Fullsend

Appearance

126. Runner-owned policy for native Codex children ​

Date: 2026-09-28

Status ​

Accepted

Context ​

Review and retrospective workflows need independent child contexts, selected personas, bounded execution and attributable usage (agent architecture). Codex provides native children, but reads role configuration again when each child starts. Checking a file only before the parent starts does not protect subsequent child dispatch.

ADR 0104 makes model selection a runner concern. Its Claude aliases and persona tool lists cannot be applied directly to Codex. ADR 0100 translates the shared security hooks; their wiring must also remain intact when native children load it.

Decision ​

The runner provisions and protects the policy for native Codex children. It registers skill personas plus generic and Explore roles. For Codex, model precedence is an explicit persona mapping, FULLSEND_CODEX_SUBAGENT_MODEL, subagents.default, then gpt-5.6-luna. Claude frontmatter models and tool lists are reported as documentation only. Invalid or unavailable explicit models never fall back to another model.

Before sourcing the sandbox environment or starting Codex, the runner applies an inherited Linux Landlock write restriction. Role files, CODEX_HOME configuration, hooks and their directory entries remain protected; exact native state paths remain writable. The launcher closes inherited writable descriptors and verifies authority files against runner-held hashes after applying the restriction. A missing capability or changed policy fails the run.

Native configuration bounds open child IDs to four, including completed children that have not been closed. A mandatory dispatch hook rejects grandchildren, context inheritance, model overrides and resuming any child, including when optional security scanning is disabled. Native resume can replace a child's role policy with the parent's; a new task must use a fresh spawn. Shared security hooks apply to parent and child tools. Model metadata determines the native collaboration API: validation must cover the selected model's lifecycle, not infer it from the CLI version alone.

Consequences ​

  • Persona selection remains a workflow decision; models and dispatch constraints remain runner decisions.
  • Codex requires Python and Linux Landlock ABI 3 or newer inside its OpenShell sandbox, including for runs without children.
  • Native state paths, role loading, hook inheritance and collaboration APIs require revalidation on CLI or model changes.
  • Parent and child usage and transcripts are collected by native thread identity; incomplete evidence fails visibly, and unreported dollar cost remains unavailable.
  • These restrictions protect the launched native hierarchy; tool hooks remain defense in depth within the outer sandbox, not a prohibition on every interpreter an agent can invoke.