GPT-5.5’s 14 October ChatGPT Change: Audit the Surface and Model ID

News analysis, 6 October 2026: OpenAI says GPT-5.5 is scheduled to retire on 14 October 2026 from ChatGPT, ChatGPT Work and Codex on all plans, including consumer, Business, Enterprise and Edu plans. The company’s changelog immediately limits that statement: this retirement does not apply to the OpenAI application programming interface (API)A documented way for software systems to exchange requests and results. Open glossary entry. Teams should therefore audit each saved selection by product surface and authentication method before editing a release plan, selector or production document.

What is scheduled for 14 October

The scheduled event concerns named product surfaces, not every context in which the text “GPT-5.5” might appear. As of 6 October 2026, OpenAI’s changelog says GPT-5.5 is scheduled to retire from ChatGPT, ChatGPT Work and Codex on 14 October. For Codex, the associated instruction is specifically framed around Codex with ChatGPT sign-in: users are told to choose an available option for their plan and client.

The explicit API non-application is equally important. It means the 14 October product notice is not, by itself, an API retirement notice. It does not establish perpetual API availability, however. OpenAI maintains a separate API deprecations page, and any later API lifecycle decision would need to be assessed from that independent signal. Classify the 14 October notice by its named surfaces; classify API status from API documentation, account evidence and the API deprecations record. Do not use one as a substitute for the other.

A practical first pass is to search release calendars, internal documentation and configuration inventories for the literal strings “GPT-5.5” and gpt-5.5. Treat every match as an unresolved reference until its product and authentication context are recorded. For example, “GPT-5.5 enabled for October release” is insufficient evidence: it could refer to a ChatGPT workspace selection, Codex authenticated through ChatGPT, a direct API request or a gateway alias. Bulk-editing the label is quick but can conflate unrelated surfaces; classifying each match takes longer but avoids turning a bounded product change into an unsupported system-wide claim.

OpenAI’s retirement guidance identifies workspace defaults, saved model settings, managed configurations, custom agents, scheduled tasks and scripts as places that can still select gpt-5.5. That list is an inventory starting point, not proof that every location exists or is affected in every organisation. A team should record which of those locations it actually uses, who owns each one and which product executes it. A consequential release decision must receive human review after the evidence has been collected.

The boundary is the surface and sign-in

OpenAI’s workspace documentation says model availability depends on the product surface and how the user signed in. It also says a ChatGPT workspace setting does not automatically apply to Codex in the ChatGPT desktop app, Codex command-line interface (CLI)A text-based interface for running commands and tools. Open glossary entry, integrated development environment extension, Codex cloud or the OpenAI API. Changing a default does not grant access. Consequently, a familiar display label across two interfaces is not evidence that the underlying entitlement, identifier or lifecycle is shared.

The matrix below is a classification aid, not an availability guarantee. Its “known source fact” column states only what the assigned official documentation supports. The local-evidence column describes what a team should gather without exposing credentials or customer material. The final column prevents overreach.

Use the matrix row that describes the execution path, not the row whose product name looks most familiar. If a workflow starts in a coding client but sends requests through an API key, classify it separately from Codex with ChatGPT sign-in. If a gateway receives an OpenAI-like model string, place it in the gateway row until its upstream route is evidenced. Where one workflow spans several rows, create linked records rather than collapsing them into a single status.

For example, a ChatGPT workspace administrator may see a saved default labelled “GPT-5.5”. The correct procedure is to record that setting under ChatGPT Work, identify the workspace and role scope, and check the applicable admin and plan state. A saved label identifies an inventory location; entitlement requires separate evidence. This distinction matters because a stale default can survive after availability changes, and a documented option can remain unavailable to a particular seat or client.

Before changing a saved workspace or Codex selection, distinguish the product surface from its default configuration and permissions, then separate defaults from actual model entitlements so a visible starting option is not confused with confirmed access on the affected plan, role, client and workspace.

A release-plan decision starts with proof

Consider a synthetic example. A release manager opens a calendar entry created several months earlier and sees the saved text “GPT-5.5” beside a 20 October documentation milestone. The manager does not immediately replace or delete it. First, they copy the literal label into an evidence record and mark it as an unverified display name. They identify the named product from the linked work item, record whether the intended user signs in with ChatGPT or authenticates with an API key, and assign an owner who can verify that context.

Suppose the calendar entry links to a Codex task but does not say how Codex authenticates. That missing fact prevents classification. The manager pauses editing until the owner establishes whether it is Codex with ChatGPT sign-in, API-key Codex, Codex cloud or a provider-mediated route. The scheduled retirement is relevant immediately only if the evidence places the selection on the named product and sign-in surface. If the task instead uses a direct API project, it belongs in a separate API review because the changelog expressly says this retirement does not apply there.

This pause is not a claim that the workflow will continue or fail. It preserves the distinction between a scheduled product retirement and an unresolved local reference. A short delay in document editing is preferable to the risk of publishing an inaccurate lifecycle statement. For a release note, customer communication, production selector or other consequential change, require a human owner to approve the classification and supporting evidence.

Non-destructive verification procedure

1. Preserve the literal selection. Copy the displayed label or configured model string exactly, including punctuation and version text. Take a redacted screenshot or text extract where policy permits. Do not normalise “GPT-5.5” into gpt-5.5 before establishing whether one is a display label and the other a documented API identifier.
2. Name the product surface. Record ChatGPT, ChatGPT Work, the specific Codex client, Codex cloud, direct API or custom gateway/provider. If the source does not reveal the surface, mark it “unresolved” rather than guessing from the wording.
3. Record authentication context. Note ChatGPT sign-in, API key or provider-managed authentication. Record only the category and, where needed, a non-secret account reference. Never paste tokens, API keys, session material, private configuration or credentials into prompts or evidence notes.
4. Capture scope. For product use, record the relevant plan, client, workspace, seat or role. For API use, record the organisation or project and the non-production environment. For a gateway, record the routing owner and provider. Avoid live customer data.
5. Attach authoritative documentation. Save the applicable official source Uniform Resource Locator (URL)The address used to identify and access a resource on the web. Open glossary entry and its read date. Use the ChatGPT changelog for the scheduled product event, the workspace page for surface and sign-in rules, and the API model or deprecations pages for API claims.
6. Verify entitlement separately. Check the intended account, role or project rather than relying on a picker, configuration value or documentation entry. A control appearing in a client is evidence of interface state, not proof that the request is authorised or usable.
7. Run a scoped non-production check where appropriate. Use representative but non-sensitive input in the intended environment. Keep secrets and untrusted data out of prompts. Record the exact model string and context, but redact request credentials and protected content. This is a suggested verification method, not a guarantee of future behaviour.
8. Apply a reviewed status. Mark the record “in scheduled product scope”, “separate API review”, “provider review” or “unresolved”. Have a responsible person review any decision that changes production documentation, scheduled work or customer-facing material.

A compact evidence record might read: “Claimed label: GPT-5.5; surface: unresolved Codex client; authentication: awaiting owner confirmation; plan/project: not yet evidenced; source: OpenAI changelog; read: 6 October 2026; action: pause calendar edit.” That sample is an example of record structure, not a product result. Its value lies in exposing the missing authentication fact instead of concealing it behind a familiar label.

The same label can require a different classification

A useful negative test is to find the same “GPT-5.5” label in an API request builder. Do not mark that item retired merely because the display text matches the calendar entry. Record the builder as a direct API or provider-mediated surface, inspect the literal request model value and identify the API organisation or project. If the request uses gpt-5.5, compare that exact string with the official API model documentation and perform a representative non-production entitlement check.

The reason for separate classification is source scope. OpenAI’s 14 October notice expressly excludes the API, while the API page independently documents the model identifier (ID)A value used to distinguish one record, task, source or object from another. Open glossary entry gpt-5.5 and default snapshot gpt-5.5-2026-04-23. OpenAI describes snapshots as locking a specific model version so performance and behaviour remain consistent. A snapshot is therefore a version-control selection; it neither preserves a ChatGPT picker nor proves access for an API project.

Conversely, the API documentation cannot preserve a product picker after a product-surface retirement. A documented API identifier is evidence about the API catalogue, not evidence that ChatGPT, ChatGPT Work or Codex with ChatGPT sign-in will continue exposing the corresponding option. Keep both directions distinct: do not use API documentation to negate a named product change, and never use a product notice to declare all key-authenticated or provider-mediated configurations stopped.

A team that discovers a reference to GPT-5.5 in a tool should first decide whether it belongs in ChatGPT, Codex or a product-owned API workflow and choose the smallest controlled integration surface rather than assuming that membership, configuration or permissions on one OpenAI surface transfer to another.

Record the string before interpreting it

An identifier audit starts with the characters actually found, not with an editor’s recollection of a model name. Preserve capitalisation, punctuation and version suffixes exactly. A human-facing label such as “GPT-5.5” may describe a picker entry or documentation heading, while gpt-5.5 is the model identifier documented on OpenAI’s public API page. Neither should be silently substituted for the other. The distinction matters because a display name can be suitable for prose but invalid in an application request, and an API identifier does not prove that a similarly named option remains selectable in ChatGPT.

Where both contexts exist, the audit needs two records: one for the affected product or ChatGPT-sign-in selection and another for the direct API or API-key context.

Create one evidence row per claimed selection. The minimum fields are:

• Claimed string: the value exactly as found, including case, spaces, punctuation and any date suffix.
• Official ID or display name: whether an official source treats the string as a request identifier, a human-readable name, or neither.
• Snapshot or alias: whether the value is a dated version or a non-dated identifier.
• Source URL: the official page used to classify it.
• Read date: when the page was checked; for this report, 6 October 2026.
• Intended surface: ChatGPT, ChatGPT Work, Codex with ChatGPT sign-in, API-key Codex, Codex cloud, direct API, or a custom gateway or provider.
• Authentication context: ChatGPT sign-in, API key and associated organisation or project, or another provider’s credentials.
• Endpoint: the API endpoint intended to receive the identifier, if this is an API record.
• Disposition: retain for verification, correct documentation, test in a non-production context, escalate an ambiguity, or remove only after approval.

The procedure is to copy the value into the claimed-string field, classify its source and intended surface, and only then compare it with official documentation. For example, finding gpt-5.5-2026-04-23 in an application variable should produce a snapshot record. It should not be normalised to gpt-5.5 merely because the shorter value appears easier to read. Conversely, the heading “GPT-5.5” in a release note should not be converted automatically into an API configuration value.

If the source, surface or authentication context is unknown, the disposition remains “unresolved”; it is not “invalid” or “safe to replace”. This costs more record-keeping than a global search-and-replace, but it prevents one surface’s retirement notice from being applied to a different contract.

The documented ID and snapshot

OpenAI’s GPT-5.5 API page identifies gpt-5.5 as the model ID and gpt-5.5-2026-04-23 as the default snapshot. These are related but distinct strings. The non-dated ID is the documented model identifier; the dated string selects the specified snapshot. Record both when the repository, deployment record or release documentation uses both, rather than treating the suffix as incidental formatting.

OpenAI describes snapshots as a way to lock a specific model version so that performance and behaviour remain consistent. That makes a snapshot a consistency control. It is not a separate product family, proof that an account is entitled to use the model, evidence that the model appears in a ChatGPT picker, or a promise that any ChatGPT surface will preserve it after 14 October. Nor does documenting the default snapshot mean that every application must replace the alias with that snapshot. Choosing between them is an application-level control decision that requires testing and approval.

Audit the pair with the following procedure:

1. Compare the stored value character-for-character with gpt-5.5 and gpt-5.5-2026-04-23.
2. Mark the first as the documented ID or alias and the second as the documented snapshot; do not collapse the records.
3. Attach the GPT-5.5 API model page as the official source and record 6 October 2026 as the read date.
4. State the intended API endpoint and authentication context separately.
5. Check entitlement in the intended organisation or project without placing an API key, token or other secret in the audit record.
6. Run a representative non-production request before approving a release change.

For example, a deployment manifest might hold the snapshot because its owner wants explicit version control, while an internal reference page uses gpt-5.5 to describe the documented model. The evidence record should retain both and state their different purposes. Changing the manifest to the alias could reduce version specificity; changing the documentation to the dated snapshot could misrepresent a general reference as an implementation commitment.

Retain the exact snapshot where explicit version locking is an approved requirement, and retain the non-dated ID where the application intentionally follows that documented identifier. Do not decide between them merely from the changelog event. The choice is between an explicitly version-locked request and one using the documented non-dated identifier; official documentation establishes the strings, but representative testing and human review must establish which control is acceptable for a consequential release.

Keep alias, snapshot and display label as separate evidence

A repository often contains more than one representation of the same underlying selection. The audit must distinguish a machine-supplied value from an internal alias and from text shown to people. An alias can be local to an application or gateway, whereas a display label may be freely worded. Neither becomes an official OpenAI model ID simply because it resolves internally to one.

Consider this synthetic repository example, offered only to demonstrate record preservation rather than to prescribe a configuration format:

MODEL_SNAPSHOT=gpt-5.5-2026-04-23
MODEL_ALIAS=primary_reasoning_model
MODEL_DISPLAY_LABEL=GPT-5.5

The correct evidence record retains all three values. Record gpt-5.5-2026-04-23 as the documented snapshot. Record primary_reasoning_model as a repository-defined alias whose resolution must be inspected. Record “GPT-5.5” as the human-facing display label. Do not rewrite the alias to gpt-5.5, remove the snapshot suffix, or add code formatting to the display label as part of discovery. Those would be changes, not observations.

A practical review should also preserve provenance: file or system owner, environment classification, and the place where the alias resolves. Keep secret values and untrusted repository content out of prompts used to assist the review. Record redacted references rather than credentials, tokens, customer inputs or complete environment dumps. If an alias is supplied by a custom gateway, its mapping is evidence about that gateway, not evidence that OpenAI documents the alias.

Keep each layer distinct until its owner confirms the mapping and a safe test verifies it. Consolidation can make documentation tidier, but premature consolidation destroys evidence about where a value originated. Any edit that can alter production routing, customer-visible text or release commitments requires human review.

Test an unsupported label without promoting it

The phrase “GPT-5.5 Mini” requires a name audit, not a product comparison. On the official public API model pages reviewed on 6 October 2026, OpenAI listed gpt-5.5, gpt-5.5-pro, gpt-5.4-mini and gpt-5-mini. The string gpt-5.5-mini was not documented on those reviewed pages. That is an absence finding bounded by the pages and date; it is not proof about private, future, regional, partner or unpublished availability.

Use this name-audit procedure:

1. Write the claim exactly as received: “GPT-5.5 Mini”.
2. Inspect the dated public API model index and the relevant official model page.
3. Quote only the IDs that those pages actually list: gpt-5.5, gpt-5.5-pro, gpt-5.4-mini and gpt-5-mini.
4. Record: “gpt-5.5-mini was not documented on the public official API pages reviewed on 6 October 2026.”
5. Do not create a configuration value, comparison row or replacement plan for the unsupported label.
6. If the phrase came from an internal system, classify it as an unverified local label and ask its owner for provenance.

For example, suppose a draft release note says, “Move to GPT-5.5 Mini.” The auditor should not convert that wording into gpt-5.5-mini and attempt to legitimise it through formatting. The evidence row should retain the phrase as the claimed string, mark the official-ID field as “not documented on reviewed public pages”, include the read date, and return the claim to its owner for correction or substantiation.

A related negative test is the assumption that gpt-5.4-mini must be the recommended substitute because it is a distinct listed ID containing “mini”. Reject that inference. Its presence in the public index establishes that it is a documented identifier; it does not make it OpenAI’s recommendation for this application, this plan, this client or the 14 October event. The same restriction applies to gpt-5-mini. Similar naming is not migration guidance.

Publish the dated absence statement only at its supported scope. If an official public page does not document the claimed identifier, stop before discussing access, capabilities, pricing, performance or suitability. This restraint may leave an internal question unresolved, but it avoids converting a typo, house label or unsupported assertion into an apparent offering.

Match the endpoint to the record

The GPT-5.5 API page documents Chat Completions at v1/chat/completions, Responses at v1/responses, and Batch as supported. It documents Assistants at v1/assistants and fine-tuning at v1/fine-tuning as not supported. These statuses form an endpoint contract boundary; they do not establish entitlement, quota, regional routing, gateway compatibility or successful execution in a particular project.

Record the endpoint alongside the model string because “the model is documented” is too broad to approve an implementation. A request builder targeting Responses has a different contract from one targeting Chat Completions. OpenAI’s GPT-5.5 page also lists supported features and Responses tools, but a tool listed for Responses does not automatically describe Chat Completions. In particular, do not copy a Responses tool selection into a Chat Completions plan merely because both endpoints support the same model ID.

Use an endpoint-contract check before changing a release record:

1. Identify the endpoint actually invoked, rather than the endpoint an owner believes is invoked.
2. Compare that endpoint with the support table on the GPT-5.5 model page.
3. Record tools, input forms and output handling only under the endpoint where they are documented.
4. Mark Assistants and fine-tuning proposals as outside the documented GPT-5.5 support boundary.
5. For Batch, record the underlying request form and test the actual intended combination rather than relying on the word “supported” alone.
6. Verify through a representative non-production request in the intended API organisation or project.

For example, a design note might pair gpt-5.5 with v1/chat/completions while a separate test plan mentions a tool documented for Responses. The model-and-endpoint pair is documented, but the tool claim must be checked against the Responses contract and must not be carried across automatically. The disposition should be “split and verify”, not “supported by model page”. Likewise, an Assistants implementation cannot be approved for GPT-5.5 merely because another endpoint on the same page is supported.

Approve only the exact documented and tested combination of identifier, endpoint and required features. Reusing one model ID across endpoints can simplify inventory, but it can conceal contract differences. Where the intended endpoint is unsupported, do not improvise a substitution inside the audit; return the design for human review.

For direct API inventory, teams should preserve the identifier, snapshot and retrieval evidence rather than copy a ChatGPT picker label, so they can record the documented GPT-5.5 ID and snapshot before editing a request builder or treating a generated answer as evidence that the project is entitled to use that model.

Prove access with a scoped non-production request

After the documentary check, make one representative non-production request through the intended endpoint and authentication context. Use safe, synthetic or approved non-sensitive input that exercises the application’s necessary request shape without containing live customer data. Capture the timestamp, organisation or project reference in redacted form, model string sent, endpoint, requested features, response status and enough non-sensitive outcome detail for a reviewer to distinguish success from rejection. Never capture or paste the credential itself.

A suitable example method is to send a benign synthetic task through the non-production project using the exact snapshot and endpoint proposed for release, then retain a redacted request description and the resulting status. This is an example of a verification method, not a guarantee of future access or behaviour. A successful request establishes only that the tested combination worked in that scoped context at that time. It does not prove another workspace, project, region, gateway or sign-in method will behave identically.

A failed request also needs careful classification. It may show lack of access, an unsupported endpoint or feature, an invalid request, or another project-specific condition; it does not by itself disprove the public documentation. Preserve the safe error category, remove sensitive material, and route the finding to the responsible owner. Do not repeatedly test production credentials or live data to turn an ambiguous result into apparent certainty.

Documentation alone cannot authorise a release decision. Require both a source-backed contract record and a representative non-production outcome in the intended scope, followed by human review. This adds time compared with accepting a picker or configuration value as evidence, but it distinguishes discoverability from entitlement and documented support from operational verification.

After an organisation has separately verified entitlement for any model it chooses to test, a staged evaluation and rollback case study shows a customer-agent example of testing historical and simulated work against declared quality, tool-use and human-escalation criteria before a limited rollout. This is a method illustration, not evidence that a successor to GPT-5.5 is available or preferred.

Close the record without overstating the lifecycle

The final disposition should answer a narrow question: is this exact named selection, on this surface and authentication context, sufficiently evidenced for the proposed release action? It should not declare GPT-5.5 universally available or unavailable. A ChatGPT retirement finding and an API verification can coexist because they concern separate surfaces. Similarly, a successful direct API request does not preserve a ChatGPT picker, and the scheduled product retirement does not establish that an API-key Codex, Codex cloud or custom provider route will stop.

Before closure, have a reviewer confirm that the row contains the exact claimed string, official classification, snapshot or alias status, source URL, 6 October 2026 read date, intended surface, authentication context, endpoint and disposition. The reviewer should also check that unsupported-name findings use the bounded absence wording, that no credentials or live customer data have been retained, and that any consequential change has an accountable human approver.

For example, a complete API disposition might say that gpt-5.5-2026-04-23 is the documented default snapshot, intended for Responses in a named non-production project, with entitlement and the representative safe request still pending. That record is not release approval. Once those checks are completed, the disposition can identify the captured outcome and approval without claiming future continuity. A ChatGPT row using the display name “GPT-5.5” would instead cite the scheduled 14 October retirement and remain separate.

Search for persisted selections, not a single setting

As of 6 October 2026, the control objective is to find every persisted selection that could still send work to gpt-5.5, then classify each finding by product surface and authentication boundary. OpenAI’s changelog says the model is scheduled to retire on 14 October 2026 from ChatGPT, ChatGPT Work and Codex on consumer, Business, Enterprise and Edu plans, but says this retirement does not apply to the OpenAI API. That distinction means a single organisation can have affected ChatGPT-sign-in selections alongside separately governed API-key selections.

Use OpenAI’s named inventory locations (workspace defaults, saved model settings, managed configurations, custom agents, scheduled tasks and scripts) as a starting point. A search result proves only that text or a setting was found; it does not prove which configuration wins, whether the account has access, whether the code executes or whether the 14 October event governs that surface.

1. Define the search token. Search first for the exact documented identifier gpt-5.5. Record the documented snapshot gpt-5.5-2026-04-23 separately, because an alias and a locked snapshot are different configuration choices.
2. Set boundaries before running tools. List the workspaces, trusted repositories, deployment definitions and configuration stores that the audit is authorised to inspect. Exclude dependency caches, generated output and personal directories unless they are expressly in scope.
3. Search without collecting secrets. Return a redacted location class, line or setting name, owner and match count. Do not copy tokens, credentials, customer prompts, production payloads or unrelated configuration values into search reports or model prompts.
4. Inspect each match in place. Determine whether it is active configuration, an example, a test fixture, documentation, dead code or generated material. A release note containing the string is not equivalent to an executable request builder.
5. Assign one surface and one authentication boundary. If a finding can feed several surfaces, create linked records rather than labelling it “global”. Each record needs its own access check and non-production test plan.

For example, a repository search might safely report “three exact matches: one trusted project configuration, one deployment template and one archived example”, without printing paths other than documented configuration examples or exposing surrounding values. A match remains unresolved until an owner has classified whether it can influence an in-scope execution path. The trade-off is additional review effort, but deleting every literal match risks changing examples, tests or API paths that are not governed by the ChatGPT retirement.

Separate inventory lanes before changing a value

The inventory should have six lanes. They may contain the same literal string, but no lane proves the status of another. OpenAI’s workspace documentation says availability depends on the product surface and sign-in method, and that a ChatGPT workspace setting does not automatically apply to Codex clients, Codex cloud or the OpenAI API. Use the following procedures to prevent a convenient workspace observation from becoming an unsupported organisation-wide conclusion.

ChatGPT workspace settings

Inventory workspace defaults, saved model selections, managed settings and any agent configuration administered through the ChatGPT workspace. Record the workspace, plan category, affected seat or role class, setting owner and whether the selection is a default or an explicit saved choice. Do not infer access from the presence of a picker or configuration value: OpenAI expressly says changing a default does not grant model access.

A practical review starts with an administrator exporting or manually recording the relevant setting metadata without user conversations. A sample evidence entry might read: “Example only — consumer-facing workspace; default contains gpt-5.5; owner: collaboration platform team; authentication: ChatGPT sign-in; seat scope: to be confirmed.” An administrator may flag the setting for change only after its workspace scope and entitled user population are known. A broad default is easier to find, but it may conceal saved user-level selections that need separate handling.

ChatGPT Work and Codex with ChatGPT sign-in

For this lane, inspect workspace defaults, saved settings, managed configuration, custom agents, scheduled tasks, scripts or commands and local configuration used by the relevant Codex client. Confirm that the user or automation actually signs in with ChatGPT. OpenAI’s retirement guidance specifically directs users of Codex with ChatGPT sign-in to choose an available option for their plan and client; it should not be expanded to every Codex authentication method.

Review client-by-client rather than recording “Codex” as one system. For example, a custom agent saved in a workspace and a command launched from a developer’s local client can share a model string while receiving configuration from different places. Record the desktop application, CLI or integrated development environment client, the sign-in method and the setting’s owner. A ChatGPT-sign-in finding belongs in this lane only when the authentication method is verified; an ambiguous credential source must remain unclassified.

OpenAI documents personal Codex defaults at ~/.codex/config.toml and project overrides in .codex/config.toml. Inspect those files only in authorised accounts and trusted repositories. Capture the key name and redacted value, not the rest of the file. Project configuration deserves separate ownership because a repository can persist a selection after a user or workspace default changes.

For managed Codex deployments, inventory findings should be tested against the effective policy rather than inferred from one local file or console view, so security and platform owners can test the effective managed configuration and precedence and distinguish enforced requirements from user-changeable defaults before they document a supposedly retired selection as removed.

Codex with an API key

Place API-key-authenticated Codex in its own lane: check its API organisation or project independently of any ChatGPT workspace setting. Inventory local configuration, environment-variable references, wrapper scripts, project settings and continuous-integration jobs, while recording only the credential’s non-secret organisational reference. Never print the key, copy it into an audit prompt or test against production data.

For example, a script may contain gpt-5.5 while obtaining its key from an approved secret store. The finding should state “API-key Codex; project reference redacted; key material not collected”, then identify a non-production project in which entitlement can be checked. Do not classify this as affected merely because a ChatGPT-sign-in client is scheduled to lose the selection. Conversely, the changelog’s statement that this retirement does not apply to the API is not a perpetual-availability guarantee.

Codex cloud

Codex cloud requires a distinct record even when it is visible to the same user as a local client. Inspect cloud-managed defaults, repository associations, task definitions and any centrally supplied environment or policy configuration. Establish how the cloud task authenticates instead of inferring its boundary from the person who created it.

A safe example record is: “Codex cloud task template references model ID gpt-5.5; authentication boundary unresolved; repository owner and cloud administrator assigned.” Do not edit until the cloud owner confirms which setting is effective and provides a representative non-production task that contains no live customer data.

Direct API

The direct API lane needs a code-and-deployment inventory, not a workspace-settings review. Inspect request builders, deployment variables, internal aliases, explicit snapshots, endpoint selection, tests or evaluations, tool dependencies, limits, data-residency routing and provider mappings. Record the API organisation and project by approved internal identifier, without retaining keys.

Separate gpt-5.5 from gpt-5.5-2026-04-23. A snapshot is a version-control choice, not evidence that a ChatGPT picker remains available. Also record whether code targets Chat Completions, Responses or Batch, which OpenAI documents as supported for GPT-5.5. A request aimed at Assistants or fine-tuning needs correction at the contract level because the model page marks those as unsupported, independently of the 14 October retirement.

For example, an API inventory might identify an internal alias resolving to the snapshot, a Responses request builder and a tool schema used in evaluation. The review should verify that exact combination in the intended non-production API project with representative, non-sensitive inputs. Documentation of an ID or endpoint is necessary evidence but not access proof; entitlement, limits, routing and tool behaviour require scoped verification.

Custom provider or gateway

A gateway can translate a friendly label, route to another provider or map an alias to an OpenAI model. Inventory routing tables, provider adapters, regional policies, fallback rules, deployment names and any model-normalisation code. Record both the incoming label and the resolved provider identifier. Do not assume that a gateway label matching gpt-5.5 reaches OpenAI, or that an OpenAI documentation change automatically alters a third party’s mapping.

As an example, “GPT55-primary” might resolve through a redacted routing map to the literal gpt-5.5. That is evidence of a mapping, not a promise of provider continuity, residence, quota or billing treatment. Obtain the gateway owner’s resolution evidence and a non-production route test before editing downstream release materials. The trade-off is that abstraction simplifies application code but can hide the model, provider and authentication boundary that determine actual impact.

Precedence is evidence, not a guess

Finding several values does not establish which one controls execution. For Codex configuration, investigate CLI flags, project configuration, profiles, user configuration, cloud-managed defaults and system configuration as potential precedence inputs. OpenAI documents the personal and project file locations, but this audit should not invent one universal order for every client, version and managed environment.

Use a controlled provenance test. First, record all candidate sources without changing them. Secondly, identify the client, invocation method, working repository, selected profile and authentication method. Thirdly, use supported diagnostic output or an administrator-approved observation point to determine the effective model without exposing credentials or prompt content. Fourthly, reproduce the resolution in a non-production context. Finally, retain the configuration sources and observed resolution as linked evidence.

Consider a negative test. A release owner changes a ChatGPT workspace default away from gpt-5.5, then observes that a new workspace conversation uses the changed default. A trusted repository still contains model = "gpt-5.5" in .codex/config.toml. This is incomplete evidence: the workspace observation says nothing conclusive about a Codex client launched in that repository, and the project setting may remain an effective override. It also does not prove that any newly selected model is accessible to the relevant seat or client, because OpenAI says a changed default does not grant access.

The corrective procedure is to keep the workspace and repository findings open as separate records, establish the client’s effective configuration, and run an authorised non-production check under the intended sign-in method. Absence of failure in one surface cannot close a finding on another. This costs more than a single smoke check, but it prevents a successful workspace test from masking a persisted project selection.

Redacted findings that a release owner can review

A substantial audit can remain useful without publishing real paths, secrets or customer material. In the following fictional example, an engineering team searches only approved settings, a trusted repository and a redacted gateway export. It finds the same literal string three times:

Redacted match	Owner	Expected surface	Evidence still needed
1 of 3: workspace default selects gpt-5.5	Workspace administration team	ChatGPT Work with ChatGPT sign-in	Plan, client, seat scope and saved-selection review
2 of 3: trusted repository .codex/config.toml selects gpt-5.5	Repository service owner	Codex client; authentication not yet established	Effective precedence, sign-in method and non-production invocation
3 of 3: routing map resolves an internal alias to gpt-5.5	Gateway platform team	Custom gateway feeding a direct API path	Provider, API organisation/project, endpoint and route verification

The count is intentionally “three exact matches”, not “three affected systems”. The workspace finding is within the named product retirement boundary; the repository finding cannot be classified until its authentication method and effective precedence are known; the routing-map finding belongs to an independent API or provider lifecycle. If the route resolves to OpenAI’s API, the 14 October ChatGPT event still does not itself establish an API shutdown.

For each finding, the release owner should receive a compact evidence record containing the literal identifier, owner, surface, authentication boundary, candidate precedence sources, documented endpoint where relevant and proposed non-production verification. Sample output, not a product guarantee: “Match 2 remains unresolved because project configuration is present and the client authentication method has not been evidenced.” This wording reports what is known without converting a text match into an availability claim.

The change-control gate is therefore simple: make no edit until the owner, surface, authentication boundary, precedence evidence and non-production test plan are recorded. Human review is required where a change can affect customer-facing agents, scheduled work, production routing, residence requirements or release claims. This gate may delay a bulk replacement, but it preserves the central distinction: a persisted selection can be scheduled to retire on one product surface while remaining separately documented and governed on another.

Build the release evidence record

First, freeze the original string before correcting, normalising or replacing it. Copy the value exactly as found, preserving punctuation, capitalisation and any date suffix. Record whether it appeared as gpt-5.5, the documented snapshot gpt-5.5-2026-04-23, a display label, an internal alias or another claimed name. Where a screenshot is permitted, redact account details and unrelated content. Where it is not, retain a text extract and a checksum or change-control reference. Classify using the original evidence; an editor must not silently convert an ambiguous label into a documented model identifier.

Use the evidence-row fields listed under “Record the string before interpreting it”, adding configuration owner and reviewer. Record the source date as 6 October 2026 rather than presenting the finding as timeless. Keep access tokens, API keys, session material, personal data and live customer content out of the record and all test prompts.

Next, classify the row by operational boundary. Use “ChatGPT”, “ChatGPT Work” or “Codex with ChatGPT sign-in” only when the evidence supports that authentication route. Classify API-key-authenticated Codex, direct API, Codex cloud and a custom gateway or provider separately. Do not let one row inherit another row’s status merely because both display “GPT-5.5”.

For a concrete example, suppose a release note contains “Codex — GPT-5.5”. Freeze that text, then ask the owner to identify the client and sign-in method. If it is Codex with ChatGPT sign-in, assess it against the scheduled 14 October product change and the replacement availability for that plan and client. If it is a command using an API key, assess it against the associated API organisation and project instead. If ownership or authentication cannot be established, mark the record “unresolved” and block the change; do not assume that every Codex context is affected.

Link each classified row to the persisted matches recorded under “Search for persisted selections, not a single setting”.

For each match, determine whether it is executable, descriptive or historical. An executable selection can affect a request or product session; descriptive text may need a dated clarification; historical evidence should normally be preserved rather than rewritten. For example, a completed change ticket stating that a test used gpt-5.5-2026-04-23 is a historical record, whereas a future scheduled task selecting gpt-5.5 is an actionable configuration. Change executable records only after verification and approval; annotate rather than falsify historical ones.

When inventory finds GPT-5.5 in a recurring or event-driven job, inspect its execution surface, context, status and human gates rather than assuming a scheduled task inherits the same permissions as chat; audit scheduled-task execution and approval conditions before changing or recreating the automation, particularly where a run may touch connected apps, local projects or consequential actions.

Verify before a scoped change

Verification has two gates: entitlement and representative behaviour. The entitlement gate asks whether the intended user, workspace, plan, role, client, rollout or API organisation and project can actually make the selection. The behaviour gate asks whether a safe, non-production example works for the intended operation. A picker, configuration value, documentation page or workspace default cannot satisfy either gate alone.

Use a synthetic two-case gate to prevent the product notice from being misapplied. Case A is one Codex selection authenticated with ChatGPT sign-in. Case B is one direct API request authenticated to a named non-production API project. These cases may use related strings, but they have different controlling evidence. Case A is assessed against the scheduled product change, the user’s plan, client and workspace controls. Case B is assessed against the API project’s entitlement and the documented API contract. Neither case may be declared ended solely because the other fails.

For Case A, record an input class such as “synthetic source-code explanation”, the Codex client, the exact displayed or configured selection, “ChatGPT sign-in” as the surface boundary, the test time, the observed result category and the reviewer. Use invented code with no credentials, proprietary logic or customer material. Confirm that the tester’s workspace, seat or role is representative of the intended deployment. The result might be recorded as “selection offered”, “selection not offered”, “request not authorised” or “inconclusive”; these are example categories, not predicted product responses.

Assess Case A against the 14 October event only after confirming the authentication route. OpenAI’s changelog directs users of Codex with ChatGPT sign-in to choose an available replacement for their plan and client. That instruction does not identify a universal replacement and must not be extended to API-key Codex, Codex cloud, a gateway or another provider. Proceed only when the affected plan and client expose an approved selection and the non-production check succeeds; otherwise, hold the change and escalate to the workspace owner.

For Case B, submit a minimal representative request through an endpoint documented for GPT-5.5, using a non-production API project and synthetic input. OpenAI’s GPT-5.5 page, reviewed on 6 October 2026, documents Chat Completions, Responses and Batch as supported, while Assistants and fine-tuning are not supported. Select the endpoint required by the existing release record rather than changing the endpoint merely to make a model test pass. Keep keys in the approved secret store and retain only a redacted request description, correlation reference where permitted, and result category.

The Case B evidence row should state the input class, endpoint, exact model string or snapshot, “direct API” as the surface, API organisation/project reference, time, result and human reviewer. For example, it could describe a synthetic classification input sent to v1/responses with gpt-5.5-2026-04-23; the evidence pack should not contain the bearer token or any live customer data. This is a sample procedure, not a guarantee that a particular project has access or that outputs will remain unchanged.

Interpret API outcomes narrowly. A successful scoped request proves that the tested project, endpoint and identifier worked at that time under that configuration. It does not prove availability for another project, region, client, gateway or future date. A rejected request may reflect entitlement, role, project controls or another account-specific condition; it does not, by itself, prove global retirement. The release owner should seek project-specific evidence before editing a production selector.

Retain the two-case test results with the frozen strings, source dates and reviewer decisions. Preserve failed and inconclusive checks as evidence rather than rerunning them until one passes. If a later test differs, add a new timestamped row and explain the changed account, client, configuration or source. This maintains an auditable distinction between what documentation stated, what a particular account exposed and what a representative non-production request demonstrated.

Approval and rollback

Approval converts verified evidence into a scoped change; it must not convert uncertainty into a broad claim. The approver should see the affected surface, authentication method, owner, exact string, persisted locations, entitlement check, representative test and proposed edit. For ChatGPT-sign-in use, approval should address the scheduled 14 October retirement and the availability of the intended selection on the applicable plan and client. For direct API use, approval should instead address the API project and contract evidence.

Use a change set that names every approved record. For example, an approval may cover one workspace default, two saved configurations and one scheduled task while explicitly excluding an API deployment whose separate check remains open. This is preferable to approving “replace GPT-5.5 everywhere”, because the latter collapses product, authentication and ownership boundaries. Assign one approval scope per independently controlled surface; mixed-surface batches require separate findings and named owners.

Apply changes only to approved executable or current descriptive records. Preserve the original value, new value, location, operator, timestamp and approval reference. Update the dated release plan so that it says the product selection is scheduled to retire on 14 October 2026, where that remains the relevant event. Do not rewrite that statement as an API shutdown, and do not use the API documentation to promise that the ChatGPT, ChatGPT Work or Codex picker will remain.

Rollback evidence should be prepared before the edit. Retain a redacted prior configuration, version-control reference or reversible change record; document the restoration owner and the condition that triggers review. A rollback is not necessarily a return to gpt-5.5: after the scheduled product change, that selection may no longer be offered on the affected surface. The practical rollback may instead restore the previous configuration structure while pausing execution for an authorised decision. Test that mechanism in non-production where feasible.

For a consequential workflow, require a human reviewer to confirm that rollback will not send live data to an unverified surface or expose secrets. If the changed selection produces an access error, unexpected tool behaviour or an unapproved routing path, stop the release rather than automatically trying undocumented labels. Automatic fallback can cross organisation, provider or data-handling boundaries that the original evidence did not approve.

Close the change only when the evidence pack contains the source read date, verification time, approved records, actual edits, reviewer and rollback reference. Mark unresolved API, gateway or Codex-cloud rows as separate open items rather than claiming completion for all uses. This produces a defensible release statement: the named product selections were handled for their verified surfaces, while independently governed contexts remain subject to their own checks.

Monitor API lifecycle separately

The 14 October notice is a product-surface lifecycle signal, not an API deprecation notice. That statement should be reported as the status of this retirement as of 6 October 2026, not as a perpetual-availability guarantee. API entitlement, limits, routing, behaviour and later lifecycle decisions remain independent matters.

Maintain a separate API lifecycle register for direct API, API-key Codex and any gateway mapping to OpenAI. Record the model ID or snapshot, endpoint, organisation/project owner, documentation read date, last representative non-production check and next review date. Do not copy a ChatGPT retirement date into that register as an API end date. Conversely, a documented API identifier must not be used to keep a product picker in a release plan after the product surface changes.

Review OpenAI’s API deprecations page on the organisation’s normal release cadence and when OpenAI sends a relevant notice. OpenAI states there that announced model deprecations are documented on that page and that actively using customers are notified by email. Treat those channels as separate evidence requiring their own dated record. An email or deprecations entry should be assessed by the API owner against the affected organisation, project and deployment; it should not be generalised to unrelated product surfaces.

For example, if the product record is closed on 14 October but a direct API test remains valid, leave the API row open under its own lifecycle monitoring rather than declaring it retired or permanently safe. If a later API deprecation is documented, open a new change record with the announced scope and dates. The governing rule is that each lifecycle decision must cite the source that controls that surface, followed by scoped entitlement verification, safe testing and human approval.

Useful Links

• OpenAI changelog
• OpenAI GPT-5.5 model documentation
• OpenAI models overview
• OpenAI workspace model availability
• OpenAI Codex basic configuration and project overrides
• OpenAI API deprecations