OpenAI-Codex Daybreak Blue access program support
OpenAI are retiring the gpt-daybreak-blue-latest model alias from the Codex API catalog and instead provide an available_access_programs.cyber property for each model and a corresponding access_programs.cyber property for inference calls. The official guidance for the Responses API is honestly kind of weird and also a little out of date, but it explains the general shape. Note that the access program is selected per turn, so each request using Daybreak Blue access needs to have access_programs.cyber = "daybreak_blue".
available_access_programs.cyber information becomes available when an authenticated account reads the model catalog from the API. This information is then propagated to the model pickers in both webui and TUI, exposing an additional model choice of the format <catalog-name> · Daybreak Blue for each model accessible under Daybreak Blue. Selecting a Daybreak Blue model persists across turns, however each turn checks the local model catalog cache (and refreshes it if stale) to ensure a model with the corresponding access property exists. If the catalog cache has updated and no corresponding model selection exists, no inference request is sent and an error is raised for the user. New-session requests also checks access before hitting the API.
Daybreak Blue access is also surfaced for agents when querying the model catalog, so agents are capable of spawning subagents with Daybreak Blue access. A manually forked session will retain the access program setting of the progenitor.
Additionally, the albedo CLI command now takes a --cyber-access flag to enable creating new workspaces, or run a headless prompt, with Daybreak Blue access:
albedo new [workspace] --cyber-access=daybreak_blue
albedo new [workspace] --cyber-access=standard
albedo --prompt '...' --model codex/gpt-6-sol --cyber-access=daybreak_blue
albedo --prompt '...' --session <id> --cyber-access=standard
Tests: ./test.sh and ./test.sh --full both pass with this PR based on upstream ae46b165b5e9b2d886172e38fa8a2caaec8b5497. Tests have been added for account-bound eligibility, session behavior, provider requests, CLI/TUI and webui settings picker and error behavior.
Note: in all cases where the access parameter daybreak_blue may be provided, Albedo will default to standard which is the explicit choice to use the standard cyber safeguards.
Note 2: OpenAI web_search queries are excepted from requesting Daybreak Blue access. I have no idea if that's even possible, and it seems kind of silly, and OpenAI's documentation doesn't mention it.
Note 3: surfacing Daybreak Red access should be an easy patch on top of this, but I'm not cool enough to join that club so I'm not going to bother. :3
