Support ChatGPT Sites repositories as ephemeral Codex cloud workspaces

Component

Codex cloud environments + ChatGPT Sites source repositories

Problem

ChatGPT Sites can materialize and edit its managed canonical repository, then save a Sites version tied to a commit. Codex cloud environments currently start from connected GitHub repositories. There is no sanctioned way to attach a Sites-managed repository to a temporary Codex workspace without exporting a short-lived repository credential or creating a competing mirror.

Passing a Sites repository credential through model context, prompts, environment configuration, tracker records, or logs is not an acceptable bridge. A GitHub mirror also breaks Sites-as-source-of-truth workflows.

Requested platform capability

Expose opaque, audited Sites-bound workspace operations:

sites.create_codex_workspace(
  project_id,
  expected_base_commit_or_version,
  permissions = [source_read, source_write],
  ttl,
  task_id,
  task_revision,
  durable_lane_identity,
  exact_file_lock,
  idempotency_key
) -> { workspace_handle, base_commit, expires_at, audit_receipt_id }

The platform should create an ephemeral environment from the canonical Sites repository and inject the least-privilege repository lease outside model context. The lease and repository coordinates must be non-exportable and unavailable to prompts, logs, task records, and generated artifacts.

sites.finalize_codex_workspace(
  workspace_handle,
  expected_base_commit,
  proposed_head_commit,
  task_id,
  task_revision,
  verification_receipt_digest
) -> { commit_sha, sites_version_id, version_number, artifact_digest, audit_receipt_id }

Finalization should:

• reject canonical base divergence instead of merging or force-pushing;
• enforce the exact file lock and clean/diff boundary;
• publish with the platform-held lease;
• build and save an immutable Sites version tied to the resulting commit;
• return non-sensitive commit/version/artifact proof;
• revoke the lease and destroy the environment;
• not deploy production (deployment remains a separate approval gate).

A third operation is needed for fail-closed cleanup:

sites.abort_codex_workspace(workspace_handle, reason, idempotency_key)
  -> { lease_revoked, workspace_destroyed, audit_receipt_id }

Abort should be automatic on expiry, cancellation, failed verification, task-revision drift, base-CAS failure, or finalize failure.

Security and acceptance requirements

• Sites remains the sole source repository.
• No raw credential or reusable token is returned to the model or caller.
• Workspace handles are opaque, scoped, expiring, revocable, and task-bound.
• Every create/finalize/abort transition is immutable and auditable.
• Exact base commit, task revision, durable identity, and file lock are server-validated.
• Replays are idempotent; mismatched fingerprints conflict.
• Successful finalize returns commit-bound and Sites-version-bound proof.
• Failed or abandoned work cannot leave a usable lease or persistent workspace.

This would allow tracked Codex cloud implementation against Sites-managed source without weakening either product's security boundary.

sites.authenticated_fetch_site_route(
  project_id,
  method = GET | HEAD,
  allowlisted_route,
  expected_sites_version?,
  response_size_limit,
  ttl,
  idempotency_key
) -> {
  status,
  etag,
  response_body_or_digest,
  sites_version,
  audit_receipt_id
}

sites.read_bound_d1(
  project_id,
  binding_name,
  allowlisted_query_id,
  parameters,
  expected_schema_or_projection_version,
  ttl,
  idempotency_key
) -> {
  rows_or_digest,
  projection_revision,
  etag,
  audit_receipt_id
}