Codex mutation-scope integration - #268
Open
davidabram wants to merge 20 commits into
Open
Conversation
davidabram
added a commit
that referenced
this pull request
Sep 7, 2026
Amend the Codex mutation-scope integration plan after PR #268 review: - Add D10a and a dedicated T01 probe for a failed mutation-capable tool with no terminal event followed by another tool in the same turn, with three recorded dispositions (reliable intermediate signal / proven serial-lane successor barrier / unsupported-lifecycle stop) and the successor-Start invariant plus the anti-over-sweep rule. Fold the lane key into T02, the barrier into T04, and a real Git/DB scenario into T06. New AC9a; strengthen AC11/AC12. - Add D20/D21/D22: preserve existing Codex hook trust identity (event/matcher/group-index/handler-index/hash) across an additive merge, extend hook_event_key_label from upstream for every new event, and give each mutation-scope registration the full structural + trust + effective-policy doctor health model. Fold into T05. New AC16a/AC17a; rewrite AC18 as six observable points. No task added; T01->T07 stack and architecture unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LBU1RzU6Senqf3t4MDYL2A Co-authored-by: SCE <sce@crocoder.dev>
davidabram
force-pushed
the
codex-mutation-scope-integration
branch
8 times, most recently
from
September 8, 2026 15:00
4b26b41 to
b72f6c2
Compare
davidabram
added a commit
that referenced
this pull request
Sep 8, 2026
Record the accepted boundary-aware unconfirmed-Codex attribution semantics from the fifth PR #268 follow-up, correcting the prior no-protocol-change narrative and updating AC22, T06, and T07 constraints. Preserve MCP/unknown untracked behavior while documenting the SQL/schema exclusions and frozen production baseline. Plan: codex-mutation-scope-integration (T06, T07) Co-authored-by: SCE <sce@crocoder.dev>
davidabram
force-pushed
the
codex-mutation-scope-integration
branch
from
September 8, 2026 16:01
23b2c7f to
771c6a7
Compare
davidabram
added a commit
that referenced
this pull request
Sep 8, 2026
Record the accepted boundary-aware unconfirmed-Codex attribution semantics from the fifth PR #268 follow-up, correcting the prior no-protocol-change narrative and updating AC22, T06, and T07 constraints. Preserve MCP/unknown untracked behavior while documenting the SQL/schema exclusions and frozen production baseline. Plan: codex-mutation-scope-integration (T06, T07) Co-authored-by: SCE <sce@crocoder.dev>
davidabram
force-pushed
the
codex-mutation-scope-integration
branch
3 times, most recently
from
September 8, 2026 17:57
ad44876 to
6e0350e
Compare
davidabram
added a commit
that referenced
this pull request
Sep 8, 2026
Record the accepted boundary-aware unconfirmed-Codex attribution semantics from the fifth PR #268 follow-up, correcting the prior no-protocol-change narrative and updating AC22, T06, and T07 constraints. Preserve MCP/unknown untracked behavior while documenting the SQL/schema exclusions and frozen production baseline. Plan: codex-mutation-scope-integration (T06, T07) Co-authored-by: SCE <sce@crocoder.dev>
davidabram
force-pushed
the
codex-mutation-scope-integration
branch
2 times, most recently
from
September 9, 2026 04:45
50e5578 to
a6b7111
Compare
Define the empirical research, adapter implementation, hook routing, setup/doctor integration, regression coverage, and durable context needed to wire Codex into mutation-scope tracking. The plan sequences T01 through T07 and records fail-closed, recovery, lifecycle, attribution, and unsupported-execution requirements. Ref: context/plans/codex-mutation-scope-integration.md (T01–T07)
Record the codex-cli 0.153.4 hook and lifecycle behavior needed to implement the Codex mutation-scope adapter. Add byte-for-byte event captures and evidence for tool classification, terminal cleanup, interruption, delegation, detached descendants, and linked worktrees, and include the fixture directory in the CLI build inputs. The findings establish the adapter's supported boundaries and allow the plan to proceed to T02 without adding a successor barrier or background-process supervision. Plan: codex-mutation-scope-integration.md (T01) Co-authored-by: SCE <sce@crocoder.dev>
Codex 0.153.4 MCP probes show successful calls emit PostToolUse, but mutate-then-error calls can leave git-visible changes without terminal hooks, failed calls can be followed directly by successors, and parallel-capable MCP calls can overlap. Capture the raw fixtures and probe harness, and update the plan to stop before T02 for MCP re-planning while preserving built-in Bash/apply_patch findings. Plan: codex-mutation-scope-integration.md, T01 Co-authored-by: SCE <sce@crocoder.dev>
Add strict Codex hook event parsing, tool classification, and deterministic attempt scope ID formatters for the mutation-scope adapter. Register the module and record T02's architecture decision and completion evidence in the integration plan. Plan: codex-mutation-scope-integration (T02) Co-authored-by: SCE <sce@crocoder.dev>
Persist checkout-local Codex adapter attempts across short-lived hook processes so duplicate deliveries can reuse live scopes while terminal attempts receive fresh monotonic identifiers. Protect updates with a separate OS lock and durable temp-file replacement, and reject malformed or unsupported state. The module is intentionally unwired; runtime and ingress integration remain follow-up work. Plan: codex-mutation-scope-integration (T03) Co-authored-by: SCE <sce@crocoder.dev>
Add hidden CLI routing for the Codex mutation-scope hook and implement its write-ahead Start, fail-closed PreToolUse handling, cleanup events, and recovery barrier through the existing mutation-scope ingress. Keep untracked and delegation tools neutral while tracking built-in mutations. Plan: context/plans/codex-mutation-scope-integration.md (T04) Co-authored-by: SCE <sce@crocoder.dev>
Close inter-process TOCTOU gaps in the Codex mutation-scope recovery barrier by replacing the boolean state with generation-aware Clear/Pending/Flushing transitions and performing recovery checks, duplicate reuse, and PendingStart persistence under one adapter-state lock. Keep the lock out of ingress seam calls, fail closed on uncertain attempts, and add deterministic concurrency regressions for stale flushes, duplicate admissions, and neutral tools. Plan: context/plans/codex-mutation-scope-integration.md (T04) Co-authored-by: SCE <sce@crocoder.dev>
Serialize each tracked adapter transaction across durable state transitions and runtime ingress with a checkout-local OS advisory lock. Reuse the shared lock primitive, reclaim orphaned Flushing generations, and suppress duplicate Start calls for already-active attempts. Add concurrency, crash-recovery, process-death, and untracked-tool regression coverage. Plan: codex-mutation-scope-integration, T07 (D13c) Co-authored-by: SCE <sce@crocoder.dev>
Return neutral before resolving git state for MCP, unknown, and delegation tools, preventing boundary-lock and adapter-state side effects. Add lifecycle tests covering zero-footprint behavior. Plan: codex-mutation-scope-integration (T04) Co-authored-by: SCE <sce@crocoder.dev>
Add six unmatched Codex lifecycle registrations for `sce hooks codex-mutation-scope` alongside the four conversation/diff registrations. Make setup merging and doctor diagnostics command-aware so each contract is managed independently while preserving existing handler positions, trust identity, and user-owned hooks. Update generated contracts, installation fixtures, regression tests, and durable context for the four-plus-six registration shape. Plan: context/plans/codex-mutation-scope-integration.md (T05) Co-authored-by: SCE <sce@crocoder.dev>
Prevent tracked Bash and apply_patch executions from proceeding without mutation attribution when Git-root resolution, helper startup, sce availability, or adapter execution fails. Narrow mutation-scope PreToolUse/PostToolUse registrations to the anchored tracked-tool matcher and add a fail-closed bootstrap that emits the stable deny response while forwarding successful adapter output. Update generated-contract and hook regressions, and migrate legacy unmatched registrations without changing untracked-tool Option B behavior. Plan: codex-mutation-scope-integration (T05)
Codex runs matching PreToolUse handlers concurrently, so the mutation-scope adapter could persist `Start` before SCE's Bash-policy hook denied execution. Share policy evaluation and command extraction with the Codex Bash handler, and preflight Bash policy before Git resolution, locking, or mutation-scope state. Return the native policy denial, while failing closed on malformed input or evaluation errors. Keep `apply_patch` unchanged and document the remaining race with arbitrary user-owned blocking hooks. Add parity and lifecycle regressions for blocked, allowed, malformed, and failed-policy paths. Plan: context/plans/codex-mutation-scope-integration.md (T04 follow-up)
Prevent an arbitrary concurrent PreToolUse denial from leaving an active mutation scope alongside a later built-in execution in the same Codex session turn. Persist turn metadata, retire differing same-lane attempts with Abandon, flush recovery before Start, and add a fail-closed admission backstop plus regressions for lane scoping, duplicates, and recovery failures. Document the exceptional Case-B lifecycle and its follow-up evidence. Plan: context/plans/codex-mutation-scope-integration.md (T04 follow-up)
…Codex scopes Treat Codex Start as write-ahead admission rather than execution confirmation, so transitions observed before the scope's own Close remain attribution-ineligible. Derive boundary-aware attribution in Rust and Quint, extend MBT scope coverage, and add coordinator/runtime regressions for cross-harness contention and multiple live Codex scopes. At a confirming Codex Close, preserve exclusive or cross-harness contended attribution unless another live Codex scope remains unconfirmed. This intentionally favors false negatives over false-positive AI mutation lineage. Plan: codex-mutation-scope-integration (T06)
Ensure the hook test validates behavior when only the required bash, cat, and git commands are available. This keeps the test focused on the hook's actual tool dependencies.
Record the accepted boundary-aware unconfirmed-Codex attribution semantics from the fifth PR #268 follow-up, correcting the prior no-protocol-change narrative and updating AC22, T06, and T07 constraints. Preserve MCP/unknown untracked behavior while documenting the SQL/schema exclusions and frozen production baseline. Plan: codex-mutation-scope-integration (T06, T07) Co-authored-by: SCE <sce@crocoder.dev>
Exercise the real Codex hook adapter, temporary Git repositories, and Agent Trace database across lifecycle, recovery, attribution, policy, worktree, and MCP edge cases. Record completion of T06 in the codex-mutation-scope-integration plan while keeping production behavior unchanged; the new coverage is confined to test code. Ref: context/plans/codex-mutation-scope-integration.md (T06) Co-authored-by: SCE <sce@crocoder.dev>
Document the completed Codex adapter as the second wired mutation-scope producer and preserve the tested boundaries around tracked, delegation, and untracked tools, lifecycle recovery, attribution, setup, and doctor behavior. Split the existing apply_patch evidence contract into its own context document and update overview, architecture, routing, and context-map references to keep durable context aligned. Complete plan `codex-mutation-scope-integration` task T07 and record its verification evidence and synchronized context state. Co-authored-by: SCE <sce@crocoder.dev>
Co-authored-by: SCE <sce@crocoder.dev>
davidabram
force-pushed
the
codex-mutation-scope-integration
branch
from
September 9, 2026 04:48
a6b7111 to
0a827f3
Compare
Match SessionEnd and Interrupt hook identities to Codex's one-second default and three-second cap. Preserve the existing timeout normalization for other hook events and cover the lifecycle defaults and cap with tests. Co-authored-by: SCE <sce@crocoder.dev>
davidabram
force-pushed
the
codex-mutation-scope-integration
branch
from
September 9, 2026 04:50
0a827f3 to
c3bee66
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.