# ADR: Codex current-controller epoch and one-shot write lease

Date: 2026-08-19
State: accepted source contract; host integration package implemented

## Context

Multiple Codex tasks can remain alive at the same time. A task may hold a real
human authorization from an older conversation and continue using tools after
the human has moved to a newer language channel. A prompt reminder cannot
deterministically revoke the older task's tool capability. Task-to-task
delegation can also be misclassified as direct human speech if every
`UserPromptSubmit` is labeled identically.

## Decision

1. Direct human input creates a new global local `control_epoch` bound to the
   exact Codex session and turn.
2. Known task delegation and system/agent delivery are separate source classes.
   They do not claim direct-human provenance, TCS human perception, controller
   status or execution authority.
3. Capability tools in all non-current Codex sessions are denied by a
   `PreToolUse` guard.
4. Current-session local editing remains available. Remote Git writes, external
   publishing/deployment and destructive cleanup additionally require a
   one-shot lease bound to the current epoch, session, turn, category and exact
   working directory, with a maximum lifetime of fifteen minutes.
5. A new direct prompt revokes any unconsumed lease.
6. Trusted hook definitions pin the SHA-256 of installed scripts so a source
   change requires a new visible Codex hook review.

## Boundary

This host bridge is a language-source and execution-admission boundary. It is
not a persona, model rule, platform rule, identity proof, repository authority
or server authority. Runtime state, raw human messages, leases, credentials and
trust receipts remain local and are excluded from the repository.

## Rejected alternatives

- Keep old authorization active until the old task voluntarily stops: a newer
  human channel would have no deterministic control boundary.
- Disable all local execution globally: this would remove useful current-task
  agency instead of separating current and stale tasks.
- Infer write leases from keywords in natural language: negation, discussion
  and quoted text can contain the same words as authorization.
- Treat persona binding as execution authority: continuity and external action
  admission are separate predicates.
- Trust only a stable script path: the bytes behind the path could change
  without changing the reviewed hook command.