary HOME, covering private-home auth delivery and secret-safe failures without live credentials.
+
 - Make Codex Keychain helper guidance independent of private reviewer HOME paths and add a secret-safe `--private-home` delivery diagnostic without changing reviewer isolation or provider selection.
 
 - Align shared Codex routing rules with the canonical `codex-first` skill and its launch recipe instead of stale saved-defaults guidance; preserve the model gate and isolated review workflow.