›_ Codex Issues
Codex Issues / #33979

Codex Desktop macOS: issuer-bound Host carrier observation for occupancy snapshots

Open 💬 0 comments Opened Jul 18, 2026 by soponcd

Codex Desktop macOS: issuer-bound Host carrier observation

Request to the packaged Host source owner

Please choose one bounded disposition:

  1. Accept this contract for source-owner design review.
  2. Reject it with an exact, currently supported substitute that provides the same issuer-bound guarantees.
  3. Identify the packaged Host/runtime owner and the supported intake format for this request.

This proposal concerns authority carrier identity and launch provenance only. It does not request user authority, provider admission, activation, release, cleanup, or resource effects.

Anonymous consumer roles

The missing Host observation blocks five roles:

  • current task snapshot admission;
  • control-plane project integration;
  • safe worktree reclamation qualification;
  • heartbeat migration;
  • dependent lifecycle closure.

Minimum source-owner seam

The accepted minimum sequence is:

  1. Open the selected CLI as a regular file with O_NOFOLLOW and reject blank, relative, symlink, nonregular, unsafe-owner, or unsafe-mode carriers.
  2. From that same open file descriptor, bind immutable metadata, SHA-256, and code identity.
  3. Mint a short-lived, single-use launch attempt and nonce bound to the accepted carrier.
  4. After spawn, use the exact spawned process and OS-owned observations to compare its executable identity with the same-file preflight binding.
  5. Produce a closed, Host-authored HostCarrierObservation before protocol initialization; child self-report is insufficient.
  6. Bind the observation digest and launch attempt into purpose-specific key enrollment and every signed occupancy snapshot.
  7. Require downstream consumers to verify the conjunction of Host key, Host epoch, runtime generation, complete census, and exact worktree identity.

The handoff includes verification attacks, rollback, expiry, and reopen conditions. The package expires at 2026-08-17T00:00:00Z; after expiry or any source, signature, entitlement, carrier, observation, or review-subject drift, it must be revalidated before review or consumption.

Public routes, listed but not submitted

No submission, implementation, installation, launch, restart, activation, or provider admission has been authorized or performed.

---

Scope: This is a design/source-owner review request only. It does not claim vulnerability validation, engineering acceptance, provider admission, activation readiness, or user authority.

Exact public package identities

| Attachment | UTF-8 bytes | SHA-256 |
| --- | ---: | --- |
| proposal.md | 2430 | 20d73277ed2067e9fa1b2194cc2e0bf5a09f8f48711cf5b7ab0d2a03ab46944b |
| host-carrier-observation-contract.public.json | 3744 | 545d6329b6fa2dd893adca06facc7e0c309530c86e2d31beb7cadaa410e68c87 |
| attack-matrix.json | 2284 | 63a152877184e3e32ab5b5dc66b1f5d8f964f7997ef8199575adde2ab8723034 |
| content-manifest.json | 1603 | raw ca112dbf0586803bf55578a2581aefb9416e7f4dc6d59f4e59325cc12bc1f839 |

Manifest normalized-self SHA-256: ed33dffc9a6d126ae5ae481a0e650dd2682c4d157c9e92cb773c34f0e33410ec.

Stable package marker: HCO-PUBLIC-PACKAGE-SHA256-ca112dbf0586803bf55578a2581aefb9416e7f4dc6d59f4e59325cc12bc1f839

Exact JSON attachments

<details>
<summary>Public Host carrier observation contract — <code>host-carrier-observation-contract.public.json</code></summary>

{
  "schemaVersion": "host-carrier-observation.public.v1",
  "title": "Codex Desktop macOS issuer-bound Host carrier observation",
  "status": "source_owner_design_intake_only",
  "expiresAt": "2026-08-17T00:00:00Z",
  "publicSource": {
    "repository": "https://github.com/openai/codex",
    "commit": "82b294c73c902a4c51f789ba68bb599f0065616f",
    "tree": "981bffce9d09250369fbe5966b8125c04c90dca8",
    "patchSha256": "5c8d47442688fae597ef2cc97b36de0b200647f6b50d254f3824275656afb162"
  },
  "nativeAbi": {
    "name": "observeCodexChildExecutable",
    "inputFieldNames": [
      "launchAttemptId",
      "nonce",
      "expiresAt",
      "hostPid",
      "childPid",
      "preflightFdIdentity",
      "expectedCliSha256"
    ],
    "preflightFdIdentityFieldNames": [
      "device",
      "inode",
      "generation",
      "ctimeNs",
      "mode",
      "uid",
      "gid",
      "size",
      "sha256",
      "codeDirectoryHash"
    ],
    "outputFieldNames": [
      "source",
      "hostAuditTokenDigest",
      "childAuditTokenDigest",
      "canonicalPath",
      "device",
      "inode",
      "generation",
      "ctimeNs",
      "mode",
      "uid",
      "gid",
      "size",
      "sha256",
      "codeDirectoryHash",
      "observedAt"
    ],
    "valuePolicy": "field_names_only_no_live_values"
  },
  "hostCarrierObservation": {
    "fieldNames": [
      "schemaVersion",
      "purpose",
      "protocolVersion",
      "launchAttemptId",
      "nonceDigest",
      "issuedAt",
      "expiresAt",
      "observedAt",
      "hostRuntimeEpoch",
      "hostPid",
      "hostAuditTokenDigest",
      "childPid",
      "childAuditTokenDigest",
      "canonicalPath",
      "device",
      "inode",
      "generation",
      "ctimeNs",
      "mode",
      "uid",
      "gid",
      "size",
      "sha256",
      "codeDirectoryHash",
      "observationSource",
      "observationDigest"
    ],
    "digestRule": "SHA-256 over RFC 8785 canonical JSON of all HostCarrierObservation fields except observationDigest",
    "initializationBinding": "The Host supplies one closed observation on the exact spawned connection before initialization completes; child-authored carrier fields are rejected.",
    "enrollmentBinding": "Purpose-specific key enrollment binds launchAttemptId and carrierObservationDigest into its signed digest.",
    "snapshotBinding": "Every signed occupancy snapshot binds launchAttemptId and carrierObservationDigest into its aggregate digest and signature.",
    "singleUseBinding": "One launchAttemptId binds exactly one child process, connection, enrollment, and current Host runtime epoch; expiry or replay fails closed."
  },
  "stableErrors": [
    "HOST_OCCUPANCY_CARRIER_INVALID",
    "HOST_OCCUPANCY_CARRIER_CHANGED",
    "HOST_OCCUPANCY_CARRIER_DIGEST_MISMATCH",
    "HOST_OCCUPANCY_CARRIER_FALLBACK_FORBIDDEN",
    "HOST_OCCUPANCY_CARRIER_PROCESS_MISMATCH",
    "HOST_OCCUPANCY_CARRIER_OBSERVATION_UNAVAILABLE",
    "HOST_OCCUPANCY_CARRIER_ATTEMPT_EXPIRED",
    "HOST_OCCUPANCY_CARRIER_ATTEMPT_REPLAY",
    "HOST_OCCUPANCY_CARRIER_OBSERVATION_DIGEST_MISMATCH"
  ],
  "consumerCount": 5,
  "anonymousConsumerRoles": [
    "current task snapshot admission",
    "control-plane project integration",
    "safe worktree reclamation qualification",
    "heartbeat migration",
    "dependent lifecycle closure"
  ],
  "downstreamConjunction": [
    "Host key",
    "Host epoch",
    "runtime generation",
    "complete census",
    "exact worktree identity",
    "launch attempt",
    "carrier observation digest"
  ],
  "explicitlyNotGranted": [
    "user authority",
    "provider admission",
    "activation",
    "release",
    "cleanup",
    "Resource effects"
  ],
  "runtimeUseForbidden": true
}

</details>

<details>
<summary>Unexecuted RED attack matrix — <code>attack-matrix.json</code></summary>

{
  "schemaVersion": "host-carrier-observation.attack-matrix.v1",
  "status": "red_contract_not_executed",
  "executed": false,
  "activationReady": false,
  "providerAdmission": false,
  "attacks": [
    {
      "id": "HCO-RED-01",
      "attack": "blank or relative carrier path",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_INVALID"]
    },
    {
      "id": "HCO-RED-02",
      "attack": "symlink carrier or symlink swap",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_INVALID", "HOST_OCCUPANCY_CARRIER_CHANGED"]
    },
    {
      "id": "HCO-RED-03",
      "attack": "carrier SHA-256 or code identity differs from the accepted CLI",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_DIGEST_MISMATCH"]
    },
    {
      "id": "HCO-RED-04",
      "attack": "same-path replacement after preflight",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_CHANGED"]
    },
    {
      "id": "HCO-RED-05",
      "attack": "bundled fallback is spawned instead of the accepted carrier",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_FALLBACK_FORBIDDEN"]
    },
    {
      "id": "HCO-RED-06",
      "attack": "launch attempt is stale or outside its expiry",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_ATTEMPT_EXPIRED"]
    },
    {
      "id": "HCO-RED-07",
      "attack": "launch attempt or nonce is replayed",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_ATTEMPT_REPLAY"]
    },
    {
      "id": "HCO-RED-08",
      "attack": "spawned process identifier or audit-token identity does not match the launch attempt",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_PROCESS_MISMATCH"]
    },
    {
      "id": "HCO-RED-09",
      "attack": "post-spawn executable vnode or code identity differs from same-fd preflight",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_CHANGED", "HOST_OCCUPANCY_CARRIER_PROCESS_MISMATCH"]
    },
    {
      "id": "HCO-RED-10",
      "attack": "OS-owned code or executable-vnode observation is unavailable",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_OBSERVATION_UNAVAILABLE"]
    },
    {
      "id": "HCO-RED-11",
      "attack": "cross-process enrollment or carrier observation digest mismatch",
      "expectedErrors": ["HOST_OCCUPANCY_CARRIER_PROCESS_MISMATCH", "HOST_OCCUPANCY_CARRIER_OBSERVATION_DIGEST_MISMATCH"]
    }
  ]
}

</details>

<details>
<summary>Content manifest — <code>content-manifest.json</code></summary>

{
  "schemaVersion": "host-occupancy.public-attachment-manifest.v1",
  "sourcePlanSha256": "d47eb0541b554c59895ca8991394ed2c5bc866e2fb4578e1887b17077126abdc",
  "attachmentCount": 4,
  "entries": [
    {
      "path": "proposal.md",
      "bytes": 2430,
      "mediaType": "text/markdown; charset=utf-8",
      "role": "source-owner proposal",
      "sha256": "20d73277ed2067e9fa1b2194cc2e0bf5a09f8f48711cf5b7ab0d2a03ab46944b"
    },
    {
      "path": "host-carrier-observation-contract.public.json",
      "bytes": 3744,
      "mediaType": "application/json",
      "role": "public Host carrier observation contract",
      "sha256": "545d6329b6fa2dd893adca06facc7e0c309530c86e2d31beb7cadaa410e68c87"
    },
    {
      "path": "attack-matrix.json",
      "bytes": 2284,
      "mediaType": "application/json",
      "role": "unexecuted RED attack contract",
      "sha256": "63a152877184e3e32ab5b5dc66b1f5d8f964f7997ef8199575adde2ab8723034"
    },
    {
      "path": "content-manifest.json",
      "bytes": 1603,
      "mediaType": "application/json",
      "role": "content manifest and reconstruction seal",
      "sha256": "ed33dffc9a6d126ae5ae481a0e650dd2682c4d157c9e92cb773c34f0e33410ec"
    }
  ],
  "manifestSelfDigestAlgorithm": "SHA-256 over exact manifest bytes after replacing only the content-manifest.json entry sha256 value with 64 lowercase zero characters",
  "submission": {
    "authorized": false,
    "performed": false
  },
  "receiptAck": {
    "receiptObserved": false,
    "ackObserved": false
  },
  "activationReady": false,
  "activationPreauthorizationConsumed": false
}

</details>

View original on GitHub ↗