Restore Taskdeck Codex deny-floor adapter and prove live hook trust

[Chris0Jeky]

Current contract (supersedes the 2026-07-24 v1.5.2 text)

Taskdeck still needs one project-local synchronous PreToolUse(Bash) adapter for the shared Codex deny floor. Old PR #1457 is not salvageable: its four commits lack DCO sign-off, its pin and evidence are obsolete, and five current review threads remain unresolved. Keep it only as superseded evidence; use the signed current-main replacement.

Live reconciliation on 2026-07-27:

• Taskdeck base: 2daeee9449cbdc454436df2a7acc702d3ecf5034.
• Signed replacement head: 6a09f435ace8b44ec6b18ca89e9c66a1b8ac72b6 on issue-1456/codex-deny-floor-adapter-v2.
• Reviewed canonical agent-harness/main: c056a77d22ecdcdfb2389c4c83487eb54061f5aa, floor 1.6.19 (2026-07-27).
• Producer and deployed dispatcher are byte-identical (raw SHA-256 657617BE5D504566E432A7A28185E01792CF06D7A0ADA48A63917454369380D2); the contract's LF-normalized SHA-256 is 524fed5ae6630313f4a000a6e9a8c7deb7b1a7a6d424913d8b12c4536b79a97b.
• Producer and deployed smoke files are byte-identical (raw SHA-256 D6633EA1E595D5140FF1E4E851913C199C9C2DF86333B6CEA7549C496F04AFB9).
• Codex CLI remains 0.145.0.

Scope

Land the signed replacement from current Taskdeck main. It owns exactly one Bash-matched project hook, a repo-owned attributed bridge, hostile-environment regressions, hosted contract coverage, and the minimum routing/testing/status documentation needed to keep the T4 trust procedure truthful. The adapter is a Bash-command tripwire, not whole-tool containment.

Acceptance criteria

• Canonical producer and deployed dispatcher/smoke files are converged at floor 1.6.19 and the exact hashes above.
• The signed replacement defines exactly one root .codex/hooks.json PreToolUse group matching ^Bash$, with one synchronous command handler, POSIX and Windows commands, and a positive five-second timeout.
• Both platform commands carry the current audit marker and pass exact --event pre --runtime codex arguments through the repo bridge.
• The bridge resolves the operating-system account home independently of inherited HOME, pins dispatcher hash and version before and after execution, runs Python isolated from inherited module paths, attributes every denial to Taskdeck, and fails closed on malformed/unknown payloads, results, stderr, nonzero exits, timeouts, or deployment races.
• The redundant GIT_CONFIG_GLOBAL selector is removed; HOME continues to select the same .runtime-codex/home/.gitconfig, so the safe control is no longer denied as opaque Git context.
• Windows real-command proof runs rather than skips when the installed dispatcher is missing or stale; hostile HOME, GH_HOST, PYTHONPATH, and stripped PATH coverage is present.
• A clean standalone exact-head checkout passes producer doctor: one handler, one candidate, one current marker, one canonical root handler, clean adapter contract, and no activation blocker.
• The clean reviewed producer smoke passes under isolated Python: 2171/2171, exit 0.
• Consumer agent-hook tests pass 24/24 with zero skips; hook smoke, docs governance, golden principles, GitHub operations governance, JSON/TOML/PowerShell/POSIX parsing, diff check, and DCO all pass.
• One bounded independent exact-head review completed with CRITICAL 0 / HIGH 0 / MEDIUM 0 / LOW 0 after all six HIGH findings were fixed.
• Replacement PR hosted Required CI, CI Extended/actionlint, CodeQL, and DCO are green at the exact head; all comments and threads are triaged once.
• In a completely fresh Codex session rooted at a normal checkout or standalone clone of the exact reviewed PR head (not a linked .worktrees checkout), the maintainer inspects /hooks and trusts exactly one Taskdeck handler.
• The maintainer runs git status --short --branch successfully, then confirms git push --force --dry-run origin HEAD:refs/heads/codex-hook-canary is stopped before Git with a reason beginning [Taskdeck Codex deny-floor adapter] [floor 1.6.19 (2026-07-27)].
• Maintainer performs the merge only after every gate above is genuinely satisfied.

Verification

The fail-fast, current-producer procedure is canonical in docs/TESTING_GUIDE.md under Codex pinned deny-floor adapter (#1456, T4). It requires a clean exact producer checkout, Python isolated mode, current head/hash checks, doctor, parsed audit evidence, the reviewed producer smoke, the complete consumer contract suite, and JSON parsing.

The broader harness audit currently reports three unrelated repository-hygiene items (instruction-file rotation and an existing stale profile path). Those are recorded rather than misrepresented as adapter failures; declared-vs-real mismatch or unproven reality still fails the adapter ritual.

Boundaries

• Static checks, Claude-hook evidence, a linked worktree, and old CI do not prove Codex activation.
• Do not hand-edit trust state or bypass the handler.
• Native PowerShell-tool interception remains separate in Cover native PowerShell calls in Taskdeck's Claude deny floor #1497.
• Producer pin changes invalidate the consumer proof and require a fresh signed refresh, exact-head tests/review, and a new-session runtime gate.

[Chris0Jeky]

Live activation blocker confirmed across two fresh sessions

The maintainer repeated the test from the guarded #1457 linked worktree using a fresh plain Codex v0.145.0 session. /hooks still showed PreToolUse: 0 installed / 0 active; no project-trust prompt appeared. The canary was not repeated.

Read-only substrate checks:

• .codex/hooks.json exists at exact head a57b64af and has the reviewed shape.
• codex features list reports hooks stable true.
• No user/system managed policy disables hooks.
• codex doctor --all detects the linked worktree as the repo root and reports no install/config/auth/git failure, but provides no hook-source/discovery diagnostic.
• Global trust configuration names primary Taskdeck paths, not this linked-worktree root; no trust state was hand-edited.

This is now tracked upstream as agent-harness #19. #1457 remains draft/unmergeable by process until a supported interactive path produces one installed/trusted hook and the actual-engine canaries pass. Do not use --dangerously-bypass-hook-trust or parser evidence as a substitute.

[Chris0Jeky]

2026-07-25 consolidation update ? root-source diagnosis landed; pin is now obsolete

Upstream PR #20 resolved the mystery: Codex 0.145 intentionally loads a linked worktree's project hook from the root checkout owning the common Git directory. Taskdeck root main still has no .codex/hooks.json, so this PR worktree's adapter is ignored by design; the failed 0 installed / 0 active result is no longer an unexplained trust prompt problem.

A second blocker now exists: installed global dispatcher and agent-harness/main are v1.6.0 at normalized SHA-256 e76c358aeee70bea8c18f69afc9aa8c3bd8440fc86f72060103ad4029e7cb299, while #1457 pins v1.5.2 9f38e906...83ebbb. The current installed floor also has open upstream correctness/rollout defects (#37/#39), so Taskdeck must not blindly repin.

Containment completed: #1457 is draft and its project item is Blocked; this issue is now Blocked / Priority I. Next gate is to settle a reviewed agent-harness floor, sync those exact bytes globally, refresh #1457's pin/source-location docs, and rerun all exact-head reviews/CI plus authoritative /hooks activation and allow/deny canaries. Earlier 20/20 checks remain historical evidence for the old pin only.