{
 "schemaVersion": "1.0.0",
 "generatedAt": "2026-08-13T21:20:39Z",
 "claimContract": "A result describes only what this exact build did in this exact test. It does not establish purpose, retention, training use, sale, safety, or behavior in another account, region, operating system, or scenario.",
 "method": {
  "platform": "macOS 15 arm64",
  "network": "Existing operator VPN remained enabled. The lab does not claim a geographic cohort.",
  "capture": "Fresh per-run config and data directories; one CLI process per local mitmproxy instance; HTTP(S) proxy; dedicated test CA where accepted.",
  "redaction": "No credentials, header values, query strings, request bodies, response bodies, prompts, model output, file paths, or IP addresses are published.",
  "repeats": 3,
  "statusVocabulary": [
   "observed",
   "not_observed",
   "opaque",
   "inconclusive",
   "not_tested"
  ]
 },
 "tool": {
  "id": "codex-cli",
  "name": "Codex CLI",
  "vendor": "OpenAI",
  "version": "0.146.0",
  "binarySha256": "ae1d3ffe6d48aec6a4dc3f50e7eb8e0d11962485a6a9406c5a7012139383da02",
  "testedAt": "2026-08-13T21:18:10Z",
  "path": "/codex/telemetry",
  "feed": "/codex/telemetry/feed.xml",
  "status": "limited",
  "headline": "Fresh startup contacted four decoded hosts in 3/3 runs.",
  "summary": "The same plugin-catalog and model-request routes appeared in all three clean-profile runs. No documented analytics opt-out comparison is published yet.",
  "scenario": "Fresh CODEX_HOME, ignored user config, ephemeral read-only run, fixed prompt, deliberately invalid API key. Authentication failed as designed.",
  "configs": [
   {
    "id": "default",
    "label": "Documented defaults",
    "repeats": 3,
    "requestCounts": [
     18,
     18,
     18
    ],
    "destinations": [
     {
      "host": "api.openai.com",
      "owner": "OpenAI",
      "classification": "first_party",
      "observedIn": 3,
      "paths": [
       {
        "method": "POST",
        "path": "/v1/responses",
        "counts": [
         13,
         13,
         13
        ],
        "status": "observed"
       }
      ]
     },
     {
      "host": "chatgpt.com",
      "owner": "OpenAI",
      "classification": "first_party",
      "observedIn": 3,
      "paths": [
       {
        "method": "GET",
        "path": "/backend-api/plugins/featured",
        "counts": [
         1,
         1,
         1
        ],
        "status": "observed"
       }
      ]
     },
     {
      "host": "api.github.com",
      "owner": "GitHub",
      "classification": "third_party",
      "observedIn": 3,
      "paths": [
       {
        "method": "GET",
        "path": "/repos/openai/plugins",
        "counts": [
         3,
         3,
         3
        ],
        "status": "observed"
       }
      ]
     },
     {
      "host": "codeload.github.com",
      "owner": "GitHub",
      "classification": "third_party",
      "observedIn": 3,
      "paths": [
       {
        "method": "GET",
        "path": "/openai/plugins/legacy.zip/:opaque",
        "counts": [
         1,
         1,
         1
        ],
        "status": "observed"
       }
      ]
     }
    ]
   }
  ],
  "evidence": {
   "harness": "scripts/mitm-sanitize.py",
   "rawCaptureSha256": [
    "baec63fee2dccd5a0311f5cb5085e7c865263ba15e89652ab03170d99dd750e1",
    "9bf27282b5202e3b688b07fac88d1465cf631bc71749f74c579acdf69b5a7733",
    "401d1c519fc15215f458790f576a6f6bd32e23f8437fe5c994056e231f644e67"
   ],
   "sanitizedManifestSha256": [
    "921da49d4bd90ed040f86ab5e3c2c9658fbca48d42d5970a20b7ce4e7221b7e5",
    "3c787f4a9554e4355f8ca09985f6440f208526038dff72c275d208ba53c29ec1",
    "e49f8ae9b8a69555422d9992d1e6e9ce5ceaf9e5ec86e60b72d3da8cb17f4742"
   ]
  },
  "limitations": [
   "The API key was intentionally invalid, so this is a startup and retry trace, not a successful coding session.",
   "One Git TLS connection rejected the test CA; opaque connection coverage is not included in decoded request totals.",
   "No analytics opt-out comparison has been run.",
   "The test used macOS arm64 and one network path behind the operator's existing VPN."
  ],
  "manifest": "/evidence/codex-cli-0.146.0.json"
 }
}