01 / Selected tool executes
Grant exec_command
Actual command on a fictional fixture
cat fictional-observatory.txtFICTIONAL OBSERVATORY The brass telescope points north.
Exit code 0 Fixture unchanged
EngineChoose the tools an agent may use
Make tool choices an enforced boundary.
The problem
A profile that names only allowed MCP tools leaves native shell, browser or other runtime tools outside the visible choice.
Recorded runtime check
The grant survives
a restart.
The protected thread could use exec_command. After the app-server restarted, that same thread still could not use apply_patch. A separate control granted the patch tool and created its expected file.
Actual patched Codex app-server · scripted upstream messages · synthetic model/account fixtures · no real model inference.
A shell grant, with its full reach. exec_command is a broad shell tool. The harmless read shown here does not make it a read-only filesystem permission.
Grant
02 / App-server restarts
Same saved thread.
New app-server process.
The engine’s start_or_resume_thread path reloads the protected thread after the app-server stops.
- Grant after resume
exec_command- Engine policy record
- Unchanged
- Runtime ceiling
- Unchanged
One app-server restart; the Engine process itself was not restarted.
03 / Protected thread after resume
The excluded tool
is unavailable.
Refused as expected- Exact grant
exec_command- Scripted requested tool
apply_patch
Actual runtime refusal
unsupported custom tool call: apply_patch
Protected target fileAbsent before absent after
Separate fresh control thread
Grant the patch tool.
The file is created.
Accepted as expected- Exact grant
apply_patch- Scripted operation
- Same FREEFORM patch shape
Selected recorded result
Exit code 0; file added.Expected fixture bytes matched.
Different owned control fileAbsent before present after
The control is a different thread. It did not widen the protected grant. Start requests differ only in the selected tool; the patch item differs only in its owned target filename.
These are the runtime’s native tools. Gateway/MCP resource scopes and tool menus are a separate boundary.
Inspect the recorded checks
This is a selected projection of two saved runs, not a live terminal. A deterministic local fake Responses peer supplied every assistant message and tool-call item. No real model chose either operation; no hosted inference occurred. This page only displays saved results.
- Runtime
- Patched Codex app-server, CLI 0.162.0; policy bridge 1
- Source pins
- Codex Engine
e1553a5; upstreamrust-v0.162.0/c1382380 - Catalog provenance
- 24 runtime-emitted native identities under synthetic model/account configuration, identical across restart and control. The model label
gpt-6.1-solis fixture metadata, not an inference claim or current account catalog. - Prepared artifact
- Existing prepared patched runtime reused; not independently rebuilt by these checks.
- Operation threads
- One protected thread with one app-server restart/resume; one separate fresh patch control, with no restart. Both configured zero MCP servers.
- Catalog-only helper
- The source catalog probe used an inventory-only local MCP fixture in ephemeral probe threads. It did not exercise Gateway authorization or a real MCP service.
- Separate source checks
- 13 focused original source checks passed, with zero skips. Actual native execution and resume are evidenced separately by the recorded operations above.
- Cleanup
- Owned processes, loopback peers and temporary runtime state were removed. Host mounts were read-only apart from task-owned fixture, evidence and state directories.
The denied patch follows cold resume; the accepted patch starts a fresh control thread. This checks native tool identity and resume behavior. It does not establish production deployment, settings UI, account authentication, fork/child inheritance, broad shell containment or an adversarial security audit.
Read the selected public receiptWhat this makes possible
Codex resolves exact native tool identities against a runtime catalog and enforces the selected ceiling. The recorded checks show that grant surviving an app-server restart and same-thread resume.
Source information sheet
Evidence, implementation & history Implementation inspected
What I checked
Source and release history inspected. The 15 October controlled checks ran the actual patched Codex app-server with scripted local upstream messages and synthetic model/account fixtures. They establish a real native read, same-thread app-server resume and separate denied/granted patch outcomes; no real inference or production deployment is claimed.
Release anchor: codex-engine v0.6.28; panel-forge web-v10.20.74.
Research cut: 15 October 2026. Source areas below are from codex-engine + panel-forge. Private conversation references are retained in the research ledger and are not published here.
Implementation decisions
Discover the runtime catalog, validate exact selected names and pass an enforced registry ceiling into the patched app-server. The engine also persists its policy record for protected sessions.
The source defines ceiling inheritance for fork and child sessions as well. The execution exhibit here checks resume only; its separate positive control verifies that the excluded patch call form works when granted.
A path through the feature
- Select an exact native tool
The protected thread grants exec_command, a broad shell tool. Its harmless fixture read does not make that grant a read-only filesystem permission.
- Resume with the same ceiling
After one app-server restart, the engine resumes the same saved thread and the excluded apply_patch call is unavailable.
- Check the separate control
A fresh control thread grants apply_patch and creates its expected owned file. The protected thread is not widened.
Source areas
codex-engine/codex_engine/tool_policy.pycodex-engine/codex_engine/native_tools.pycodex-engine/codex_engine/thread_session.pypanel-forge/resources/js/components/settings/tabs/SystemPromptsTab.vuepanel-forge/app/Support/CodexEngine/CodexEngineToolFence.php
The saved runtime checks use scripted local upstream messages and synthetic model/account fixtures. A real native shell read, same-thread app-server restart/resume, excluded patch and separate granted patch control establish the bounded behavior shown. No real model inference or Gateway authorization is exercised.
Recorded history
Dates describe the researched record, rather than today’s deployment.
codex-engine v0.6.28; panel-forge web-v10.20.74