[blitzcrieg1]

Fixes #389.

What was wrong

The Codex hook reads the reported model and sends it as a nested model object. ExternalIngestBody did not declare model, so it was dropped over HTTP and the event recorded codex as both model and provider. The spool replay skips that route, so the same call could record different values depending on whether the receiver was up.

The hook also hardcoded provider: "openai". Codex can use any endpoint, so fixing the drop alone would have labelled a GLM model as OpenAI.

What changed

Codex reports glm-5.3	Before	After
Over HTTP	{"id": "codex", "provider": "codex"}	{"id": "glm-5.3", "provider": "codex"}
From the spool	{"id": "glm-5.3", "provider": "openai"}	{"id": "glm-5.3", "provider": "codex"}

• ExternalIngestBody declares model. A wrong-shaped value is ignored rather than refused, because the field was ignored while undeclared.
• map_codex_hook states no provider, and model.provider falls back to the source app as it does for other agents.
• Model values are capped at 256 characters in external.py, so the cap covers both paths.
• The schema doc now says what these fields mean: codex there means "not reported", and neither field shows what actually served the request.

Consumers

AiSOC's template reads model.id and model.provider. They are not renamed or moved, but the values change for Codex events, so the schema doc's promise means announcing this in the AiSOC discussion before it ships. That has not been posted. Tenzir's listed fields do not include them.

Not in this PR

• Inferred approval events (codex_inferred) are generated without a model and still say codex.
• Older records are not rewritten.
• Claude Code, Cursor and Antigravity still capture no model.
• The source-app fallback is unchanged, so model.id can still hold an agent's name.

Checks

Run locally on this branch, before a final edit to one code comment. After that edit, the two changed test files and ruff were rerun.

• Full suite: 2118 passed, 6 skipped, 3 failed. The failures are the ones CLAUDE.md lists for the dogfood machine: test_arguments_sent_as_a_json_string_are_enriched, test_the_cli_rotates_lists_and_verifies and the README count (2125 expected, 2127 collected locally). Their messages match, but they were not re-run with .env moved aside, so CI is the check on those.
• Benchmark: 0 missed, 0 false positives.
• Ruff: clean.
• Fingerprint: 15846a0915769d4a, unchanged. No frozen file is touched.
• Tests that exercise the bug failed before the fix, including one through the real route and one through drain_spool.
• Not run: a real Codex session against a live recorder.

🤖 Generated with Claude Code