Pin Codex 0.165.0 and read its archive layout from a reviewed listing file

setup/provenance/README.md

@@ -40,7 +40,7 @@ The key sources above are supported by these publisher-controlled records:
 - `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
 - `https://github.com/nodejs/node/releases/tag/v24.20.0`
 - `https://github.com/nodejs/node/blob/main/README.md`
-- `https://github.com/openai/codex/releases/tag/rust-v0.150.1`
+- `https://github.com/openai/codex/releases/tag/rust-v0.165.0`
 - `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
 - `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
 
@@ -50,8 +50,8 @@ The reviewed immutable artifact and repository URLs are:
 - `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
 - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
 - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
-- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz`
-- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz`
+- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz`
+- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz`
 - `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
 - `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
 - `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
@@ -72,6 +72,15 @@ record both the reviewed archive digest and this reviewed installed-byte digest
 in `.panama-provenance`; later runs require the receipt and re-hash the installed
 binary before treating an existing directory as trusted.
 
+Codex was re-reviewed on 2026-10-29 for 0.165.0. Each archive's `sha256sum`
+matched the `digest` GitHub publishes for that release asset. The installer
+accepts a Codex archive only when `tar -tzf` prints exactly the entries in
+`codex-package.listing`. Both architectures share that listing. 0.165.0 dropped
+the bundled `codex-resources/zsh/` and added `codex-resources/voice/`, and the
+archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. To bump Codex,
+update `installers.conf`, regenerate the listing with `tar -tzf ARTIFACT`, and
+run `tests/setup/package-provenance-contract`.
+
 ## Panama bootstrap
 
 The public desktop and server commands use the same committed `boot` blob: