Repository navigation
RFC: Codex plugin startup through Sandbox transport - #3985
kevinlin-openai wants to merge 2 commits into
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 751f280cac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Submit this RFC before implementing the Driver behavior. Add a separate | ||
| implementation plan for transport, native plugin startup, policy/network wiring, | ||
| and real workflow proof. Update the owning runtime flow and current references | ||
| with implementation; keep this proposal marked unimplemented until then. |
There was a problem hiding this comment.
This RFC changes the Sandbox, Compute, Gateway, and credential boundaries and defines a substantial multi-stage delivery, but it defers the implementation plan to a later change; a repository-wide search of specs/plans/ finds no existing plan for this proposal. Add the required RFC-linked plan now so affected files, dependencies, sequencing, and verification remain reviewable and synchronized with the RFC.
AGENTS.md reference: AGENTS.md:L318-L319
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
P2
|
Codex review: needs changes before merge. What this changesThis PR proposes authenticated per-start transport registration so OpenShell-backed Codex Agents can start selected plugins without receiving the Gateway’s reusable secret. Example: An OpenShell-backed dedicated Codex Agent selects GitHub and Linear plugins.
Review scores
ProductKind: Docs · Worth it: Yes Merge readiness⛔ Needs changes before merge - 1 item remains Keep this PR open: the maintainer-authored RFC addresses a verified missing capability, but its required implementation plan is absent. Priority: P2 Before merge
Findings
Agent review detailsHow this fits togetherKubernetes Compute provisions the Sandbox-owned Codex Harness and connects its Agent Gateway; runtime configuration and transport verifiers enter this boundary, while authenticated native connections and readiness observations leave it. flowchart LR
A[Slack request] --> B[Agent Gateway]
C[Kubernetes Compute] --> D[Sandbox Driver]
D --> E[Proposed startup endpoint]
B --> E
E --> F[Native Codex process]
F --> G[GitHub and Linear apps]
Technical reviewBest possible solution: Pair the RFC with a linked delivery plan that preserves verifier-only transport and sequences candidate preparation, restart recovery, and real Agent workflow verification. Do we have a high-confidence way to reproduce the issue? Source establishes the reported limitation: OpenShell refuses selected Codex plugins, while existing native plugin startup requires the base transport token; no runtime reproduction was performed. Is this the best way to solve the issue? The proposal uses existing Sandbox, Compute, and Gateway owners, retains credential separation, and addresses candidate and restart ordering; its delivery plan must make the cross-owner work concrete. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 4837711993d6. Provenance checked
SecurityNone. EvidenceWhat I checked:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 28, 2026, 6:02 PM ET / 22:02 UTC. |
|
Proposed amendment for human review: #3998 adds TASK-0049, based on this RFC's head The selected lifecycle now prepares plugins through a temporary native stdio app-server inside the dedicated OpenShell Harness, reaps that generation, and starts the final verifier-only WebSocket app-server against the same CODEX_HOME. Final-process verification is read-only and still gates native initialization and user requests. The raw Gateway token is not provisioned to the Harness; transient authentication handling remains distinct from provisioning. Dedicated Kubernetes replacement preserves its existing stopped-predecessor contract. Pinned Codex 0.163.0-alpha.2 passed a local stdio install → clean exit → authenticated WebSocket replacement check without reinstall. It also reproduced a concrete policy-readback gap: config/read does not project managed app/tool constraints, and configRequirements/read omits those constraints. app/installed provides effective app enablement/callability but lacks per-tool approval/reviewer and explicit pre-thread workspace context. Independent scope review supports a narrow extension to that existing readback using native policy resolvers, rather than a new bootstrap protocol or a copied evaluator. This is a submitted amendment proposal, not an acceptance or completion claim. Please review the lifecycle and native dependency. This PR's branch and files remain unchanged by the separate implementation lease. Reconcile the owning RFC and plan before merge. OpenShell, remote-plugin, model, and live user proof remain required; no merge or release is requested. |
|
Scope correction from the requesting user: "no need to do strong readiness guarantee. just make sure plugin is installed. that is all". TASK-0049/#3998 is being narrowed to temporary native stdio installation inside the Harness, clean process shutdown, and final APP_TOKEN_SHA-only WebSocket startup using the same CODEX_HOME. The new effective-policy readback API and stronger request/readiness gate are dropped. Existing managed configuration, proxy custody, startup failure behavior, cancellation cleanup, and basic platform readiness remain. Real installation persistence/final discovery and isolated integration proof remain required. No native product changes will be submitted for the discarded scope. The earlier local native edits have been saved outside the repository and reverted; the selected native checkout is clean. This amendment retains the existing Driver/lifecycle owners and does not add an installation Job or protocol. |
|
The real stdio installation reproduction exposed a Credential Gateway prerequisite for TASK-0049/#3998. With pinned Codex 0.163.0-alpha.2 and the existing Codex-PAT identity, native login and model probes pass. Proposed contract amendment for review: use existing enforced method/path rules and configured native binaries for these operations on
Do not grant all The native bundle fetch is separately unauthenticated and follows a backend-issued HTTPS URL. Observe its actual destination before proposing any credential-free egress; never forward the PAT to that host or log signed URLs. No profile expansion has been applied yet. This prerequisite needs an explicit scope decision/review, and remote installation remains incomplete. A separate native workspace-initializer exit 3 is also under investigation; no integration success is claimed. |
|
Implementation update for #3998, keeping the user's installation-only scope:
The real Agent run verified installation and discovery after native restart, including ownership and secret-exposure checks. A test-only Agent update body was then rejected during removal; it has been corrected from the existing API contract and the complete scenario is being rerun. This is not yet a claim that the full workflow test passed. |
freeqaz-openai
left a comment
freeqaz-openai
left a comment
There was a problem hiding this comment.
These suggestions apply your installation-only correction and updated route description to the RFC and its primary plan. Apply the ranges together so the plan tests what the RFC proposes: installation survives the move from stdio to the normal serving process, without adding a readiness gate.
| Keep OpenShell's existing bearer-passthrough WebSocket and verifier-only | ||
| provisioning. Add a trusted Harness startup gate that prepares and checks every | ||
| selected plugin on the final native process before forwarding client requests. | ||
| Require a real native initialization result for provider readiness. Do not add | ||
| credential registration or a separate control API. |
There was a problem hiding this comment.
| Keep OpenShell's existing bearer-passthrough WebSocket and verifier-only | |
| provisioning. Add a trusted Harness startup gate that prepares and checks every | |
| selected plugin on the final native process before forwarding client requests. | |
| Require a real native initialization result for provider readiness. Do not add | |
| credential registration or a separate control API. | |
| For a dedicated OpenShell Codex Harness, install the managed plugin selections | |
| through a temporary native stdio app-server. After it exits cleanly, start the | |
| normal verifier-authenticated WebSocket app-server on the same `CODEX_HOME`. | |
| Keep existing readiness and authentication. Installation needs neither a Gateway | |
| bearer nor a new control API. |
| The initial proposal used stdio preparation and verifier registration. Source | ||
| review and the live reproduction support the smaller gate described here. | ||
| [RFC-0016](0016-sandbox-credential-injection/index.md) excluded this transport | ||
| work. [RFC-0014](0014-plugin-policy-enforcement.md) continues to own plugin policy. | ||
|
|
||
| ## Scope | ||
|
|
||
| The supported caller is the normal managed Agent deployment and conversation | ||
| workflow. The first proof is one Slack request whose Codex Agent reads an | ||
| authorized GitHub repository file and Linear issue or project, then replies in | ||
| the original thread with verifiable facts. |
There was a problem hiding this comment.
| The initial proposal used stdio preparation and verifier registration. Source | |
| review and the live reproduction support the smaller gate described here. | |
| [RFC-0016](0016-sandbox-credential-injection/index.md) excluded this transport | |
| work. [RFC-0014](0014-plugin-policy-enforcement.md) continues to own plugin policy. | |
| ## Scope | |
| The supported caller is the normal managed Agent deployment and conversation | |
| workflow. The first proof is one Slack request whose Codex Agent reads an | |
| authorized GitHub repository file and Linear issue or project, then replies in | |
| the original thread with verifiable facts. | |
| The Harness installs plugins without a separate installation Job or verifier registration. | |
| [RFC-0016](0016-sandbox-credential-injection/index.md) excluded this transport | |
| work. [RFC-0014](0014-plugin-policy-enforcement.md) continues to own plugin policy. | |
| ## Scope | |
| A managed Agent deployment must install the exact plugins selected for its | |
| revision. The serving process must discover them on the shared Codex home. | |
| Check discovery in integration. It does not establish app login, effective tool | |
| policy, or permission to read a private GitHub repository or Linear issue. |
| The Sandbox Driver declares that its Harness prepares selected plugins before | ||
| native initialization. Compute consumes this capability instead of applying the | ||
| ordinary peer-status/HMAC protocol to that provider. Missing capability continues | ||
| to refuse selected plugins; do not silently infer support from an endpoint. | ||
|
|
||
| The existing trusted Harness launcher owns one native child and its startup gate. | ||
| The Sandbox Driver owns exposure, public CA trust, adoption, and cleanup. Compute | ||
| owns candidate preparation and activation; Gateway configuration contains the | ||
| full immutable selection map because partial provider startup is forbidden. | ||
| OCC gains no provider-specific branch. | ||
|
|
||
| The native child listens on one fixed loopback endpoint, distinct from the | ||
| exposed gate, with its existing SHA-256 bearer verifier. Failure to start that | ||
| child is fatal; never discover and adopt an unrelated listener. Loopback access | ||
| still requires native authentication. |
There was a problem hiding this comment.
| The Sandbox Driver declares that its Harness prepares selected plugins before | |
| native initialization. Compute consumes this capability instead of applying the | |
| ordinary peer-status/HMAC protocol to that provider. Missing capability continues | |
| to refuse selected plugins; do not silently infer support from an endpoint. | |
| The existing trusted Harness launcher owns one native child and its startup gate. | |
| The Sandbox Driver owns exposure, public CA trust, adoption, and cleanup. Compute | |
| owns candidate preparation and activation; Gateway configuration contains the | |
| full immutable selection map because partial provider startup is forbidden. | |
| OCC gains no provider-specific branch. | |
| The native child listens on one fixed loopback endpoint, distinct from the | |
| exposed gate, with its existing SHA-256 bearer verifier. Failure to start that | |
| child is fatal; never discover and adopt an unrelated listener. Loopback access | |
| still requires native authentication. | |
| The Sandbox Driver declares support for Harness-owned installation. Compute | |
| uses that capability instead of ordinary Compute's peer-status/HMAC protocol. | |
| Missing capability still refuses selected plugins; an endpoint alone is not | |
| evidence of support. | |
| The trusted Harness launcher owns the installer and serving process. The | |
| Sandbox Driver retains exposure, public CA trust, adoption, and cleanup. | |
| Compute retains candidate preparation, activation, and the provider's existing | |
| replacement ordering. The revision's immutable selection map remains the input; | |
| OCC gains no provider-specific branch. |
| 1. The launcher authenticates the model as today, starts the final native child, | ||
| and opens the existing provider endpoint through the gate. Its state is | ||
| unprepared. An absent or incorrect bearer fails before any installation or | ||
| local native connection. | ||
| 2. The first correctly authenticated WebSocket owns preparation. Accept its | ||
| WebSocket upgrade within the pinned client's ten-second handshake budget, | ||
| but forward no application frame. Buffer at most four messages and 64 KiB | ||
| until preparation finishes; reject overflow. Admit at most sixteen clients. | ||
| 3. Use the owning connection's credential only for existing local native RPCs. | ||
| Run the production installation, app/tool ownership, configuration, and | ||
| reviewer checks against this same final child. Every selected plugin must | ||
| pass. Preserve a preparation deadline of at most sixty seconds and bound | ||
| individual RPCs within it. | ||
| 4. After successful preparation, forward each client's original initialization | ||
| request and relay the real native response. Do not synthesize initialization | ||
| success or leak bootstrap responses, notifications, or approvals to clients. | ||
| Forwarding remains restricted to the fixed native child, with backpressure, | ||
| message limits, and socket cleanup. | ||
| 5. Compute requires successful native initialization before reporting serving. | ||
| A WebSocket `101` alone now means authenticated connection acceptance on this | ||
| capability, not readiness. Keep handshake-only protected-Git checks outside | ||
| this supported combination. | ||
|
|
||
| The bearer already crosses the existing passthrough route during native | ||
| WebSocket authentication. This change lets the trusted launcher use that | ||
| in-flight credential for preparation. It does not provision a bearer through | ||
| provider files, process environments, or disk. Parameterize the local RPC client; | ||
| never temporarily put the credential into environment variables. Do not log | ||
| headers, bodies, native auth files, or credential-bearing exceptions. Release | ||
| credential references after preparation settles; this is not a secure-erasure | ||
| claim for JavaScript memory. | ||
|
|
||
| Exactly one connection owns preparation for a native-process generation. Other | ||
| authenticated clients wait within the fixed limits; they cannot replace the | ||
| owner or run concurrent installers. If the owner disconnects before preparation | ||
| commits, stop preparation, close waiting clients, and terminate and reap that | ||
| native generation. Closing its administrative socket alone is insufficient: | ||
| an interrupted installation could otherwise finish a late write. Restart must | ||
| restore managed configuration and revalidate any retained package state. |
There was a problem hiding this comment.
| 1. The launcher authenticates the model as today, starts the final native child, | |
| and opens the existing provider endpoint through the gate. Its state is | |
| unprepared. An absent or incorrect bearer fails before any installation or | |
| local native connection. | |
| 2. The first correctly authenticated WebSocket owns preparation. Accept its | |
| WebSocket upgrade within the pinned client's ten-second handshake budget, | |
| but forward no application frame. Buffer at most four messages and 64 KiB | |
| until preparation finishes; reject overflow. Admit at most sixteen clients. | |
| 3. Use the owning connection's credential only for existing local native RPCs. | |
| Run the production installation, app/tool ownership, configuration, and | |
| reviewer checks against this same final child. Every selected plugin must | |
| pass. Preserve a preparation deadline of at most sixty seconds and bound | |
| individual RPCs within it. | |
| 4. After successful preparation, forward each client's original initialization | |
| request and relay the real native response. Do not synthesize initialization | |
| success or leak bootstrap responses, notifications, or approvals to clients. | |
| Forwarding remains restricted to the fixed native child, with backpressure, | |
| message limits, and socket cleanup. | |
| 5. Compute requires successful native initialization before reporting serving. | |
| A WebSocket `101` alone now means authenticated connection acceptance on this | |
| capability, not readiness. Keep handshake-only protected-Git checks outside | |
| this supported combination. | |
| The bearer already crosses the existing passthrough route during native | |
| WebSocket authentication. This change lets the trusted launcher use that | |
| in-flight credential for preparation. It does not provision a bearer through | |
| provider files, process environments, or disk. Parameterize the local RPC client; | |
| never temporarily put the credential into environment variables. Do not log | |
| headers, bodies, native auth files, or credential-bearing exceptions. Release | |
| credential references after preparation settles; this is not a secure-erasure | |
| claim for JavaScript memory. | |
| Exactly one connection owns preparation for a native-process generation. Other | |
| authenticated clients wait within the fixed limits; they cannot replace the | |
| owner or run concurrent installers. If the owner disconnects before preparation | |
| commits, stop preparation, close waiting clients, and terminate and reap that | |
| native generation. Closing its administrative socket alone is insufficient: | |
| an interrupted installation could otherwise finish a late write. Restart must | |
| restore managed configuration and revalidate any retained package state. | |
| 1. Keep existing model authentication and apply the revision's managed | |
| configuration. For selected plugins, the launcher starts one temporary native | |
| app-server on stdio. For a remote selection, use native search to match the | |
| exact plugin ID and admitted marketplace, then read and install it. An absent or mismatched selection is an error. | |
| 2. Close the installer's input and wait for a clean exit before starting the | |
| serving process. Bound the session and its RPCs. On error, timeout, or | |
| cancellation, terminate and reap the installer. A partial install is a startup | |
| failure. | |
| 3. Start the normal WebSocket app-server on the same `CODEX_HOME` with the | |
| existing bearer verifier (`APP_TOKEN_SHA`). Client connections authenticate | |
| as before; none supplies a bootstrap credential or owns installation. Do not | |
| provision the reusable Gateway bearer to the Harness or log credentials. | |
| For remote selections, the proposed Codex PAT profile permits configured native | |
| binaries to use GET/HEAD on `chatgpt.com:443/backend-api/ps/plugins/{segment}` | |
| (catalog search, list, installed state, or plugin details) and POST on | |
| `/backend-api/ps/plugins/{remote_plugin_id}/install`. The read rule matches one | |
| path segment. These are source-wide routes: the installer enforces the Agent's | |
| selection; a shared PAT profile cannot enforce a per-Agent plugin allowlist. | |
| Do not rewrite it per Agent or add uninstall, sharing, or publishing routes. | |
| Package downloads use credential-free, operator-controlled Sandbox egress, | |
| separate from the PAT profile. Retain enforced read-only access for configured | |
| native binaries, TLS inspection, and any protected egress policy. Never send the | |
| PAT to an artifact host or log signed URLs. Development hosts are not production | |
| defaults. |
| Give the control-plane native initialization check a deadline that includes the | ||
| preparation budget. The pinned Gateway already distinguishes WebSocket upgrade | ||
| from native initialization; its startup budget can still be shortened by the | ||
| caller's remaining turn budget. A timeout cancels that attempt rather than | ||
| bypassing preparation or becoming a plugin-policy denial. | ||
|
|
||
| Remove the ordinary private plugin-status wait only when the provider declares | ||
| this capability. Compute must be able to initiate candidate preparation before | ||
| Gateway readiness depends on it. Keep candidate cutover in its existing owner; | ||
| do not redirect a serving predecessor merely to obtain a bootstrap credential. | ||
|
|
||
| On preparation failure, the gate serves the existing authenticated runtime | ||
| failure document and refuses application traffic. Do not start a second | ||
| held-failure listener on the same port. GitHub authentication required, for | ||
| example, remains fatal even when Linear is ready. | ||
|
|
||
| Bind preparation success to the actual native child. Its exit synchronously | ||
| closes forwarded sockets and clears readiness. A restart repeats all preparation | ||
| before forwarding a stale Gateway's request. This provider guarantee is | ||
| **no request reaches an unprepared replacement**. Ordinary Compute keeps its | ||
| separate guarantee that an earlier startup credential cannot reconnect. | ||
| Deletion retains the existing Sandbox-before-provider cleanup ordering. |
There was a problem hiding this comment.
| Give the control-plane native initialization check a deadline that includes the | |
| preparation budget. The pinned Gateway already distinguishes WebSocket upgrade | |
| from native initialization; its startup budget can still be shortened by the | |
| caller's remaining turn budget. A timeout cancels that attempt rather than | |
| bypassing preparation or becoming a plugin-policy denial. | |
| Remove the ordinary private plugin-status wait only when the provider declares | |
| this capability. Compute must be able to initiate candidate preparation before | |
| Gateway readiness depends on it. Keep candidate cutover in its existing owner; | |
| do not redirect a serving predecessor merely to obtain a bootstrap credential. | |
| On preparation failure, the gate serves the existing authenticated runtime | |
| failure document and refuses application traffic. Do not start a second | |
| held-failure listener on the same port. GitHub authentication required, for | |
| example, remains fatal even when Linear is ready. | |
| Bind preparation success to the actual native child. Its exit synchronously | |
| closes forwarded sockets and clears readiness. A restart repeats all preparation | |
| before forwarding a stale Gateway's request. This provider guarantee is | |
| **no request reaches an unprepared replacement**. Ordinary Compute keeps its | |
| separate guarantee that an earlier startup credential cannot reconnect. | |
| Deletion retains the existing Sandbox-before-provider cleanup ordering. | |
| Keep basic platform readiness unchanged. No authenticated client starts | |
| preparation, and no new frame gate or effective-policy readback is required. | |
| An unavailable catalog, failed installation, or installer that does not exit | |
| cleanly remains a startup failure. If the serving child fails to start, do not | |
| adopt an unrelated listener. Preserve authenticated failure reporting, candidate | |
| cutover, and Sandbox-before-provider cleanup. Ordinary Compute keeps | |
| its separate per-start authentication. |
| Extend the real Agent QA workflow and verify: | ||
|
|
||
| - Wrong/missing authentication causes no preparation; direct loopback access | ||
| without the bearer fails. | ||
| - A fast WebSocket upgrade does not establish readiness. Delayed native | ||
| initialization succeeds only after actual plugin/policy checks. | ||
| - Failed or partly successful installation never serves. Concurrent probes | ||
| have one owner, and an owner's disconnect cannot leave late writes or a | ||
| surviving native generation. | ||
| - Native exit during verification invalidates readiness. An immediate Slack | ||
| reconnect after restart cannot execute before replacement preparation. | ||
| - Candidate preparation and Gateway-only restart preserve existing lifecycle | ||
| ownership and the final-process verification boundary. | ||
| - The actual pinned OpenShell and native clients complete the same-Agent | ||
| Slack/GitHub/Linear chain. Record source/image identities, resource and | ||
| turn/tool identities, sanitized results, and the Slack permalink. |
There was a problem hiding this comment.
| Extend the real Agent QA workflow and verify: | |
| - Wrong/missing authentication causes no preparation; direct loopback access | |
| without the bearer fails. | |
| - A fast WebSocket upgrade does not establish readiness. Delayed native | |
| initialization succeeds only after actual plugin/policy checks. | |
| - Failed or partly successful installation never serves. Concurrent probes | |
| have one owner, and an owner's disconnect cannot leave late writes or a | |
| surviving native generation. | |
| - Native exit during verification invalidates readiness. An immediate Slack | |
| reconnect after restart cannot execute before replacement preparation. | |
| - Candidate preparation and Gateway-only restart preserve existing lifecycle | |
| ownership and the final-process verification boundary. | |
| - The actual pinned OpenShell and native clients complete the same-Agent | |
| Slack/GitHub/Linear chain. Record source/image identities, resource and | |
| turn/tool identities, sanitized results, and the Slack permalink. | |
| Verify installation through the managed deployment path: | |
| - The installer accepts only the selected ID and marketplace. A missing plugin, | |
| failed native install, timeout, or cancellation leaves no installer running | |
| when startup returns. | |
| - After a clean installer exit, the verifier-authenticated serving process can | |
| discover the selection without reinstalling it. Wrong or missing client | |
| authentication still fails. Check discovery again after native replacement. | |
| - Verify that the shared credential profile limits methods and paths and that | |
| artifact downloads use the separate Sandbox rule. Keep credential-bearing | |
| diagnostics out of test output. |
| One Slack request reaches a dedicated Codex Agent in OpenShell. That Agent reads | ||
| a specified repository file through the GitHub app, reads an authorized Linear | ||
| issue or project, and returns verifiable facts in the original Slack thread. | ||
| Use the existing Plugin Driver, native app policy, Credential Gateway, and Agent | ||
| lifecycle. This is development proof; production qualification and protected Git | ||
| remain outside scope. |
There was a problem hiding this comment.
| One Slack request reaches a dedicated Codex Agent in OpenShell. That Agent reads | |
| a specified repository file through the GitHub app, reads an authorized Linear | |
| issue or project, and returns verifiable facts in the original Slack thread. | |
| Use the existing Plugin Driver, native app policy, Credential Gateway, and Agent | |
| lifecycle. This is development proof; production qualification and protected Git | |
| remain outside scope. | |
| A dedicated OpenShell Codex Harness installs the plugins selected for a managed | |
| Agent revision. A subsequent serving process discovers them in the same | |
| `CODEX_HOME`. Verify installation and persistence here. A private app read or an | |
| end-to-end conversation is outside this milestone. Production qualification and protected | |
| Git remain outside scope. |
| 1. Declare provider-owned preparation before native initialization. Keep ordinary | ||
| Compute HMAC, private status, and best-effort semantics unchanged. | ||
| 2. Gate the existing authenticated WebSocket path around the final native child. | ||
| Reuse production plugin installation and policy checks with a connection-scoped | ||
| credential, without provisioning it through environment variables or files. | ||
| 3. Bound pending frames, clients, RPCs, and preparation. Terminate the generation | ||
| when its preparation owner disconnects; close transport on child exit. | ||
| 4. Require the real native initialization response for provider readiness. | ||
| Integrate candidate preparation before dependent Gateway readiness. | ||
| 5. Admit managed selections only through the complete provider capability, | ||
| retaining fatal plugin failures and existing credential/network restrictions. | ||
| 6. Extend the real Agent QA workflow and register its inputs/lane. Exercise the | ||
| actual runtime, OpenShell, GitHub, Linear, and Slack dependencies. Keep private | ||
| credentials and evidence outside this checkout. | ||
| 7. Update the Sandbox/Plugin references, OpenShell provisioning flow, deployment |
There was a problem hiding this comment.
| 1. Declare provider-owned preparation before native initialization. Keep ordinary | |
| Compute HMAC, private status, and best-effort semantics unchanged. | |
| 2. Gate the existing authenticated WebSocket path around the final native child. | |
| Reuse production plugin installation and policy checks with a connection-scoped | |
| credential, without provisioning it through environment variables or files. | |
| 3. Bound pending frames, clients, RPCs, and preparation. Terminate the generation | |
| when its preparation owner disconnects; close transport on child exit. | |
| 4. Require the real native initialization response for provider readiness. | |
| Integrate candidate preparation before dependent Gateway readiness. | |
| 5. Admit managed selections only through the complete provider capability, | |
| retaining fatal plugin failures and existing credential/network restrictions. | |
| 6. Extend the real Agent QA workflow and register its inputs/lane. Exercise the | |
| actual runtime, OpenShell, GitHub, Linear, and Slack dependencies. Keep private | |
| credentials and evidence outside this checkout. | |
| 7. Update the Sandbox/Plugin references, OpenShell provisioning flow, deployment | |
| 1. Declare Harness-owned installation on the Sandbox Driver. Preserve ordinary | |
| Compute HMAC, private status, and best-effort semantics. | |
| 2. In the trusted launcher, install the exact ID from the admitted marketplace | |
| through a temporary native stdio app-server. On timeout, cancellation, or | |
| failure, terminate and reap the installer and fail startup. | |
| 3. After a clean installer exit, start the normal verifier-only WebSocket | |
| app-server on the same Codex home. Keep basic readiness and Compute's | |
| candidate lifecycle unchanged; do not provision the reusable Gateway bearer. | |
| 4. For remote installation, use the [RFC's source-wide PAT routes](../rfcs/0024-openshell-codex-plugin-transport.md#startup-and-credential-lifetime) | |
| and separate operator-controlled, credential-free artifact egress. | |
| 5. Exercise the real native installation and replacement discovery in isolated | |
| integration and dedicated OpenShell. Preserve hard failures, existing | |
| authorization, and network restrictions; record sanitized results. | |
| 6. Update the Sandbox/Plugin references, OpenShell provisioning flow, deployment |
| | Required outcome | Proof | Result | | ||
| | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ---------------------- | | ||
| | Plugin preparation and final policy | Real native stdio installation and serving-process readback through deployment | Not run | | ||
| | Authentication and registration failures | Real runtime endpoint tests with absent, wrong, stale and conflicting inputs | Not run | | ||
| | Replacement and recovery | Candidate failure preserves predecessor; Harness restart rejects old bearer; Gateway restart adopts only after readback | Not run | | ||
| | Credential and containment boundary | Real Sandbox model commands, denied app/server requests, filesystem and network checks | Not run | | ||
| | Complete user request | Same-Agent Slack, GitHub, and Linear chain with source-verified thread reply | Not run | | ||
| | Repository quality | Focused integration, typecheck, lint, formatting, workspace, docs and independent review | Pending implementation | |
There was a problem hiding this comment.
| | Required outcome | Proof | Result | | |
| | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ---------------------- | | |
| | Plugin preparation and final policy | Real native stdio installation and serving-process readback through deployment | Not run | | |
| | Authentication and registration failures | Real runtime endpoint tests with absent, wrong, stale and conflicting inputs | Not run | | |
| | Replacement and recovery | Candidate failure preserves predecessor; Harness restart rejects old bearer; Gateway restart adopts only after readback | Not run | | |
| | Credential and containment boundary | Real Sandbox model commands, denied app/server requests, filesystem and network checks | Not run | | |
| | Complete user request | Same-Agent Slack, GitHub, and Linear chain with source-verified thread reply | Not run | | |
| | Repository quality | Focused integration, typecheck, lint, formatting, workspace, docs and independent review | Pending implementation | | |
| | Required outcome | Evidence | | |
| | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | |
| | Installation persists | Install the exact selection over stdio, observe clean exit, and discover it without reinstalling in the authenticated serving process and after replacement. | | |
| | Failure and cancellation | Reject a missing selection or failed install; terminate and reap the temporary process. Verify that a partial install does not start the serving process. | | |
| | Authentication and egress | Keep verifier-only serving and existing authentication failures. Check the permitted PAT methods and paths separately from credential-free artifact policy. | | |
| | Repository quality | Run the owning integration checks and the applicable type, lint, formatting, and documentation checks. | |
| The RFC has been submitted before implementation. Source review found the | ||
| current selected-plugin rejection, verifier-only transport, and candidate | ||
| Gateway dependency. A real baseline model turn passed; managed selections failed | ||
| with `SANDBOX_HARNESS_UNSUPPORTED`. The revised design uses the existing native | ||
| protocol instead of credential registration. The proposal addresses each; no implemented support is | ||
| claimed. Toolchain preparation and isolated deployment preparation are ongoing. |
There was a problem hiding this comment.
| The RFC has been submitted before implementation. Source review found the | |
| current selected-plugin rejection, verifier-only transport, and candidate | |
| Gateway dependency. A real baseline model turn passed; managed selections failed | |
| with `SANDBOX_HARNESS_UNSUPPORTED`. The revised design uses the existing native | |
| protocol instead of credential registration. The proposal addresses each; no implemented support is | |
| claimed. Toolchain preparation and isolated deployment preparation are ongoing. | |
| On the source baseline above, a model turn passed but a managed selection failed | |
| with `SANDBOX_HARNESS_UNSUPPORTED`. The [author's integration update](https://github.com/openclaw/openclaw-enterprise/pull/3985#issuecomment-6485508372) | |
| reports installation and discovery after native restart in development. That | |
| observation does not establish private app access, a full workflow pass, or | |
| acceptance of this proposal. |
|
Proposed follow-up amendment for human review, before changing the Credential Gateway contract in #3998. The requested acceptance now includes an authenticated Linear read through a fresh, API-provisioned OpenShell Agent. This does not add a stronger readiness contract or change the completed installation-only record in TASK-0049. The current installation control passed (1 passed, 0 failed, 0 skipped) against implementation head Proposed change: add these exact POST allowances to the existing
The profile remains source-wide and shared by that source's Agents. These transport rules do not filter JSON-RPC app IDs or tool names and must not be described as a per-Agent selection ACL or a read-only MCP grant. Existing managed app/tool selections, default-off policy and approval settings remain their enforcement owner. Keep the existing executable restrictions, credential custody, model routes and separate credential-free artifact policy. Add no wildcard backend path, account/OAuth scope change, credential export, new protocol, or running-workload/profile patch. Implementation and verification will use the normal launcher and OCE provisioning/Gateway APIs. A pass requires an actual native Linear call and linked successful result from the same Agent turn; installation, model prose and green ordinary CI are insufficient. The real read cases are still failing, and no positive Linear proof is claimed. This amendment is submitted against the unchanged owning RFC head |
OpenShell currently refuses selected Codex plugins because its Harness receives only a transport verifier, while plugin startup requires the Gateway’s reusable base secret. This RFC proposes native stdio preparation and authenticated per-start verifier registration, with final native policy readback before readiness. Compute prepares replacement candidates while the predecessor continues serving; the Gateway verifies at cutover and reconnect.
The intended development proof is one Slack request that performs authenticated GitHub and Linear app reads and replies in the same thread. Protected Git delivery, account-policy expansion, and production qualification remain outside scope.
Please review the transport ownership, candidate/restart lifecycle, and credential boundaries. The RFC remains Proposed and Not implemented. Implementation may proceed after this submission under the repository’s RFC process; no merge or release is requested.
Verification: repository documentation check passed (295 pages and 4,686 links), specification metadata/local links passed, Markdown length check passed, formatting and diff checks passed. Independent source/design review found no remaining submission blockers after candidate lifecycle corrections. No product tests were run solely for this RFC. Runtime preparation in the associated task is separate and is not claimed as feature proof.
Numbering follows current main’s highest RFC ID, 0023. Other unmerged RFC-0024 proposals do not reserve the ID; recheck and renumber before merge as required.