#380)
Before a local child opens or resumes a thread, CodexBackend reads the
child's own config/read (effective configuration, the layer that set each
key, every layer's contents and hash) and configRequirements/read, and
admitLocalConfiguration (engine/local-models/run-policy.ts) admits it only
when every governed key comes from Modex's session flags, no project layer
is loaded, the private home is empty, no managed layer touches a governed
key, no managed requirements apply, and the effective destination, wire,
credential reference, context and tools are exactly what Modex passed.
Otherwise the turn fails naming the layer and key; nothing is rewritten or
sent. The admitted provenance is kept with the child. A model/rerouted
notification on a local turn interrupts it and reports it failed.
Real-CLI evidence (codex-cli 0.164.0): config/read reports origins and
layers as the policy expects; a requirements.toml in the private home is
not read; a 307 from the configured loopback server is followed with the
full body and never with the token, a 302 as a bodyless GET. The opt-in
native test records both. This is the refusal boundary #417's review asked
for; wiring local execution into the product stays a separate decision.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
LM-5 slice 1 (#380) under #376, stacked on LM-3 (#417,
lm3-codex): the base islm3-codex, so this PR shows only its own commit until #417 lands. Main-only: no UI, no new IPC, no inference client. Refs #380, #379, #376.What it answers. The #417 review's remaining finding: naming a provider on
thread/startdoes not verify the effective HTTP destination, and #379 AC6 (inherited config, proxy/redirect and managed policy) was open.Admission by effective configuration (
engine/local-models/run-policy.ts,backends/codex.ts,local-models/execution.ts). Before a local child opens or resumes any thread,CodexBackendreads the child's ownconfig/read(with layers, for the turn'scwd) andconfigRequirements/read, andadmitLocalConfigurationadmits it only when: every governed key (model,model_provider(s),openai_base_url, context,web_search,features,mcp_servers,shell_environment_policy,plugins,hooks, instructions,experimental_*, …) originates from Modex's session flags; no project layer is loaded; the private home is empty; no managed layer (MDM,/etc/codex, enterprise bundle, legacymanaged_config.toml) touches a governed key even where its value loses;requirementsis null; and the effective values are exactly the ones Modex passed (destination<origin>/v1, Responses wire, no OpenAI auth,env_keyonly with a token, no retries, no headers/query/auth command, the context window, web search disabled, no reasoning summary,view_imageoff, no MCP servers). Otherwise the turn fails naming the layer and key; nothing is rewritten, bypassed or sent. A Codex withoutconfig/readis refused. The admitted provenance (session-flags hash, each layer's source/hash/file; no secrets) is kept with the child (LocalExecution.provenance). Amodel/reroutednotification on a local turn interrupts it and reports it failed, ending running terminals as on Stop.Evidence (review). codex-cli 0.164.0
config/readreturns the effective configuration, anoriginsmap and the layers with hashes; for an LM-3 child every origin issessionFlagsover an emptyuserand emptysystemlayer (receipt). Arequirements.tomlin the private home is not read. Redirects: a 307 from the configured loopback server is followed with the full 29 KB body and without the token; a 302 becomes a bodyless GET; no Codex setting constrains this (receipt). The opt-in native test now asserts the token never follows a redirect and records the body behaviour.Checks. RED at LM-3's head: the extended execution tests fail to build (
provenancemissing) and the reroute case never ends. GREEN:local-run-policy(5),local-model-execution(11),codex-backend,runner-local-models: 62/62;pnpm buildandpnpm typecheckpass; full desktop unit suite: 2,038 tests, 2,018 passed, 0 failed, 20 skipped (17 usual opt-in plus the three native LM-3/LM-5 checks); core/site/store-desktop/worktree suites pass.MODEX_LM3_WIRE=1: the LM-3 wire test passed with admission in the path (provenance recorded, receipt) and the redirect test passed.Open. A live managed-policy run on a Mac that has one (the refusal is fixture-proven). Product admission stays closed (
main/index.tsstill does not constructLocalExecution): this is the refusal boundary the review asked for, and wiring it is Val's decision. AC1's live local turn (LM-3) remains Val's. AC2/AC5/AC6 of #380 and the capacity/outcome slices are later slices. No merge or release is requested.🤖 Generated with Claude Code