A review environment should feel like booking a meeting room.

Recommended day-one boundary: each room has a fixed identity and dedicated mutable product state. Shared services are allowed only when they are stateless or deliberately partitioned by room and lease.

• Related changes from several designers are deliberately assembled into one candidate PR. The room is a place to experience their interactions together, not merely a preview for one isolated branch.
• The candidate PR is canonical for the lease. Its component PR numbers and exact head SHAs are recorded as inputs, so adding or removing work is an explicit, auditable generation change.
• When work is tightly coupled, open the canonical PR early. When work is independently useful, preserve separate PRs and create a short-lived bundle only when interaction testing is needed.
• Component PRs cannot queue independently while included in an active bundle. When the canonical bundle merges, automation marks them as included and closes them with a link to the merge.
• The workflow checks out the candidate PR and creates a temporary merge with the selected staging baseline. It does not push that merge back to a designer's branch.
• A conflict fails before deployment and leaves the existing room untouched. An agent can resolve the real conflict on the PR once.
• The lease stores base_sha, head_sha and candidate_sha. Staging moving forward does not silently alter a room under active review.
• “Update the room” explicitly builds a new candidate and increments its generation. Review acceptance is cleared whenever the candidate SHA changes.
• Acceptance freezes the reviewed work, not an old base. Before merge, the candidate is always rebuilt against the latest staging tip and that exact merge result must pass the required integration checks.
• If staging advances while verification is running, the merge queue regenerates the candidate against the new tip and verifies it again. Only a green candidate based on current staging may merge.

{
  "slot": "review-2",
  "lease_id": "lease_7f2…",
  "generation": 4,
  "owner": "lagnesh",
  "pull_request": 241,
  "component_prs": [238, 239],
  "base_sha": "staging@8b7…",
  "head_sha": "feature@73a…",
  "candidate_sha": "review@129…",
  "state": "ready"
}

Reset makes a room clean; parking makes it cheap. Neither operation deletes the room's DNS, Access application or provider identity. The workflow proves a known staging baseline before releasing the lease, then stops compute that need not run while nobody owns the room.

1. 1
   Fence the lease

   Atomically move the matching lease generation to resetting. New claims are rejected.

2. 2
   Resolve the baseline

   Fetch the current staging SHA after the merge event—not the staging SHA from when the room was claimed.

3. 3
   Replace code

   Deploy staging frontend and backend artifacts to the room's fixed destinations.

4. 4
   Destroy mutable state

   Recreate the dedicated database, wipe the dedicated R2 bucket and invalidate room-scoped sessions, caches and jobs.

5. 5
   Rebuild known state

   Run migrations, apply the versioned sanitized seed and create namespaced test identities.

6. 6
   Prove the baseline

   Run readiness plus one representative journey while the room is still running.

7. 7
   Release and park

   Close the lease, stop workers and scheduled jobs, scale or suspend eligible compute, then publish available · parked.

Codex supports remote Streamable HTTP MCP servers with bearer-token or OAuth authentication; OAuth is the preferred user-attributable route. Official OpenAI MCP documentation ↗

• The controller accepts a GitHub webhook only when the PR number, repository and recorded lease match.
• Automatic cleanup requires merged = true and base.ref = staging. Closing, merging elsewhere or deleting a branch does not masquerade as a staging release.
• The merge queue records the staging-tip SHA used for its final candidate. If the tip changes first, the candidate is regenerated and all required verification reruns before merge.
• Every command and workflow callback carries lease_id + generation. A delayed callback from generation three cannot update generation four.
• Webhook delivery IDs and workflow idempotency keys are recorded, making retries safe.
• Force release is an approver-only command with an explicit reason; it always runs reset before the room can be claimed again.

Available means claimable, not necessarily running. A parked room keeps its stable address and authority boundaries while avoiding idle application compute.