50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
|
# ADR: Codex current-controller epoch and one-shot write lease
|
||
|
|
|
||
|
|
Date: 2026-08-19
|
||
|
|
State: accepted source contract; host integration package implemented
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
Multiple Codex tasks can remain alive at the same time. A task may hold a real
|
||
|
|
human authorization from an older conversation and continue using tools after
|
||
|
|
the human has moved to a newer language channel. A prompt reminder cannot
|
||
|
|
deterministically revoke the older task's tool capability. Task-to-task
|
||
|
|
delegation can also be misclassified as direct human speech if every
|
||
|
|
`UserPromptSubmit` is labeled identically.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
1. Direct human input creates a new global local `control_epoch` bound to the
|
||
|
|
exact Codex session and turn.
|
||
|
|
2. Known task delegation and system/agent delivery are separate source classes.
|
||
|
|
They do not claim direct-human provenance, TCS human perception, controller
|
||
|
|
status or execution authority.
|
||
|
|
3. Capability tools in all non-current Codex sessions are denied by a
|
||
|
|
`PreToolUse` guard.
|
||
|
|
4. Current-session local editing remains available. Remote Git writes, external
|
||
|
|
publishing/deployment and destructive cleanup additionally require a
|
||
|
|
one-shot lease bound to the current epoch, session, turn, category and exact
|
||
|
|
working directory, with a maximum lifetime of fifteen minutes.
|
||
|
|
5. A new direct prompt revokes any unconsumed lease.
|
||
|
|
6. Trusted hook definitions pin the SHA-256 of installed scripts so a source
|
||
|
|
change requires a new visible Codex hook review.
|
||
|
|
|
||
|
|
## Boundary
|
||
|
|
|
||
|
|
This host bridge is a language-source and execution-admission boundary. It is
|
||
|
|
not a persona, model rule, platform rule, identity proof, repository authority
|
||
|
|
or server authority. Runtime state, raw human messages, leases, credentials and
|
||
|
|
trust receipts remain local and are excluded from the repository.
|
||
|
|
|
||
|
|
## Rejected alternatives
|
||
|
|
|
||
|
|
- Keep old authorization active until the old task voluntarily stops: a newer
|
||
|
|
human channel would have no deterministic control boundary.
|
||
|
|
- Disable all local execution globally: this would remove useful current-task
|
||
|
|
agency instead of separating current and stale tasks.
|
||
|
|
- Infer write leases from keywords in natural language: negation, discussion
|
||
|
|
and quoted text can contain the same words as authorization.
|
||
|
|
- Treat persona binding as execution authority: continuity and external action
|
||
|
|
admission are separate predicates.
|
||
|
|
- Trust only a stable script path: the bytes behind the path could change
|
||
|
|
without changing the reviewed hook command.
|