[abruption]

Summary

Related #238. Implement cooperative wake-chain cost controls without changing queue-only sends or the native wake version/approval boundary.

• Default hop limit 3, hard configuration bound 16; explicitly configured --wake-max-depth / SESSION_PEER_WAKE_MAX_DEPTH may lower or raise it (0 disables wakes).
• Validate depth/origin and carried context before effect. Preserve one UUID origin across fanout; SSH transports typed context and cannot raise destination policy; MCP reads operator-owned startup context.
• Pass incremented context to the owned app-server; include a diagnostic-only provenance prefix within the native message byte limit and optional wakeProvenance result.
• Persist per-canonical-home/thread activation reservations under the existing wake lock (default 3 / 60 s, configurable 0–16). Refuse before queueing when exhausted/corrupt; retain failed/interrupted slots; conserve reservations on clock rollback. Known active writers and dry-runs do not consume activation slots.
• Preserve existing concurrent-wake refusal, already-active behavior, queue/partial failure facts, native 0.154.0 gate, owned process cleanup and refusal of interactive approvals. A writer disappearing after an initially active preflight cannot start an unreserved activation.
• Update all four wake guides with filtering/shared-MCP/local-rate limitations and pinned official source evidence.

Type

• feat

Verification

Prior runtime-candidate verification (before the test/docs-only c009972 follow-up): Python 3.13.7 on macOS arm64, isolated SQLite/locks and process stand-ins:

• Targeted wake/descendant/MCP tests: 47 tests, OK, 2 skips.
• Full suite with available Relay/MCP extras: 800 tests, OK, 14 skips.
• Default dependency scope: 611 tests, OK, 29 skips.
• Documentation: 32 tests, OK; generator check and diff check pass.
• A missing local test-only packaging dependency initially prevented one release-artifact test. Added packaging only to an isolated temporary venv, retained the existing extras via a test-only .pth, and reran the complete suite successfully. No user runtime/dependencies were changed.
• Follow-up f5502a0 refuses foreign-owned, group/world-readable, multiply-linked or non-regular local rate files and unsafe/symlink state directories before queueing; no automatic permission repair. Real isolated unsafe-file/directory fixtures pass.
• App-server stand-in is a real isolated subprocess and checks the incremented environment. CLI/SSH/MCP propagation, malformed/over-limit contexts, prefix byte budget, rate exhaustion before queueing, persisted slots, rollback, corrupt state, active/dry-run paths and no post-effect fallback are covered.
• The original policy-filter fixtures mirror audited upstream rules; they are distinct from the actual native executable checks below.
• Pinned upstream Codex 0.154.0 commit 6b9826e3aa83b1a5947db50f4332cb9c65f1b340: codex-rs/protocol/src/shell_environment.rs, codex-rs/rmcp-client/src/utils.rs; current official configuration/MCP documentation was also checked. This does not expand native wake support to newer versions.

Actual native environment follow-up (c009972a39cc435dad434ab3ba3d5a53e90fdb52)

• Two opt-in test methods cover 10 actual native cases against the official Codex 0.154.0 macOS arm64 release: six shell policy cases (all/core/none/include/exclude/none+include) via command/exec, and four real stdio MCP startup cases via mcpServerStatus/list (default whitelist vs explicit env_vars, including inherit=none).
• The native MCP child returns only synthetic depth/origin/max-depth metadata through its tool description. No MCP tool is invoked. Only initialize/initialized, command/exec and MCP status/list are requested; no user credentials, user home, existing session, thread, turn, prompt, model, wake or real message is used. The owned HOME/CODEX_HOME and environment whitelist are disposable, and processes/output/deadlines are bounded.
• Release tag rust-v0.154.0 peels to source 6b9826e3aa83b1a5947db50f4332cb9c65f1b340. Archive SHA-256: 344310a0a591c1b192e04feff304321a69907c9498baaac331ca7e16ebcef9d7; extracted native binary SHA-256: 4f85982624b3898c8991cb80c0981b2aa71070e3537046c9a95950318a95afcc.
• Native opt-in check: 2 tests / 10 cases PASS, repeated independently under -X dev -W error::ResourceWarning. Existing wake tests 27 PASS, docs 32 PASS, generator and diff checks PASS. Earlier full-suite results above predate this test/docs-only delta; they are not a new full-suite run of this head.
• No binary is downloaded/installed by the repository test. An absent SESSION_PEER_CODEX154_ENV_BINARY produces 2 explicit skips, not native evidence. Explicit selection of a wrong binary hard-fails its pinned hash check before execution; tested with a benign wrong executable.
• An initial isolated exploratory run with a synthetic workload-identity variable exited before initialize because the required paired federation setting was absent. The final fixture instead uses a synthetic NODE_REPL_AUTH_TOKEN to verify unconditional exclusion and completed all cases. No real credential was supplied.
• Current-head CI and automatic review are pending after this push. Linux/Windows, later Codex versions, full native model/wake behavior, live SSH and global chain guarantees are not established by these checks.

Boundaries / remaining gates

• Cooperative context is not caller authentication or permission. Never derive it from message/history/transcript contents; no approvals or environment policies are automatically changed.
• Default MCP environment does not carry chain variables; explicit forwarding is necessary for newly started servers. Shared servers cannot recover later callers' environments. Filtered context starts a new local origin; rates are per target/home/host, not a global spend guarantee.
• Per-target reservations are bounded local JSON under the existing lock; operator/same-user reset remains outside this cooperative guarantee.
• No actual TUI message, model wake, live SSH send, install, operational change, tag, release or merge.
• Keep feat(wake): bound chained wakes with a hop limit and wake provenance #238 open for current-head review and integration acceptance. The model-free native environment-policy checks below close the stand-in-only evidence gap on the pinned macOS arm64 version; they do not prove model wake or other platforms. This PR intentionally has no automatic closing directive.
• feat(delivery): frame unverified peer messages for Codex, Antigravity and Relay receivers #232 envelope work is on another branch; integration must preserve both its trust warning and this diagnostic-only wake marker.
• Current-head CI and automatically triggered review are required; no review mention is requested.

Checklist

• Conventional commit; source generator and all locale docs updated
• No secrets, real session identifiers or private paths in public changes
• Isolated fixture-only validation
• Current-head CI/review (pending at creation)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T00:29:47.934622Z	e56bae2	PR opened
🔒 Security Review	✅ Completed 2026-10-09T00:29:50.158012Z	e56bae2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.