feat(browser): persist thinking-effort selection evidence

[frontierkodiak]

Persist thinking-effort selection evidence independently of model-selection metadata. The selector now returns the requested level, observed selected label, verification/strict-failure status, and capture time; the record is saved as browser.thinkingSelection, displayed by oracle status, and retained in remote structured results.

The maintainer integration preserves current direct-slider readiness, explicit Deep Research effort selection, strict Pro refusal, and the conversation-scoped remote configuration allowlist. Host PID, port, and profile fields remain excluded from structured bridge results. A disabled best-effort option is recorded as unverified with no resolved label, rather than suggesting that the unavailable requested option was selected.

Evidence is limited to what the UI confirmed at capturedAt. It does not attest the backend model/effort or guarantee that later UI state remained unchanged.

Validation: 2,123 tests passed, 45 skipped; 176 focused tests; lint/typecheck/build/docs passed. The disabled-option regression failed before its repair. The actual built CLI and real isolated Chrome passed switched Pro, already-selected Pro, unverified best-effort selection, and strict refusal cases, checking metadata and status output. A further case ran both the built oracle serve process and built CLI client, verifying real browser execution, preserved structured effort evidence, and absence of host PID/profile fields. The expanded proof runs in Linux CI. Final branch review and exact-head CI are linked in the proof comment.

Unproven here: fresh signed-in ChatGPT/Deep Research/follow-up behavior, actual backend effort/model identity, and UI changes after the recorded observation. The contributor's earlier live trace remains historical evidence; the current pages are explicitly synthetic.

Thanks @frontierkodiak. Deferred changelog line after landing: Browser: persist and display thinking-effort selection evidence, including remote results, without treating unverified or disabled options as confirmed selections; thanks @frontierkodiak.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 10:09 AM ET / 14:09 UTC.

ClawSweeper review

What this changes

Records observed ChatGPT thinking-effort selections in session metadata, displays them in session status, and preserves selection and conversation details in remote results.

Merge readiness

✅ Ready for maintainer review

The PR remains useful: current main lacks structured thinking-effort evidence. The integrated head resolves the earlier configuration-allowlist concern, and no blocking introduced defect was found.

Priority: P3
Reviewed head: 20124a9eacc72e02a849f1f552016e33dcb50f4a

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused additive implementation with relevant production-path proof and no remaining concrete blocker.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The captured report describes actual built CLI, Chrome, and serve/client execution checking effort evidence through persistence and status output, including unverified and refused selections. The inspected harness matches those assertions; historical live output supplements it. Fresh signed-in behavior and backend effort are outside this evidence claim.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured report describes actual built CLI, Chrome, and serve/client execution checking effort evidence through persistence and status output, including unverified and refused selections. The inspected harness matches those assertions; historical live output supplements it. Fresh signed-in behavior and backend effort are outside this evidence claim.
Evidence reviewed	7 items	Policy and review boundary: Verified the origin repository and read the complete root AGENTS.md. No nested AGENTS.md or .agents maintainer-notes directory was present. Applied the browser-proof guidance and respected the captured maintainer decision to defer the changelog entry until landing. Introduced behavior remains absent from main: Read the complete introduced source/test diff and proof script. Main retains model-selection metadata but lacks thinkingSelection; the branch adds optional evidence without changing existing strict-selection decisions. Related merged work covers selector readiness and remote configuration filtering, not this persistence capability. Previous review concern resolved: The pinned head includes current main. Its introduced remote-server delta only expands the result allowlist; pickClientBrowserConfig remains applied before browser execution. The verified test-merge comparison contains the same 15 changed files. This preserves the boundary established by #398 and satisfies the earlier integration request.
Findings	None	None.
Security	None	None.

How this fits together

Oracle’s browser runner selects ChatGPT controls before submitting prompts. This change carries the observed effort selection through local session storage and the remote bridge into CLI status output.

flowchart LR
  A[Requested thinking effort] --> B[ChatGPT picker]
  B --> C{Selection confirmed?}
  C -->|Yes| D[Timestamped UI evidence]
  C -->|Best effort only| D
  C -->|Strict request unconfirmed| E[Stop before submission]
  D --> F[Local or remote result]
  F --> G[Session metadata]
  G --> H[CLI status]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and validation growth	Production +108/-13; tests +182/-2; proof harness +175/-11	Production growth is justified by carrying one optional evidence record through selection, storage, display, and remote results.

Technical review

Best possible solution:

Retain optional, timestamped UI-selection evidence independently of model identity, with strict refusal preserved and historical sessions remaining readable.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a new evidence capability; source inspection confirms main does not persist a separate thinking-selection record.

Is this the best way to solve the issue?

Yes. Returning evidence from the existing selector avoids a competing verification path, and optional storage preserves older session records.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 54dafa78fe6f.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.
• remove merge-risk: 🚨 security-boundary: Current PR review selected no merge-risk labels.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This improves diagnostic evidence without changing the existing selection policy or introducing an urgent runtime fix.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured report describes actual built CLI, Chrome, and serve/client execution checking effort evidence through persistence and status output, including unverified and refused selections. The inspected harness matches those assertions; historical live output supplements it. Fresh signed-in behavior and backend effort are outside this evidence claim.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured report describes actual built CLI, Chrome, and serve/client execution checking effort evidence through persistence and status output, including unverified and refused selections. The inspected harness matches those assertions; historical live output supplements it. Fresh signed-in behavior and backend effort are outside this evidence claim.

Evidence

What I checked:

• Policy and review boundary: Verified the origin repository and read the complete root AGENTS.md. No nested AGENTS.md or .agents maintainer-notes directory was present. Applied the browser-proof guidance and respected the captured maintainer decision to defer the changelog entry until landing. (AGENTS.md:1, 20124a9eacc7)
• Introduced behavior remains absent from main: Read the complete introduced source/test diff and proof script. Main retains model-selection metadata but lacks thinkingSelection; the branch adds optional evidence without changing existing strict-selection decisions. Related merged work covers selector readiness and remote configuration filtering, not this persistence capability. (src/browser/actions/thinkingTime.ts:127, 20124a9eacc7)
• Previous review concern resolved: The pinned head includes current main. Its introduced remote-server delta only expands the result allowlist; pickClientBrowserConfig remains applied before browser execution. The verified test-merge comparison contains the same 15 changed files. This preserves the boundary established by fix(serve)!: accept only conversation-scoped fields from remote clients #398 and satisfies the earlier integration request. (src/remote/server.ts:302, 20124a9eacc7)
• Stored-format compatibility: thinkingSelection is optional, JSON readers retain their existing acceptance rules, and status rendering checks for the field before formatting it. Existing session-display coverage supplies metadata without this field. No migration, preference rewrite, or stricter metadata validation is introduced. (src/sessionManager.ts:182, 20124a9eacc7)
• Behavior proof and its scope: The captured PR body, sourceRevision 86fc5a58c1ab17855db23dbec9a6441986f86ba2edc65c562e729f985fd292f1, reports successful built-CLI/real-Chrome runs for switched, already-selected, unverified, strict-refusal, and client/server bridge cases. Inspected the complete harness: it checks prompt counts, metadata, status output, and exclusion of host runtime fields. The historical live trace visible at feat(browser): persist thinking-effort selection evidence #397 shows separate effort output; the cached page predates the integration and was not substituted for the captured body. The latest proof-comment contents could not be independently retrieved. (scripts/effort-readiness-proof.mjs:391, 20124a9eacc7)
• Security boundary: The authenticated result response adds descriptive selection and conversation fields while continuing to omit host PID, port, and profile path. No dependency, install hook, credential policy, or production authorization change is introduced; the browser interception added by this PR belongs to the isolated proof harness. (src/remote/server.ts:827, 20124a9eacc7)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• frontierkodiak: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-08-18T19:04:13.211Z sha 1564899 :: needs maintainer review before merge. :: none
• reviewed 2026-08-24T20:00:43.015Z sha 1564899 :: needs maintainer review before merge. :: none
• reviewed 2026-08-31T01:33:46.791Z sha 1564899 :: needs maintainer review before merge. :: none

[steipete]

Maintainer integration verified at 20124a9eacc72e02a849f1f552016e33dcb50f4a. All four CI jobs passed: https://github.com/steipete/oracle/actions/runs/34131020066. Local and final branch autoreview through P2 are scoped-clean.

The record describes UI selection at capturedAt. Existing direct-slider readiness, explicit Deep Research effort handling, strict Pro refusal, and the remote request allowlist are preserved. Disabled non-strict choices now produce verified=false and no resolved label; the regression failed before repair.

Validation: 2,123 tests passed, 45 skipped; 176 focused tests; lint/typecheck/build/docs passed. Actual built CLI runs in real isolated Chrome verified switched Pro, already-selected Pro, unverified best-effort selection, and strict refusal. Metadata and oracle status output agreed with the observed fixture tier. A built oracle serve process and built CLI client additionally exercised the real browser bridge: effort evidence survived while structured host PID, port, and profile fields remained absent. The expanded proof also passed in Linux CI.

Unproven: fresh signed-in ChatGPT/Deep Research/follow-up behavior, actual backend model or effort identity, and UI state after the recorded observation. The current pages and service login responses are explicitly synthetic; the contributor's prior live trace remains historical evidence.

Thanks @frontierkodiak. Human credit and contributor history are preserved. The deferred changelog line remains in the PR body; no branch changelog delta, merge, or release was introduced.