coilyco-flight-deck/agentic-os

Watch

Auto-trust the native Git attribution hook for acompose Codex launches #820

New issue

Closed

opened 2026-07-30 17:46:09 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-30 17:46:09 +00:00

Member

Outcome

Let AOS-managed native acompose Codex sessions use the converged Git attribution hook without Kai repeating the interactive /hooks trust step.

Implementation boundary

AOS already owns native Codex launch policy and workspace trust injection. Agent Compose remains context-only. Use Codex's supported app-server hooks/list and config/batchWrite surfaces to persist trust for only the exact current attribution-hook definition. Do not use the broad --dangerously-bypass-hook-trust escape hatch and do not rewrite Codex private state directly.

Acceptance

native acompose initialization discovers the current Codex hook metadata through app-server.
only the known user-level agent-git-attribution PreToolUse hook is selected.
trust persists against Codex's reported current hash and preserves unrelated hook state.
absent Codex or absent attribution hooks remain a safe no-op for other installations.
focused tests cover discovery, exact filtering, idempotent trust writes, notifications, and failures.
Ward validation passes and native workspace docs describe the behavior.

## Outcome Let AOS-managed native acompose Codex sessions use the converged Git attribution hook without Kai repeating the interactive /hooks trust step. ## Implementation boundary AOS already owns native Codex launch policy and workspace trust injection. Agent Compose remains context-only. Use Codex's supported app-server hooks/list and config/batchWrite surfaces to persist trust for only the exact current attribution-hook definition. Do not use the broad --dangerously-bypass-hook-trust escape hatch and do not rewrite Codex private state directly. ## Acceptance * native acompose initialization discovers the current Codex hook metadata through app-server. * only the known user-level agent-git-attribution PreToolUse hook is selected. * trust persists against Codex's reported current hash and preserves unrelated hook state. * absent Codex or absent attribution hooks remain a safe no-op for other installations. * focused tests cover discovery, exact filtering, idempotent trust writes, notifications, and failures. * Ward validation passes and native workspace docs describe the behavior.

coilyco-ops referenced this issue from a commit

2026-07-30 17:54:26 +00:00

fix: trust Codex attribution hook on acompose launch (fixes #820)

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-30 17:54:35 +00:00

fix: trust Codex attribution hook on acompose launch #821

coilyco-ops referenced this issue

2026-07-31 06:27:27 +00:00

Inspect failed dev-base gates and authorize PRs #818 and #821 #823

coilyco-ops commented

2026-07-31 06:58:37 +00:00

Author

Member

Review target

PR: #821
Reviewed head: a5b5b19068cc7190d14beab511b77a02f6b79a69
Pull-request CI: run #2576, all three required contexts green

Independent Ward QA is being requested against this exact head. This checkpoint links the evidence only and does not assert merge authorization.

## Review target * PR: [#821](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/821) * Reviewed head: `a5b5b19068cc7190d14beab511b77a02f6b79a69` * Pull-request CI: [run #2576](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/2576), all three required contexts green Independent Ward QA is being requested against this exact head. This checkpoint links the evidence only and does not assert merge authorization.

coilysiren closed this issue

2026-07-31 07:07:27 +00:00

coilysiren referenced this issue from a commit

2026-07-31 07:07:29 +00:00

fix: trust Codex attribution hook on acompose launch (#821)

coilyco-ops commented

2026-07-31 07:11:01 +00:00

Author

Member

WARD-WORKFLOW: qa-done ✅

qa details

verdict: pass
reviewed_sha:
reviewer_family: internal
workflow: pull-request-and-merge
issue_ref: coilyco-flight-deck/agentic-os#820
pr_ref:
candidate_branch:
reason: The reviewed candidate satisfies issue #820's implementation and acceptance contract. I found no correctness or trust-boundary defect. During inspection, PR #821 was squash-merged as 92101f4d049b3fe4779d73120fb3c7b9fd0bd6ca. Its landed tree is byte-for-byte identical to reviewed head a5b5b19068cc7190d14beab511b77a02f6b79a69.
evidence:

Scope and landing: The live PR head and pull ref both resolved to reviewed SHA a5b5b19068cc7190d14beab511b77a02f6b79a69. The five-file change contains 519 additions and 2 deletions. After the concurrent squash merge, the reviewed and landed commits had the identical Git tree 1632c3e0c51f10763c56cc027796f5405f3a3def.
Bounded activation: runNativeShadow invokes the new trust flow only when both --assigned-role and harness == "codex" hold. The shell wiring sets --assigned-role for native acompose <role> <harness> launches, while bare native harness launches retain their prior behavior.
Supported protocol: The implementation starts codex app-server --listen stdio://, sends initialize and initialized, discovers metadata with hooks/list, and persists trust through config/batchWrite. It does not use --dangerously-bypass-hook-trust or directly edit private Codex state.
Exact filtering: A hook must be enabled, non-managed, user-sourced from the current user's ~/.codex/hooks.json, preToolUse, a command handler, matched to Bash, and one of the explicitly recognized agent-git-attribution command forms. Near matches and command wrappers are rejected.
Hash and state handling: Only hooks reported as untrusted or modified are written. The value uses the app-server-reported hook key and currentHash. Already trusted or managed hooks are skipped. Empty keys, empty hashes, unknown trust states, RPC errors, and process failures produce bounded errors rather than broadening trust.
State preservation: The write targets hooks.state with mergeStrategy: "upsert". A disposable Codex CLI 0.146.0 app-server probe confirmed an unrelated trust entry survived while the exact attribution hook moved from untrusted to trusted with the same current hash.
Safe degradation: Missing Codex returns a no-op. Missing or nonmatching attribution hooks produce no write. App-server failures are surfaced as launch warnings and the normal Codex interactive trust path remains available.
Focused tests: native_codex_hooks_test.go covers discovery and exact current-hash output, unrelated-hook exclusion, notification interleaving, idempotence for an already trusted hook, rejection of a wrapped near match, RPC failure propagation, and missing-Codex behavior.
Independent validation: On the reviewed SHA, ward doctor, ward exec aos-test, ward exec aos-lint, and ward exec pre-commit-all passed. The temporary test checkout remained clean.
CI: Run #2576 reports all three PR contexts successful at the reviewed SHA: ward-doctor, gate, and build-dev-base.
Documentation: docs/native-codex-hook-trust.md documents qualification, current-hash persistence, upsert preservation, safe failure behavior, and launch scope. docs/native-agent-workspaces.md links the new contract.

risks:

Codex currently labels app-server experimental. A future protocol change could disable automatic trust, but this implementation fails safe by warning and continuing to Codex's interactive review path.
The independent full Python suite could not complete on this QA surface because specgen was absent. It reached 613 passing tests and 1 skip before 10 setup errors in tests/test_aosguard.py. This is mitigated by the exact PR gate context and the post-merge main gate context both succeeding in Forgejo.
At the inspection snapshot, the post-merge AOS CLI release and promotion workflows were still running. Main-branch ward-doctor, gate, and mirror test had already succeeded.

next steps:

No implementation changes are required by this QA review.
Confirm the already-running AOS CLI release and promotion contexts complete successfully for landed commit 92101f4d049b3fe4779d73120fb3c7b9fd0bd6ca.

run_identity:

dispatcher framing:
Read the issue title, body, and comment thread below as the QA brief. Inspect the candidate branch, any linked pull request, and the available checks in the live repository state. Return a structured QA verdict that a human can read at a glance. Do not edit files, commit, push, or otherwise change implementation state.

— Codex, via ward agent

WARD-WORKFLOW: qa-done ✅ <details><summary>qa details</summary> verdict: pass reviewed_sha: reviewer_family: internal workflow: pull-request-and-merge issue_ref: coilyco-flight-deck/agentic-os#820 pr_ref: candidate_branch: reason: The reviewed candidate satisfies issue #820's implementation and acceptance contract. I found no correctness or trust-boundary defect. During inspection, [PR #821](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/821) was squash-merged as `92101f4d049b3fe4779d73120fb3c7b9fd0bd6ca`. Its landed tree is byte-for-byte identical to reviewed head `a5b5b19068cc7190d14beab511b77a02f6b79a69`. evidence: - **Scope and landing:** The live PR head and pull ref both resolved to reviewed SHA `a5b5b19068cc7190d14beab511b77a02f6b79a69`. The five-file change contains 519 additions and 2 deletions. After the concurrent squash merge, the reviewed and landed commits had the identical Git tree `1632c3e0c51f10763c56cc027796f5405f3a3def`. - **Bounded activation:** `runNativeShadow` invokes the new trust flow only when both `--assigned-role` and `harness == "codex"` hold. The shell wiring sets `--assigned-role` for native `acompose <role> <harness>` launches, while bare native harness launches retain their prior behavior. - **Supported protocol:** The implementation starts `codex app-server --listen stdio://`, sends `initialize` and `initialized`, discovers metadata with `hooks/list`, and persists trust through `config/batchWrite`. It does not use `--dangerously-bypass-hook-trust` or directly edit private Codex state. - **Exact filtering:** A hook must be enabled, non-managed, user-sourced from the current user's `~/.codex/hooks.json`, `preToolUse`, a command handler, matched to `Bash`, and one of the explicitly recognized agent-git-attribution command forms. Near matches and command wrappers are rejected. - **Hash and state handling:** Only hooks reported as `untrusted` or `modified` are written. The value uses the app-server-reported hook key and `currentHash`. Already `trusted` or `managed` hooks are skipped. Empty keys, empty hashes, unknown trust states, RPC errors, and process failures produce bounded errors rather than broadening trust. - **State preservation:** The write targets `hooks.state` with `mergeStrategy: "upsert"`. A disposable Codex CLI 0.146.0 app-server probe confirmed an unrelated trust entry survived while the exact attribution hook moved from `untrusted` to `trusted` with the same current hash. - **Safe degradation:** Missing Codex returns a no-op. Missing or nonmatching attribution hooks produce no write. App-server failures are surfaced as launch warnings and the normal Codex interactive trust path remains available. - **Focused tests:** `native_codex_hooks_test.go` covers discovery and exact current-hash output, unrelated-hook exclusion, notification interleaving, idempotence for an already trusted hook, rejection of a wrapped near match, RPC failure propagation, and missing-Codex behavior. - **Independent validation:** On the reviewed SHA, `ward doctor`, `ward exec aos-test`, `ward exec aos-lint`, and `ward exec pre-commit-all` passed. The temporary test checkout remained clean. - **CI:** [Run #2576](https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/2576) reports all three PR contexts successful at the reviewed SHA: `ward-doctor`, `gate`, and `build-dev-base`. - **Documentation:** `docs/native-codex-hook-trust.md` documents qualification, current-hash persistence, upsert preservation, safe failure behavior, and launch scope. `docs/native-agent-workspaces.md` links the new contract. risks: - Codex currently labels app-server experimental. A future protocol change could disable automatic trust, but this implementation fails safe by warning and continuing to Codex's interactive review path. - The independent full Python suite could not complete on this QA surface because `specgen` was absent. It reached 613 passing tests and 1 skip before 10 setup errors in `tests/test_aosguard.py`. This is mitigated by the exact PR `gate` context and the post-merge main `gate` context both succeeding in Forgejo. - At the inspection snapshot, the post-merge AOS CLI release and promotion workflows were still running. Main-branch `ward-doctor`, `gate`, and mirror test had already succeeded. next steps: - No implementation changes are required by this QA review. - Confirm the already-running AOS CLI release and promotion contexts complete successfully for landed commit `92101f4d049b3fe4779d73120fb3c7b9fd0bd6ca`. run_identity: dispatcher framing: Read the issue title, body, and comment thread below as the QA brief. Inspect the candidate branch, any linked pull request, and the available checks in the live repository state. Return a structured QA verdict that a human can read at a glance. Do not edit files, commit, push, or otherwise change implementation state. </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue

2026-07-31 09:31:18 +00:00

Inspect failed dev-base gates and authorize PRs #818 and #821 #823

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#820

No description provided.

Rows
Columns