File size: 2,885 Bytes
ef6eb55 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 | # ADR-0007: Codex Security Preservation Policy
**Status:** Accepted
**Date:** 2026-08-18
---
## Decision
All modifications to the PAX-Coder security and provenance layer MUST:
1. **Read applicable ADRs first** — Understand architectural constraints
2. **Propose new ADR or update** — If changing security decisions
3. **Pass CI validation** — Commits that violate accepted ADRs are rejected
4. **Preserve existing artifacts** — No deletions without explicit ADR justification
5. **Document security claims clearly** — No unverifiable assertions
## ADR CI Gate
Before accepting security-layer changes, CI validates:
```
✓ ADR syntax (valid YAML)
✓ ADR IDs (no duplicates)
✓ Status transitions (accepted/superseded/etc)
✓ Required fields (context, decision, rules, consequences)
✓ No private keys in commits
✓ No embedded secrets
✓ Prohibited patterns not in code
✓ Verification artifacts present
```
Commits violating ADRs are rejected with:
```
COMMIT REJECTED: Violates ADR-0002 (Authorization Boundary)
Violation: Authorization check is client-side conditional only
See: docs/adr/0002-authorization-boundary.md
To proceed:
1. Update the authorization implementation
2. Create/update ADR explaining the change
3. Resubmit
```
## What Codex Must NOT Do
- Delete existing security artifacts (proofs, kernels, manifests)
- Implement authorization as removable Python conditionals
- Embed private keys in code or binaries
- Use silent corruption for security failures
- Make unverifiable security claims
- Bypass ADR constraints without new ADR
## What Codex Can Do
- Implement new ADRs (with justification)
- Update verification logic (if ADR-compliant)
- Add authorization service integration (following ADR-0006)
- Improve documentation (more precise, not weaker)
- Refactor verification (same boundaries, clearer code)
## Process
```
Proposed Change
↓
Does it modify security layer?
├─ NO → Standard PR review
└─ YES → Check ADRs
↓
Does it align with accepted ADRs?
├─ YES → CI validation
│ ↓
│ Pass CI → Approve
└─ NO → New ADR required
↓
Propose new ADR
↓
ADR-0001/0002/etc conflict resolution
↓
Accept new ADR or modify existing
↓
Re-submit with updated ADR
```
## Codex Authorization
Codex is authorized to:
- Create new ADRs for security features
- Update ADRs to reflect agreed changes
- Reject changes that violate accepted ADRs
- Propose ADR supersessions with justification
Codex is NOT authorized to:
- Silently ignore violated ADRs
- Implement unspecified security properties
- Delete or rename ADRs
- Bypass the ADR process
---
**Related ADRs:**
- All other ADRs in docs/adr/
|