fix(operator): guard Codex release compatibility

[urbanplanningpros]

Issue for this PR

Related upstream and official references include openai/codex#35990, #36001, #36042, #36063, #36093, #36175, #36201, #36203, #36211, #36215, #36219, #36245, #36247, #36249, #36256, #36257, #36258, #36259, #36260, #36261, #36267, #36268, #36272, #36273, #36280, and #36287; merged upstream fixes referenced in earlier commits; OpenAI's July 29 access/identity documentation; OpenAI's July 30 Fast mode and desktop documentation; and OpenAI's official Computer Use and Remote Control documentation.

Local repository issues are disabled, so upstream reports and official OpenAI documentation are the technical references.

Type of change

• Bug fix
• Compatibility, access, security, and routing policy update
• Refactor / code improvement
• Documentation through executable policy

What does this PR do?

Adds executable admission and continuity guards for Codex release compatibility, executor and connector routing, external writes, model and tool selection, task-state preservation, browser and desktop failures, automation persistence, long-running goal checkpoints, content-addressed visual inputs, and nested execution process lifecycle.

The guards reject unapproved routes, automatic model selection, destructive recovery, unsafe replay, broad operational shutdown, filename-keyed image identity, stale visual revisions, repeated unbounded goal loops, blind Windows Desktop reinstall cycles, and false parent completion while a nested mutating process remains live. They preserve operation and idempotency receipts, reconcile durable writes, isolate only the affected capability or workspace, and keep essential work moving through direct OpenAI or explicitly approved local routes.

Windows Desktop bootstrap continuity — openai/codex#36272

Added:

• scripts/operator/codex-windows-desktop-bootstrap-continuity-guard.mjs
• scripts/operator/codex-windows-desktop-bootstrap-continuity-guard-selftest.mjs

The guard detects native startup or sandbox-bootstrap failure, rejects repeated reinstall of the same failing build and destructive state deletion before reconciliation, quarantines only the Desktop surface, and permits continuity through a verified operation-bound direct or approved local route. Desktop authority resumes only after a corrected signed build passes cold-start, sandbox, and multi-task restart canaries.

Long-running Goal checkpoints — openai/codex#36273

Added:

• scripts/operator/codex-goal-checkpoint-guard.mjs
• scripts/operator/codex-goal-checkpoint-guard-selftest.mjs

The guard requires bounded elapsed-time and token checkpoints, detects repeated low-progress and compaction loops, blocks goal replay before write reconciliation, rejects broad pauses, and requires one narrow reproducible probe before further continuation.

Image-input revision identity — openai/codex#36280

Added:

• scripts/operator/codex-image-input-revision-guard.mjs
• scripts/operator/codex-image-input-revision-guard-selftest.mjs

The guard binds visual inputs to their actual SHA-256 and byte count, accepts only content-hash or opaque-upload identity, invalidates outputs derived from an older same-named revision, requires a fresh visual canary, and preserves the canonical task before any retry or replacement.

Nested exec process continuity — openai/codex#36287

Added:

• scripts/operator/codex-nested-exec-process-continuity-guard.mjs
• scripts/operator/codex-nested-exec-process-continuity-guard-selftest.mjs

The guard rejects parent completion, new same-workspace mutations, and automatic replay while a nested process is live or its writes remain unreconciled. It requires retained logical session handles, exact process ownership for termination, filesystem and Git checkpoints before orphan recovery, and a verified operation-bound continuity route. Broad process killing is rejected; independent work can continue while only the affected workspace is quarantined.

Existing guarded areas

The branch also contains controls for release compatibility, MCP and connector policy, external-write target binding, marketplace concurrency, access and identity boundaries, browser bootstrap continuity, configuration preservation, exact model/tool routing, subagent lifecycle closure, Fast-mode routing, authoritative change manifests, skill/bootstrap continuity, false terminal Goal blocks, Windows process ownership, Remote thread idempotency, automation status readback, connector rehydration, read-only Node staging, connector-file materialization, Computer Use disable enforcement, Remote pairing/daemon recovery, and nested exec process continuity.

Excluded providers, model gateways, automatic selectors, and unapproved deployment routes remain rejected. References to excluded systems are compatibility intelligence only and are not execution routes or dependencies.

Run the new guards

node scripts/operator/codex-windows-desktop-bootstrap-continuity-guard.mjs --input /approved/task/windows-desktop-bootstrap.json --json
node scripts/operator/codex-windows-desktop-bootstrap-continuity-guard-selftest.mjs

node scripts/operator/codex-goal-checkpoint-guard.mjs --input /approved/task/goal-checkpoint.json --json
node scripts/operator/codex-goal-checkpoint-guard-selftest.mjs

node scripts/operator/codex-image-input-revision-guard.mjs --input /approved/task/image-input-revision.json --json
node scripts/operator/codex-image-input-revision-guard-selftest.mjs

node scripts/operator/codex-nested-exec-process-continuity-guard.mjs --input /approved/task/nested-exec-process.json --json
node scripts/operator/codex-nested-exec-process-continuity-guard-selftest.mjs

Verification

• Prepared guard logic passed Node syntax checks and 40 deterministic fixtures locally before repository upload.
• Repository-wide CI and disposable affected-runtime canaries remain required before production promotion.

Checklist

• Deterministic fixture coverage is included
• Windows Desktop failure isolates only the affected Desktop surface
• Goal continuation is bounded by checkpoints and measurable progress
• Image inputs are content-addressed rather than filename-addressed
• Nested child processes remain handle-bound until terminal state and write reconciliation
• Task, operation, idempotency, filesystem, and external-write state are preserved
• Approved direct OpenAI and approved-local continuity routes remain available
• No excluded provider, gateway, automatic selector, or unapproved deployment route was introduced
• Repository CI has passed for the current head
• Disposable Windows Desktop, long-goal, image-revision, and nested-exec canaries have passed

Sanitized-Manifest: codex-release-compatibility-2026-07-31
Allowed-Paths: package.json, scripts/operator/codex-release-compatibility-guard.mjs, scripts/operator/codex-release-compatibility-guard-selftest.mjs, scripts/operator/codex-mcp-policy-guard.mjs, scripts/operator/codex-mcp-policy-guard-selftest.mjs, scripts/operator/codex-external-write-target-guard.mjs, scripts/operator/codex-external-write-target-guard-selftest.mjs, scripts/operator/codex-marketplace-concurrency-guard.mjs, scripts/operator/codex-marketplace-concurrency-guard-selftest.mjs, scripts/operator/codex-openai-access-identity-guard.mjs, scripts/operator/codex-openai-access-identity-guard-selftest.mjs, scripts/operator/codex-linux-chrome-bootstrap-continuity-guard.mjs, scripts/operator/codex-linux-chrome-bootstrap-continuity-guard-selftest.mjs, scripts/operator/codex-typescript-config-override-guard.mjs, scripts/operator/codex-typescript-config-override-guard-selftest.mjs, scripts/operator/codex-macos-browser-backend-continuity-guard.mjs, scripts/operator/codex-macos-browser-backend-continuity-guard-selftest.mjs, scripts/operator/codex-model-selection-tool-route-guard.mjs, scripts/operator/codex-model-selection-tool-route-guard-selftest.mjs, scripts/operator/codex-vscode-subagent-lifecycle-guard.mjs, scripts/operator/codex-vscode-subagent-lifecycle-guard-selftest.mjs, scripts/operator/codex-tool-registry-sandbox-guard.mjs, scripts/operator/codex-tool-registry-sandbox-guard-selftest.mjs, scripts/operator/openai-fast-mode-routing-guard.mjs, scripts/operator/openai-fast-mode-routing-guard-selftest.mjs, scripts/operator/codex-task-change-manifest-guard.mjs, scripts/operator/codex-task-change-manifest-guard-selftest.mjs, scripts/operator/codex-bootstrap-skill-continuity-guard.mjs, scripts/operator/codex-bootstrap-skill-continuity-guard-selftest.mjs, scripts/operator/codex-goal-block-continuity-guard.mjs, scripts/operator/codex-goal-block-continuity-guard-selftest.mjs, scripts/operator/codex-windows-mcp-process-ownership-guard.mjs, scripts/operator/codex-windows-mcp-process-ownership-guard-selftest.mjs, scripts/operator/codex-remote-thread-create-idempotency-guard.mjs, scripts/operator/codex-remote-thread-create-idempotency-guard-selftest.mjs, scripts/operator/codex-automation-paused-create-guard.mjs, scripts/operator/codex-automation-paused-create-guard-selftest.mjs, scripts/operator/codex-automation-connector-rehydration-guard.mjs, scripts/operator/codex-automation-connector-rehydration-guard-selftest.mjs, scripts/operator/codex-windows-readonly-node-runtime-continuity-guard.mjs, scripts/operator/codex-windows-readonly-node-runtime-continuity-guard-selftest.mjs, scripts/operator/codex-connector-file-materialization-guard.mjs, scripts/operator/codex-connector-file-materialization-guard-selftest.mjs, scripts/operator/codex-computer-use-disable-continuity-guard.mjs, scripts/operator/codex-computer-use-disable-continuity-guard-selftest.mjs, scripts/operator/codex-remote-pairing-daemon-continuity-guard.mjs, scripts/operator/codex-remote-pairing-daemon-continuity-guard-selftest.mjs, scripts/operator/codex-windows-desktop-bootstrap-continuity-guard.mjs, scripts/operator/codex-windows-desktop-bootstrap-continuity-guard-selftest.mjs, scripts/operator/codex-goal-checkpoint-guard.mjs, scripts/operator/codex-goal-checkpoint-guard-selftest.mjs, scripts/operator/codex-image-input-revision-guard.mjs, scripts/operator/codex-image-input-revision-guard-selftest.mjs, scripts/operator/codex-nested-exec-process-continuity-guard.mjs, scripts/operator/codex-nested-exec-process-continuity-guard-selftest.mjs

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[urbanplanningpros]

New upstream security delta: openai/codex#36079 (created 2026-07-30 04:30 UTC) reports that runtime-generated values passed directly into nested MCP calls are persisted unredacted in local session transcripts under records resembling mcp_tool_call_end.payload.invocation, even when the value was never printed or returned to the model.

Required implementation before production promotion:

1. Treat every nested MCP argument as durable transcript-visible data by default.
2. Reject authority-bearing MCP calls when the canonical argument payload contains a secret, credential, private key, access token, password, or runtime-generated sensitive value.
3. Add a secret_transport admission receipt with: operation_id, secret_reference_id, secret_source, resolved_outside_codex, not_present_in_mcp_args, not_present_in_rollout, rotation_required, and transcript_scan_sha256.
4. For operations that require a literal secret in a command or SQL statement, route only the exact mutation through the explicitly authorized local executor. Resolve the secret just-in-time from an approved local secret store, inject it through a non-echoing environment/stdin boundary, and independently verify the destination. Do not send the literal through MCP.
5. After any suspected exposure: immediately rotate/revoke the credential, preserve the affected session file hash as evidence, remove that session from active/resume paths, scan the exact transcript for the exposed value and known derivatives, and verify the old credential is unusable before continuing.
6. Add deterministic fixtures using harmless markers that prove: nested MCP args containing a marker are denied; opaque reference handles are admitted; local just-in-time resolution is admitted; transcript scans find no resolved marker; prohibited routing remains rejected.

Suggested new files:

• scripts/operator/codex-secret-transcript-guard.mjs
• scripts/operator/codex-secret-transcript-guard-selftest.mjs
• docs/operator/codex-secret-transcript-boundary.md

Do not attempt a redaction-only shim that edits completed transcripts after the fact; prevention and credential rotation are the authority boundary.

[urbanplanningpros]

July 30 tool-authority and skill-sandbox update

Added executable coverage for newly merged upstream Codex changes openai/codex#36119, #36120, #36121, #36124, #36127, and #36129.

New files:

• scripts/operator/codex-tool-registry-sandbox-guard.mjs
• scripts/operator/codex-tool-registry-sandbox-guard-selftest.mjs

The guard now requires one ordered tool registry, reserves host-owned tools before external MCP/extension/dynamic tools, binds normalized-name collisions to the first registered runtime for both model declarations and dispatch, waits on the exact selected runtime before opening the execution gate, and carries one filesystem sandbox context through capability discovery and executor skill reads. It rejects exposed denied roots or symlink targets, context-free caches, root batches above 128, and restricted Windows skill reads that do not fail closed when sandboxing is unavailable.

Local node --check and deterministic self-tests passed before upload. Remote CI and disposable MCP/skill-root canaries are still required before production promotion.

Run:

node scripts/operator/codex-tool-registry-sandbox-guard.mjs \
  --input /approved/task/codex-tool-registry-sandbox-evidence.json \
  --json
node scripts/operator/codex-tool-registry-sandbox-guard-selftest.mjs

No excluded provider, model gateway, automatic selector, Bedrock, Vertex, or Copilot route was introduced.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.