01 · Empty isolated configuration
No default role to override it.
No denial emitted
stdout was empty
The hook returned without output. It emitted no explicit allow JSON, and no agent was launched.
Process exit 0 · stderr empty
WorkbenchModel policy guard
Check what an agent launch would use.
The problem
A valid model and effort on the request can still be overridden by a configured default role.
A saved source check
Same request.
A different effective model.
The explicit parameters meet the policy. A default role can still change what an agent would use. These actual hook outputs show why the configuration is checked too.
Identical request in both checks
- model
gpt-6.1-sol- reasoning_effort
low- fork_turns
none
02 · Synthetic default role
The role selects Luna instead.
Role model gpt-6-luna
Role effort low
Denial emitted
PreToolUse · deny
Model policy: A configured default agent role overrides the requested model/effort. Correct that role before retrying.
Process exit 0 · stderr empty
The original Python hook was executed offline with synthetic JSON and fictional configuration. No Codex, child agent, model or provider process was involved. This page displays the saved results.
Source and execution limits
Unchanged Metacodex v1.0.6 source, checked on 15 October 2026. Real user configuration and network access were hidden during the standalone execution.
The request names collaborationspawn_agent and the active model gpt-6.1-sol. The two inputs were byte-identical; only the synthetic configuration changed.
Both denials exit 0 because the hook returns its decision in stdout JSON. The displayed reason is the exact prefix; the appended policy text is omitted.
A Codex installation must load, enable and trust its hook. That runtime integration was not tested here. This guard does not filter a model picker or text-only inference. The separate Metaclaude guard was not exercised.
The original 15-test suite result is historical; the suite was not rerun for this receipt.
- Hook SHA-256
f90583560b45cbcf494e547d09c4726dee6103fe7b5c4837965b16c1f573674d- Adjacent policy SHA-256
54b803df319f59b74f8860895c5601a17481c6ba24294fa24716faec11c47100
A separate allowlist check
One secondary input changed the requested model to the literal data value unknown. The hook parsed that value locally; it was never sent to a model.
PreToolUse · deny
Model policy: Choose an allowed explicit model and reasoning_effort pair.
Process exit 0 · stderr empty.
What this makes possible
I built a Codex pre-tool guard that checks explicit spawn arguments and rejects a default role that would change the requested model or effort.
Source information sheet
Evidence, implementation & history Implementation inspected
What I checked
Metacodex v1.0.6 hook and adjacent policy matched the tagged source. The unchanged Python entry point ran offline against three synthetic inputs; saved stdout distinguishes no denial from two JSON denials. Installed Codex integration and the separate Metaclaude guard were not exercised.
Research cut: 15 October 2026. Source areas below are from metacodex. Private conversation references are retained in the research ledger and are not published here.
Implementation decisions
The Python hook checks the model, effort and fork arguments on a proposed Codex spawn. It also reads relevant default-role configuration to detect a different effective model or effort.
The saved offline check executes the unchanged tagged hook against fictional configuration. A Codex installation must load, enable and trust its hook; this source check does not establish that runtime integration or filter text-only inference.
A path through the feature
- Inspect the explicit request
Compare the requested model, reasoning effort and fork setting with the policy.
- Check the effective configuration
A default role can override otherwise valid parameters. Correct the role before retrying the intended task.
Source areas
bin/enforce-model-policy.pybin/codex-trust-everythingconfig/hooks.jsonconfig/AGENTS.md
The saved comparison is standalone execution of the unchanged tagged Python hook with synthetic JSON and fictional configuration. Empty stdout is no denial emitted, not an explicit allow decision or a child launch. The separate Metaclaude guard and installed Codex integration were not tested.
Recorded history
Dates describe the researched record, rather than today’s deployment.
Repairing trust and configuration drift
Porting model routing guidance to Codex
Standalone tagged hook checked with synthetic requests and default-role configuration