feat: require externally trusted startup#167
Conversation
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.github.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f934ff6c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f934ff6c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| > **Current v0.30.0 support is documentation/package compatibility with no target read.** None of | ||
| > the five agent surfaces has yet proved both pre-start package authenticity and project-instruction | ||
| > neutralization. Do not point an agent or packaged engine at a target repository. The workflow | ||
| > below is the contract a later reviewed startup path must satisfy, not a current execution claim. |
There was a problem hiding this comment.
With this release capped to documentation/package compatibility and “no target read,” the generated Codex envelope still allows implicit invocation (.agents/skills/vulnerability-validation/agents/openai.yaml has allow_implicit_invocation: true and a target-repository default prompt). Codex docs state skills can be chosen implicitly from the description and that this flag disables that behavior (https://developers.openai.com/codex/skills), so a normal “audit this repo” prompt can auto-load the package before the operator-originated startup proof this paragraph now requires. Please regenerate the Codex metadata to disable implicit invocation or make the trigger metadata no-target-read-only until a trusted startup path is promoted.
Useful? React with 👍 / 👎.
1 participant
Summary
Why
The loaded package cannot prove its own pre-load authenticity or neutralization. v0.30.0 makes that boundary explicit and fails closed until an external operator-controlled verifier supplies the required startup evidence.
Impact
This is a compatibility and workflow-contract release. Current supported surfaces may inspect the package as documentation, but they must not read a target repository. Later Tranche 1 work will implement and empirically prove the runtime prerequisites needed to raise that tier.
Validation
make verify: 853 unit tests passed (2 expected skips); 9 integration tests passed (3 expected skips)make ci: green, including optimization, privacy, and review-invariant gatesReview record
reviews/tranche-1-foundations-consensus.mddocs/authoritative-sources.mdskill-core/references/agent-feature-matrix.mdSimplification gate
Public scrub gate