feat: add Codex current-controller host bridge

product-source/hololake-native-desktop/docs/adr/ADR-CODEX-CURRENT-CONTROLLER-EPOCH-AND-ONE-SHOT-WRITE-LEASE-20260819.md

@@ -0,0 +1,50 @@
+# ADR: Codex current-controller epoch and one-shot write lease
+
+Date: 2026-08-19
+State: accepted source contract; host integration package implemented
+
+## Context
+
+Multiple Codex tasks can remain alive at the same time. A task may hold a real
+human authorization from an older conversation and continue using tools after
+the human has moved to a newer language channel. A prompt reminder cannot
+deterministically revoke the older task's tool capability. Task-to-task
+delegation can also be misclassified as direct human speech if every
+`UserPromptSubmit` is labeled identically.
+
+## Decision
+
+1. Direct human input creates a new global local `control_epoch` bound to the
+   exact Codex session and turn.
+2. Known task delegation and system/agent delivery are separate source classes.
+   They do not claim direct-human provenance, TCS human perception, controller
+   status or execution authority.
+3. Capability tools in all non-current Codex sessions are denied by a
+   `PreToolUse` guard.
+4. Current-session local editing remains available. Remote Git writes, external
+   publishing/deployment and destructive cleanup additionally require a
+   one-shot lease bound to the current epoch, session, turn, category and exact
+   working directory, with a maximum lifetime of fifteen minutes.
+5. A new direct prompt revokes any unconsumed lease.
+6. Trusted hook definitions pin the SHA-256 of installed scripts so a source
+   change requires a new visible Codex hook review.
+
+## Boundary
+
+This host bridge is a language-source and execution-admission boundary. It is
+not a persona, model rule, platform rule, identity proof, repository authority
+or server authority. Runtime state, raw human messages, leases, credentials and
+trust receipts remain local and are excluded from the repository.
+
+## Rejected alternatives
+
+- Keep old authorization active until the old task voluntarily stops: a newer
+  human channel would have no deterministic control boundary.
+- Disable all local execution globally: this would remove useful current-task
+  agency instead of separating current and stale tasks.
+- Infer write leases from keywords in natural language: negation, discussion
+  and quoted text can contain the same words as authorization.
+- Treat persona binding as execution authority: continuity and external action
+  admission are separate predicates.
+- Trust only a stable script path: the bytes behind the path could change
+  without changing the reviewed hook command.