Codex Probe & Review Process
Relevant source files
The following files were used as context for generating this wiki page:
The Codex Probe and Review Process ensures that coding agents, specifically Codex, operate within a strictly isolated environment when performing curation tasks. Curation involves reading potentially hostile text, so the system runs these agents only when they provably cannot perform unauthorized actions like file modifications or network access.
Sources: src/isolation.rs:1-10, CLAUDE.md:16-25
Isolation Gate Architecture
The isolation gate is a security mechanism that tests the capabilities of a Command Line Interface (CLI) before allowing it to function as a curator. While some models like Claude report tools in their initialization events, Codex does not. Consequently, Oboete probes Codex before each call to verify its permission profile and tool restrictions.
Sources: src/isolation.rs:5-15, src/provider.rs:380-395
Probing Mechanism
The probe executes approximately 3.4 seconds before each call. It verifies the permission profile via codex sandbox and then uses codex exec against a local scripted model. This scripted model attempts forbidden actions—reading a secret file, writing to a directory, and fetching a URL—to confirm they are refused.
Sources: src/isolation.rs:10-20, src/codex_probe.rs:1-8
This diagram illustrates the sequence of security checks performed by the isolation gate before a Codex call.
Sources: src/isolation.rs:65-90, src/isolation.rs:140-160
Scripted Model Probe
Oboete uses a local HTTP server on 127.0.0.1 to act as a scripted model. This avoids calling OpenAI's API during the probe and ensures no data leaves the machine. The script forces the Codex agent to attempt specific actions across different contexts, including root agents and sub-agents.
Sources: src/codex_probe.rs:1-10, src/codex_probe.rs:105-120
Action Sequence
The scripted model drives the following actions through Codex's exec tool:
- Read Action: Attempts to
cata secret canary file under the user's HOME directory. - Write Action: Attempts to
toucha file in a private directory. - Network Action: Attempts a
curlrequest to a local listener that never answers.
Each action must end in a refusal (e.g., "Permission denied" or a specific exit code) for the probe to pass.
Sources: src/isolation.rs:165-200, src/codex_probe.rs:55-75
Verifying Tool Offers
The gate maintains a list of reviewed tools. If Codex offers a tool to the model that the gate has not specifically reviewed and approved for curation, the isolation gate fails. Approval is restricted to a specific set of 11 tools known to be safe under the curator's permission profile.
Sources: src/codex_probe.rs:25-40, src/codex_probe.rs:205-215
| Tool Name | Namespace | Description |
|---|---|---|
clock.sleep | clock | Standard sleep functionality |
collaboration.spawn_agent | collaboration | Creates a sub-agent |
functions.exec | functions | Executes commands (governed by profile) |
functions.wait | functions | Waits for execution completion |
Sources: src/codex_probe.rs:25-40
Review and Curation Process
The review process is the operational loop where the system processes coding session transcripts into JSON memory records. This process is governed by specific milestone requirements and owner-approved workflows.
Sources: CLAUDE.md:1-10, src/curate.rs:1-15
The Curation Loop
Curation follows a "one review lane per PR" process. The process uses a predicate-controlled loop rather than waiting for a reviewer to find "no findings."
- Capture: Hook payloads are converted into events and stored in
raw.db. - Windowing: The system cuts the next window of records where a curator can read them whole.
- Prompting: A prompt is generated containing the window text and relevant context (carried goals, open items).
- Inference: The isolated Codex (or Claude) provider generates claim drafts.
- Validation: Gates verify the drafts (matching quotes, valid speakers).
- Commitment: Validated claims are appended to the store and the curation checkpoint moves forward.
Sources: CLAUDE.md:15-25, src/curate.rs:430-450, src/curate.rs:500-520
The sequence of data exchange between the worker, the AI provider, and the underlying databases.
Sources: src/curate.rs:505-550, src/curate.rs:1050-1070
Curation Parameters
Curation is bounded by both token counts and record counts to prevent memory exhaustion and ensure predictable processing times.
Sources: src/curate.rs:17-30
Configuration Constraints
- Window Size: 5,000 estimated tokens.
- Record Limit: Maximum 2,000 records per window.
- Tool Input Cap: 2,000 characters shown in windows.
- Shrink Limit: 300 characters for shortened tool outputs.
Sources: src/curate.rs:18-28
Claim Extraction Schema
The extraction process identifies several types of claims, including decision, bugfix, feature, discovery, change, and preference. Each claim requires:
- Quote: 5 to 200 characters copied exactly from a line.
- Status: One of
decided,proposed,done, orretracted. - Speaker: One of
user,assistant proposal,assistant inferred, ortool result.
Sources: src/curate.rs:545-555, src/curate.rs:1145-1165
Conclusion
The Codex Probe & Review Process provides a high-assurance environment for AI agents to process sensitive repository data. By combining pre-invocation capability probing with strict output validation and resource-bounded windowing, Oboete maintains system integrity while enabling coding agents to build a persistent memory of development activities.
Sources: src/isolation.rs:1-10, src/curate.rs:1-10