Override validation uses the image the tick runs with

[renmengye]

Found on a live deployment before it could hurt it. The tick runs sessions with OUTERLOOP_IMAGE, falling back to the default image, but its startup validation of OUTERLOOP_AUTHOR_OVERRIDES used OUTERLOOP_IMAGE falling back to an empty string. On a deployment that leaves OUTERLOOP_IMAGE unset (its codex authors run fine on the default image), adding a codex override made validation fail with "requires --image", and that failure exits the tick through parser.error: a whole-fleet outage. outerloop start had the same mismatch.

What changes

• tick.startup_image(): the one place that decides the session image (OUTERLOOP_IMAGE, else the default). The service spec and startup validation both use it.
• outerloop start validates with the same default when the setting is unset.

Compatibility (RELEASING.md)

No persisted state. Deployments that set OUTERLOOP_IMAGE behave exactly as before; deployments that do not can now use codex overrides.

Tests

The production case (codex override, OUTERLOOP_IMAGE unset) validates with the tick's image and fails with the old empty image; a guard that the tick's entry point validates with startup_image() (mutation-checked: reverting the call fails it). Gate: 2755 passed, 10 skipped; ruff, format, mypy clean.

🤖 Generated with Claude Code

[github-actions]

Round 1 — reviewed head 85213199 — reviewer summarizer:hermes/gpt-5.6-terra over coverage+credentials+deployment+general+lifecycle+prose.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: 1 blocking, 0 advisory.

1 finding attached to the lines below.

Merged one blocking finding: coverage, credentials, deployment, general, lifecycle, and prose agree that explicit empty image settings make start-time and tick-time override validation disagree. Rejected findings: none; all submitted findings describe the same defect at src/outerloop/cli.py:620.

[github-actions]

Round 1 — reviewed head 85213199 — reviewer hermes/gpt-5.6-terra.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: 1 blocking, 0 advisory.

1 finding attached to the lines below.

The start command accepts a Codex override with the explicit no-image setting, then launches a tick that rejects it.

[github-actions]

Round 2 — reviewed head 1346a6cb — reviewer hermes/gpt-5.6-terra.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: 1 blocking, 0 advisory.

1 finding attached to the lines below.

Start can validate a different image from the tick when the environment and .env both set OUTERLOOP_IMAGE.

[github-actions]

Round 3 — reviewed head 47fd7817 — reviewer hermes/gpt-5.6-terra.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: 1 blocking, 0 advisory.

1 finding attached to the lines below.

Local and login starts can validate a different image from the tick they launch.

[github-actions]

Round 4 — reviewed head 453ccce0 — reviewer hermes/gpt-5.6-terra.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: no defects found.