bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/product-source/hololake-native-desktop/docs/adr/ADR-CODEX-CURRENT-CONTROLLER-EPOCH-AND-ONE-SHOT-WRITE-LEASE-20260819.md

2.4 KiB
Raw Blame History

ADR: Codex current-controller epoch and one-shot write lease

Date: 2026-08-19 State: accepted source contract; host integration package implemented

Context

Multiple Codex tasks can remain alive at the same time. A task may hold a real human authorization from an older conversation and continue using tools after the human has moved to a newer language channel. A prompt reminder cannot deterministically revoke the older task's tool capability. Task-to-task delegation can also be misclassified as direct human speech if every UserPromptSubmit is labeled identically.

Decision

  1. Direct human input creates a new global local control_epoch bound to the exact Codex session and turn.
  2. Known task delegation and system/agent delivery are separate source classes. They do not claim direct-human provenance, TCS human perception, controller status or execution authority.
  3. Capability tools in all non-current Codex sessions are denied by a PreToolUse guard.
  4. Current-session local editing remains available. Remote Git writes, external publishing/deployment and destructive cleanup additionally require a one-shot lease bound to the current epoch, session, turn, category and exact working directory, with a maximum lifetime of fifteen minutes.
  5. A new direct prompt revokes any unconsumed lease.
  6. Trusted hook definitions pin the SHA-256 of installed scripts so a source change requires a new visible Codex hook review.

Boundary

This host bridge is a language-source and execution-admission boundary. It is not a persona, model rule, platform rule, identity proof, repository authority or server authority. Runtime state, raw human messages, leases, credentials and trust receipts remain local and are excluded from the repository.

Rejected alternatives

  • Keep old authorization active until the old task voluntarily stops: a newer human channel would have no deterministic control boundary.
  • Disable all local execution globally: this would remove useful current-task agency instead of separating current and stale tasks.
  • Infer write leases from keywords in natural language: negation, discussion and quoted text can contain the same words as authorization.
  • Treat persona binding as execution authority: continuity and external action admission are separate predicates.
  • Trust only a stable script path: the bytes behind the path could change without changing the reviewed hook command.